Skip to content

Commit b1329fd

Browse files
michaelnebelmichaelnebel
authored
Merge pull request github#16362 from michaelnebel/java/removelocalqueries
Java: Remove local query variants.
2 parents ea3cc51 + 8b0f3af commit b1329fd

File tree

71 files changed

+182
-459
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

71 files changed

+182
-459
lines changed

‎java/ql/automodel/src/AutomodelAlertSinkUtil.qll

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -159,11 +159,7 @@ predicate sinkModelTallyPerQuery(string queryName, int alertCount, SinkModel sin
159159
SinkTallier<RequestForgeryConfig>::getSinkModelCount(alertCount, sinkModel)
160160
or
161161
queryName = "java/command-line-injection" and
162-
exists(int c1, int c2 |
163-
SinkTallier<RemoteUserInputToArgumentToExecFlowConfig>::getSinkModelCount(c1, sinkModel) and
164-
SinkTallier<LocalUserInputToArgumentToExecFlowConfig>::getSinkModelCount(c2, sinkModel) and
165-
alertCount = c1 + c2
166-
)
162+
SinkTallier<InputToArgumentToExecFlowConfig>::getSinkModelCount(alertCount, sinkModel)
167163
or
168164
queryName = "java/concatenated-sql-query" and
169165
SinkTallier<UncontrolledStringBuilderSourceFlowConfig>::getSinkModelCount(alertCount, sinkModel)

‎java/ql/lib/semmle/code/java/security/ArithmeticTaintedLocalQuery.qll

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.security.ArithmeticCommon
66

77
/**
8+
* DEPRECATED: Use `ArithmeticOverflowConfig` instead.
9+
*
810
* A taint-tracking configuration to reason about arithmetic overflow using local-user-controlled data.
911
*/
10-
module ArithmeticTaintedLocalOverflowConfig implements DataFlow::ConfigSig {
12+
deprecated module ArithmeticTaintedLocalOverflowConfig implements DataFlow::ConfigSig {
1113
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
1214

1315
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
@@ -18,15 +20,17 @@ module ArithmeticTaintedLocalOverflowConfig implements DataFlow::ConfigSig {
1820
}
1921

2022
/**
23+
* DEPRECATED: Use `ArithmeticOverflow` instead and configure threat model sources to include `local`.
24+
*
2125
* Taint-tracking flow for arithmetic overflow using local-user-controlled data.
2226
*/
23-
module ArithmeticTaintedLocalOverflowFlow =
27+
deprecated module ArithmeticTaintedLocalOverflowFlow =
2428
TaintTracking::Global<ArithmeticTaintedLocalOverflowConfig>;
2529

2630
/**
2731
* A taint-tracking configuration to reason about arithmetic underflow using local-user-controlled data.
2832
*/
29-
module ArithmeticTaintedLocalUnderflowConfig implements DataFlow::ConfigSig {
33+
deprecated module ArithmeticTaintedLocalUnderflowConfig implements DataFlow::ConfigSig {
3034
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
3135

3236
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
@@ -37,7 +41,9 @@ module ArithmeticTaintedLocalUnderflowConfig implements DataFlow::ConfigSig {
3741
}
3842

3943
/**
44+
* DEPRECATED: Use `ArithmeticUnderflow` instead and configure threat model sources to include `local`.
45+
*
4046
* Taint-tracking flow for arithmetic underflow using local-user-controlled data.
4147
*/
42-
module ArithmeticTaintedLocalUnderflowFlow =
48+
deprecated module ArithmeticTaintedLocalUnderflowFlow =
4349
TaintTracking::Global<ArithmeticTaintedLocalUnderflowConfig>;

‎java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll

Lines changed: 29 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
/** Provides taint-tracking configurations to reason about arithmetic with unvalidated user input. */
1+
/** Provides taint-tracking configurations to reason about arithmetic with unvalidated input. */
22

33
import java
44
private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.security.ArithmeticCommon
66

7-
/** A taint-tracking configuration to reason about overflow from unvalidated user input. */
8-
module RemoteUserInputOverflowConfig implements DataFlow::ConfigSig {
7+
/** A taint-tracking configuration to reason about overflow from unvalidated input. */
8+
module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
99
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
1010

1111
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
@@ -15,8 +15,13 @@ module RemoteUserInputOverflowConfig implements DataFlow::ConfigSig {
1515
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
1616
}
1717

18-
/** A taint-tracking configuration to reason about underflow from unvalidated user input. */
19-
module RemoteUserInputUnderflowConfig implements DataFlow::ConfigSig {
18+
/**
19+
* DEPRECATED: Use `ArithmeticOverflowConfig` instead.
20+
*/
21+
deprecated module RemoteUserInputOverflowConfig = ArithmeticOverflowConfig;
22+
23+
/** A taint-tracking configuration to reason about underflow from unvalidated input. */
24+
module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
2025
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
2126

2227
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
@@ -26,8 +31,23 @@ module RemoteUserInputUnderflowConfig implements DataFlow::ConfigSig {
2631
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
2732
}
2833

29-
/** Taint-tracking flow for overflow from unvalidated user input. */
30-
module RemoteUserInputOverflow = TaintTracking::Global<RemoteUserInputOverflowConfig>;
34+
/**
35+
* DEPRECATED: Use `ArithmeticUnderflowConfig` instead.
36+
*/
37+
deprecated module RemoteUserInputUnderflowConfig = ArithmeticUnderflowConfig;
38+
39+
/** Taint-tracking flow for overflow from unvalidated input. */
40+
module ArithmeticOverflow = TaintTracking::Global<ArithmeticOverflowConfig>;
41+
42+
/**
43+
* DEPRECATED: Use `ArithmeticOverflow` instead.
44+
*/
45+
deprecated module RemoteUserInputOverflow = ArithmeticOverflow;
46+
47+
/** Taint-tracking flow for underflow from unvalidated input. */
48+
module ArithmeticUnderflow = TaintTracking::Global<ArithmeticUnderflowConfig>;
3149

32-
/** Taint-tracking flow for underflow from unvalidated user input. */
33-
module RemoteUserInputUnderflow = TaintTracking::Global<RemoteUserInputUnderflowConfig>;
50+
/**
51+
* DEPRECATED: Use `ArithmeticUnderflow` instead.
52+
*/
53+
deprecated module RemoteUserInputUnderflow = ArithmeticUnderflow;

‎java/ql/lib/semmle/code/java/security/CommandLineQuery.qll

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ private class DefaultCommandInjectionSanitizer extends CommandInjectionSanitizer
4848
/**
4949
* A taint-tracking configuration for unvalidated user input that is used to run an external process.
5050
*/
51-
module RemoteUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
51+
module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
5252
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
5353

5454
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
@@ -61,15 +61,24 @@ module RemoteUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig
6161
}
6262

6363
/**
64-
* Taint-tracking flow for unvalidated user input that is used to run an external process.
64+
* DEPRECATED: Use `InputToArgumentToExecFlowConfig` instead.
6565
*/
66-
module RemoteUserInputToArgumentToExecFlow =
67-
TaintTracking::Global<RemoteUserInputToArgumentToExecFlowConfig>;
66+
deprecated module RemoteUserInputToArgumentToExecFlowConfig = InputToArgumentToExecFlowConfig;
67+
68+
/**
69+
* Taint-tracking flow for unvalidated input that is used to run an external process.
70+
*/
71+
module InputToArgumentToExecFlow = TaintTracking::Global<InputToArgumentToExecFlowConfig>;
72+
73+
/**
74+
* DEPRECATED: Use `InputToArgumentToExecFlow` instead.
75+
*/
76+
deprecated module RemoteUserInputToArgumentToExecFlow = InputToArgumentToExecFlow;
6877

6978
/**
7079
* A taint-tracking configuration for unvalidated local user input that is used to run an external process.
7180
*/
72-
module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
81+
deprecated module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
7382
predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
7483

7584
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
@@ -82,9 +91,11 @@ module LocalUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
8291
}
8392

8493
/**
94+
* DEPRECATED: Use `InputToArgumentToExecFlow` instead and configure threat model sources to include `local`.
95+
*
8596
* Taint-tracking flow for unvalidated local user input that is used to run an external process.
8697
*/
87-
module LocalUserInputToArgumentToExecFlow =
98+
deprecated module LocalUserInputToArgumentToExecFlow =
8899
TaintTracking::Global<LocalUserInputToArgumentToExecFlowConfig>;
89100

90101
/**
@@ -93,10 +104,9 @@ module LocalUserInputToArgumentToExecFlow =
93104
* reporting overlapping results.
94105
*/
95106
predicate execIsTainted(
96-
RemoteUserInputToArgumentToExecFlow::PathNode source,
97-
RemoteUserInputToArgumentToExecFlow::PathNode sink, Expr execArg
107+
InputToArgumentToExecFlow::PathNode source, InputToArgumentToExecFlow::PathNode sink, Expr execArg
98108
) {
99-
RemoteUserInputToArgumentToExecFlow::flowPath(source, sink) and
109+
InputToArgumentToExecFlow::flowPath(source, sink) and
100110
argumentToExec(execArg, sink.getNode())
101111
}
102112

‎java/ql/lib/semmle/code/java/security/ExecTaintedLocalQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.security.CommandArguments
77
private import semmle.code.java.security.Sanitizers
88

99
/** A taint-tracking configuration to reason about use of externally controlled strings to make command line commands. */
10-
module ExecTaintedLocalConfig implements DataFlow::ConfigSig {
10+
deprecated module ExecTaintedLocalConfig implements DataFlow::ConfigSig {
1111
predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
1212

1313
predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof ArgumentToExec }
@@ -20,6 +20,8 @@ module ExecTaintedLocalConfig implements DataFlow::ConfigSig {
2020
}
2121

2222
/**
23+
* DEPRCATED: Unused.
24+
*
2325
* Taint-tracking flow for use of externally controlled strings to make command line commands.
2426
*/
25-
module ExecTaintedLocalFlow = TaintTracking::Global<ExecTaintedLocalConfig>;
27+
deprecated module ExecTaintedLocalFlow = TaintTracking::Global<ExecTaintedLocalConfig>;

‎java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringLocalQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ private import semmle.code.java.dataflow.FlowSources
55
private import semmle.code.java.StringFormat
66

77
/** A taint-tracking configuration to reason about externally-controlled format strings from local sources. */
8-
module ExternallyControlledFormatStringLocalConfig implements DataFlow::ConfigSig {
8+
deprecated module ExternallyControlledFormatStringLocalConfig implements DataFlow::ConfigSig {
99
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
1010

1111
predicate isSink(DataFlow::Node sink) {
@@ -18,7 +18,9 @@ module ExternallyControlledFormatStringLocalConfig implements DataFlow::ConfigSi
1818
}
1919

2020
/**
21+
* DEPRECATED: Use `ExternallyControlledFormatStringFlow` instead and configure threat model sources to include `local`.
22+
*
2123
* Taint-tracking flow for externally-controlled format strings from local sources.
2224
*/
23-
module ExternallyControlledFormatStringLocalFlow =
25+
deprecated module ExternallyControlledFormatStringLocalFlow =
2426
TaintTracking::Global<ExternallyControlledFormatStringLocalConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.dataflow.FlowSources
77
/**
88
* A taint-tracking configuration to reason about improper validation of local user-provided size used for array construction.
99
*/
10-
module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::ConfigSig {
10+
deprecated module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::ConfigSig {
1111
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
1212

1313
predicate isSink(DataFlow::Node sink) {
@@ -16,7 +16,9 @@ module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::Con
1616
}
1717

1818
/**
19+
* DEPRECATED: Use `ImproperValidationOfArrayConstructionFlow` instead and configure threat model sources to include `local`.
20+
*
1921
* Taint-tracking flow for improper validation of local user-provided size used for array construction.
2022
*/
21-
module ImproperValidationOfArrayConstructionLocalFlow =
23+
deprecated module ImproperValidationOfArrayConstructionLocalFlow =
2224
TaintTracking::Global<ImproperValidationOfArrayConstructionLocalConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.dataflow.FlowSources
77
/**
88
* A taint-tracking configuration to reason about improper validation of local user-provided array index.
99
*/
10-
module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig {
10+
deprecated module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig {
1111
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
1212

1313
predicate isSink(DataFlow::Node sink) {
@@ -20,7 +20,9 @@ module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig
2020
}
2121

2222
/**
23+
* DEPRECATED: Use `ImproperValidationOfArrayIndexFlow` instead and configure threat model sources to include `local`.
24+
*
2325
* Taint-tracking flow for improper validation of local user-provided array index.
2426
*/
25-
module ImproperValidationOfArrayIndexLocalFlow =
27+
deprecated module ImproperValidationOfArrayIndexLocalFlow =
2628
TaintTracking::Global<ImproperValidationOfArrayIndexLocalConfig>;

‎java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ module NumericCastFlow = TaintTracking::Global<NumericCastFlowConfig>;
113113
* A taint-tracking configuration for reasoning about local user input that is
114114
* used in a numeric cast.
115115
*/
116-
module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
116+
deprecated module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
117117
predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
118118

119119
predicate isSink(DataFlow::Node sink) {
@@ -134,6 +134,8 @@ module NumericCastLocalFlowConfig implements DataFlow::ConfigSig {
134134
}
135135

136136
/**
137+
* DEPRECATED: Use `NumericCastFlow` instead and configure threat model sources to include `local`.
138+
*
137139
* Taint-tracking flow for local user input that is used in a numeric cast.
138140
*/
139-
module NumericCastLocalFlow = TaintTracking::Global<NumericCastLocalFlowConfig>;
141+
deprecated module NumericCastLocalFlow = TaintTracking::Global<NumericCastLocalFlowConfig>;

‎java/ql/lib/semmle/code/java/security/ResponseSplittingLocalQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import semmle.code.java.security.ResponseSplitting
77
/**
88
* A taint-tracking configuration to reason about response splitting vulnerabilities from local user input.
99
*/
10-
module ResponseSplittingLocalConfig implements DataFlow::ConfigSig {
10+
deprecated module ResponseSplittingLocalConfig implements DataFlow::ConfigSig {
1111
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
1212

1313
predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
@@ -32,6 +32,8 @@ module ResponseSplittingLocalConfig implements DataFlow::ConfigSig {
3232
}
3333

3434
/**
35+
* DEPRECATED: Use `ResponseSplittingFlow` instead and configure threat model sources to include `local`.
36+
*
3537
* Taint-tracking flow for response splitting vulnerabilities from local user input.
3638
*/
37-
module ResponseSplittingLocalFlow = TaintTracking::Global<ResponseSplittingLocalConfig>;
39+
deprecated module ResponseSplittingLocalFlow = TaintTracking::Global<ResponseSplittingLocalConfig>;

0 commit comments

Comments
 (0)