Allow MaD sanitizers for java/http-response-splitting

Author: owen-mc

java/ql/lib/semmle/code/java/security/ResponseSplitting.qll

@@ -8,6 +8,7 @@ import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.frameworks.Servlets
 import semmle.code.java.frameworks.JaxWS
 private import semmle.code.java.dataflow.ExternalFlow
+private import semmle.code.java.security.Sanitizers
 
 /** A sink that is vulnerable to an HTTP header splitting attack. */
 abstract class HeaderSplittingSink extends DataFlow::Node { }
@@ -16,6 +17,32 @@ private class DefaultHeaderSplittingSink extends HeaderSplittingSink {
   DefaultHeaderSplittingSink() { sinkNode(this, "response-splitting") }
 }
 
+/** A sanitizer for an HTTP header splitting attack. */
+abstract class HeaderSplittingSanitizer extends DataFlow::Node { }
+
+private class SimpleTypeHeaderSplittingSanitizer extends HeaderSplittingSanitizer instanceof SimpleTypeSanitizer
+{ }
+
+private class ExternalHeaderSplittingSanitizer extends HeaderSplittingSanitizer {
+  ExternalHeaderSplittingSanitizer() { barrierNode(this, "response-splitting") }
+}
+
+private class NewlineRemovalHeaderSplittingSanitizer extends HeaderSplittingSanitizer {
+  NewlineRemovalHeaderSplittingSanitizer() {
+    exists(MethodCall ma, string methodName, CompileTimeConstantExpr target |
+      this.asExpr() = ma and
+      ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
+      target = ma.getArgument(0) and
+      (
+        methodName = "replace" and target.getIntValue() = [10, 13] // 10 == "\n", 13 == "\r"
+        or
+        methodName = "replaceAll" and
+        target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
+      )
+    )
+  }
+}
+
 /** A source that introduces data considered safe to use by a header splitting source. */
 abstract class SafeHeaderSplittingSource extends DataFlow::Node instanceof RemoteFlowSource { }
 

java/ql/lib/semmle/code/java/security/ResponseSplittingQuery.qll

@@ -2,7 +2,6 @@
 
 import java
 private import semmle.code.java.dataflow.FlowSources
-private import semmle.code.java.security.Sanitizers
 import semmle.code.java.security.ResponseSplitting
 
 /**
@@ -16,21 +15,7 @@ module ResponseSplittingConfig implements DataFlow::ConfigSig {
 
   predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
 
-  predicate isBarrier(DataFlow::Node node) {
-    node instanceof SimpleTypeSanitizer
-    or
-    exists(MethodCall ma, string methodName, CompileTimeConstantExpr target |
-      node.asExpr() = ma and
-      ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
-      target = ma.getArgument(0) and
-      (
-        methodName = "replace" and target.getIntValue() = [10, 13] // 10 == "\n", 13 == "\r"
-        or
-        methodName = "replaceAll" and
-        target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
-      )
-    )
-  }
+  predicate isBarrier(DataFlow::Node node) { node instanceof HeaderSplittingSanitizer }
 
   predicate observeDiffInformedIncrementalMode() { any() }
 }