Skip to content

Commit 161e756

Browse files
aschackmullaschackmull
authored
Merge pull request github#5141 from github/yo-h/java-flow-check-fix
Java: prepare to enforce additional compiler checks in test code
2 parents 178c54e + 1d007b6 commit 161e756

File tree

53 files changed

+166
-159
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+166
-159
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ public X509Certificate[] getAcceptedIssuers() {
8787
/**
8888
* Test the endpoint identification of SSL engine is set to null
8989
*/
90-
public void testSSLEngineEndpointIdSetNull() {
90+
public void testSSLEngineEndpointIdSetNull() throws java.security.NoSuchAlgorithmException {
9191
SSLContext sslContext = SSLContext.getInstance("TLS");
9292
SSLEngine sslEngine = sslContext.createSSLEngine();
9393
SSLParameters sslParameters = sslEngine.getSSLParameters();
@@ -98,15 +98,15 @@ public void testSSLEngineEndpointIdSetNull() {
9898
/**
9999
* Test the endpoint identification of SSL engine is not set
100100
*/
101-
public void testSSLEngineEndpointIdNotSet() {
101+
public void testSSLEngineEndpointIdNotSet() throws java.security.NoSuchAlgorithmException {
102102
SSLContext sslContext = SSLContext.getInstance("TLS");
103103
SSLEngine sslEngine = sslContext.createSSLEngine();
104104
}
105105

106106
/**
107107
* Test the endpoint identification of SSL socket is not set
108108
*/
109-
public void testSSLSocketEndpointIdNotSet() {
109+
public void testSSLSocketEndpointIdNotSet() throws java.security.NoSuchAlgorithmException, java.io.IOException {
110110
SSLContext sslContext = SSLContext.getInstance("TLS");
111111
final SSLSocketFactory socketFactory = sslContext.getSocketFactory();
112112
SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443);
@@ -115,7 +115,7 @@ public void testSSLSocketEndpointIdNotSet() {
115115
/**
116116
* Test the endpoint identification of regular socket is not set
117117
*/
118-
public void testSocketEndpointIdNotSet() {
118+
public void testSocketEndpointIdNotSet() throws java.io.IOException {
119119
SocketFactory socketFactory = SocketFactory.getDefault();
120120
Socket socket = socketFactory.createSocket("www.example.com", 80);
121121
}
@@ -127,4 +127,4 @@ public void testSocketEndpointIdNotSet() {
127127
// ConnectionFactory connectionFactory = new ConnectionFactory();
128128
// connectionFactory.useSslProtocol();
129129
// }
130-
}
130+
}

‎java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ protected PasswordAuthentication getPasswordAuthentication() {
2929
final Session session = Session.getInstance(properties, authenticator);
3030
}
3131

32-
public void testSimpleMail() {
32+
public void testSimpleMail() throws Exception {
3333
Email email = new SimpleEmail();
3434
email.setHostName("config.hostName");
3535
email.setSmtpPort(25);
@@ -42,4 +42,4 @@ public void testSimpleMail() {
4242
email.addTo("toAddress");
4343
email.send();
4444
}
45-
}
45+
}

‎java/ql/test/experimental/query-tests/security/CWE-312/CleartextStorageSharedPrefs.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ public void testSetSharedPrefs1(Context context, String name, String password) {
2020
}
2121

2222
// GOOD - save sensitive information in encrypted format
23-
public void testSetSharedPrefs2(Context context, String name, String password) {
23+
public void testSetSharedPrefs2(Context context, String name, String password) throws Exception {
2424
SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
2525
Editor editor = sharedPrefs.edit();
2626
editor.putString("name", encrypt(name));
2727
editor.putString("password", encrypt(password));
2828
editor.commit();
2929
}
3030

31-
private static String encrypt(String cleartext) {
31+
private static String encrypt(String cleartext) throws Exception {
3232
// Use an encryption or hashing algorithm in real world. The demo below just returns its hash.
3333
MessageDigest digest = MessageDigest.getInstance("SHA-256");
3434
byte[] hash = digest.digest(cleartext.getBytes(StandardCharsets.UTF_8));
@@ -37,7 +37,7 @@ private static String encrypt(String cleartext) {
3737
}
3838

3939
// GOOD - save sensitive information in encrypted format using separate variables
40-
public void testSetSharedPrefs3(Context context, String name, String password) {
40+
public void testSetSharedPrefs3(Context context, String name, String password) throws Exception {
4141
String encUsername = encrypt(name);
4242
String encPassword = encrypt(password);
4343
SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
@@ -49,7 +49,7 @@ public void testSetSharedPrefs3(Context context, String name, String password) {
4949

5050

5151
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
52-
public void testSetSharedPrefs4(Context context, String name, String password) {
52+
public void testSetSharedPrefs4(Context context, String name, String password) throws Exception {
5353
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
5454
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
5555
.build();
@@ -69,7 +69,7 @@ public void testSetSharedPrefs4(Context context, String name, String password) {
6969
}
7070

7171
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
72-
public void testSetSharedPrefs5(Context context, String name, String password) {
72+
public void testSetSharedPrefs5(Context context, String name, String password) throws Exception {
7373
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
7474
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
7575
.build();
@@ -89,7 +89,7 @@ public void testSetSharedPrefs5(Context context, String name, String password) {
8989
}
9090

9191
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
92-
public void testSetSharedPrefs6(Context context, String name, String password) {
92+
public void testSetSharedPrefs6(Context context, String name, String password) throws Exception {
9393
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
9494
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
9595
.build();

‎java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
import javax.crypto.KeyGenerator;
44

55
public class InsufficientKeySize {
6-
public void CryptoMethod() {
6+
public void CryptoMethod() throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
77
KeyGenerator keyGen1 = KeyGenerator.getInstance("AES");
88
// BAD: Key size is less than 128
99
keyGen1.init(64);

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public void testApacheHttpRequest3(String username, String password) {
5757
/**
5858
* Test basic authentication with Apache HTTP POST request using the URI constructor with one argument.
5959
*/
60-
public void testApacheHttpRequest4(String username, String password) {
60+
public void testApacheHttpRequest4(String username, String password) throws Exception {
6161
String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
6262
URI uri = new URI(uriStr);
6363
HttpRequestBase post = new HttpPost(uri);
@@ -74,7 +74,7 @@ public void testApacheHttpRequest4(String username, String password) {
7474
/**
7575
* Test basic authentication with Apache HTTP POST request using a URI constructor with multiple arguments.
7676
*/
77-
public void testApacheHttpRequest5(String username, String password) {
77+
public void testApacheHttpRequest5(String username, String password) throws Exception {
7878
HttpRequestBase post = new HttpPost(new URI("http", "www.example.com", "/test", "abc=123", null));
7979
post.setHeader("Accept", "application/json");
8080
post.setHeader("Content-type", "application/json");
@@ -122,7 +122,7 @@ public void testApacheHttpRequest7(String username, String password) {
122122
/**
123123
* Test basic authentication with Java HTTP URL connection using the `URL(String spec)` constructor.
124124
*/
125-
public void testHttpUrlConnection(String username, String password) {
125+
public void testHttpUrlConnection(String username, String password) throws Exception {
126126
String urlStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
127127
String authString = username + ":" + password;
128128
String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
@@ -136,7 +136,7 @@ public void testHttpUrlConnection(String username, String password) {
136136
/**
137137
* Test basic authentication with Java HTTP URL connection using the `URL(String protocol, String host, String file)` constructor.
138138
*/
139-
public void testHttpUrlConnection2(String username, String password) {
139+
public void testHttpUrlConnection2(String username, String password) throws Exception {
140140
String host = "www.example.com";
141141
String path = "/rest/getuser.do?uid=abcdx";
142142
String protocol = "http";
@@ -152,7 +152,7 @@ public void testHttpUrlConnection2(String username, String password) {
152152
/**
153153
* Test basic authentication with Java HTTP URL connection using a constructor with private URL.
154154
*/
155-
public void testHttpUrlConnection3(String username, String password) {
155+
public void testHttpUrlConnection3(String username, String password) throws Exception {
156156
String host = "LOCALHOST";
157157
String authString = username + ":" + password;
158158
String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
@@ -161,4 +161,4 @@ public void testHttpUrlConnection3(String username, String password) {
161161
conn.setDoOutput(true);
162162
conn.setRequestProperty("Authorization", "Basic " + encoding);
163163
}
164-
}
164+
}

‎java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
public class InsecureLdapAuth {
99
// BAD - Test LDAP authentication in cleartext using `DirContext`.
10-
public void testCleartextLdapAuth(String ldapUserName, String password) {
10+
public void testCleartextLdapAuth(String ldapUserName, String password) throws Exception {
1111
String ldapUrl = "ldap://ad.your-server.com:389";
1212
Hashtable<String, String> environment = new Hashtable<String, String>();
1313
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -21,7 +21,7 @@ public void testCleartextLdapAuth(String ldapUserName, String password) {
2121
}
2222

2323
// BAD - Test LDAP authentication in cleartext using `DirContext`.
24-
public void testCleartextLdapAuth(String ldapUserName, String password, String serverName) {
24+
public void testCleartextLdapAuth(String ldapUserName, String password, String serverName) throws Exception {
2525
String ldapUrl = "ldap://"+serverName+":389";
2626
Hashtable<String, String> environment = new Hashtable<String, String>();
2727
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -35,7 +35,7 @@ public void testCleartextLdapAuth(String ldapUserName, String password, String s
3535
}
3636

3737
// GOOD - Test LDAP authentication over SSL.
38-
public void testSslLdapAuth(String ldapUserName, String password) {
38+
public void testSslLdapAuth(String ldapUserName, String password) throws Exception {
3939
String ldapUrl = "ldaps://ad.your-server.com:636";
4040
Hashtable<String, String> environment = new Hashtable<String, String>();
4141
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -49,7 +49,7 @@ public void testSslLdapAuth(String ldapUserName, String password) {
4949
}
5050

5151
// GOOD - Test LDAP authentication over SSL.
52-
public void testSslLdapAuth2(String ldapUserName, String password) {
52+
public void testSslLdapAuth2(String ldapUserName, String password) throws Exception {
5353
String ldapUrl = "ldap://ad.your-server.com:636";
5454
Hashtable<String, String> environment = new Hashtable<String, String>();
5555
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -64,7 +64,7 @@ public void testSslLdapAuth2(String ldapUserName, String password) {
6464
}
6565

6666
// GOOD - Test LDAP authentication with SASL authentication.
67-
public void testSaslLdapAuth(String ldapUserName, String password) {
67+
public void testSaslLdapAuth(String ldapUserName, String password) throws Exception {
6868
String ldapUrl = "ldap://ad.your-server.com:389";
6969
Hashtable<String, String> environment = new Hashtable<String, String>();
7070
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -78,7 +78,7 @@ public void testSaslLdapAuth(String ldapUserName, String password) {
7878
}
7979

8080
// GOOD - Test LDAP authentication in cleartext connecting to local LDAP server.
81-
public void testCleartextLdapAuth2(String ldapUserName, String password) {
81+
public void testCleartextLdapAuth2(String ldapUserName, String password) throws Exception {
8282
String ldapUrl = "ldap://localhost:389";
8383
Hashtable<String, String> environment = new Hashtable<String, String>();
8484
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -92,7 +92,7 @@ public void testCleartextLdapAuth2(String ldapUserName, String password) {
9292
}
9393

9494
// BAD - Test LDAP authentication in cleartext using `InitialLdapContext`.
95-
public void testCleartextLdapAuth3(String ldapUserName, String password) {
95+
public void testCleartextLdapAuth3(String ldapUserName, String password) throws Exception {
9696
String ldapUrl = "ldap://ad.your-server.com:389";
9797
Hashtable<String, String> environment = new Hashtable<String, String>();
9898
environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -107,7 +107,7 @@ public void testCleartextLdapAuth3(String ldapUserName, String password) {
107107

108108

109109
// BAD - Test LDAP authentication in cleartext using `DirContext` and string literals.
110-
public void testCleartextLdapAuth4(String ldapUserName, String password) {
110+
public void testCleartextLdapAuth4(String ldapUserName, String password) throws Exception {
111111
String ldapUrl = "ldap://ad.your-server.com:389";
112112
Hashtable<String, String> environment = new Hashtable<String, String>();
113113
environment.put("java.naming.factory.initial",
@@ -131,7 +131,7 @@ private void setBasicAuth(Hashtable env, String ldapUserName, String password) {
131131
}
132132

133133
// GOOD - Test LDAP authentication with `ssl` configuration and basic authentication.
134-
public void testCleartextLdapAuth5(String ldapUserName, String password, String serverName) {
134+
public void testCleartextLdapAuth5(String ldapUserName, String password, String serverName) throws Exception {
135135
String ldapUrl = "ldap://"+serverName+":389";
136136
Hashtable<String, String> environment = new Hashtable<String, String>();
137137
setSSL(environment);
@@ -143,7 +143,7 @@ public void testCleartextLdapAuth5(String ldapUserName, String password, String
143143
}
144144

145145
// BAD - Test LDAP authentication with basic authentication.
146-
public void testCleartextLdapAuth6(String ldapUserName, String password, String serverName) {
146+
public void testCleartextLdapAuth6(String ldapUserName, String password, String serverName) throws Exception {
147147
String ldapUrl = "ldap://"+serverName+":389";
148148
Hashtable<String, String> environment = new Hashtable<String, String>();
149149
environment.put(Context.INITIAL_CONTEXT_FACTORY,

‎java/ql/test/experimental/query-tests/security/CWE-918/SpringSSRF.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ protected void doGet(HttpServletRequest request2, HttpServletResponse response2)
2626
String fooResourceUrl = request2.getParameter("uri");;
2727
RestTemplate restTemplate = new RestTemplate();
2828
HttpEntity<String> request = new HttpEntity<>(new String("bar"));
29-
29+
try {
3030
{
3131
ResponseEntity<String> response =
3232
restTemplate.getForEntity(fooResourceUrl + "/1", String.class);
@@ -68,5 +68,6 @@ protected void doGet(HttpServletRequest request2, HttpServletResponse response2)
6868
{
6969
restTemplate.put(fooResourceUrl, new String("object"));
7070
}
71+
} catch (org.springframework.web.client.RestClientException | java.net.URISyntaxException e) {}
7172
}
7273
}

‎java/ql/test/library-tests/ExternalProcess/Test.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,28 +43,28 @@ void exec(String command) {
4343
new Bogus().exec("Irrelevant version of exec");
4444
}
4545

46-
void apacheExecute1() {
46+
void apacheExecute1() throws IOException {
4747
String line = "AcroRd32.exe /p /h some.file";
4848
CommandLine cmdLine = CommandLine.parse(line);
4949
DefaultExecutor executor = new DefaultExecutor();
5050
int exitValue = executor.execute(cmdLine);
5151
}
5252

53-
void apacheExecute2() {
53+
void apacheExecute2() throws IOException {
5454
String line = "AcroRd32.exe /p /h some.file";
5555
CommandLine cmdLine = CommandLine.parse(line, null);
5656
DefaultExecutor executor = new DefaultExecutor();
5757
int exitValue = executor.execute(cmdLine);
5858
}
5959

60-
void apacheExecute3() {
60+
void apacheExecute3() throws IOException {
6161
CommandLine cmdLine = new CommandLine("AcroRd32.exe");
6262
cmdLine.addArguments("/p /h some.file");
6363
DefaultExecutor executor = new DefaultExecutor();
6464
int exitValue = executor.execute(cmdLine);
6565
}
6666

67-
void apacheExecute4() {
67+
void apacheExecute4() throws IOException {
6868
CommandLine cmdLine = new CommandLine("AcroRd32.exe");
6969
cmdLine.addArguments("/p /h some.file", false);
7070
DefaultExecutor executor = new DefaultExecutor();

‎java/ql/test/library-tests/RelativePaths/Test.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
class Test {
2-
public static void main(String[] args) {
2+
public static void main(String[] args) throws java.io.IOException {
33
// Relative paths
44
Runtime.getRuntime().exec("make");
55
Runtime.getRuntime().exec("m");

‎java/ql/test/library-tests/commentedcode/CommentedCode.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@ public static int method(){
8888
* &nbsp ;
8989
* &nbsp ;
9090
*/
91+
return -1;
9192
}
92-
9393
// public static int commentedOutMethod(){
9494
//
9595
// return 123;

0 commit comments

Comments
 (0)