Skip to content

Commit 5c917b4

Browse files
smowtonsmowton
authored
Merge pull request github#6353 from sauyon/sauyon/java/model-constructors
Java: Add models for collection constructors
2 parents f71c99a + fd02dcd commit 5c917b4

File tree

3 files changed

+326
-1
lines changed

3 files changed

+326
-1
lines changed

‎java/change-notes/2021-07-22-model-collection-constructors.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added additional taint steps modeling constructors for collections in `java.util`.

‎java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,44 @@ private class ContainerFlowSummaries extends SummaryModelCsv {
368368
"java.util;Collections;false;copy;(List,List);;Element of Argument[1];Element of Argument[0];value",
369369
"java.util;Collections;false;fill;(List,Object);;Argument[1];Element of Argument[0];value",
370370
"java.util;Arrays;false;asList;;;ArrayElement of Argument[0];Element of ReturnValue;value",
371-
"java.util;Collections;false;addAll;(Collection,Object[]);;ArrayElement of Argument[1];Element of Argument[0];value"
371+
"java.util;Collections;false;addAll;(Collection,Object[]);;ArrayElement of Argument[1];Element of Argument[0];value",
372+
"java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Object,Object);;Argument[0];MapKey of Argument[-1];value",
373+
"java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Object,Object);;Argument[1];MapValue of Argument[-1];value",
374+
"java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Entry);;MapKey of Argument[0];MapKey of Argument[-1];value",
375+
"java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Entry);;MapValue of Argument[0];MapValue of Argument[-1];value",
376+
"java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Object,Object);;Argument[0];MapKey of Argument[-1];value",
377+
"java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Object,Object);;Argument[1];MapValue of Argument[-1];value",
378+
"java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Entry);;MapKey of Argument[0];MapKey of Argument[-1];value",
379+
"java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Entry);;MapValue of Argument[0];MapValue of Argument[-1];value",
380+
"java.util;ArrayDeque;false;ArrayDeque;(Collection);;Element of Argument[0];Element of Argument[-1];value",
381+
"java.util;ArrayList;false;ArrayList;(Collection);;Element of Argument[0];Element of Argument[-1];value",
382+
"java.util;EnumMap;false;EnumMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
383+
"java.util;EnumMap;false;EnumMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
384+
"java.util;EnumMap;false;EnumMap;(EnumMap);;MapKey of Argument[0];MapKey of Argument[-1];value",
385+
"java.util;EnumMap;false;EnumMap;(EnumMap);;MapValue of Argument[0];MapValue of Argument[-1];value",
386+
"java.util;HashMap;false;HashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
387+
"java.util;HashMap;false;HashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
388+
"java.util;HashSet;false;HashSet;(Collection);;Element of Argument[0];Element of Argument[-1];value",
389+
"java.util;Hashtable;false;Hashtable;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
390+
"java.util;Hashtable;false;Hashtable;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
391+
"java.util;IdentityHashMap;false;IdentityHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
392+
"java.util;IdentityHashMap;false;IdentityHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
393+
"java.util;LinkedHashMap;false;LinkedHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
394+
"java.util;LinkedHashMap;false;LinkedHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
395+
"java.util;LinkedHashSet;false;LinkedHashSet;(Collection);;Element of Argument[0];Element of Argument[-1];value",
396+
"java.util;LinkedList;false;LinkedList;(Collection);;Element of Argument[0];Element of Argument[-1];value",
397+
"java.util;PriorityQueue;false;PriorityQueue;(Collection);;Element of Argument[0];Element of Argument[-1];value",
398+
"java.util;PriorityQueue;false;PriorityQueue;(PriorityQueue);;Element of Argument[0];Element of Argument[-1];value",
399+
"java.util;PriorityQueue;false;PriorityQueue;(SortedSet);;Element of Argument[0];Element of Argument[-1];value",
400+
"java.util;TreeMap;false;TreeMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
401+
"java.util;TreeMap;false;TreeMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value",
402+
"java.util;TreeMap;false;TreeMap;(SortedMap);;MapKey of Argument[0];MapKey of Argument[-1];value",
403+
"java.util;TreeMap;false;TreeMap;(SortedMap);;MapValue of Argument[0];MapValue of Argument[-1];value",
404+
"java.util;TreeSet;false;TreeSet;(Collection);;Element of Argument[0];Element of Argument[-1];value",
405+
"java.util;TreeSet;false;TreeSet;(SortedSet);;Element of Argument[0];Element of Argument[-1];value",
406+
"java.util;Vector;false;Vector;(Collection);;Element of Argument[0];Element of Argument[-1];value",
407+
"java.util;WeakHashMap;false;WeakHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
408+
"java.util;WeakHashMap;false;WeakHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
372409
]
373410
}
374411
}

‎java/ql/test/library-tests/dataflow/collections/Constructors.java

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
package generatedtest;
2+
3+
import java.util.AbstractMap;
4+
import java.util.ArrayDeque;
5+
import java.util.ArrayList;
6+
import java.util.Collection;
7+
import java.util.EnumMap;
8+
import java.util.HashMap;
9+
import java.util.HashSet;
10+
import java.util.Hashtable;
11+
import java.util.IdentityHashMap;
12+
import java.util.LinkedHashMap;
13+
import java.util.LinkedHashSet;
14+
import java.util.LinkedList;
15+
import java.util.List;
16+
import java.util.Map;
17+
import java.util.PriorityQueue;
18+
import java.util.SortedMap;
19+
import java.util.SortedSet;
20+
import java.util.TreeMap;
21+
import java.util.TreeSet;
22+
import java.util.Vector;
23+
import java.util.WeakHashMap;
24+
25+
// Test case generated by GenerateFlowTestCase.ql
26+
public class Constructors {
27+
28+
Object getElement(Collection container) { return container.iterator().next(); }
29+
Object getMapKey(Map container) { return container.keySet().iterator().next(); }
30+
Object getMapValue(Map container) { return container.get(null); }
31+
Object getMapKey(Map.Entry container) { return container.getKey(); }
32+
Object getMapValue(Map.Entry container) { return container.getValue(); }
33+
Object source() { return null; }
34+
void sink(Object o) { }
35+
36+
public void test() {
37+
38+
{
39+
// "java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Entry);;MapKey of Argument[0];MapKey of Argument[-1];value"
40+
AbstractMap.SimpleEntry out = null;
41+
Map.Entry in = new AbstractMap.SimpleEntry(source(), null);
42+
out = new AbstractMap.SimpleEntry(in);
43+
sink(getMapKey(out)); // $ hasValueFlow
44+
}
45+
{
46+
// "java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Entry);;MapValue of Argument[0];MapValue of Argument[-1];value"
47+
AbstractMap.SimpleEntry out = null;
48+
Map.Entry in = new AbstractMap.SimpleEntry(null, source());;
49+
out = new AbstractMap.SimpleEntry(in);
50+
sink(getMapValue(out)); // $ hasValueFlow
51+
}
52+
{
53+
// "java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Object,Object);;Argument[0];MapKey of Argument[-1];value"
54+
AbstractMap.SimpleEntry out = null;
55+
Object in = source();
56+
out = new AbstractMap.SimpleEntry(in, null);
57+
sink(getMapKey(out)); // $ hasValueFlow
58+
}
59+
{
60+
// "java.util;AbstractMap$SimpleEntry;false;SimpleEntry;(Object,Object);;Argument[1];MapValue of Argument[-1];value"
61+
AbstractMap.SimpleEntry out = null;
62+
Object in = source();
63+
out = new AbstractMap.SimpleEntry(null, in);
64+
sink(getMapValue(out)); // $ hasValueFlow
65+
}
66+
{
67+
// "java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Entry);;MapKey of Argument[0];MapKey of Argument[-1];value"
68+
AbstractMap.SimpleImmutableEntry out = null;
69+
Map.Entry in = new AbstractMap.SimpleEntry(source(), null);
70+
out = new AbstractMap.SimpleImmutableEntry(in);
71+
sink(getMapKey(out)); // $ hasValueFlow
72+
}
73+
{
74+
// "java.util;AbstractMap$SimpleImmutableEntry;false;SimpleImmutableEntry;(Entry);;MapValue of Argument[0];MapValue of Argument[-1];value"
75+
AbstractMap.SimpleImmutableEntry out = null;
76+
Map.Entry in = new AbstractMap.SimpleEntry(null, source());
77+
out = new AbstractMap.SimpleImmutableEntry(in);
78+
sink(getMapValue(out)); // $ hasValueFlow
79+
}
80+
{
81+
// "java.util;ArrayDeque;false;ArrayDeque;(Collection);;Element of Argument[0];Element of Argument[-1];value"
82+
ArrayDeque out = null;
83+
Collection in = List.of(source());
84+
out = new ArrayDeque(in);
85+
sink(getElement(out)); // $ hasValueFlow
86+
}
87+
{
88+
// "java.util;ArrayList;false;ArrayList;(Collection);;Element of Argument[0];Element of Argument[-1];value"
89+
ArrayList out = null;
90+
Collection in = List.of(source());
91+
out = new ArrayList(in);
92+
sink(getElement(out)); // $ hasValueFlow
93+
}
94+
{
95+
// "java.util;EnumMap;false;EnumMap;(EnumMap);;MapKey of Argument[0];MapKey of Argument[-1];value"
96+
EnumMap out = null;
97+
EnumMap in = new EnumMap(Map.of(source(), null));
98+
out = new EnumMap(in);
99+
sink(getMapKey(out)); // $ hasValueFlow
100+
}
101+
{
102+
// "java.util;EnumMap;false;EnumMap;(EnumMap);;MapValue of Argument[0];MapValue of Argument[-1];value"
103+
EnumMap out = null;
104+
EnumMap in = new EnumMap(Map.of(null, source()));
105+
out = new EnumMap(in);
106+
sink(getMapValue(out)); // $ hasValueFlow
107+
}
108+
{
109+
// "java.util;EnumMap;false;EnumMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
110+
EnumMap out = null;
111+
Map in = Map.of(source(), null);
112+
out = new EnumMap(in);
113+
sink(getMapKey(out)); // $ hasValueFlow
114+
}
115+
{
116+
// "java.util;EnumMap;false;EnumMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
117+
EnumMap out = null;
118+
Map in = Map.of(null, source());
119+
out = new EnumMap(in);
120+
sink(getMapValue(out)); // $ hasValueFlow
121+
}
122+
{
123+
// "java.util;HashMap;false;HashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
124+
HashMap out = null;
125+
Map in = Map.of(source(), null);
126+
out = new HashMap(in);
127+
sink(getMapKey(out)); // $ hasValueFlow
128+
}
129+
{
130+
// "java.util;HashMap;false;HashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
131+
HashMap out = null;
132+
Map in = Map.of(null, source());
133+
out = new HashMap(in);
134+
sink(getMapValue(out)); // $ hasValueFlow
135+
}
136+
{
137+
// "java.util;HashSet;false;HashSet;(Collection);;Element of Argument[0];Element of Argument[-1];value"
138+
HashSet out = null;
139+
Collection in = List.of(source());
140+
out = new HashSet(in);
141+
sink(getElement(out)); // $ hasValueFlow
142+
}
143+
{
144+
// "java.util;Hashtable;false;Hashtable;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
145+
Hashtable out = null;
146+
Map in = Map.of(source(), null);
147+
out = new Hashtable(in);
148+
sink(getMapKey(out)); // $ hasValueFlow
149+
}
150+
{
151+
// "java.util;Hashtable;false;Hashtable;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
152+
Hashtable out = null;
153+
Map in = Map.of(null, source());
154+
out = new Hashtable(in);
155+
sink(getMapValue(out)); // $ hasValueFlow
156+
}
157+
{
158+
// "java.util;IdentityHashMap;false;IdentityHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
159+
IdentityHashMap out = null;
160+
Map in = Map.of(source(), null);
161+
out = new IdentityHashMap(in);
162+
sink(getMapKey(out)); // $ hasValueFlow
163+
}
164+
{
165+
// "java.util;IdentityHashMap;false;IdentityHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
166+
IdentityHashMap out = null;
167+
Map in = Map.of(null, source());
168+
out = new IdentityHashMap(in);
169+
sink(getMapValue(out)); // $ hasValueFlow
170+
}
171+
{
172+
// "java.util;LinkedHashMap;false;LinkedHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
173+
LinkedHashMap out = null;
174+
Map in = Map.of(source(), null);
175+
out = new LinkedHashMap(in);
176+
sink(getMapKey(out)); // $ hasValueFlow
177+
}
178+
{
179+
// "java.util;LinkedHashMap;false;LinkedHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
180+
LinkedHashMap out = null;
181+
Map in = Map.of(null, source());
182+
out = new LinkedHashMap(in);
183+
sink(getMapValue(out)); // $ hasValueFlow
184+
}
185+
{
186+
// "java.util;LinkedHashSet;false;LinkedHashSet;(Collection);;Element of Argument[0];Element of Argument[-1];value"
187+
LinkedHashSet out = null;
188+
Collection in = List.of(source());
189+
out = new LinkedHashSet(in);
190+
sink(getElement(out)); // $ hasValueFlow
191+
}
192+
{
193+
// "java.util;LinkedList;false;LinkedList;(Collection);;Element of Argument[0];Element of Argument[-1];value"
194+
LinkedList out = null;
195+
Collection in = List.of(source());
196+
out = new LinkedList(in);
197+
sink(getElement(out)); // $ hasValueFlow
198+
}
199+
{
200+
// "java.util;PriorityQueue;false;PriorityQueue;(Collection);;Element of Argument[0];Element of Argument[-1];value"
201+
PriorityQueue out = null;
202+
Collection in = List.of(source());
203+
out = new PriorityQueue(in);
204+
sink(getElement(out)); // $ hasValueFlow
205+
}
206+
{
207+
// "java.util;PriorityQueue;false;PriorityQueue;(PriorityQueue);;Element of Argument[0];Element of Argument[-1];value"
208+
PriorityQueue out = null;
209+
PriorityQueue in = new PriorityQueue(List.of(source()));
210+
out = new PriorityQueue(in);
211+
sink(getElement(out)); // $ hasValueFlow
212+
}
213+
{
214+
// "java.util;PriorityQueue;false;PriorityQueue;(SortedSet);;Element of Argument[0];Element of Argument[-1];value"
215+
PriorityQueue out = null;
216+
SortedSet in = new TreeSet(List.of(source()));
217+
out = new PriorityQueue(in);
218+
sink(getElement(out)); // $ hasValueFlow
219+
}
220+
{
221+
// "java.util;TreeMap;false;TreeMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
222+
TreeMap out = null;
223+
Map in = Map.of(source(), null);
224+
out = new TreeMap(in);
225+
sink(getMapKey(out)); // $ hasValueFlow
226+
}
227+
{
228+
// "java.util;TreeMap;false;TreeMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
229+
TreeMap out = null;
230+
Map in = Map.of(null, source());
231+
out = new TreeMap(in);
232+
sink(getMapValue(out)); // $ hasValueFlow
233+
}
234+
{
235+
// "java.util;TreeMap;false;TreeMap;(SortedMap);;MapKey of Argument[0];MapKey of Argument[-1];value"
236+
TreeMap out = null;
237+
SortedMap in = new TreeMap(Map.of(source(), null));
238+
out = new TreeMap(in);
239+
sink(getMapKey(out)); // $ hasValueFlow
240+
}
241+
{
242+
// "java.util;TreeMap;false;TreeMap;(SortedMap);;MapValue of Argument[0];MapValue of Argument[-1];value"
243+
TreeMap out = null;
244+
SortedMap in = new TreeMap(Map.of(null, source()));
245+
out = new TreeMap(in);
246+
sink(getMapValue(out)); // $ hasValueFlow
247+
}
248+
{
249+
// "java.util;TreeSet;false;TreeSet;(Collection);;Element of Argument[0];Element of Argument[-1];value"
250+
TreeSet out = null;
251+
Collection in = List.of(source());
252+
out = new TreeSet(in);
253+
sink(getElement(out)); // $ hasValueFlow
254+
}
255+
{
256+
// "java.util;TreeSet;false;TreeSet;(SortedSet);;Element of Argument[0];Element of Argument[-1];value"
257+
TreeSet out = null;
258+
SortedSet in = new TreeSet(List.of(source()));
259+
out = new TreeSet(in);
260+
sink(getElement(out)); // $ hasValueFlow
261+
}
262+
{
263+
// "java.util;Vector;false;Vector;(Collection);;Element of Argument[0];Element of Argument[-1];value"
264+
Vector out = null;
265+
Collection in = List.of(source());
266+
out = new Vector(in);
267+
sink(getElement(out)); // $ hasValueFlow
268+
}
269+
{
270+
// "java.util;WeakHashMap;false;WeakHashMap;(Map);;MapKey of Argument[0];MapKey of Argument[-1];value"
271+
WeakHashMap out = null;
272+
Map in = Map.of(source(), null);
273+
out = new WeakHashMap(in);
274+
sink(getMapKey(out)); // $ hasValueFlow
275+
}
276+
{
277+
// "java.util;WeakHashMap;false;WeakHashMap;(Map);;MapValue of Argument[0];MapValue of Argument[-1];value"
278+
WeakHashMap out = null;
279+
Map in = Map.of(null, source());
280+
out = new WeakHashMap(in);
281+
sink(getMapValue(out)); // $ hasValueFlow
282+
}
283+
284+
}
285+
286+
}

0 commit comments

Comments
 (0)