Replace stringbuilder step with model

Author: Benjamin Muskalla

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -147,8 +147,6 @@ private predicate localAdditionalTaintExprStep(Expr src, Expr sink) {
   or
   comparisonStep(src, sink)
   or
-  stringBuilderStep(src, sink)
-  or
   serializationStep(src, sink)
   or
   formatStep(src, sink)
@@ -392,15 +390,6 @@ private predicate comparisonStep(Expr tracked, Expr sink) {
   )
 }
 
-/** Flow through a `StringBuilder`. */
-private predicate stringBuilderStep(Expr tracked, Expr sink) {
-  exists(StringBuilderVar sbvar, MethodAccess input, int arg |
-    input = sbvar.getAnInput(arg) and
-    tracked = input.getArgument(arg) and
-    sink = sbvar.getToStringCall()
-  )
-}
-
 /** Flow through data serialization. */
 private predicate serializationStep(Expr tracked, Expr sink) {
   exists(ObjectOutputStreamVar v, VariableAssign def |

java/ql/src/semmle/code/java/frameworks/Strings.qll

@@ -43,9 +43,12 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.io;StringWriter;true;write;;;Argument[0];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;AbstractStringBuilder;(String);;Argument[0];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;append;;;Argument[0];Argument[-1];taint",
-        "java.lang;AbstractStringBuilder;true;append;;;Argument[-1];ReturnValue;taint",
+        "java.lang;AbstractStringBuilder;true;append;;;Argument[-1];ReturnValue;value",
+        "java.lang;AbstractStringBuilder;true;append;;;Argument[0];ReturnValue;taint",
         "java.lang;AbstractStringBuilder;true;insert;;;Argument[1];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;insert;;;Argument[-1];ReturnValue;taint",
+        "java.lang;AbstractStringBuilder;true;replace;;;Argument[2];ReturnValue;taint",
+        "java.lang;AbstractStringBuilder;true;replace;;;Argument[2];Argument[-1];taint",
         "java.lang;AbstractStringBuilder;true;toString;;;Argument[-1];ReturnValue;taint",
         "java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint",
         "java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint",

java/ql/test/experimental/query-tests/security/CWE-601/SpringUrlRedirect.expected

@@ -5,8 +5,11 @@ edges
 | SpringUrlRedirect.java:36:30:36:47 | redirectUrl : String | SpringUrlRedirect.java:37:47:37:57 | redirectUrl |
 | SpringUrlRedirect.java:41:24:41:41 | redirectUrl : String | SpringUrlRedirect.java:44:29:44:39 | redirectUrl |
 | SpringUrlRedirect.java:49:24:49:41 | redirectUrl : String | SpringUrlRedirect.java:52:30:52:40 | redirectUrl |
-| SpringUrlRedirect.java:57:24:57:41 | redirectUrl : String | SpringUrlRedirect.java:58:30:58:66 | format(...) |
-| SpringUrlRedirect.java:62:24:62:41 | redirectUrl : String | SpringUrlRedirect.java:63:30:63:76 | format(...) |
+| SpringUrlRedirect.java:57:24:57:41 | redirectUrl : String | SpringUrlRedirect.java:58:55:58:65 | redirectUrl : String |
+| SpringUrlRedirect.java:58:30:58:66 | new ..[] { .. } [[]] : String | SpringUrlRedirect.java:58:30:58:66 | format(...) |
+| SpringUrlRedirect.java:58:55:58:65 | redirectUrl : String | SpringUrlRedirect.java:58:30:58:66 | new ..[] { .. } [[]] : String |
+| SpringUrlRedirect.java:62:24:62:41 | redirectUrl : String | SpringUrlRedirect.java:63:44:63:68 | ... + ... : String |
+| SpringUrlRedirect.java:63:44:63:68 | ... + ... : String | SpringUrlRedirect.java:63:30:63:76 | format(...) |
 | SpringUrlRedirect.java:89:38:89:55 | redirectUrl : String | SpringUrlRedirect.java:91:38:91:48 | redirectUrl : String |
 | SpringUrlRedirect.java:91:38:91:48 | redirectUrl : String | SpringUrlRedirect.java:91:27:91:49 | create(...) |
 | SpringUrlRedirect.java:96:39:96:56 | redirectUrl : String | SpringUrlRedirect.java:98:44:98:54 | redirectUrl : String |
@@ -45,8 +48,11 @@ nodes
 | SpringUrlRedirect.java:52:30:52:40 | redirectUrl | semmle.label | redirectUrl |
 | SpringUrlRedirect.java:57:24:57:41 | redirectUrl : String | semmle.label | redirectUrl : String |
 | SpringUrlRedirect.java:58:30:58:66 | format(...) | semmle.label | format(...) |
+| SpringUrlRedirect.java:58:30:58:66 | new ..[] { .. } [[]] : String | semmle.label | new ..[] { .. } [[]] : String |
+| SpringUrlRedirect.java:58:55:58:65 | redirectUrl : String | semmle.label | redirectUrl : String |
 | SpringUrlRedirect.java:62:24:62:41 | redirectUrl : String | semmle.label | redirectUrl : String |
 | SpringUrlRedirect.java:63:30:63:76 | format(...) | semmle.label | format(...) |
+| SpringUrlRedirect.java:63:44:63:68 | ... + ... : String | semmle.label | ... + ... : String |
 | SpringUrlRedirect.java:89:38:89:55 | redirectUrl : String | semmle.label | redirectUrl : String |
 | SpringUrlRedirect.java:91:27:91:49 | create(...) | semmle.label | create(...) |
 | SpringUrlRedirect.java:91:38:91:48 | redirectUrl : String | semmle.label | redirectUrl : String |