Skip to content

Commit df87297

Browse files
smowtonsmowton
authored
Merge pull request github#7733 from pwntester/java_util_regex_qll
Java: Add models for java.util.regex.Pattern and Matcher
2 parents 477f83c + ba90fec commit df87297

File tree

5 files changed

+127
-0
lines changed

5 files changed

+127
-0
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ private module Frameworks {
9999
private import semmle.code.java.frameworks.Logging
100100
private import semmle.code.java.frameworks.Objects
101101
private import semmle.code.java.frameworks.Optional
102+
private import semmle.code.java.frameworks.Regex
102103
private import semmle.code.java.frameworks.Stream
103104
private import semmle.code.java.frameworks.Strings
104105
private import semmle.code.java.frameworks.ratpack.Ratpack

‎java/ql/lib/semmle/code/java/frameworks/Regex.qll

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/** Definitions related to `java.util.regex`. */
2+
3+
import semmle.code.java.dataflow.ExternalFlow
4+
5+
private class RegexModel extends SummaryModelCsv {
6+
override predicate row(string s) {
7+
s =
8+
[
9+
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
10+
"java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint",
11+
"java.util.regex;Matcher;false;replaceAll;;;Argument[-1];ReturnValue;taint",
12+
"java.util.regex;Matcher;false;replaceAll;;;Argument[0];ReturnValue;taint",
13+
"java.util.regex;Matcher;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
14+
"java.util.regex;Matcher;false;replaceFirst;;;Argument[0];ReturnValue;taint",
15+
"java.util.regex;Pattern;false;matcher;;;Argument[0];ReturnValue;taint",
16+
"java.util.regex;Pattern;false;quote;;;Argument[0];ReturnValue;taint",
17+
"java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint",
18+
]
19+
}
20+
}

‎java/ql/test/library-tests/regex/Test.java

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
package generatedtest;
2+
3+
import java.util.regex.Matcher;
4+
import java.util.regex.Pattern;
5+
6+
// Test case generated by GenerateFlowTestCase.ql
7+
public class Test {
8+
9+
private final String str_pattern = "\\$\\{(.*)\\}";
10+
private final Pattern pattern = Pattern.compile(str_pattern);
11+
12+
Object source() { return null; }
13+
void sink(Object o) { }
14+
15+
public void test() throws Exception {
16+
17+
{
18+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
19+
String out = null;
20+
String in = (String) source();
21+
Matcher m = pattern.matcher(in);
22+
out = m.group("foo");
23+
sink(out); // $ hasTaintFlow
24+
}
25+
{
26+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
27+
String out = null;
28+
String in = (String) source();
29+
Matcher m = pattern.matcher(in);
30+
out = m.group();
31+
sink(out); // $ hasTaintFlow
32+
}
33+
{
34+
// "java.util.regex;Matcher;false;group;;;Argument[-1];ReturnValue;taint"
35+
String out = null;
36+
String in = (String) source();
37+
Matcher m = pattern.matcher(in);
38+
out = m.group(0);
39+
sink(out); // $ hasTaintFlow
40+
}
41+
{
42+
// "java.util.regex;Matcher;false;replaceAll;;;Argument[-1];ReturnValue;taint"
43+
String out = null;
44+
String in = (String) source();
45+
Matcher m = pattern.matcher(in);
46+
out = m.replaceAll("foo");
47+
sink(out); // $ hasTaintFlow
48+
}
49+
{
50+
// "java.util.regex;Matcher;false;replaceAll;;;Argument[0];ReturnValue;taint"
51+
String out = null;
52+
String in = (String) source();
53+
Matcher m = pattern.matcher("foo");
54+
out = m.replaceAll(in);
55+
sink(out); // $ hasTaintFlow
56+
}
57+
{
58+
// "java.util.regex;Matcher;false;replaceFirst;;;Argument[-1];ReturnValue;taint"
59+
String out = null;
60+
String in = (String) source();
61+
Matcher m = pattern.matcher(in);
62+
out = m.replaceFirst("foo");
63+
sink(out); // $ hasTaintFlow
64+
}
65+
{
66+
// "java.util.regex;Matcher;false;replaceFirst;;;Argument[0];ReturnValue;taint"
67+
String out = null;
68+
String in = (String) source();
69+
Matcher m = pattern.matcher("foo");
70+
out = m.replaceFirst(in);
71+
sink(out); // $ hasTaintFlow
72+
}
73+
{
74+
// "java.util.regex;Pattern;false;matcher;;;Argument[0];ReturnValue;taint"
75+
Matcher out = null;
76+
CharSequence in = (CharSequence)source();
77+
out = pattern.matcher(in);
78+
sink(out); // $ hasTaintFlow
79+
}
80+
{
81+
// "java.util.regex;Pattern;false;quote;;;Argument[0];ReturnValue;taint"
82+
String out = null;
83+
String in = (String)source();
84+
out = Pattern.quote(in);
85+
sink(out); // $ hasTaintFlow
86+
}
87+
{
88+
// "java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint"
89+
String[] out = null;
90+
CharSequence in = (CharSequence)source();
91+
out = pattern.split(in);
92+
sink(out); // $ hasTaintFlow
93+
}
94+
{
95+
// "java.util.regex;Pattern;false;split;;;Argument[0];ReturnValue;taint"
96+
String[] out = null;
97+
CharSequence in = (CharSequence)source();
98+
out = pattern.split(in, 0);
99+
sink(out); // $ hasTaintFlow
100+
}
101+
102+
}
103+
104+
}

‎java/ql/test/library-tests/regex/test.expected

Whitespace-only changes.

‎java/ql/test/library-tests/regex/test.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import java
2+
import TestUtilities.InlineFlowTest

0 commit comments

Comments
 (0)