Skip to content

Commit 162b1c5

Browse files
d10cd10c
committed
Java: convert XXE test to .qlref
1 parent 7f33f57 commit 162b1c5

20 files changed

+560
-132
lines changed

‎java/ql/test/query-tests/security/CWE-611/CdaUtilTests.java

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77
public class CdaUtilTests {
88

99
public void test(Socket sock) throws Exception {
10-
InputStream is = sock.getInputStream();
10+
InputStream is = sock.getInputStream(); // $ Source
1111
InputSource iSrc = new InputSource(new InputStreamReader(is));
12-
CDAUtil.load(is); // $ hasTaintFlow
13-
CDAUtil.load(iSrc); // $ hasTaintFlow
14-
CDAUtil.load(is, (CDAUtil.ValidationHandler) null); // $ hasTaintFlow
15-
CDAUtil.load(is, (CDAUtil.LoadHandler) null); // $ hasTaintFlow
16-
CDAUtil.load(null, null, is, null); // $ hasTaintFlow
17-
CDAUtil.load(iSrc, (CDAUtil.ValidationHandler) null); // $ hasTaintFlow
18-
CDAUtil.load(iSrc, (CDAUtil.LoadHandler) null); // $ hasTaintFlow
19-
CDAUtil.load(null, null, iSrc, null); // $ hasTaintFlow
20-
CDAUtil.loadAs(is, null); // $ hasTaintFlow
21-
CDAUtil.loadAs(is, null, null); // $ hasTaintFlow
12+
CDAUtil.load(is); // $ Alert
13+
CDAUtil.load(iSrc); // $ Alert
14+
CDAUtil.load(is, (CDAUtil.ValidationHandler) null); // $ Alert
15+
CDAUtil.load(is, (CDAUtil.LoadHandler) null); // $ Alert
16+
CDAUtil.load(null, null, is, null); // $ Alert
17+
CDAUtil.load(iSrc, (CDAUtil.ValidationHandler) null); // $ Alert
18+
CDAUtil.load(iSrc, (CDAUtil.LoadHandler) null); // $ Alert
19+
CDAUtil.load(null, null, iSrc, null); // $ Alert
20+
CDAUtil.loadAs(is, null); // $ Alert
21+
CDAUtil.loadAs(is, null, null); // $ Alert
2222
}
2323
}

‎java/ql/test/query-tests/security/CWE-611/DigesterTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ public class DigesterTests {
1111

1212
@PostMapping(value = "bad")
1313
public void bad1(HttpServletRequest request, HttpServletResponse response) throws Exception {
14-
ServletInputStream servletInputStream = request.getInputStream();
14+
ServletInputStream servletInputStream = request.getInputStream(); // $ Source
1515
Digester digester = new Digester();
16-
digester.parse(servletInputStream); // $ hasTaintFlow
16+
digester.parse(servletInputStream); // $ Alert
1717
}
1818

1919
@PostMapping(value = "good")

‎java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ class DocumentBuilderTests {
1111
public void unconfiguredParse(Socket sock) throws Exception {
1212
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
1313
DocumentBuilder builder = factory.newDocumentBuilder();
14-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
14+
builder.parse(sock.getInputStream()); // $ Alert
1515
}
1616

1717
public void disableDTD(Socket sock) throws Exception {
@@ -25,30 +25,30 @@ public void enableSecurityFeature(Socket sock) throws Exception {
2525
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
2626
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
2727
DocumentBuilder builder = factory.newDocumentBuilder();
28-
builder.parse(sock.getInputStream()); // $ hasTaintFlow -- secure-processing by itself is
28+
builder.parse(sock.getInputStream()); // $ Alert -- secure-processing by itself is
2929
// insufficient
3030
}
3131

3232
public void enableSecurityFeature2(Socket sock) throws Exception {
3333
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
3434
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
3535
DocumentBuilder builder = factory.newDocumentBuilder();
36-
builder.parse(sock.getInputStream()); // $ hasTaintFlow -- secure-processing by itself is
36+
builder.parse(sock.getInputStream()); // $ Alert -- secure-processing by itself is
3737
// insufficient
3838
}
3939

4040
public void enableDTD(Socket sock) throws Exception {
4141
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
4242
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
4343
DocumentBuilder builder = factory.newDocumentBuilder();
44-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
44+
builder.parse(sock.getInputStream()); // $ Alert
4545
}
4646

4747
public void disableSecurityFeature(Socket sock) throws Exception {
4848
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
4949
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", false);
5050
DocumentBuilder builder = factory.newDocumentBuilder();
51-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
51+
builder.parse(sock.getInputStream()); // $ Alert
5252
}
5353

5454
public void disableExternalEntities(Socket sock) throws Exception {
@@ -63,45 +63,45 @@ public void partialDisableExternalEntities(Socket sock) throws Exception {
6363
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
6464
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
6565
DocumentBuilder builder = factory.newDocumentBuilder();
66-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
66+
builder.parse(sock.getInputStream()); // $ Alert
6767
}
6868

6969
public void partialDisableExternalEntities2(Socket sock) throws Exception {
7070
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
7171
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
7272
DocumentBuilder builder = factory.newDocumentBuilder();
73-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
73+
builder.parse(sock.getInputStream()); // $ Alert
7474
}
7575

7676
public void misConfigureExternalEntities1(Socket sock) throws Exception {
7777
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
7878
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
7979
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
8080
DocumentBuilder builder = factory.newDocumentBuilder();
81-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
81+
builder.parse(sock.getInputStream()); // $ Alert
8282
}
8383

8484
public void misConfigureExternalEntities2(Socket sock) throws Exception {
8585
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
8686
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
8787
factory.setFeature("http://xml.org/sax/features/external-general-entities", true);
8888
DocumentBuilder builder = factory.newDocumentBuilder();
89-
builder.parse(sock.getInputStream()); // $ hasTaintFlow
89+
builder.parse(sock.getInputStream()); // $ Alert
9090
}
9191

9292
public void taintedSAXInputSource1(Socket sock) throws Exception {
9393
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
9494
DocumentBuilder builder = factory.newDocumentBuilder();
95-
SAXSource source = new SAXSource(new InputSource(sock.getInputStream()));
96-
builder.parse(source.getInputSource()); // $ hasTaintFlow
95+
SAXSource source = new SAXSource(new InputSource(sock.getInputStream())); // $ Source
96+
builder.parse(source.getInputSource()); // $ Alert
9797
}
9898

9999
public void taintedSAXInputSource2(Socket sock) throws Exception {
100100
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
101101
DocumentBuilder builder = factory.newDocumentBuilder();
102-
StreamSource source = new StreamSource(sock.getInputStream());
103-
builder.parse(SAXSource.sourceToInputSource(source)); // $ hasTaintFlow
104-
builder.parse(source.getInputStream()); // $ hasTaintFlow
102+
StreamSource source = new StreamSource(sock.getInputStream()); // $ Source
103+
builder.parse(SAXSource.sourceToInputSource(source)); // $ Alert
104+
builder.parse(source.getInputStream()); // $ Alert
105105
}
106106

107107
private static DocumentBuilderFactory getDocumentBuilderFactory() throws Exception {

‎java/ql/test/query-tests/security/CWE-611/ParserHelperTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ public class ParserHelperTests {
99

1010
@PostMapping(value = "bad4")
1111
public void bad4(HttpServletRequest request) throws Exception {
12-
Document document = ParserHelper.loadDocument(request.getInputStream()); // $ hasTaintFlow
12+
Document document = ParserHelper.loadDocument(request.getInputStream()); // $ Alert
1313
}
1414
}

‎java/ql/test/query-tests/security/CWE-611/SAXBuilderTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ public class SAXBuilderTests {
55

66
public void unconfiguredSAXBuilder(Socket sock) throws Exception {
77
SAXBuilder builder = new SAXBuilder();
8-
builder.build(sock.getInputStream()); // $ hasTaintFlow
8+
builder.build(sock.getInputStream()); // $ Alert
99
}
1010

1111
public void safeBuilder(Socket sock) throws Exception {
@@ -17,6 +17,6 @@ public void safeBuilder(Socket sock) throws Exception {
1717
public void misConfiguredBuilder(Socket sock) throws Exception {
1818
SAXBuilder builder = new SAXBuilder();
1919
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
20-
builder.build(sock.getInputStream()); // $ hasTaintFlow
20+
builder.build(sock.getInputStream()); // $ Alert
2121
}
2222
}

‎java/ql/test/query-tests/security/CWE-611/SAXParserTests.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ public class SAXParserTests {
1010
public void unconfiguredParser(Socket sock) throws Exception {
1111
SAXParserFactory factory = SAXParserFactory.newInstance();
1212
SAXParser parser = factory.newSAXParser();
13-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
13+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
1414
}
1515

1616
public void safeParser(Socket sock) throws Exception {
@@ -27,23 +27,23 @@ public void partialConfiguredParser1(Socket sock) throws Exception {
2727
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
2828
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
2929
SAXParser parser = factory.newSAXParser();
30-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
30+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
3131
}
3232

3333
public void partialConfiguredParser2(Socket sock) throws Exception {
3434
SAXParserFactory factory = SAXParserFactory.newInstance();
3535
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
3636
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
3737
SAXParser parser = factory.newSAXParser();
38-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
38+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
3939
}
4040

4141
public void partialConfiguredParser3(Socket sock) throws Exception {
4242
SAXParserFactory factory = SAXParserFactory.newInstance();
4343
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
4444
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
4545
SAXParser parser = factory.newSAXParser();
46-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
46+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
4747
}
4848

4949
public void misConfiguredParser1(Socket sock) throws Exception {
@@ -52,7 +52,7 @@ public void misConfiguredParser1(Socket sock) throws Exception {
5252
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
5353
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
5454
SAXParser parser = factory.newSAXParser();
55-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
55+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
5656
}
5757

5858
public void misConfiguredParser2(Socket sock) throws Exception {
@@ -61,7 +61,7 @@ public void misConfiguredParser2(Socket sock) throws Exception {
6161
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
6262
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
6363
SAXParser parser = factory.newSAXParser();
64-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
64+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
6565
}
6666

6767
public void misConfiguredParser3(Socket sock) throws Exception {
@@ -70,7 +70,7 @@ public void misConfiguredParser3(Socket sock) throws Exception {
7070
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
7171
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true);
7272
SAXParser parser = factory.newSAXParser();
73-
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
73+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ Alert
7474
}
7575

7676
public void safeParser2(Socket sock) throws Exception {

‎java/ql/test/query-tests/security/CWE-611/SAXReaderTests.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ public class SAXReaderTests {
55

66
public void unconfiguredReader(Socket sock) throws Exception {
77
SAXReader reader = new SAXReader();
8-
reader.read(sock.getInputStream()); // $ hasTaintFlow
8+
reader.read(sock.getInputStream()); // $ Alert
99
}
1010

1111
public void safeReader(Socket sock) throws Exception {
@@ -20,44 +20,44 @@ public void partialConfiguredReader1(Socket sock) throws Exception {
2020
SAXReader reader = new SAXReader();
2121
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
2222
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
23-
reader.read(sock.getInputStream()); // $ hasTaintFlow
23+
reader.read(sock.getInputStream()); // $ Alert
2424
}
2525

2626
public void partialConfiguredReader2(Socket sock) throws Exception {
2727
SAXReader reader = new SAXReader();
2828
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
2929
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
30-
reader.read(sock.getInputStream()); // $ hasTaintFlow
30+
reader.read(sock.getInputStream()); // $ Alert
3131
}
3232

3333
public void partialConfiguredReader3(Socket sock) throws Exception {
3434
SAXReader reader = new SAXReader();
3535
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
3636
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
37-
reader.read(sock.getInputStream()); // $ hasTaintFlow
37+
reader.read(sock.getInputStream()); // $ Alert
3838
}
3939

4040
public void misConfiguredReader1(Socket sock) throws Exception {
4141
SAXReader reader = new SAXReader();
4242
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
4343
reader.setFeature("http://xml.org/sax/features/external-general-entities", true);
4444
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
45-
reader.read(sock.getInputStream()); // $ hasTaintFlow
45+
reader.read(sock.getInputStream()); // $ Alert
4646
}
4747

4848
public void misConfiguredReader2(Socket sock) throws Exception {
4949
SAXReader reader = new SAXReader();
5050
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
5151
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
5252
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
53-
reader.read(sock.getInputStream()); // $ hasTaintFlow
53+
reader.read(sock.getInputStream()); // $ Alert
5454
}
5555

5656
public void misConfiguredReader3(Socket sock) throws Exception {
5757
SAXReader reader = new SAXReader();
5858
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
5959
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
6060
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
61-
reader.read(sock.getInputStream()); // $ hasTaintFlow
61+
reader.read(sock.getInputStream()); // $ Alert
6262
}
6363
}

‎java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ public class SAXSourceTests {
1414

1515
public void unsafeSource(Socket sock) throws Exception {
1616
XMLReader reader = XMLReaderFactory.createXMLReader();
17-
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
17+
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); // $ Source
1818
JAXBContext jc = JAXBContext.newInstance(Object.class);
1919
Unmarshaller um = jc.createUnmarshaller();
20-
um.unmarshal(source); // $ hasTaintFlow
20+
um.unmarshal(source); // $ Alert
2121
}
2222

2323
public void explicitlySafeSource1(Socket sock) throws Exception {

‎java/ql/test/query-tests/security/CWE-611/SchemaTests.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ public class SchemaTests {
99

1010
public void unconfiguredSchemaFactory(Socket sock) throws Exception {
1111
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
12-
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ hasTaintFlow
12+
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ Alert
1313
}
1414

1515
public void safeSchemaFactory(Socket sock) throws Exception {
@@ -22,26 +22,26 @@ public void safeSchemaFactory(Socket sock) throws Exception {
2222
public void partialConfiguredSchemaFactory1(Socket sock) throws Exception {
2323
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
2424
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
25-
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ hasTaintFlow
25+
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ Alert
2626
}
2727

2828
public void partialConfiguredSchemaFactory2(Socket sock) throws Exception {
2929
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
3030
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
31-
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ hasTaintFlow
31+
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ Alert
3232
}
3333

3434
public void misConfiguredSchemaFactory1(Socket sock) throws Exception {
3535
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
3636
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
3737
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "ab");
38-
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ hasTaintFlow
38+
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ Alert
3939
}
4040

4141
public void misConfiguredSchemaFactory2(Socket sock) throws Exception {
4242
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
4343
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "cd");
4444
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
45-
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ hasTaintFlow
45+
Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // $ Alert
4646
}
4747
}

0 commit comments

Comments
 (0)