Skip to content

Commit 5325622

Browse files
joefarebrotherjoefarebrother
committed
Convert sql-related flow steps to CSV
1 parent a25933a commit 5325622

File tree

1 file changed

+49
-67
lines changed
  • java/ql/src/semmle/code/java/frameworks/android

1 file changed

+49
-67
lines changed

‎java/ql/src/semmle/code/java/frameworks/android/SQLite.qll

Lines changed: 49 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -110,72 +110,54 @@ private class SQLiteSinkCsv extends SinkModelCsv {
110110
}
111111
}
112112

113-
private class QueryBuilderBuildMethod extends TaintPreservingCallable {
114-
int argument;
115-
116-
QueryBuilderBuildMethod() {
117-
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
118-
(
119-
// buildQuery(String[] projectionIn, String selection, String groupBy, String having, String sortOrder, String limit)
120-
// buildQuery(String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit)
121-
// buildUnionQuery(String[] subQueries, String sortOrder, String limit)
122-
this.hasName(["buildQuery", "buildUnionQuery"]) and
123-
argument = [-1 .. getNumberOfParameters()]
124-
or
125-
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String[] selectionArgs, String groupBy, String having)
126-
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String groupBy, String having)
127-
this.hasName("buildUnionSubQuery") and
128-
argument = [-1 .. getNumberOfParameters()] and
129-
argument != 3
130-
or
131-
// static buildQueryString(boolean distinct, String tables, String[] columns, String where, String groupBy, String having, String orderBy, String limit)
132-
hasName("buildQueryString") and
133-
argument = [1 .. getNumberOfParameters()]
134-
)
135-
}
136-
137-
override predicate returnsTaintFrom(int arg) { argument = arg }
138-
}
139-
140-
private class QueryBuilderAppendMethod extends TaintPreservingCallable {
141-
QueryBuilderAppendMethod() {
142-
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
143-
// setProjectionMap(Map<String, String> columnMap)
144-
// setTables(String inTables)
145-
// appendWhere(CharSequence inWhere)
146-
// appendWhereStandalone(CharSequence inWhere)
147-
// static appendColumns(StringBuilder s, String[] columns)
148-
this.hasName([
149-
"setProjectionMap", "setTables", "appendWhere", "appendWhereStandalone", "appendColumns"
150-
])
151-
}
152-
153-
override predicate transfersTaint(int src, int sink) {
154-
if hasName("appendColumns") then (src = 1 and sink = 0) else (src = 0 and sink = -1)
155-
}
156-
}
157-
158-
private class UnsafeAppendUtilMethod extends TaintPreservingCallable {
159-
UnsafeAppendUtilMethod() {
160-
this.getDeclaringType() instanceof TypeDatabaseUtils and
161-
// String[] appendSelectionArgs(String[] originalValues, String[] newValues)
162-
// String concatenateWhere(String a, String b)
163-
this.hasName(["appendSelectionArgs", "concatenateWhere"])
164-
}
165-
166-
override predicate returnsTaintFrom(int arg) { arg = [0 .. getNumberOfParameters()] }
167-
}
168-
169-
private class TaintPreservingQueryMethod extends TaintPreservingCallable {
170-
TaintPreservingQueryMethod() {
171-
(
172-
this.getDeclaringType() instanceof AndroidContentProvider or
173-
this.getDeclaringType() instanceof AndroidContentResolver
174-
) and
175-
// Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder, CancellationSignal cancellationSignal)
176-
// Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder)
177-
this.hasName("query")
113+
private class SqlFlowStep extends SummaryModelCsv {
114+
override predicate row(string row) {
115+
row =
116+
[
117+
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
118+
// buildQuery(String[] projectionIn, String selection, String groupBy, String having, String sortOrder, String limit)
119+
// buildQuery(String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit)
120+
// buildUnionQuery(String[] subQueries, String sortOrder, String limit)
121+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String,String,String,String);;Argument;ReturnValue;taint",
122+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;Argument;ReturnValue;taint",
123+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionQuery;(String[],String,String);;Argument;ReturnValue;taint",
124+
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String[] selectionArgs, String groupBy, String having)
125+
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String groupBy, String having)
126+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[-1];ReturnValue;taint",
127+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[0];ReturnValue;taint",
128+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[1];ReturnValue;taint",
129+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[2];ReturnValue;taint",
130+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[4];ReturnValue;taint",
131+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[5];ReturnValue;taint",
132+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[7];ReturnValue;taint",
133+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[8];ReturnValue;taint",
134+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[-1];ReturnValue;taint",
135+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[0];ReturnValue;taint",
136+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[1];ReturnValue;taint",
137+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[2];ReturnValue;taint",
138+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[4];ReturnValue;taint",
139+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[5];ReturnValue;taint",
140+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[6];ReturnValue;taint",
141+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[7];ReturnValue;taint",
142+
// static buildQueryString(boolean distinct, String tables, String[] columns, String where, String groupBy, String having, String orderBy, String limit)
143+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[1];ReturnValue;taint",
144+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[2];ReturnValue;taint",
145+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[3];ReturnValue;taint",
146+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[4];ReturnValue;taint",
147+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[5];ReturnValue;taint",
148+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[6];ReturnValue;taint",
149+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[7];ReturnValue;taint",
150+
"android.database.sqlite;SQLiteQueryBuilder;true;setProjectionMap;(Map<String,String>);;Argument[0];Argument[-1];taint",
151+
"android.database.sqlite;SQLiteQueryBuilder;true;setTables;(String);;Argument[0];Argument[-1];taint",
152+
"android.database.sqlite;SQLiteQueryBuilder;true;appendWhere;(CharSequence);;Argument[0];Argument[-1];taint",
153+
"android.database.sqlite;SQLiteQueryBuilder;true;appendWhereStandalone;(CharSequence);;Argument[0];Argument[-1];taint",
154+
"android.database.sqlite;SQLiteQueryBuilder;true;appendColumns;(StringBuilder,String[]);;Argument[1];Argument[0];taint",
155+
"android.database;DatabaseUtils;false;appendSelectionArgs;(String[],String[]);;Argument;ReturnValue;taint",
156+
"android.database;DatabaseUtils;false;concatenateWhere;(String,String);;Argument;ReturnValue;taint",
157+
"android.content;ContentProvider;true;query;(Uri,String[],String,String[],String);;Argument[0];ReturnValue;taint",
158+
"android.content;ContentProvider;true;query;(Uri,String[],String,String[],String,CancellationSignal);;Argument[0];ReturnValue;taint",
159+
"android.content;ContentResolver;true;query;(Uri,String[],String,String[],String);;Argument[0];ReturnValue;taint",
160+
"android.content;ContentResolver;true;query;(Uri,String[],String,String[],String,CancellationSignal);;Argument[0];ReturnValue;taint"
161+
]
178162
}
179-
180-
override predicate returnsTaintFrom(int arg) { arg = 0 }
181163
}

0 commit comments

Comments
 (0)