Skip to content

Commit 48b0df4

Browse files
atorralbaatorralba
committed
Add tests, minor bugfixes
1 parent d77d0c9 commit 48b0df4

File tree

4 files changed

+230
-14
lines changed

4 files changed

+230
-14
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,13 +81,13 @@ private module Frameworks {
8181
private import semmle.code.java.frameworks.apache.Lang
8282
private import semmle.code.java.frameworks.guava.Guava
8383
private import semmle.code.java.frameworks.jackson.JacksonSerializability
84+
private import semmle.code.java.frameworks.spring.SpringBeans
8485
private import semmle.code.java.security.ResponseSplitting
8586
private import semmle.code.java.security.InformationLeak
8687
private import semmle.code.java.security.XSS
8788
private import semmle.code.java.security.LdapInjection
8889
private import semmle.code.java.security.XPath
8990
private import semmle.code.java.security.JexlInjection
90-
private import semmle.code.java.frameworks.spring.Spring
9191
}
9292

9393
private predicate sourceModelCsv(string row) {

‎java/ql/src/semmle/code/java/frameworks/spring/SpringBeans.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,10 @@ module SpringBeans {
1010
"org.springframework.beans;PropertyValue;false;PropertyValue;(String,Object);;Argument[1];MapValue of Argument[-1];value",
1111
"org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue);;Argument[0];Argument[-1];value",
1212
"org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue,Object);;MapKey of Argument[0];MapKey of Argument[-1];value",
13+
"org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue,Object);;Argument[1];MapValue of Argument[-1];value",
1314
"org.springframework.beans;PropertyValue;false;getName;;;MapKey of Argument[-1];ReturnValue;value",
1415
"org.springframework.beans;PropertyValue;false;getValue;;;MapValue of Argument[-1];ReturnValue;value",
15-
"org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Argument[-1];ReturnValue;value",
16+
"org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Element of Argument[-1];ReturnValue;value",
1617
"org.springframework.beans;PropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
1718
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
1819
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of ReturnValue;value",

‎java/ql/test/library-tests/frameworks/spring/beans/Test.java

Lines changed: 225 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
package generatedtest;
22

3+
import java.util.HashMap;
4+
import java.util.List;
5+
import java.util.Map;
6+
import org.springframework.beans.MutablePropertyValues;
37
import org.springframework.beans.PropertyValue;
8+
import org.springframework.beans.PropertyValues;
49

510

611
public class Test {
@@ -12,6 +17,14 @@ Object getMapValue(Object container) {
1217
return null;
1318
}
1419

20+
Object getElement(Object container) {
21+
return null;
22+
}
23+
24+
Object getArrayElement(Object container) {
25+
return null;
26+
}
27+
1528
Object newWithMapKey(Object element) {
1629
return null;
1730
}
@@ -20,6 +33,10 @@ Object newWithMapValue(Object element) {
2033
return null;
2134
}
2235

36+
Object newWithElement(Object element) {
37+
return null;
38+
}
39+
2340
Object source() {
2441
return null;
2542
}
@@ -31,53 +48,250 @@ public void test() {
3148
// "org.springframework.beans;PropertyValue;false;;(String,Object);;Argument[0];MapKey of Argument[-1];value",
3249
{
3350
PropertyValue v = new PropertyValue((String) source(), null);
34-
sink(newWithMapKey(v)); // $hasValueFlow
35-
sink(newWithMapValue(v)); // Safe
51+
sink(getMapKey(v)); // $hasValueFlow
52+
sink(getMapValue(v)); // Safe
3653
}
3754
// "org.springframework.beans;PropertyValue;false;;(String,Object);;Argument[1];MapValue of Argument[-1];value",
3855
{
3956
PropertyValue v = new PropertyValue("", source());
40-
sink(newWithMapKey(v)); // Safe
41-
sink(newWithMapValue(v)); // $hasValueFlow
57+
sink(getMapKey(v)); // Safe
58+
sink(getMapValue(v)); // $hasValueFlow
4259
}
4360
// "org.springframework.beans;PropertyValue;false;;(PropertyValue);;Argument[0];Argument[-1];value",
4461
{
4562
PropertyValue v1 = new PropertyValue((String) source(), null);
4663
PropertyValue v2 = new PropertyValue(v1);
47-
sink(newWithMapKey(v2)); // $hasValueFlow
48-
sink(newWithMapValue(v2)); // Safe
49-
PropertyValue v3 = new PropertyValue("", source());
64+
sink(getMapKey(v2)); // $hasValueFlow
65+
sink(getMapValue(v2)); // Safe
66+
67+
PropertyValue v3 = new PropertyValue("safe", source());
5068
PropertyValue v4 = new PropertyValue(v3);
51-
sink(newWithMapKey(v4)); // Safe
52-
sink(newWithMapValue(v4)); // $hasValueFlow
69+
sink(getMapKey(v4)); // Safe
70+
sink(getMapValue(v4)); // $hasValueFlow
5371
}
5472
// "org.springframework.beans;PropertyValue;false;;(PropertyValue,Object);;MapKey of Argument[0];MapKey of Argument[-1];value",
73+
{
74+
PropertyValue v1 = new PropertyValue((String) source(), source());
75+
PropertyValue v2 = new PropertyValue(v1, null);
76+
sink(getMapKey(v2)); // $hasValueFlow
77+
sink(getMapValue(v2)); // Safe
78+
}
79+
// "org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue,Object);;Argument[1];MapValue of Argument[-1];value",
80+
{
81+
PropertyValue v1 = new PropertyValue("safe", null);
82+
PropertyValue v2 = new PropertyValue(v1, source());
83+
sink(getMapKey(v2)); // Safe
84+
sink(getMapValue(v2)); // $hasValueFlow
85+
}
5586
// "org.springframework.beans;PropertyValue;false;getName;;;MapKey of Argument[-1];ReturnValue;value",
87+
{
88+
PropertyValue v = new PropertyValue((String) source(), null);
89+
sink(v.getName()); // $hasValueFlow
90+
sink(v.getValue()); // Safe
91+
}
5692
// "org.springframework.beans;PropertyValue;false;getValue;;;MapValue of Argument[-1];ReturnValue;value",
57-
// "org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Argument[-1];ReturnValue;value",
93+
{
94+
PropertyValue v = new PropertyValue("safe", source());
95+
sink(v.getName()); // Safe
96+
sink(v.getValue()); // $hasValueFlow
97+
}
98+
// "org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Element of Argument[-1];ReturnValue;value",
99+
{
100+
PropertyValues pv = (PropertyValues) newWithElement(newWithMapValue(source()));
101+
sink(pv.getPropertyValue("safe")); // $hasValueFlow
102+
}
58103
// "org.springframework.beans;PropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
104+
{
105+
PropertyValues pv = (PropertyValues) newWithElement(newWithMapValue(source()));
106+
PropertyValue[] vs = pv.getPropertyValues();
107+
sink(getMapKey(getArrayElement(vs))); // Safe
108+
sink(getMapValue(getArrayElement(vs))); // $hasValueFlow
109+
}
59110
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
111+
{
112+
MutablePropertyValues pv = new MutablePropertyValues();
113+
pv.add((String) source(), null);
114+
sink(getMapKey(getElement(pv))); // $hasValueFlow
115+
sink(getMapValue(getElement(pv))); // Safe
116+
}
60117
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of ReturnValue;value",
118+
{
119+
MutablePropertyValues pv = new MutablePropertyValues();
120+
sink(getMapKey(getElement(pv.add((String) source(), null)))); // $hasValueFlow
121+
sink(getMapValue(getElement(pv.add((String) source(), null)))); // Safe
122+
}
61123
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
124+
{
125+
MutablePropertyValues pv = new MutablePropertyValues();
126+
pv.add("safe", source());
127+
sink(getMapKey(getElement(pv))); // Safe
128+
sink(getMapValue(getElement(pv))); // $hasValueFlow
129+
}
62130
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of ReturnValue;value",
131+
{
132+
MutablePropertyValues pv = new MutablePropertyValues();
133+
sink(getMapKey(getElement(pv.add("safe", source())))); // Safe
134+
sink(getMapValue(getElement(pv.add("safe", source())))); // $hasValueFlow
135+
}
63136
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of Argument[-1];value",
137+
{
138+
MutablePropertyValues pv1 = new MutablePropertyValues();
139+
PropertyValue v1 = (PropertyValue) newWithMapKey(source());
140+
pv1.addPropertyValue(v1);
141+
sink(getMapKey(getElement(pv1))); // $hasValueFlow
142+
sink(getMapValue(getElement(pv1))); // Safe
143+
144+
MutablePropertyValues pv2 = new MutablePropertyValues();
145+
PropertyValue v2 = (PropertyValue) newWithMapValue(source());
146+
pv2.addPropertyValue(v2);
147+
sink(getMapKey(getElement(pv2))); // Safe
148+
sink(getMapValue(getElement(pv2))); // $hasValueFlow
149+
}
64150
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of ReturnValue;value",
151+
{
152+
MutablePropertyValues pv1 = new MutablePropertyValues();
153+
PropertyValue v1 = (PropertyValue) newWithMapKey(source());
154+
PropertyValues pv2 = pv1.addPropertyValue(v1);
155+
sink(getMapKey(getElement(pv2))); // $hasValueFlow
156+
sink(getMapValue(getElement(pv2))); // Safe
157+
158+
MutablePropertyValues pv3 = new MutablePropertyValues();
159+
PropertyValue v2 = (PropertyValue) newWithMapValue(source());
160+
PropertyValues pv4 = pv3.addPropertyValue(v2);
161+
sink(getMapKey(getElement(pv4))); // Safe
162+
sink(getMapValue(getElement(pv4))); // $hasValueFlow
163+
}
65164
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
165+
{
166+
MutablePropertyValues pv = new MutablePropertyValues();
167+
pv.addPropertyValue((String)source(), null);
168+
sink(getMapKey(getElement(pv))); // $hasValueFlow
169+
sink(getMapValue(getElement(pv))); // Safe
170+
}
66171
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
172+
{
173+
MutablePropertyValues pv = new MutablePropertyValues();
174+
pv.addPropertyValue("safe", source());
175+
sink(getMapKey(getElement(pv))); // Safe
176+
sink(getMapValue(getElement(pv))); // $hasValueFlow
177+
}
67178
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of Argument[-1];value",
179+
{
180+
MutablePropertyValues pv = new MutablePropertyValues();
181+
Map<String, Object> values = (Map<String, Object>) newWithMapKey(source());
182+
pv.addPropertyValues(values);
183+
sink(getMapKey(getElement(pv))); // $hasValueFlow
184+
sink(getMapValue(getElement(pv))); // Safe
185+
}
68186
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of ReturnValue;value",
187+
{
188+
MutablePropertyValues pv = new MutablePropertyValues();
189+
Map<String, Object> values = (Map<String, Object>) newWithMapKey(source());
190+
PropertyValues pv2 = pv.addPropertyValues(values);
191+
sink(getMapKey(getElement(pv2))); // $hasValueFlow
192+
sink(getMapValue(getElement(pv2))); // Safe
193+
}
69194
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of Argument[-1];value",
195+
{
196+
MutablePropertyValues pv = new MutablePropertyValues();
197+
Map<String, Object> values = (Map<String, Object>) newWithMapValue(source());
198+
pv.addPropertyValues(values);
199+
sink(getMapKey(getElement(pv))); // Safe
200+
sink(getMapValue(getElement(pv))); // $hasValueFlow
201+
}
70202
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of ReturnValue;value",
203+
{
204+
MutablePropertyValues pv = new MutablePropertyValues();
205+
Map<String, Object> values = (Map<String, Object>) newWithMapValue(source());
206+
PropertyValues pv2 = pv.addPropertyValues(values);
207+
sink(getMapKey(getElement(pv2))); // Safe
208+
sink(getMapValue(getElement(pv2))); // $hasValueFlow
209+
}
71210
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of Argument[-1];value",
211+
{
212+
MutablePropertyValues pv = new MutablePropertyValues();
213+
PropertyValues values = (PropertyValues) newWithElement(newWithMapKey(source()));
214+
pv.addPropertyValues(values);
215+
sink(getMapKey(getElement(pv))); // $hasValueFlow
216+
sink(getMapValue(getElement(pv))); // Safe
217+
}
72218
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of ReturnValue;value",
219+
{
220+
MutablePropertyValues pv = new MutablePropertyValues();
221+
PropertyValues values = (PropertyValues) newWithElement(newWithMapKey(source()));
222+
PropertyValues pv2 = pv.addPropertyValues(values);
223+
sink(getMapKey(getElement(pv2))); // $hasValueFlow
224+
sink(getMapValue(getElement(pv2))); // Safe
225+
}
73226
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of Argument[-1];value",
227+
{
228+
MutablePropertyValues pv = new MutablePropertyValues();
229+
PropertyValues values = (PropertyValues) newWithElement(newWithMapValue(source()));
230+
pv.addPropertyValues(values);
231+
sink(getMapKey(getElement(pv))); // Safe
232+
sink(getMapValue(getElement(pv))); // $hasValueFlow
233+
}
74234
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of ReturnValue;value",
235+
{
236+
MutablePropertyValues pv = new MutablePropertyValues();
237+
PropertyValues values = (PropertyValues) newWithElement(newWithMapValue(source()));
238+
PropertyValues pv2 = pv.addPropertyValues(values);
239+
sink(getMapKey(getElement(pv2))); // Safe
240+
sink(getMapValue(getElement(pv2))); // $hasValueFlow
241+
}
75242
// "org.springframework.beans;MutablePropertyValues;true;get;;;MapValue of Element of Argument[-1];ReturnValue;value",
243+
{
244+
MutablePropertyValues pv = (MutablePropertyValues) newWithElement(newWithMapValue(source()));
245+
sink(pv.get("something")); // $hasValueFlow
246+
}
76247
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValue;;;Element of Argument[-1];ReturnValue;value",
248+
{
249+
MutablePropertyValues pv1 = (MutablePropertyValues) newWithElement(newWithMapKey(source()));
250+
sink(pv1.getPropertyValue("something").getName()); // $hasValueFlow
251+
sink(pv1.getPropertyValue("something").getValue()); // Safe
252+
253+
MutablePropertyValues pv2 = (MutablePropertyValues) newWithElement(newWithMapValue(source()));
254+
sink(pv2.getPropertyValue("something").getName()); // Safe
255+
sink(pv2.getPropertyValue("something").getValue()); // $hasValueFlow
256+
}
77257
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValueList;;;Element of Argument[-1];Element of ReturnValue;value",
258+
{
259+
MutablePropertyValues pv1 = (MutablePropertyValues) newWithElement(newWithMapKey(source()));
260+
List<PropertyValue> pvl1 = pv1.getPropertyValueList();
261+
sink(getMapKey(getElement(pvl1))); // $hasValueFlow
262+
sink(getMapValue(getElement(pvl1))); // Safe
263+
264+
MutablePropertyValues pv2 = (MutablePropertyValues) newWithElement(newWithMapValue(source()));
265+
List<PropertyValue> pvl2 = pv2.getPropertyValueList();
266+
sink(getMapKey(getElement(pvl2))); // Safe
267+
sink(getMapValue(getElement(pvl2))); // $hasValueFlow
268+
}
78269
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
270+
{
271+
MutablePropertyValues pv1 = (MutablePropertyValues) newWithElement(newWithMapKey(source()));
272+
PropertyValue[] pvl1 = pv1.getPropertyValues();
273+
sink(getMapKey(getArrayElement(pvl1))); // $hasValueFlow
274+
sink(getMapValue(getArrayElement(pvl1))); // Safe
275+
276+
MutablePropertyValues pv2 = (MutablePropertyValues) newWithElement(newWithMapValue(source()));
277+
PropertyValue[] pvl2 = pv2.getPropertyValues();
278+
sink(getMapKey(getArrayElement(pvl2))); // Safe
279+
sink(getMapValue(getArrayElement(pvl2))); // $hasValueFlow
280+
}
79281
// "org.springframework.beans;MutablePropertyValues;true;setPropertyValueAt;;;Argument[0];Element of Argument[-1];value"
80-
// @formatter:on
282+
{
283+
MutablePropertyValues pv1 = new MutablePropertyValues();
284+
PropertyValue v1 = (PropertyValue) newWithMapKey(source());
285+
pv1.setPropertyValueAt(v1, 0);
286+
sink(getMapKey(getElement(pv1))); // $hasValueFlow
287+
sink(getMapValue(getElement(pv1))); // Safe
81288

289+
MutablePropertyValues pv2 = new MutablePropertyValues();
290+
PropertyValue v2 = (PropertyValue) newWithMapValue(source());
291+
pv2.setPropertyValueAt(v2, 0);
292+
sink(getMapKey(getElement(pv2))); // Safe
293+
sink(getMapValue(getElement(pv2))); // $hasValueFlow
294+
}
295+
// @formatter:on
82296
}
83297
}

‎java/ql/test/library-tests/frameworks/spring/beans/test.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ import java
22
import semmle.code.java.dataflow.ExternalFlow
33
import semmle.code.java.dataflow.TaintTracking
44
import TestUtilities.InlineExpectationsTest
5-
import semmle.code.java.dataflow.internal.FlowSummaryImpl
65

76
class SummaryModelTest extends SummaryModelCsv {
87
override predicate row(string row) {
@@ -11,6 +10,8 @@ class SummaryModelTest extends SummaryModelCsv {
1110
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
1211
"generatedtest;Test;false;getMapKey;;;MapKey of Argument[0];ReturnValue;value",
1312
"generatedtest;Test;false;getMapValue;;;MapValue of Argument[0];ReturnValue;value",
13+
"generatedtest;Test;false;getElement;;;Element of Argument[0];ReturnValue;value",
14+
"generatedtest;Test;false;getArrayElement;;;ArrayElement of Argument[0];ReturnValue;value",
1415
"generatedtest;Test;false;newWithElement;;;Argument[0];Element of ReturnValue;value",
1516
"generatedtest;Test;false;newWithMapKey;;;Argument[0];MapKey of ReturnValue;value",
1617
"generatedtest;Test;false;newWithMapValue;;;Argument[0];MapValue of ReturnValue;value"

0 commit comments

Comments
 (0)