Skip to content

Commit f07f088

Browse files
atorralbaStephan Brandauer
atorralba
authored and
Stephan Brandauer
committed
Fix tests
1 parent 393a075 commit f07f088

File tree

6 files changed

+61
-21
lines changed

6 files changed

+61
-21
lines changed

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 41 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,22 @@ edges
1414
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) |
1515
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) |
1616
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) |
17-
| Test.java:105:14:105:34 | getHostName(...) : String | Test.java:107:46:107:46 | t |
17+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:17:61:17:72 | source(...) : String |
18+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:19:41:19:52 | source(...) : String |
19+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:25:38:25:49 | source(...) : String |
20+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:27:36:27:47 | source(...) : String |
21+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:29:31:29:42 | source(...) : String |
22+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:31:33:31:44 | source(...) : String |
23+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:33:50:33:61 | source(...) : String |
24+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:35:54:35:65 | source(...) : String |
25+
| mad/Test.java:17:61:17:72 | source(...) : String | mad/Test.java:17:52:17:72 | (...)... |
26+
| mad/Test.java:19:41:19:52 | source(...) : String | mad/Test.java:19:32:19:52 | (...)... |
27+
| mad/Test.java:25:38:25:49 | source(...) : String | mad/Test.java:25:31:25:49 | (...)... |
28+
| mad/Test.java:27:36:27:47 | source(...) : String | mad/Test.java:27:29:27:47 | (...)... |
29+
| mad/Test.java:29:31:29:42 | source(...) : String | mad/Test.java:29:24:29:42 | (...)... |
30+
| mad/Test.java:31:33:31:44 | source(...) : String | mad/Test.java:31:24:31:44 | (...)... |
31+
| mad/Test.java:33:50:33:61 | source(...) : String | mad/Test.java:33:41:33:61 | (...)... |
32+
| mad/Test.java:35:54:35:65 | source(...) : String | mad/Test.java:35:45:35:65 | (...)... |
1833
nodes
1934
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
2035
| Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -35,8 +50,23 @@ nodes
3550
| Test.java:99:12:99:33 | new URI(...) | semmle.label | new URI(...) |
3651
| Test.java:100:12:100:45 | new URI(...) | semmle.label | new URI(...) |
3752
| Test.java:101:12:101:54 | new URI(...) | semmle.label | new URI(...) |
38-
| Test.java:105:14:105:34 | getHostName(...) : String | semmle.label | getHostName(...) : String |
39-
| Test.java:107:46:107:46 | t | semmle.label | t |
53+
| mad/Test.java:12:16:12:36 | getHostName(...) : String | semmle.label | getHostName(...) : String |
54+
| mad/Test.java:17:52:17:72 | (...)... | semmle.label | (...)... |
55+
| mad/Test.java:17:61:17:72 | source(...) : String | semmle.label | source(...) : String |
56+
| mad/Test.java:19:32:19:52 | (...)... | semmle.label | (...)... |
57+
| mad/Test.java:19:41:19:52 | source(...) : String | semmle.label | source(...) : String |
58+
| mad/Test.java:25:31:25:49 | (...)... | semmle.label | (...)... |
59+
| mad/Test.java:25:38:25:49 | source(...) : String | semmle.label | source(...) : String |
60+
| mad/Test.java:27:29:27:47 | (...)... | semmle.label | (...)... |
61+
| mad/Test.java:27:36:27:47 | source(...) : String | semmle.label | source(...) : String |
62+
| mad/Test.java:29:24:29:42 | (...)... | semmle.label | (...)... |
63+
| mad/Test.java:29:31:29:42 | source(...) : String | semmle.label | source(...) : String |
64+
| mad/Test.java:31:24:31:44 | (...)... | semmle.label | (...)... |
65+
| mad/Test.java:31:33:31:44 | source(...) : String | semmle.label | source(...) : String |
66+
| mad/Test.java:33:41:33:61 | (...)... | semmle.label | (...)... |
67+
| mad/Test.java:33:50:33:61 | source(...) : String | semmle.label | source(...) : String |
68+
| mad/Test.java:35:45:35:65 | (...)... | semmle.label | (...)... |
69+
| mad/Test.java:35:54:35:65 | source(...) : String | semmle.label | source(...) : String |
4070
subpaths
4171
#select
4272
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | This path depends on a $@. | Test.java:19:18:19:38 | getHostName(...) | user-provided value |
@@ -50,4 +80,11 @@ subpaths
5080
| Test.java:99:3:99:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
5181
| Test.java:100:3:100:46 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
5282
| Test.java:101:3:101:55 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
53-
| Test.java:107:46:107:46 | t | Test.java:105:14:105:34 | getHostName(...) : String | Test.java:107:46:107:46 | t | This path depends on a $@. | Test.java:105:14:105:34 | getHostName(...) | user-provided value |
83+
| mad/Test.java:17:52:17:72 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:17:52:17:72 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
84+
| mad/Test.java:19:32:19:52 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:19:32:19:52 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
85+
| mad/Test.java:25:31:25:49 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:25:31:25:49 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
86+
| mad/Test.java:27:29:27:47 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:27:29:27:47 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
87+
| mad/Test.java:29:24:29:42 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:29:24:29:42 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
88+
| mad/Test.java:31:9:31:45 | new FileReader(...) | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:31:24:31:44 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
89+
| mad/Test.java:33:41:33:61 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:33:41:33:61 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
90+
| mad/Test.java:35:45:35:65 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:35:45:35:65 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,30 @@
88

99
public class Test {
1010

11+
public Object source(InetAddress address) {
12+
return address.getHostName();
13+
}
14+
1115
void test(InetAddress address) throws IOException {
12-
String t = address.getHostName();
1316
// "java.lang;Module;true;getResourceAsStream;(String);;Argument[0];read-file;ai-generated"
14-
getClass().getModule().getResourceAsStream(t);
17+
getClass().getModule().getResourceAsStream((String) source(null));
1518
// "java.lang;Class;false;getResource;(String);;Argument[0];read-file;ai-generated"
16-
getClass().getResource(t);
19+
getClass().getResource((String) source(null));
1720
// "java.lang;ClassLoader;true;getSystemResourceAsStream;(String);;Argument[0];read-file;ai-generated"
18-
ClassLoader.getSystemResource(t);
21+
ClassLoader.getSystemResource((String) source(null));
1922
// "java.io;File;true;createTempFile;(String,String,File);;Argument[2];create-file;ai-generated"
20-
File.createTempFile(";", t);
23+
File.createTempFile(";", (String) source(null));
2124
// "java.io;File;true;renameTo;(File);;Argument[0];create-file;ai-generated"
22-
new File("").renameTo((File) t);
25+
new File("").renameTo((File) source(null));
2326
// "java.io;FileInputStream;true;FileInputStream;(File);;Argument[0];read-file;ai-generated"
24-
new FileInputStream((File) t);
27+
new FileInputStream((File) source(null));
2528
// "java.io;FileReader;true;FileReader;(File);;Argument[0];read-file;ai-generated"
26-
new FileReader((File) t);
29+
new FileReader((File) source(null));
2730
// "java.io;FileReader;true;FileReader;(String);;Argument[0];read-file;ai-generated"
28-
new FileReader(t);
31+
new FileReader((String) source(null));
2932
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[1];create-file;ai-generated"
30-
new ZipURLInstaller((URL) null, t, "");
33+
new ZipURLInstaller((URL) null, (String) source(null), "");
3134
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[2];create-file;ai-generated"
32-
new ZipURLInstaller((URL) null, "", t);
35+
new ZipURLInstaller((URL) null, "", (String) source(null));
3336
}
3437
}

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6
1+
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6:${testdir}/../../../../../stubs/cargo

‎java/ql/test/query-tests/security/CWE-918/JdbcUrlSSRF.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
2020

2121
String jdbcUrl = request.getParameter("jdbcUrl");
2222
Driver driver = new org.postgresql.Driver();
23-
DataSourceBuilder dsBuilder = new DataSourceBuilder();
23+
DataSourceBuilder dsBuilder = DataSourceBuilder.create();
2424

2525
try {
2626
driver.connect(jdbcUrl, null); // $ SSRF

‎java/ql/test/query-tests/security/CWE-918/mad/Test.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import java.net.URL;
12
import javax.servlet.http.HttpServletRequest;
23
import javafx.scene.web.WebEngine;
34
import org.codehaus.cargo.container.installer.ZipURLInstaller;
@@ -9,14 +10,13 @@ public static Object source(HttpServletRequest request) {
910
}
1011

1112
public void test(WebEngine webEngine) {
12-
String taint = source(null);
1313
// "javafx.scene.web;WebEngine;false;load;(String);;Argument[0];open-url;ai-generated"
14-
webEngine.load(taint); // $ SSRF
14+
webEngine.load((String) source(null)); // $ SSRF
1515
}
1616

1717
public void test() {
1818
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[0];open-url:ai-generated"
19-
new ZipURLInstaller((URL) source(), "", ""); // $ SSRF
19+
new ZipURLInstaller((URL) source(null), "", ""); // $ SSRF
2020
}
2121

2222
}

‎java/ql/test/query-tests/security/CWE-918/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/
1+
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web
22

0 commit comments

Comments
 (0)