Skip to content

Commit 25a0e09

Browse files
smowtonsmowton
committed
Convert StringUtils models to CSV
1 parent 1beac06 commit 25a0e09

File tree

1 file changed

+144
-52
lines changed
  • java/ql/src/semmle/code/java/frameworks/apache

1 file changed

+144
-52
lines changed

‎java/ql/src/semmle/code/java/frameworks/apache/Lang.qll

Lines changed: 144 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -70,58 +70,150 @@ private class ApacheArrayUtilsModel extends SummaryModelCsv {
7070
}
7171
}
7272

73-
private Type getAnExcludedParameterType() {
74-
result instanceof PrimitiveType or
75-
result.(RefType).hasQualifiedName("java.nio.charset", "Charset") or
76-
result.(RefType).hasQualifiedName("java.util", "Locale")
77-
}
78-
79-
private class ApacheStringUtilsTaintPreservingMethod extends TaintPreservingCallable {
80-
ApacheStringUtilsTaintPreservingMethod() {
81-
this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "StringUtils") and
82-
this.hasName([
83-
"abbreviate", "abbreviateMiddle", "appendIfMissing", "appendIfMissingIgnoreCase",
84-
"capitalize", "center", "chomp", "chop", "defaultIfBlank", "defaultIfEmpty",
85-
"defaultString", "deleteWhitespace", "difference", "firstNonBlank", "firstNonEmpty",
86-
"getBytes", "getCommonPrefix", "getDigits", "getIfBlank", "getIfEmpty", "join", "joinWith",
87-
"left", "leftPad", "lowerCase", "mid", "normalizeSpace", "overlay", "prependIfMissing",
88-
"prependIfMissingIgnoreCase", "remove", "removeAll", "removeEnd", "removeEndIgnoreCase",
89-
"removeFirst", "removeIgnoreCase", "removePattern", "removeStart", "removeStartIgnoreCase",
90-
"repeat", "replace", "replaceAll", "replaceChars", "replaceEach", "replaceEachRepeatedly",
91-
"replaceFirst", "replaceIgnoreCase", "replaceOnce", "replaceOnceIgnoreCase",
92-
"replacePattern", "reverse", "reverseDelimited", "right", "rightPad", "rotate", "split",
93-
"splitByCharacterType", "splitByCharacterTypeCamelCase", "splitByWholeSeparator",
94-
"splitByWholeSeparatorPreserveAllTokens", "splitPreserveAllTokens", "strip", "stripAccents",
95-
"stripAll", "stripEnd", "stripStart", "stripToEmpty", "stripToNull", "substring",
96-
"substringAfter", "substringAfterLast", "substringBefore", "substringBeforeLast",
97-
"substringBetween", "substringsBetween", "swapCase", "toCodePoints", "toEncodedString",
98-
"toRootLowerCase", "toRootUpperCase", "toString", "trim", "trimToEmpty", "trimToNull",
99-
"truncate", "uncapitalize", "unwrap", "upperCase", "valueOf", "wrap", "wrapIfMissing"
100-
])
101-
}
102-
103-
private predicate isExcludedParameter(int arg) {
104-
this.getName().matches(["appendIfMissing%", "prependIfMissing%"]) and arg = [2, 3]
105-
or
106-
this.getName().matches(["remove%", "split%", "substring%", "strip%"]) and
107-
arg = [1 .. getNumberOfParameters() - 1]
108-
or
109-
this.getName().matches(["chomp", "getBytes", "replace%", "toString", "unwrap"]) and arg = 1
110-
or
111-
this.getName() = "join" and
112-
// Exclude joins of types that render numerically (char[] and non-primitive arrays
113-
// are still considered taint sources)
114-
exists(PrimitiveType pt |
115-
this.getParameterType(arg).(Array).getComponentType() = pt and
116-
not pt instanceof CharacterType
117-
) and
118-
arg = 0
119-
}
120-
121-
override predicate returnsTaintFrom(int arg) {
122-
arg = [0 .. getNumberOfParameters() - 1] and
123-
not this.getParameterType(arg) = getAnExcludedParameterType() and
124-
not isExcludedParameter(arg)
73+
private class ApacheStringUtilsModel extends SummaryModelCsv {
74+
override predicate row(string row) {
75+
row =
76+
[
77+
"org.apache.commons.lang3;StringUtils;false;abbreviate;(java.lang.String,java.lang.String,int);;Argument[1];ReturnValue;taint",
78+
"org.apache.commons.lang3;StringUtils;false;abbreviate;(java.lang.String,java.lang.String,int,int);;Argument[1];ReturnValue;taint",
79+
"org.apache.commons.lang3;StringUtils;false;abbreviate;;;Argument[0];ReturnValue;taint",
80+
"org.apache.commons.lang3;StringUtils;false;abbreviateMiddle;;;Argument[0];ReturnValue;taint",
81+
"org.apache.commons.lang3;StringUtils;false;abbreviateMiddle;;;Argument[1];ReturnValue;taint",
82+
"org.apache.commons.lang3;StringUtils;false;appendIfMissing;;;Argument[0];ReturnValue;taint",
83+
"org.apache.commons.lang3;StringUtils;false;appendIfMissing;;;Argument[1];ReturnValue;taint",
84+
"org.apache.commons.lang3;StringUtils;false;appendIfMissingIgnoreCase;;;Argument[0];ReturnValue;taint",
85+
"org.apache.commons.lang3;StringUtils;false;appendIfMissingIgnoreCase;;;Argument[1];ReturnValue;taint",
86+
"org.apache.commons.lang3;StringUtils;false;capitalize;;;Argument;ReturnValue;taint",
87+
"org.apache.commons.lang3;StringUtils;false;center;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
88+
"org.apache.commons.lang3;StringUtils;false;center;;;Argument[0];ReturnValue;taint",
89+
"org.apache.commons.lang3;StringUtils;false;chomp;(java.lang.String);;Argument;ReturnValue;taint",
90+
"org.apache.commons.lang3;StringUtils;false;chomp;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
91+
"org.apache.commons.lang3;StringUtils;false;chop;;;Argument;ReturnValue;taint",
92+
"org.apache.commons.lang3;StringUtils;false;defaultIfBlank;;;Argument;ReturnValue;taint",
93+
"org.apache.commons.lang3;StringUtils;false;defaultIfEmpty;;;Argument;ReturnValue;taint",
94+
"org.apache.commons.lang3;StringUtils;false;defaultString;;;Argument;ReturnValue;taint",
95+
"org.apache.commons.lang3;StringUtils;false;deleteWhitespace;;;Argument;ReturnValue;taint",
96+
"org.apache.commons.lang3;StringUtils;false;difference;;;Argument;ReturnValue;taint",
97+
"org.apache.commons.lang3;StringUtils;false;firstNonBlank;;;Argument;ReturnValue;taint",
98+
"org.apache.commons.lang3;StringUtils;false;firstNonEmpty;;;Argument;ReturnValue;taint",
99+
"org.apache.commons.lang3;StringUtils;false;getBytes;;;Argument[0];ReturnValue;taint",
100+
"org.apache.commons.lang3;StringUtils;false;getCommonPrefix;;;Argument;ReturnValue;taint",
101+
"org.apache.commons.lang3;StringUtils;false;getDigits;;;Argument;ReturnValue;taint",
102+
"org.apache.commons.lang3;StringUtils;false;getIfBlank;;;Argument;ReturnValue;taint",
103+
"org.apache.commons.lang3;StringUtils;false;getIfEmpty;;;Argument;ReturnValue;taint",
104+
"org.apache.commons.lang3;StringUtils;false;join;(char[],char);;Argument[0];ReturnValue;taint",
105+
"org.apache.commons.lang3;StringUtils;false;join;(char[],char,int,int);;Argument[0];ReturnValue;taint",
106+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,char);;Argument[0];ReturnValue;taint",
107+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,java.lang.String);;Argument;ReturnValue;taint",
108+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[]);;Argument;ReturnValue;taint",
109+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char);;Argument[0];ReturnValue;taint",
110+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char,int,int);;Argument[0];ReturnValue;taint",
111+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String);;Argument;ReturnValue;taint",
112+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[0];ReturnValue;taint",
113+
"org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[1];ReturnValue;taint",
114+
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,char);;Argument[0];ReturnValue;taint",
115+
"org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,java.lang.String);;Argument;ReturnValue;taint",
116+
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,char,int,int);;Argument[0];ReturnValue;taint",
117+
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[0];ReturnValue;taint",
118+
"org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[1];ReturnValue;taint",
119+
"org.apache.commons.lang3;StringUtils;false;joinWith;;;Argument;ReturnValue;taint",
120+
"org.apache.commons.lang3;StringUtils;false;left;;;Argument[0];ReturnValue;taint",
121+
"org.apache.commons.lang3;StringUtils;false;leftPad;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
122+
"org.apache.commons.lang3;StringUtils;false;leftPad;;;Argument[0];ReturnValue;taint",
123+
"org.apache.commons.lang3;StringUtils;false;lowerCase;(java.lang.String);;Argument;ReturnValue;taint",
124+
"org.apache.commons.lang3;StringUtils;false;lowerCase;(java.lang.String,java.util.Locale);;Argument[0];ReturnValue;taint",
125+
"org.apache.commons.lang3;StringUtils;false;mid;;;Argument[0];ReturnValue;taint",
126+
"org.apache.commons.lang3;StringUtils;false;normalizeSpace;;;Argument;ReturnValue;taint",
127+
"org.apache.commons.lang3;StringUtils;false;overlay;;;Argument[0];ReturnValue;taint",
128+
"org.apache.commons.lang3;StringUtils;false;overlay;;;Argument[1];ReturnValue;taint",
129+
"org.apache.commons.lang3;StringUtils;false;prependIfMissing;;;Argument[0];ReturnValue;taint",
130+
"org.apache.commons.lang3;StringUtils;false;prependIfMissing;;;Argument[1];ReturnValue;taint",
131+
"org.apache.commons.lang3;StringUtils;false;prependIfMissingIgnoreCase;;;Argument[0];ReturnValue;taint",
132+
"org.apache.commons.lang3;StringUtils;false;prependIfMissingIgnoreCase;;;Argument[1];ReturnValue;taint",
133+
"org.apache.commons.lang3;StringUtils;false;remove;;;Argument[0];ReturnValue;taint",
134+
"org.apache.commons.lang3;StringUtils;false;removeAll;;;Argument[0];ReturnValue;taint",
135+
"org.apache.commons.lang3;StringUtils;false;removeEnd;;;Argument[0];ReturnValue;taint",
136+
"org.apache.commons.lang3;StringUtils;false;removeEndIgnoreCase;;;Argument[0];ReturnValue;taint",
137+
"org.apache.commons.lang3;StringUtils;false;removeFirst;;;Argument[0];ReturnValue;taint",
138+
"org.apache.commons.lang3;StringUtils;false;removeIgnoreCase;;;Argument[0];ReturnValue;taint",
139+
"org.apache.commons.lang3;StringUtils;false;removePattern;;;Argument[0];ReturnValue;taint",
140+
"org.apache.commons.lang3;StringUtils;false;removeStart;;;Argument[0];ReturnValue;taint",
141+
"org.apache.commons.lang3;StringUtils;false;removeStartIgnoreCase;;;Argument[0];ReturnValue;taint",
142+
"org.apache.commons.lang3;StringUtils;false;repeat;(java.lang.String,java.lang.String,int);;Argument[1];ReturnValue;taint",
143+
"org.apache.commons.lang3;StringUtils;false;repeat;;;Argument[0];ReturnValue;taint",
144+
"org.apache.commons.lang3;StringUtils;false;replace;;;Argument[0];ReturnValue;taint",
145+
"org.apache.commons.lang3;StringUtils;false;replace;;;Argument[2];ReturnValue;taint",
146+
"org.apache.commons.lang3;StringUtils;false;replaceAll;;;Argument[0];ReturnValue;taint",
147+
"org.apache.commons.lang3;StringUtils;false;replaceAll;;;Argument[2];ReturnValue;taint",
148+
"org.apache.commons.lang3;StringUtils;false;replaceChars;(java.lang.String,java.lang.String,java.lang.String);;Argument[2];ReturnValue;taint",
149+
"org.apache.commons.lang3;StringUtils;false;replaceChars;;;Argument[0];ReturnValue;taint",
150+
"org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[0];ReturnValue;taint",
151+
"org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[2];ReturnValue;taint",
152+
"org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[0];ReturnValue;taint",
153+
"org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[2];ReturnValue;taint",
154+
"org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[0];ReturnValue;taint",
155+
"org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[2];ReturnValue;taint",
156+
"org.apache.commons.lang3;StringUtils;false;replaceIgnoreCase;;;Argument[0];ReturnValue;taint",
157+
"org.apache.commons.lang3;StringUtils;false;replaceIgnoreCase;;;Argument[2];ReturnValue;taint",
158+
"org.apache.commons.lang3;StringUtils;false;replaceOnce;;;Argument[0];ReturnValue;taint",
159+
"org.apache.commons.lang3;StringUtils;false;replaceOnce;;;Argument[2];ReturnValue;taint",
160+
"org.apache.commons.lang3;StringUtils;false;replaceOnceIgnoreCase;;;Argument[0];ReturnValue;taint",
161+
"org.apache.commons.lang3;StringUtils;false;replaceOnceIgnoreCase;;;Argument[2];ReturnValue;taint",
162+
"org.apache.commons.lang3;StringUtils;false;replacePattern;;;Argument[0];ReturnValue;taint",
163+
"org.apache.commons.lang3;StringUtils;false;replacePattern;;;Argument[2];ReturnValue;taint",
164+
"org.apache.commons.lang3;StringUtils;false;reverse;;;Argument;ReturnValue;taint",
165+
"org.apache.commons.lang3;StringUtils;false;reverseDelimited;;;Argument[0];ReturnValue;taint",
166+
"org.apache.commons.lang3;StringUtils;false;right;;;Argument[0];ReturnValue;taint",
167+
"org.apache.commons.lang3;StringUtils;false;rightPad;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
168+
"org.apache.commons.lang3;StringUtils;false;rightPad;;;Argument[0];ReturnValue;taint",
169+
"org.apache.commons.lang3;StringUtils;false;rotate;;;Argument[0];ReturnValue;taint",
170+
"org.apache.commons.lang3;StringUtils;false;split;(java.lang.String);;Argument;ReturnValue;taint",
171+
"org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,char);;Argument[0];ReturnValue;taint",
172+
"org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
173+
"org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,java.lang.String,int);;Argument[0];ReturnValue;taint",
174+
"org.apache.commons.lang3;StringUtils;false;splitByCharacterType;;;Argument;ReturnValue;taint",
175+
"org.apache.commons.lang3;StringUtils;false;splitByCharacterTypeCamelCase;;;Argument;ReturnValue;taint",
176+
"org.apache.commons.lang3;StringUtils;false;splitByWholeSeparator;;;Argument[0];ReturnValue;taint",
177+
"org.apache.commons.lang3;StringUtils;false;splitByWholeSeparatorPreserveAllTokens;;;Argument[0];ReturnValue;taint",
178+
"org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String);;Argument;ReturnValue;taint",
179+
"org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,char);;Argument[0];ReturnValue;taint",
180+
"org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
181+
"org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,java.lang.String,int);;Argument[0];ReturnValue;taint",
182+
"org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String);;Argument;ReturnValue;taint",
183+
"org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
184+
"org.apache.commons.lang3;StringUtils;false;stripAccents;;;Argument;ReturnValue;taint",
185+
"org.apache.commons.lang3;StringUtils;false;stripAll;;;Argument[0];ReturnValue;taint",
186+
"org.apache.commons.lang3;StringUtils;false;stripEnd;;;Argument[0];ReturnValue;taint",
187+
"org.apache.commons.lang3;StringUtils;false;stripStart;;;Argument[0];ReturnValue;taint",
188+
"org.apache.commons.lang3;StringUtils;false;stripToEmpty;;;Argument;ReturnValue;taint",
189+
"org.apache.commons.lang3;StringUtils;false;stripToNull;;;Argument;ReturnValue;taint",
190+
"org.apache.commons.lang3;StringUtils;false;substring;;;Argument[0];ReturnValue;taint",
191+
"org.apache.commons.lang3;StringUtils;false;substringAfter;;;Argument[0];ReturnValue;taint",
192+
"org.apache.commons.lang3;StringUtils;false;substringAfterLast;;;Argument[0];ReturnValue;taint",
193+
"org.apache.commons.lang3;StringUtils;false;substringBefore;;;Argument[0];ReturnValue;taint",
194+
"org.apache.commons.lang3;StringUtils;false;substringBeforeLast;;;Argument[0];ReturnValue;taint",
195+
"org.apache.commons.lang3;StringUtils;false;substringBetween;;;Argument[0];ReturnValue;taint",
196+
"org.apache.commons.lang3;StringUtils;false;substringsBetween;;;Argument[0];ReturnValue;taint",
197+
"org.apache.commons.lang3;StringUtils;false;swapCase;;;Argument;ReturnValue;taint",
198+
"org.apache.commons.lang3;StringUtils;false;toCodePoints;;;Argument;ReturnValue;taint",
199+
"org.apache.commons.lang3;StringUtils;false;toEncodedString;;;Argument[0];ReturnValue;taint",
200+
"org.apache.commons.lang3;StringUtils;false;toRootLowerCase;;;Argument;ReturnValue;taint",
201+
"org.apache.commons.lang3;StringUtils;false;toRootUpperCase;;;Argument;ReturnValue;taint",
202+
"org.apache.commons.lang3;StringUtils;false;toString;;;Argument[0];ReturnValue;taint",
203+
"org.apache.commons.lang3;StringUtils;false;trim;;;Argument;ReturnValue;taint",
204+
"org.apache.commons.lang3;StringUtils;false;trimToEmpty;;;Argument;ReturnValue;taint",
205+
"org.apache.commons.lang3;StringUtils;false;trimToNull;;;Argument;ReturnValue;taint",
206+
"org.apache.commons.lang3;StringUtils;false;truncate;;;Argument[0];ReturnValue;taint",
207+
"org.apache.commons.lang3;StringUtils;false;uncapitalize;;;Argument;ReturnValue;taint",
208+
"org.apache.commons.lang3;StringUtils;false;unwrap;;;Argument[0];ReturnValue;taint",
209+
"org.apache.commons.lang3;StringUtils;false;upperCase;(java.lang.String);;Argument;ReturnValue;taint",
210+
"org.apache.commons.lang3;StringUtils;false;upperCase;(java.lang.String,java.util.Locale);;Argument[0];ReturnValue;taint",
211+
"org.apache.commons.lang3;StringUtils;false;valueOf;;;Argument;ReturnValue;taint",
212+
"org.apache.commons.lang3;StringUtils;false;wrap;(java.lang.String,char);;Argument[0];ReturnValue;taint",
213+
"org.apache.commons.lang3;StringUtils;false;wrap;(java.lang.String,java.lang.String);;Argument;ReturnValue;taint",
214+
"org.apache.commons.lang3;StringUtils;false;wrapIfMissing;(java.lang.String,char);;Argument[0];ReturnValue;taint",
215+
"org.apache.commons.lang3;StringUtils;false;wrapIfMissing;(java.lang.String,java.lang.String);;Argument;ReturnValue;taint"
216+
]
125217
}
126218
}
127219

0 commit comments

Comments
 (0)