Skip to content

Commit 36abf87

Browse files
smowtonsmowton
authored
Merge pull request github#5714 from aschackmull/java/add-misc-qltests
Java: Add a few qltests
2 parents 1ab75eb + 29aec0d commit 36abf87

File tree

9 files changed

+212
-4
lines changed

9 files changed

+212
-4
lines changed

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,19 @@ edges
22
| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp |
33
| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp |
44
| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp |
5+
| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp |
6+
| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... |
57
nodes
68
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
79
| Test.java:24:20:24:23 | temp | semmle.label | temp |
810
| Test.java:27:21:27:24 | temp | semmle.label | temp |
911
| Test.java:30:44:30:47 | temp | semmle.label | temp |
12+
| Test.java:34:21:34:24 | temp | semmle.label | temp |
13+
| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
14+
| Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
1015
#select
1116
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
1217
| Test.java:27:11:27:25 | get(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
1318
| Test.java:30:11:30:48 | getPath(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
19+
| Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
20+
| Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
package test.cwe22.semmle.tests;
44

55

6+
import javax.servlet.http.*;
7+
import javax.servlet.ServletException;
68

7-
8-
import java.io.IOException;
9-
import java.io.File;
9+
import java.io.*;
1010
import java.net.InetAddress;
1111
import java.nio.file.Path;
1212
import java.nio.file.Paths;
@@ -28,6 +28,11 @@ void doGet1(InetAddress address)
2828

2929
// BAD: construct a path with user input
3030
path = FileSystems.getDefault().getPath(temp);
31+
32+
// BAD: insufficient check
33+
if (temp.startsWith("/some_safe_dir/")) {
34+
file = new File(temp);
35+
}
3136
}
3237

3338
void doGet2(InetAddress address)
@@ -68,4 +73,13 @@ boolean isSortOfSafe(String pathSpec) {
6873
return false;
6974
return true;
7075
}
76+
77+
public class MyServlet extends HttpServlet {
78+
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
79+
BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
80+
String filename = br.readLine();
81+
// BAD: construct a file path with user input
82+
BufferedWriter bw = new BufferedWriter(new FileWriter("dir/"+filename, true));
83+
}
84+
}
7185
}

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4

‎java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import java.net.Socket;
2+
3+
import javax.xml.parsers.SAXParser;
4+
import javax.xml.parsers.SAXParserFactory;
5+
import javax.xml.transform.sax.SAXSource;
6+
import javax.xml.bind.JAXBContext;
7+
import javax.xml.bind.Unmarshaller;
8+
9+
import org.xml.sax.InputSource;
10+
import org.xml.sax.XMLReader;
11+
import org.xml.sax.helpers.XMLReaderFactory;
12+
13+
public class SAXSourceTests {
14+
15+
public void unsafeSource(Socket sock) throws Exception {
16+
XMLReader reader = XMLReaderFactory.createXMLReader();
17+
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
18+
JAXBContext jc = JAXBContext.newInstance(Object.class);
19+
Unmarshaller um = jc.createUnmarshaller();
20+
um.unmarshal(source); // BAD
21+
}
22+
23+
public void explicitlySafeSource1(Socket sock) throws Exception {
24+
XMLReader reader = XMLReaderFactory.createXMLReader();
25+
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
26+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
27+
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
28+
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
29+
}
30+
31+
public void createdSafeSource(Socket sock) throws Exception {
32+
SAXParserFactory factory = SAXParserFactory.newInstance();
33+
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
34+
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
35+
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
36+
SAXParser parser = factory.newSAXParser();
37+
XMLReader reader = parser.getXMLReader();
38+
SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); // GOOD
39+
SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
40+
}
41+
}

‎java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
import java.net.Socket;
2+
3+
import javax.xml.bind.JAXBContext;
4+
import javax.xml.bind.Unmarshaller;
5+
import javax.xml.parsers.SAXParserFactory;
6+
import javax.xml.transform.Source;
7+
import javax.xml.transform.sax.SAXSource;
8+
9+
import org.xml.sax.InputSource;
10+
11+
public class UnmarshallerTests {
12+
13+
public void safeUnmarshal(Socket sock) throws Exception {
14+
SAXParserFactory spf = SAXParserFactory.newInstance();
15+
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
16+
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
17+
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
18+
JAXBContext jc = JAXBContext.newInstance(Object.class);
19+
Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
20+
Unmarshaller um = jc.createUnmarshaller();
21+
um.unmarshal(xmlSource); //safe
22+
}
23+
24+
public void unsafeUnmarshal(Socket sock) throws Exception {
25+
SAXParserFactory spf = SAXParserFactory.newInstance();
26+
JAXBContext jc = JAXBContext.newInstance(Object.class);
27+
Unmarshaller um = jc.createUnmarshaller();
28+
um.unmarshal(sock.getInputStream()); //unsafe
29+
}
30+
}

‎java/ql/test/query-tests/security/CWE-611/XXE.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ edges
22
| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
33
| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
44
| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
5+
| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source |
56
| SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) |
67
| SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) |
78
| SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) |
@@ -78,6 +79,8 @@ nodes
7879
| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | semmle.label | getInputStream(...) |
7980
| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | semmle.label | getInputStream(...) |
8081
| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | semmle.label | getInputStream(...) |
82+
| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
83+
| SAXSourceTests.java:20:18:20:23 | source | semmle.label | source |
8184
| SchemaTests.java:12:39:12:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
8285
| SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
8386
| SchemaTests.java:25:39:25:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
@@ -163,6 +166,7 @@ nodes
163166
| TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
164167
| TransformerTests.java:141:18:141:70 | new SAXSource(...) | semmle.label | new SAXSource(...) |
165168
| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
169+
| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | semmle.label | getInputStream(...) |
166170
| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | semmle.label | new InputSource(...) |
167171
| XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
168172
| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | semmle.label | new InputSource(...) |
@@ -220,6 +224,7 @@ nodes
220224
| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user input |
221225
| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user input |
222226
| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user input |
227+
| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | Unsafe parsing of XML file from $@. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user input |
223228
| SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user input |
224229
| SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user input |
225230
| SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user input |
@@ -267,6 +272,7 @@ nodes
267272
| TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user input |
268273
| TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user input |
269274
| TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user input |
275+
| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user input |
270276
| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user input |
271277
| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user input |
272278
| XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user input |

‎java/ql/test/query-tests/security/CWE-611/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1

‎java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package javax.xml.bind;
2+
3+
import java.util.Map;
4+
5+
abstract public class JAXBContext {
6+
protected JAXBContext() { }
7+
8+
// public static final String JAXB_CONTEXT_FACTORY;
9+
//
10+
// public Binder<Node> createBinder() { return null; }
11+
//
12+
// public Binder<T> createBinder(Class<T> p0) { return null; }
13+
//
14+
// public JAXBIntrospector createJAXBIntrospector() { return null; }
15+
//
16+
// abstract public Marshaller createMarshaller();
17+
18+
abstract public Unmarshaller createUnmarshaller();
19+
20+
// abstract public Validator createValidator();
21+
//
22+
// public void generateSchema(SchemaOutputResolver p0) { }
23+
24+
public static JAXBContext newInstance(Class... p0) { return null; }
25+
26+
public static JAXBContext newInstance(Class<?>[] p0, Map<String,?> p1) { return null; }
27+
28+
public static JAXBContext newInstance(String p0) { return null; }
29+
30+
public static JAXBContext newInstance(String p0, ClassLoader p1) { return null; }
31+
32+
public static JAXBContext newInstance(String p0, ClassLoader p1, Map<String,?> p2) { return null; }
33+
}

‎java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package javax.xml.bind;
2+
3+
import java.net.URL;
4+
import java.io.Reader;
5+
import java.io.InputStream;
6+
import java.io.File;
7+
import javax.xml.transform.Source;
8+
9+
abstract public interface Unmarshaller {
10+
abstract public static class Listener {
11+
public Listener() { }
12+
13+
public void afterUnmarshal(Object p0, Object p1) { }
14+
15+
public void beforeUnmarshal(Object p0, Object p1) { }
16+
}
17+
18+
// abstract public A getAdapter(Class<A> p0);
19+
//
20+
// abstract public AttachmentUnmarshaller getAttachmentUnmarshaller();
21+
//
22+
// abstract public ValidationEventHandler getEventHandler();
23+
//
24+
// abstract public Listener getListener();
25+
26+
abstract public Object getProperty(String p0);
27+
28+
// abstract public Schema getSchema();
29+
//
30+
// abstract public UnmarshallerHandler getUnmarshallerHandler();
31+
32+
abstract public boolean isValidating();
33+
34+
// abstract public void setAdapter(Class<A> p0, A p1);
35+
//
36+
// abstract public void setAdapter(XmlAdapter p0);
37+
//
38+
// abstract public void setAttachmentUnmarshaller(AttachmentUnmarshaller p0);
39+
//
40+
// abstract public void setEventHandler(ValidationEventHandler p0);
41+
//
42+
// abstract public void setListener(Listener p0);
43+
//
44+
// abstract public void setProperty(String p0, Object p1);
45+
//
46+
// abstract public void setSchema(Schema p0);
47+
48+
abstract public void setValidating(boolean p0);
49+
50+
abstract public Object unmarshal(File p0);
51+
52+
abstract public Object unmarshal(InputStream p0);
53+
54+
abstract public Object unmarshal(Reader p0);
55+
56+
abstract public Object unmarshal(URL p0);
57+
58+
// abstract public Object unmarshal(XMLEventReader p0);
59+
//
60+
// abstract public JAXBElement<T> unmarshal(XMLEventReader p0, Class<T> p1);
61+
//
62+
// abstract public Object unmarshal(XMLStreamReader p0);
63+
//
64+
// abstract public JAXBElement<T> unmarshal(XMLStreamReader p0, Class<T> p1);
65+
66+
abstract public Object unmarshal(Source p0);
67+
68+
// abstract public JAXBElement<T> unmarshal(Source p0, Class<T> p1);
69+
//
70+
// abstract public Object unmarshal(Node p0);
71+
//
72+
// abstract public JAXBElement<T> unmarshal(Node p0, Class<T> p1);
73+
//
74+
// abstract public Object unmarshal(InputSource p0);
75+
}
76+

0 commit comments

Comments
 (0)