Skip to content

Commit 30cb80b

Browse files
aschackmullaschackmull
authored
Merge pull request github#5181 from smowton/smowton/feature/commons-tostringbuilder
Java: Add models for Commons ToStringBuilder
2 parents 8d7f8a5 + 76091f0 commit 30cb80b

File tree

5 files changed

+442
-0
lines changed

5 files changed

+442
-0
lines changed

‎java/change-notes/2021-03-18-commons-tostring-builder.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added models for Apache Commons Lang's `ToStringBuilder` class. This may lead to more results from any data-flow query where ToStringBuilder operations fall between the relevant untrusted source and vulnerable sink.

‎java/ql/src/semmle/code/java/frameworks/apache/Lang.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,3 +668,29 @@ private class ApacheObjectUtilsModel extends SummaryModelCsv {
668668
]
669669
}
670670
}
671+
672+
private class ApacheToStringBuilderModel extends SummaryModelCsv {
673+
override predicate row(string row) {
674+
row =
675+
[
676+
"org.apache.commons.lang3.builder;ToStringBuilder;false;toString;;;Argument[-1];ReturnValue;taint",
677+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
678+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.Object[]);;ArrayElement of Argument[0];Argument[-1];taint",
679+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0];Argument[-1];taint",
680+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;ArrayElement of Argument[1];Argument[-1];taint",
681+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,boolean);;Argument[0];Argument[-1];taint",
682+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object);;Argument[0..1];Argument[-1];taint",
683+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[],boolean);;Argument[0];Argument[-1];taint",
684+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;(java.lang.String,java.lang.Object[],boolean);;ArrayElement of Argument[1];Argument[-1];taint",
685+
"org.apache.commons.lang3.builder;ToStringBuilder;false;build;;;Argument[-1];ReturnValue;taint",
686+
"org.apache.commons.lang3.builder;ToStringBuilder;false;getStringBuffer;;;Argument[-1];ReturnValue;taint",
687+
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendToString;;;Argument[0];Argument[-1];taint",
688+
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendSuper;;;Argument[0];Argument[-1];taint",
689+
// The following are value-preserving steps for fluent methods:
690+
"org.apache.commons.lang3.builder;ToStringBuilder;false;append;;;Argument[-1];ReturnValue;value",
691+
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendAsObjectToString;;;Argument[-1];ReturnValue;value",
692+
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendSuper;;;Argument[-1];ReturnValue;value",
693+
"org.apache.commons.lang3.builder;ToStringBuilder;false;appendToString;;;Argument[-1];ReturnValue;value"
694+
]
695+
}
696+
}

‎java/ql/test/library-tests/frameworks/apache-commons-lang3/ToStringBuilderTest.java

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
import org.apache.commons.lang3.builder.ToStringBuilder;
2+
3+
class ToStringBuilderTest {
4+
String taint() { return "tainted"; }
5+
6+
void sink(Object o) {}
7+
8+
void test() throws Exception {
9+
10+
ToStringBuilder sb1 = new ToStringBuilder(null); sb1.append((Object)taint()); sink(sb1.toString()); // $hasTaintFlow
11+
ToStringBuilder sb2 = new ToStringBuilder(null); sb2.append(new Object[] { taint() }); sink(sb2.toString()); // $hasTaintFlow
12+
ToStringBuilder sb3 = new ToStringBuilder(null); sb3.append(taint(), true); sink(sb3.toString()); // $hasTaintFlow
13+
ToStringBuilder sb4 = new ToStringBuilder(null); sb4.append("fieldname", taint()); sink(sb4.toString()); // $hasTaintFlow
14+
ToStringBuilder sb5 = new ToStringBuilder(null); sb5.append("fieldname", new Object[] { taint() }); sink(sb5.toString()); // $hasTaintFlow
15+
ToStringBuilder sb6 = new ToStringBuilder(null); sb6.append("fieldname", new Object[] { taint() }, true); sink(sb6.toString()); // $hasTaintFlow
16+
// GOOD: this appends an Object using the Object.toString style, which does not expose fields or String content.
17+
ToStringBuilder sb7 = new ToStringBuilder(null); sb7.appendAsObjectToString(taint()); sink(sb7.toString());
18+
ToStringBuilder sb8 = new ToStringBuilder(null); sb8.appendSuper(taint()); sink(sb8.toString()); // $hasTaintFlow
19+
ToStringBuilder sb9 = new ToStringBuilder(null); sb9.appendToString(taint()); sink(sb9.toString()); // $hasTaintFlow
20+
ToStringBuilder sb10 = new ToStringBuilder(null); sb10.append((Object)taint()); sink(sb10.build()); // $hasTaintFlow
21+
ToStringBuilder sb11 = new ToStringBuilder(null); sb11.append((Object)taint()); sink(sb11.getStringBuffer().toString()); // $hasTaintFlow
22+
23+
// Test fluent methods:
24+
ToStringBuilder fluentTest = new ToStringBuilder(null);
25+
sink(fluentTest.append("Harmless").append(taint()).append("Also harmless").toString()); // $hasTaintFlow
26+
27+
ToStringBuilder fluentBackflowTest = new ToStringBuilder(null);
28+
fluentBackflowTest.append("Harmless").append(taint()).append("Also harmless");
29+
sink(fluentBackflowTest.toString()); // $hasTaintFlow
30+
31+
// Test the case where the fluent method contributing taint is at the end of a statement:
32+
ToStringBuilder fluentBackflowTest2 = new ToStringBuilder(null);
33+
fluentBackflowTest2.append("Harmless").append(taint());
34+
sink(fluentBackflowTest2.toString()); // $hasTaintFlow
35+
36+
}
37+
}

‎java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/builder/ToStringBuilder.java

Lines changed: 275 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,275 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.commons.lang3.builder;
18+
19+
20+
public class ToStringBuilder implements Builder<String> {
21+
public static ToStringStyle getDefaultStyle() {
22+
return null;
23+
}
24+
25+
public static void setDefaultStyle(final ToStringStyle style) {
26+
}
27+
28+
public static String reflectionToString(final Object object) {
29+
return null;
30+
}
31+
32+
public static String reflectionToString(final Object object, final ToStringStyle style) {
33+
return null;
34+
}
35+
36+
public static String reflectionToString(final Object object, final ToStringStyle style, final boolean outputTransients) {
37+
return null;
38+
}
39+
40+
public static <T> String reflectionToString(
41+
final T object,
42+
final ToStringStyle style,
43+
final boolean outputTransients,
44+
final Class<? super T> reflectUpToClass) {
45+
return null;
46+
}
47+
48+
public ToStringBuilder(final Object object) {
49+
}
50+
51+
public ToStringBuilder(final Object object, final ToStringStyle style) {
52+
}
53+
54+
public ToStringBuilder(final Object object, ToStringStyle style, StringBuffer buffer) {
55+
}
56+
57+
public ToStringBuilder append(final boolean value) {
58+
return null;
59+
}
60+
61+
public ToStringBuilder append(final boolean[] array) {
62+
return null;
63+
}
64+
65+
public ToStringBuilder append(final byte value) {
66+
return null;
67+
}
68+
69+
public ToStringBuilder append(final byte[] array) {
70+
return null;
71+
}
72+
73+
public ToStringBuilder append(final char value) {
74+
return null;
75+
}
76+
77+
public ToStringBuilder append(final char[] array) {
78+
return null;
79+
}
80+
81+
public ToStringBuilder append(final double value) {
82+
return null;
83+
}
84+
85+
public ToStringBuilder append(final double[] array) {
86+
return null;
87+
}
88+
89+
public ToStringBuilder append(final float value) {
90+
return null;
91+
}
92+
93+
public ToStringBuilder append(final float[] array) {
94+
return null;
95+
}
96+
97+
public ToStringBuilder append(final int value) {
98+
return null;
99+
}
100+
101+
public ToStringBuilder append(final int[] array) {
102+
return null;
103+
}
104+
105+
public ToStringBuilder append(final long value) {
106+
return null;
107+
}
108+
109+
public ToStringBuilder append(final long[] array) {
110+
return null;
111+
}
112+
113+
public ToStringBuilder append(final Object obj) {
114+
return null;
115+
}
116+
117+
public ToStringBuilder append(final Object[] array) {
118+
return null;
119+
}
120+
121+
public ToStringBuilder append(final short value) {
122+
return null;
123+
}
124+
125+
public ToStringBuilder append(final short[] array) {
126+
return null;
127+
}
128+
129+
public ToStringBuilder append(final String fieldName, final boolean value) {
130+
return null;
131+
}
132+
133+
public ToStringBuilder append(final String fieldName, final boolean[] array) {
134+
return null;
135+
}
136+
137+
public ToStringBuilder append(final String fieldName, final boolean[] array, final boolean fullDetail) {
138+
return null;
139+
}
140+
141+
public ToStringBuilder append(final String fieldName, final byte value) {
142+
return null;
143+
}
144+
145+
public ToStringBuilder append(final String fieldName, final byte[] array) {
146+
return null;
147+
}
148+
149+
public ToStringBuilder append(final String fieldName, final byte[] array, final boolean fullDetail) {
150+
return null;
151+
}
152+
153+
public ToStringBuilder append(final String fieldName, final char value) {
154+
return null;
155+
}
156+
157+
public ToStringBuilder append(final String fieldName, final char[] array) {
158+
return null;
159+
}
160+
161+
public ToStringBuilder append(final String fieldName, final char[] array, final boolean fullDetail) {
162+
return null;
163+
}
164+
165+
public ToStringBuilder append(final String fieldName, final double value) {
166+
return null;
167+
}
168+
169+
public ToStringBuilder append(final String fieldName, final double[] array) {
170+
return null;
171+
}
172+
173+
public ToStringBuilder append(final String fieldName, final double[] array, final boolean fullDetail) {
174+
return null;
175+
}
176+
177+
public ToStringBuilder append(final String fieldName, final float value) {
178+
return null;
179+
}
180+
181+
public ToStringBuilder append(final String fieldName, final float[] array) {
182+
return null;
183+
}
184+
185+
public ToStringBuilder append(final String fieldName, final float[] array, final boolean fullDetail) {
186+
return null;
187+
}
188+
189+
public ToStringBuilder append(final String fieldName, final int value) {
190+
return null;
191+
}
192+
193+
public ToStringBuilder append(final String fieldName, final int[] array) {
194+
return null;
195+
}
196+
197+
public ToStringBuilder append(final String fieldName, final int[] array, final boolean fullDetail) {
198+
return null;
199+
}
200+
201+
public ToStringBuilder append(final String fieldName, final long value) {
202+
return null;
203+
}
204+
205+
public ToStringBuilder append(final String fieldName, final long[] array) {
206+
return null;
207+
}
208+
209+
public ToStringBuilder append(final String fieldName, final long[] array, final boolean fullDetail) {
210+
return null;
211+
}
212+
213+
public ToStringBuilder append(final String fieldName, final Object obj) {
214+
return null;
215+
}
216+
217+
public ToStringBuilder append(final String fieldName, final Object obj, final boolean fullDetail) {
218+
return null;
219+
}
220+
221+
public ToStringBuilder append(final String fieldName, final Object[] array) {
222+
return null;
223+
}
224+
225+
public ToStringBuilder append(final String fieldName, final Object[] array, final boolean fullDetail) {
226+
return null;
227+
}
228+
229+
public ToStringBuilder append(final String fieldName, final short value) {
230+
return null;
231+
}
232+
233+
public ToStringBuilder append(final String fieldName, final short[] array) {
234+
return null;
235+
}
236+
237+
public ToStringBuilder append(final String fieldName, final short[] array, final boolean fullDetail) {
238+
return null;
239+
}
240+
241+
public ToStringBuilder appendAsObjectToString(final Object srcObject) {
242+
return null;
243+
}
244+
245+
public ToStringBuilder appendSuper(final String superToString) {
246+
return null;
247+
}
248+
249+
public ToStringBuilder appendToString(final String toString) {
250+
return null;
251+
}
252+
253+
public Object getObject() {
254+
return null;
255+
}
256+
257+
public StringBuffer getStringBuffer() {
258+
return null;
259+
}
260+
261+
public ToStringStyle getStyle() {
262+
return null;
263+
}
264+
265+
@Override
266+
public String toString() {
267+
return null;
268+
}
269+
270+
@Override
271+
public String build() {
272+
return null;
273+
}
274+
275+
}

0 commit comments

Comments
 (0)