Use InlineTest

Author: atorralba

java/ql/src/Security/CWE/CWE-094/JexlInjection.ql

@@ -11,10 +11,9 @@
  */
 
 import java
-import JexlInjectionLib
 import DataFlow::PathGraph
 import semmle.code.java.dataflow.FlowSources
-//import FlowUtils
+import semmle.code.java.security.JexlInjection
 
 /**
  * A taint-tracking configuration for unsafe user input
@@ -29,8 +28,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }
 
   override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
-    any(JexlInjectionAdditionalTaintStep c).step(node1, node2) /*or
-    hasGetterFlow(node1, node2)*/
+    any(JexlInjectionAdditionalTaintStep c).step(node1, node2) 
   }
 }
 

java/ql/src/Security/CWE/CWE-094/JexlInjectionLib.qll renamed to java/ql/src/semmle/code/java/security/JexlInjection.qll

@@ -11,22 +11,21 @@ private static void runJexlExpression(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
         Expression e = jexl.createExpression(jexlExpr);
         JexlContext jc = new MapContext();
-        e.evaluate(jc);
+        e.evaluate(jc); // $hasJexlInjection
     }
 
     private static void runJexlExpressionWithJexlInfo(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
-        Expression e = jexl.createExpression(
-                jexlExpr, new DebugInfo("unknown", 0, 0));
+        Expression e = jexl.createExpression(jexlExpr, new DebugInfo("unknown", 0, 0));
         JexlContext jc = new MapContext();
-        e.evaluate(jc);
+        e.evaluate(jc); // $hasJexlInjection
     }
 
     private static void runJexlScript(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
         Script script = jexl.createScript(jexlExpr);
         JexlContext jc = new MapContext();
-        script.execute(jc);
+        script.execute(jc); // $hasJexlInjection
     }
 
     private static void runJexlScriptViaCallable(String jexlExpr) {
@@ -35,38 +34,38 @@ private static void runJexlScriptViaCallable(String jexlExpr) {
         JexlContext jc = new MapContext();
 
         try {
-            script.callable(jc).call();
+            script.callable(jc).call(); // $hasJexlInjection
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
     }
 
     private static void runJexlExpressionViaGetProperty(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
-        jexl.getProperty(new Object(), jexlExpr);
+        jexl.getProperty(new Object(), jexlExpr); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaSetProperty(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
-        jexl.setProperty(new Object(), jexlExpr, new Object());
+        jexl.setProperty(new Object(), jexlExpr, new Object()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaUnifiedJEXLParseAndEvaluate(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
         UnifiedJEXL unifiedJEXL = new UnifiedJEXL(jexl);
-        unifiedJEXL.parse(jexlExpr).evaluate(new MapContext());
+        unifiedJEXL.parse(jexlExpr).evaluate(new MapContext()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaUnifiedJEXLParseAndPrepare(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
         UnifiedJEXL unifiedJEXL = new UnifiedJEXL(jexl);
-        unifiedJEXL.parse(jexlExpr).prepare(new MapContext());
+        unifiedJEXL.parse(jexlExpr).prepare(new MapContext()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaUnifiedJEXLTemplateEvaluate(String jexlExpr) {
         JexlEngine jexl = new JexlEngine();
         UnifiedJEXL unifiedJEXL = new UnifiedJEXL(jexl);
-        unifiedJEXL.createTemplate(jexlExpr).evaluate(new MapContext(), new StringWriter());
+        unifiedJEXL.createTemplate(jexlExpr).evaluate(new MapContext(), new StringWriter()); // $hasJexlInjection
     }
 
     private static void testWithSocket(Consumer<String> action) throws Exception {

java/ql/test/query-tests/security/CWE-094/Jexl2Injection.java

@@ -18,21 +18,21 @@ private static void runJexlExpression(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JexlExpression e = jexl.createExpression(jexlExpr);
         JexlContext jc = new MapContext();
-        e.evaluate(jc);
+        e.evaluate(jc); // $hasJexlInjection
     }
 
     private static void runJexlExpressionWithJexlInfo(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JexlExpression e = jexl.createExpression(new JexlInfo("unknown", 0, 0), jexlExpr);
         JexlContext jc = new MapContext();
-        e.evaluate(jc);
+        e.evaluate(jc); // $hasJexlInjection
     }
 
     private static void runJexlScript(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JexlScript script = jexl.createScript(jexlExpr);
         JexlContext jc = new MapContext();
-        script.execute(jc);
+        script.execute(jc); // $hasJexlInjection
     }
 
     private static void runJexlScriptViaCallable(String jexlExpr) {
@@ -41,38 +41,38 @@ private static void runJexlScriptViaCallable(String jexlExpr) {
         JexlContext jc = new MapContext();
 
         try {
-            script.callable(jc).call();
+            script.callable(jc).call(); // $hasJexlInjection
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
     }
 
     private static void runJexlExpressionViaGetProperty(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
-        jexl.getProperty(new Object(), jexlExpr);
+        jexl.getProperty(new Object(), jexlExpr); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaSetProperty(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
-        jexl.setProperty(new Object(), jexlExpr, new Object());
+        jexl.setProperty(new Object(), jexlExpr, new Object()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaJxltEngineExpressionEvaluate(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JxltEngine jxlt = jexl.createJxltEngine();
-        jxlt.createExpression(jexlExpr).evaluate(new MapContext());
+        jxlt.createExpression(jexlExpr).evaluate(new MapContext()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaJxltEngineExpressionPrepare(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JxltEngine jxlt = jexl.createJxltEngine();
-        jxlt.createExpression(jexlExpr).prepare(new MapContext());
+        jxlt.createExpression(jexlExpr).prepare(new MapContext()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaJxltEngineTemplateEvaluate(String jexlExpr) {
         JexlEngine jexl = new JexlBuilder().create();
         JxltEngine jxlt = jexl.createJxltEngine();
-        jxlt.createTemplate(jexlExpr).evaluate(new MapContext(), new StringWriter());
+        jxlt.createTemplate(jexlExpr).evaluate(new MapContext(), new StringWriter()); // $hasJexlInjection
     }
 
     private static void runJexlExpressionViaCallable(String jexlExpr) {
@@ -81,7 +81,7 @@ private static void runJexlExpressionViaCallable(String jexlExpr) {
         JexlContext jc = new MapContext();
 
         try {
-            e.callable(jc).call();
+            e.callable(jc).call(); // $hasJexlInjection
         } catch (Exception ex) {
             throw new RuntimeException(ex);
         }
@@ -141,16 +141,14 @@ public static void testWithJexlExpressionCallable() throws Exception {
     }
 
     @PostMapping("/request")
-    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromPathVariable(
-            @PathVariable String expr) {
+    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromPathVariable(@PathVariable String expr) {
 
         runJexlExpression(expr);
         return ResponseEntity.ok(HttpStatus.OK);
     }
 
     @PostMapping("/request")
-    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromRequestBody(
-            @RequestBody Data data) {
+    public ResponseEntity testWithSpringControllerThatEvaluatesJexlFromRequestBody(@RequestBody Data data) {
 
         String expr = data.getExpr();
         runJexlExpression(expr);