Skip to content

Commit c49c790

Browse files
pwntesterpwntester
committed
add java.util.regex models and tests
1 parent 82ad79f commit c49c790

File tree

5 files changed

+122
-0
lines changed

5 files changed

+122
-0
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ private module Frameworks {
9999
private import semmle.code.java.frameworks.Logging
100100
private import semmle.code.java.frameworks.Objects
101101
private import semmle.code.java.frameworks.Optional
102+
private import semmle.code.java.frameworks.Regex
102103
private import semmle.code.java.frameworks.Stream
103104
private import semmle.code.java.frameworks.Strings
104105
private import semmle.code.java.frameworks.ratpack.Ratpack

‎java/ql/lib/semmle/code/java/frameworks/Regex.qll

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/** Definitions related to `java.util.regex`. */
2+
3+
import semmle.code.java.dataflow.ExternalFlow
4+
5+
private class RegexModel extends SummaryModelCsv {
6+
override predicate row(string s) {
7+
s =
8+
[
9+
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
10+
"java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint",
11+
"java.util.regex;Matcher;false;replaceAll;;;Argument[-1];ReturnValue;taint",
12+
"java.util.regex;Matcher;false;replaceAll;;;Argument[0];ReturnValue;taint",
13+
"java.util.regex;Matcher;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
14+
"java.util.regex;Matcher;false;replaceFirst;;;Argument[0];ReturnValue;taint",
15+
"java.util.regex;Pattern;false;matcher;;;Argument[0];ReturnValue;taint",
16+
"java.util.regex;Pattern;false;quote;;;Argument[0];ReturnValue;taint",
17+
"java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint",
18+
]
19+
}
20+
}

‎java/ql/test/library-tests/regex/Test.java

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
package generatedtest;
2+
3+
import java.util.regex.Matcher;
4+
import java.util.regex.Pattern;
5+
6+
// Test case generated by GenerateFlowTestCase.ql
7+
public class Test {
8+
9+
Object source() { return null; }
10+
void sink(Object o) { }
11+
12+
public void test() throws Exception {
13+
14+
{
15+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
16+
String out = null;
17+
Matcher in = (Matcher)source();
18+
out = in.group((String)null);
19+
sink(out); // $ hasTaintFlow
20+
}
21+
{
22+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
23+
String out = null;
24+
Matcher in = (Matcher)source();
25+
out = in.group();
26+
sink(out); // $ hasTaintFlow
27+
}
28+
{
29+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
30+
String out = null;
31+
Matcher in = (Matcher)source();
32+
out = in.group(0);
33+
sink(out); // $ hasTaintFlow
34+
}
35+
{
36+
// "java.util.regex;Matcher;false;replaceAll;;;Argument[-1];ReturnValue;taint"
37+
String out = null;
38+
Matcher in = (Matcher)source();
39+
out = in.replaceAll(null);
40+
sink(out); // $ hasTaintFlow
41+
}
42+
{
43+
// "java.util.regex;Matcher;false;replaceAll;;;Argument[0];ReturnValue;taint"
44+
String out = null;
45+
String in = (String)source();
46+
Matcher instance = null;
47+
out = instance.replaceAll(in);
48+
sink(out); // $ hasTaintFlow
49+
}
50+
{
51+
// "java.util.regex;Matcher;false;replaceFirst;;;Argument[-1];ReturnValue;taint"
52+
String out = null;
53+
Matcher in = (Matcher)source();
54+
out = in.replaceFirst(null);
55+
sink(out); // $ hasTaintFlow
56+
}
57+
{
58+
// "java.util.regex;Matcher;false;replaceFirst;;;Argument[0];ReturnValue;taint"
59+
String out = null;
60+
String in = (String)source();
61+
Matcher instance = null;
62+
out = instance.replaceFirst(in);
63+
sink(out); // $ hasTaintFlow
64+
}
65+
{
66+
// "java.util.regex;Pattern;false;matcher;;;Argument[0];ReturnValue;taint"
67+
Matcher out = null;
68+
CharSequence in = (CharSequence)source();
69+
Pattern instance = null;
70+
out = instance.matcher(in);
71+
sink(out); // $ hasTaintFlow
72+
}
73+
{
74+
// "java.util.regex;Pattern;false;quote;;;Argument[0];ReturnValue;taint"
75+
String out = null;
76+
String in = (String)source();
77+
out = Pattern.quote(in);
78+
sink(out); // $ hasTaintFlow
79+
}
80+
{
81+
// "java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint"
82+
String[] out = null;
83+
CharSequence in = (CharSequence)source();
84+
Pattern instance = null;
85+
out = instance.split(in);
86+
sink(out); // $ hasTaintFlow
87+
}
88+
{
89+
// "java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint"
90+
String[] out = null;
91+
CharSequence in = (CharSequence)source();
92+
Pattern instance = null;
93+
out = instance.split(in, 0);
94+
sink(out); // $ hasTaintFlow
95+
}
96+
97+
}
98+
99+
}

‎java/ql/test/library-tests/regex/test.expected

Whitespace-only changes.

‎java/ql/test/library-tests/regex/test.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import java
2+
import TestUtilities.InlineFlowTest

0 commit comments

Comments
 (0)