Preserve taint on field-read-steps on entrypoint types

Author: atorralba

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -11,6 +11,7 @@ private import semmle.code.java.frameworks.spring.SpringController
 private import semmle.code.java.frameworks.spring.SpringHttp
 private import semmle.code.java.frameworks.Networking
 private import semmle.code.java.dataflow.ExternalFlow
+private import semmle.code.java.dataflow.FlowSources
 private import semmle.code.java.dataflow.internal.DataFlowPrivate
 import semmle.code.java.dataflow.FlowSteps
 private import FlowSummaryImpl as FlowSummaryImpl
@@ -91,6 +92,8 @@ private module Cached {
     )
     or
     FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
+    or
+    entrypointFieldStep(src, sink)
   }
 
   /**
@@ -591,3 +594,18 @@ private MethodAccess callReturningSameType(Expr ref) {
   ref = result.getQualifier() and
   result.getMethod().getReturnType() = ref.getType()
 }
+
+private SrcRefType entrypointType() {
+  result =
+    pragma[only_bind_out](any(RemoteFlowSource s | s instanceof DataFlow::ExplicitParameterNode))
+        .getType()
+        .(RefType)
+        .getASubtype*()
+        .getSourceDeclaration() or
+  result = entrypointType().getAField().getType().(RefType).getSourceDeclaration()
+}
+
+private predicate entrypointFieldStep(DataFlow::Node src, DataFlow::Node sink) {
+  src = DataFlow::getFieldQualifier(sink.asExpr().(FieldRead)) and
+  src.getType().(RefType).getSourceDeclaration() = entrypointType()
+}

java/ql/test/library-tests/dataflow/entrypoint-types/EntryPointTypesTest.expected

@@ -0,0 +1,34 @@
+public class EntryPointTypesTest {
+
+    static class TestObject {
+        public String field1;
+        private String field2;
+        private AnotherTestObject field3;
+
+        public String getField2() {
+            return field2;
+        }
+
+        public AnotherTestObject getField3() {
+            return field3;
+        }
+    }
+
+    static class AnotherTestObject {
+        public String field4;
+        private String field5;
+
+        public String getField5() {
+            return field5;
+        }
+    }
+
+    private static void sink(String sink) {}
+
+    public static void test(TestObject source) {
+        sink(source.field1); // $hasTaintFlow
+        sink(source.getField2()); // $hasTaintFlow
+        sink(source.getField3().field4); // $hasTaintFlow
+        sink(source.getField3().getField5()); // $hasTaintFlow
+    }
+}

java/ql/test/library-tests/dataflow/entrypoint-types/EntryPointTypesTest.java

@@ -0,0 +1,34 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+import TestUtilities.InlineExpectationsTest
+
+class TestRemoteFlowSource extends RemoteFlowSource {
+  TestRemoteFlowSource() { this.asParameter().hasName("source") }
+
+  override string getSourceType() { result = "test" }
+}
+
+class TaintFlowConf extends TaintTracking::Configuration {
+  TaintFlowConf() { this = "qltest:dataflow:entrypoint-types-taint" }
+
+  override predicate isSource(DataFlow::Node n) { n instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node n) {
+    exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
+  }
+}
+
+class HasFlowTest extends InlineExpectationsTest {
+  HasFlowTest() { this = "HasFlowTest" }
+
+  override string getARelevantTag() { result = ["hasTaintFlow"] }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasTaintFlow" and
+    exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf | conf.hasFlow(src, sink) |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      value = ""
+    )
+  }
+}