Skip to content

Commit 8a80158

Browse files
owen-mcowen-mc
authored
Merge pull request #17590 from Kwstubbs/java-mad-test
Java: FileUpload Support MaD
2 parents c8728c2 + bf79b8a commit 8a80158

File tree

58 files changed

+1238
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1238
-2
lines changed

‎java/ql/lib/change-notes/2024-09-24-multipart.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added more dataflow models of `org.apache.commons.fileupload.FileItem`, `javax/jakarta.servlet.http.Part` and `org.apache.commons.fileupload.util.Streams`.

‎java/ql/lib/ext/jakarta.servlet.http.model.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,14 @@ extensions:
33
pack: codeql/java-all
44
extensible: sourceModel
55
data:
6-
- ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "", "", "ReturnValue", "remote", "manual"]
6+
- ["jakarta.servlet.http", "HttpServletRequest", True, "getServletPath", "()", "", "ReturnValue", "remote", "manual"]
7+
- ["jakarta.servlet.http", "Part", True, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
8+
- ["jakarta.servlet.http", "Part", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
9+
- ["jakarta.servlet.http", "Part", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
10+
- ["jakarta.servlet.http", "Part", True, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
11+
- ["jakarta.servlet.http", "Part", True, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
12+
- ["jakarta.servlet.http", "Part", True, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]
13+
- ["jakarta.servlet.http", "Part", True, "getSubmittedFileName", "()", "", "ReturnValue", "remote", "manual"]
714
- ["jakarta.servlet.http", "HttpServletRequest", False, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
815
- ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
916
- ["jakarta.servlet.http", "HttpServletRequest", False, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]

‎java/ql/lib/ext/javax.servlet.http.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,14 @@ extensions:
1919
- ["javax.servlet.http", "HttpServletRequest", False, "getRequestURI", "()", "", "ReturnValue", "remote", "manual"]
2020
- ["javax.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "remote", "manual"]
2121
- ["javax.servlet.http", "HttpServletRequest", False, "getServletPath", "()", "", "ReturnValue", "remote", "manual"]
22+
- ["javax.servlet.http", "Part", False, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
23+
- ["javax.servlet.http", "Part", False, "getHeader", "(String)", "", "ReturnValue", "remote", "manual"]
24+
- ["javax.servlet.http", "Part", False, "getHeaderNames", "()", "", "ReturnValue", "remote", "manual"]
25+
- ["javax.servlet.http", "Part", False, "getHeaders", "(String)", "", "ReturnValue", "remote", "manual"]
26+
- ["javax.servlet.http", "Part", False, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
27+
- ["javax.servlet.http", "Part", False, "getName", "()", "", "ReturnValue", "remote", "manual"]
28+
- ["javax.servlet.http", "Part", False, "getSubmittedFileName", "()", "", "ReturnValue", "remote", "manual"]
29+
2230

2331
- addsTo:
2432
pack: codeql/java-all

‎java/ql/lib/ext/org.apache.commons.fileupload.model.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sourceModel
5+
data:
6+
- ["org.apache.commons.fileupload", "FileItem", True, "get", "()", "", "ReturnValue", "remote", "manual"]
7+
- ["org.apache.commons.fileupload", "FileItem", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
8+
- ["org.apache.commons.fileupload", "FileItem", True, "getFieldName", "()", "", "ReturnValue", "remote", "manual"]
9+
- ["org.apache.commons.fileupload", "FileItem", True, "getInputStream", "()", "", "ReturnValue", "remote", "manual"]
10+
- ["org.apache.commons.fileupload", "FileItem", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
11+
- ["org.apache.commons.fileupload", "FileItem", True, "getString", "()", "", "ReturnValue", "remote", "manual"]
12+
- ["org.apache.commons.fileupload", "FileItem", True, "getString", "(String)", "", "ReturnValue", "remote", "manual"]
13+
- ["org.apache.commons.fileupload", "FileItemStream", True, "getContentType", "()", "", "ReturnValue", "remote", "manual"]
14+
- ["org.apache.commons.fileupload", "FileItemStream", True, "getFieldName", "()", "", "ReturnValue", "remote", "manual"]
15+
- ["org.apache.commons.fileupload", "FileItemStream", True, "getName", "()", "", "ReturnValue", "remote", "manual"]
16+
- ["org.apache.commons.fileupload", "FileItemStream", True, "openStream", "()", "", "ReturnValue", "remote", "manual"]

‎java/ql/lib/ext/org.apache.commons.fileupload.util.model.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["org.apache.commons.fileupload.util", "Streams", True, "asString", "(InputStream)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
7+
- ["org.apache.commons.fileupload.util", "Streams", True, "asString", "(InputStream,String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8+
- ["org.apache.commons.fileupload.util", "Streams", True, "copy", "(InputStream,OutputStream,boolean)", "", "Argument[0]", "Argument[1]", "taint", "manual"]
9+
- ["org.apache.commons.fileupload.util", "Streams", True, "copy", "(InputStream,OutputStream,boolean,byte[])", "", "Argument[0]", "Argument[1]", "taint", "manual"]

‎java/ql/test/library-tests/dataflow/taintsources/FileUpload.java‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
import javax.servlet.http.HttpServletRequest;
2+
import javax.servlet.http.HttpServletResponse;
3+
import org.apache.commons.fileupload.FileItem;
4+
import org.apache.commons.fileupload.FileItemStream;
5+
import org.apache.commons.fileupload.servlet.ServletFileUpload;
6+
7+
public class FileUpload {
8+
9+
private HttpServletRequest request;
10+
private HttpServletResponse response;
11+
private javax.servlet.http.Part filePart;
12+
private FileItem fileItem;
13+
private FileItemStream fileItemStream;
14+
private jakarta.servlet.http.Part jakartaPart;
15+
private ServletFileUpload servletFileUpload;
16+
17+
private static void sink(Object o) {}
18+
19+
public void test() throws Exception {
20+
sink(filePart.getContentType()); // $ hasRemoteValueFlow
21+
sink(filePart.getHeader("test")); // $ hasRemoteValueFlow
22+
sink(filePart.getHeaderNames()); // $ hasRemoteValueFlow
23+
sink(filePart.getHeaders("test")); // $ hasRemoteValueFlow
24+
sink(filePart.getInputStream()); // $ hasRemoteValueFlow
25+
sink(filePart.getName()); // $ hasRemoteValueFlow
26+
sink(filePart.getSubmittedFileName()); // $ hasRemoteValueFlow
27+
28+
sink(fileItem.get()); // $ hasRemoteValueFlow
29+
sink(fileItem.getContentType()); // $ hasRemoteValueFlow
30+
sink(fileItem.getFieldName()); // $ hasRemoteValueFlow
31+
sink(fileItem.getInputStream()); // $ hasRemoteValueFlow
32+
sink(fileItem.getName()); // $ hasRemoteValueFlow
33+
sink(fileItem.getName()); // $ hasRemoteValueFlow
34+
sink(fileItem.getString()); // $ hasRemoteValueFlow
35+
36+
sink(fileItemStream.getContentType()); // $ hasRemoteValueFlow
37+
sink(fileItemStream.getFieldName()); // $ hasRemoteValueFlow
38+
sink(fileItemStream.getName()); // $ hasRemoteValueFlow
39+
sink(fileItemStream.openStream()); // $ hasRemoteValueFlow
40+
41+
sink(jakartaPart.getContentType()); // $ hasRemoteValueFlow
42+
sink(jakartaPart.getHeader("test")); // $ hasRemoteValueFlow
43+
sink(jakartaPart.getHeaderNames()); // $ hasRemoteValueFlow
44+
sink(jakartaPart.getHeaders("test")); // $ hasRemoteValueFlow
45+
sink(jakartaPart.getInputStream()); // $ hasRemoteValueFlow
46+
sink(jakartaPart.getName()); // $ hasRemoteValueFlow
47+
sink(jakartaPart.getSubmittedFileName()); // $ hasRemoteValueFlow
48+
49+
FileItem item = servletFileUpload.parseRequest(request).get(0);
50+
sink(item.getName()); // $ hasRemoteValueFlow
51+
}
52+
}

‎java/ql/test/library-tests/dataflow/taintsources/options‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.12:${testdir}/../../../stubs/jackson-core-2.12:${testdir}/../../../stubs/akka-2.6.x:${testdir}/../../../stubs/jwtk-jjwt-0.11.2:${testdir}/../../../stubs/jenkins:${testdir}/../../../stubs/stapler-1.263
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jakarta.servlet-api-6.0.0:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jackson-databind-2.12:${testdir}/../../../stubs/jackson-core-2.12:${testdir}/../../../stubs/akka-2.6.x:${testdir}/../../../stubs/jwtk-jjwt-0.11.2:${testdir}/../../../stubs/jenkins:${testdir}/../../../stubs/stapler-1.263

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/Test.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package com.mycompany.app;
2+
3+
import org.apache.commons.fileupload.util.Streams;
4+
import java.io.InputStream;
5+
import java.io.OutputStream;
6+
import java.io.ByteArrayOutputStream;
7+
8+
// Test case generated by GenerateFlowTestCase.ql
9+
public class Test {
10+
11+
Object source() {
12+
return null;
13+
}
14+
15+
void sink(Object o) {
16+
}
17+
18+
public void test() throws Exception {
19+
20+
{
21+
InputStream in = (InputStream)source();
22+
OutputStream os = new ByteArrayOutputStream(1024);
23+
24+
InputStream in2 = (InputStream)source();
25+
OutputStream os2 = new ByteArrayOutputStream(1024);
26+
27+
byte[] myArray = new byte[1024];
28+
29+
// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean,byte[]);;Argument[0];Argument[1];taint;manual"
30+
long status = Streams.copy(in, os, true, myArray);
31+
sink(os); // $ hasTaintFlow
32+
// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean);;Argument[0];Argument[1];taint;manual"
33+
long status2 = Streams.copy(in2, os2, true);
34+
sink(os2); // $ hasTaintFlow
35+
}
36+
37+
}
38+
public void test2() throws Exception {
39+
40+
{
41+
42+
InputStream in = (InputStream)source();
43+
// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
44+
String result = Streams.asString(in);
45+
sink(result); // $ hasTaintFlow
46+
47+
InputStream in1 = (InputStream)source();
48+
// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
49+
String result1 = Streams.asString(in1, "test");
50+
sink(result1); // $ hasTaintFlow
51+
}
52+
53+
}
54+
55+
}

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-fileupload-1.4

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.expected‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
models
2+
| 1 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream); ; Argument[0]; ReturnValue; taint; manual |
3+
| 2 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream,String); ; Argument[0]; ReturnValue; taint; manual |
4+
| 3 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean); ; Argument[0]; Argument[1]; taint; manual |
5+
| 4 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean,byte[]); ; Argument[0]; Argument[1]; taint; manual |
6+
edges
7+
| Test.java:21:30:21:50 | (...)... : InputStream | Test.java:30:31:30:32 | in : InputStream | provenance | |
8+
| Test.java:21:43:21:50 | source(...) : Object | Test.java:21:30:21:50 | (...)... : InputStream | provenance | |
9+
| Test.java:24:22:24:42 | (...)... : InputStream | Test.java:33:32:33:34 | in2 : InputStream | provenance | |
10+
| Test.java:24:35:24:42 | source(...) : Object | Test.java:24:22:24:42 | (...)... : InputStream | provenance | |
11+
| Test.java:30:31:30:32 | in : InputStream | Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | provenance | MaD:4 |
12+
| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | Test.java:31:9:31:10 | os | provenance | |
13+
| Test.java:33:32:33:34 | in2 : InputStream | Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | provenance | MaD:3 |
14+
| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | Test.java:34:9:34:11 | os2 | provenance | |
15+
| Test.java:42:30:42:50 | (...)... : InputStream | Test.java:44:37:44:38 | in : InputStream | provenance | |
16+
| Test.java:42:43:42:50 | source(...) : Object | Test.java:42:30:42:50 | (...)... : InputStream | provenance | |
17+
| Test.java:44:20:44:39 | asString(...) : String | Test.java:45:9:45:14 | result | provenance | |
18+
| Test.java:44:37:44:38 | in : InputStream | Test.java:44:20:44:39 | asString(...) : String | provenance | MaD:1 |
19+
| Test.java:47:31:47:51 | (...)... : InputStream | Test.java:49:47:49:49 | in1 : InputStream | provenance | |
20+
| Test.java:47:44:47:51 | source(...) : Object | Test.java:47:31:47:51 | (...)... : InputStream | provenance | |
21+
| Test.java:49:30:49:58 | asString(...) : String | Test.java:50:18:50:24 | result1 | provenance | |
22+
| Test.java:49:47:49:49 | in1 : InputStream | Test.java:49:30:49:58 | asString(...) : String | provenance | MaD:2 |
23+
nodes
24+
| Test.java:21:30:21:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
25+
| Test.java:21:43:21:50 | source(...) : Object | semmle.label | source(...) : Object |
26+
| Test.java:24:22:24:42 | (...)... : InputStream | semmle.label | (...)... : InputStream |
27+
| Test.java:24:35:24:42 | source(...) : Object | semmle.label | source(...) : Object |
28+
| Test.java:30:31:30:32 | in : InputStream | semmle.label | in : InputStream |
29+
| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | semmle.label | os [post update] : ByteArrayOutputStream |
30+
| Test.java:31:9:31:10 | os | semmle.label | os |
31+
| Test.java:33:32:33:34 | in2 : InputStream | semmle.label | in2 : InputStream |
32+
| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | semmle.label | os2 [post update] : ByteArrayOutputStream |
33+
| Test.java:34:9:34:11 | os2 | semmle.label | os2 |
34+
| Test.java:42:30:42:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
35+
| Test.java:42:43:42:50 | source(...) : Object | semmle.label | source(...) : Object |
36+
| Test.java:44:20:44:39 | asString(...) : String | semmle.label | asString(...) : String |
37+
| Test.java:44:37:44:38 | in : InputStream | semmle.label | in : InputStream |
38+
| Test.java:45:9:45:14 | result | semmle.label | result |
39+
| Test.java:47:31:47:51 | (...)... : InputStream | semmle.label | (...)... : InputStream |
40+
| Test.java:47:44:47:51 | source(...) : Object | semmle.label | source(...) : Object |
41+
| Test.java:49:30:49:58 | asString(...) : String | semmle.label | asString(...) : String |
42+
| Test.java:49:47:49:49 | in1 : InputStream | semmle.label | in1 : InputStream |
43+
| Test.java:50:18:50:24 | result1 | semmle.label | result1 |
44+
subpaths
45+
testFailures

0 commit comments

Comments
 (0)