Skip to content

Commit 5df5805

Browse files
author
Benjamin Muskalla
committed
Convert strings to summary model
1 parent e0d978f commit 5df5805

File tree

4 files changed

+43
-82
lines changed

4 files changed

+43
-82
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ private module Frameworks {
8989
private import semmle.code.java.frameworks.JsonJava
9090
private import semmle.code.java.frameworks.Objects
9191
private import semmle.code.java.frameworks.Optional
92+
private import semmle.code.java.frameworks.Strings
9293
private import semmle.code.java.frameworks.spring.SpringCache
9394
private import semmle.code.java.frameworks.spring.SpringHttp
9495
private import semmle.code.java.frameworks.spring.SpringUtil

‎java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll

Lines changed: 0 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ private import semmle.code.java.dataflow.DataFlow
1010
* ensuring that they are visible to the taint tracking library.
1111
*/
1212
private module Frameworks {
13-
private import semmle.code.java.Strings
1413
private import semmle.code.java.frameworks.jackson.JacksonSerializability
1514
private import semmle.code.java.frameworks.android.Intent
1615
private import semmle.code.java.frameworks.android.SQLite
@@ -85,30 +84,6 @@ abstract class TaintPreservingCallable extends Callable {
8584
predicate transfersTaint(int src, int sink) { none() }
8685
}
8786

88-
private class StringTaintPreservingMethod extends TaintPreservingCallable {
89-
StringTaintPreservingMethod() {
90-
this.getDeclaringType() instanceof TypeString and
91-
(
92-
this.hasName([
93-
"concat", "copyValueOf", "endsWith", "format", "formatted", "getBytes", "indent",
94-
"intern", "join", "repeat", "split", "strip", "stripIndent", "stripLeading",
95-
"stripTrailing", "substring", "toCharArray", "toLowerCase", "toString", "toUpperCase",
96-
"trim"
97-
])
98-
or
99-
this.hasName("valueOf") and this.getParameterType(0) instanceof Array
100-
)
101-
}
102-
103-
override predicate returnsTaintFrom(int arg) {
104-
arg = -1 and not this.isStatic()
105-
or
106-
this.hasName(["concat", "copyValueOf", "valueOf"]) and arg = 0
107-
or
108-
this.hasName(["format", "formatted", "join"]) and arg = [0 .. getNumberOfParameters()]
109-
}
110-
}
111-
11287
private class NumberTaintPreservingCallable extends TaintPreservingCallable {
11388
int argument;
11489

@@ -128,46 +103,3 @@ private class NumberTaintPreservingCallable extends TaintPreservingCallable {
128103

129104
override predicate returnsTaintFrom(int arg) { arg = argument }
130105
}
131-
132-
/** Holds for the types `StringBuilder`, `StringBuffer`, and `StringWriter`. */
133-
private predicate stringBuilderType(RefType t) {
134-
t instanceof StringBuildingType or
135-
t.hasQualifiedName("java.io", "StringWriter")
136-
}
137-
138-
private class StringBuilderTaintPreservingCallable extends TaintPreservingCallable {
139-
StringBuilderTaintPreservingCallable() {
140-
exists(Method m |
141-
this.(Method).overrides*(m) and
142-
stringBuilderType(m.getDeclaringType()) and
143-
m.hasName(["append", "insert", "replace", "toString", "write"])
144-
)
145-
or
146-
this.(Constructor).getParameterType(0) instanceof RefType and
147-
stringBuilderType(this.getDeclaringType())
148-
}
149-
150-
override predicate returnsTaintFrom(int arg) {
151-
arg = -1 and
152-
not this instanceof Constructor
153-
or
154-
this instanceof Constructor and arg = 0
155-
or
156-
this.hasName("append") and arg = 0
157-
or
158-
this.hasName("insert") and arg = 1
159-
or
160-
this.hasName("replace") and arg = 2
161-
}
162-
163-
override predicate transfersTaint(int src, int sink) {
164-
returnsTaintFrom(src) and
165-
sink = -1 and
166-
src != -1 and
167-
not this instanceof Constructor
168-
or
169-
this.hasName("write") and
170-
src = 0 and
171-
sink = -1
172-
}
173-
}

‎java/ql/src/semmle/code/java/Strings.qll

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎java/ql/src/semmle/code/java/frameworks/Strings.qll

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/** Definitions of taint steps in String and String-related classes of the JDK */
2+
3+
import java
4+
private import semmle.code.java.dataflow.ExternalFlow
5+
6+
private class StringSummaryCsv extends SummaryModelCsv {
7+
override predicate row(string row) {
8+
row =
9+
[
10+
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
11+
"java.lang;String;false;concat;(String);;Argument[0];ReturnValue;taint",
12+
"java.lang;String;false;copyValueOf;;;Argument[0];ReturnValue;taint",
13+
"java.lang;String;false;endsWith;;;Argument[-1];ReturnValue;taint",
14+
"java.lang;String;false;format;(Locale,String,Object[]);;Argument[1];ReturnValue;taint",
15+
"java.lang;String;false;format;(Locale,String,Object[]);;ArrayElement of Argument[2];ReturnValue;taint",
16+
"java.lang;String;false;format;(String,Object[]);;Argument[0];ReturnValue;taint",
17+
"java.lang;String;false;format;(String,Object[]);;ArrayElement of Argument[1];ReturnValue;taint",
18+
"java.lang;String;false;formatted;(Object[]);;Argument[-1];ReturnValue;taint",
19+
"java.lang;String;false;formatted;(Object[]);;ArrayElement of Argument[0];ReturnValue;taint",
20+
"java.lang;String;false;getBytes;;;Argument[-1];ReturnValue;taint",
21+
"java.lang;String;false;indent;;;Argument[-1];ReturnValue;taint",
22+
"java.lang;String;false;intern;;;Argument[-1];ReturnValue;taint",
23+
"java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint",
24+
"java.lang;String;false;repeat;(int);;Argument[-1];ReturnValue;taint",
25+
"java.lang;String;false;split;;;Argument[-1];ReturnValue;taint",
26+
"java.lang;String;false;String;;;Argument[0];Argument[-1];value",
27+
"java.lang;String;false;strip;;;Argument[-1];ReturnValue;taint",
28+
"java.lang;String;false;stripIndent;;;Argument[-1];ReturnValue;taint",
29+
"java.lang;String;false;stripLeading;;;Argument[-1];ReturnValue;taint",
30+
"java.lang;String;false;stripTrailing;;;Argument[-1];ReturnValue;taint",
31+
"java.lang;String;false;substring;;;Argument[-1];ReturnValue;taint",
32+
"java.lang;String;false;toCharArray;;;Argument[-1];ReturnValue;taint",
33+
"java.lang;String;false;toLowerCase;;;Argument[-1];ReturnValue;taint",
34+
"java.lang;String;false;toString;;;Argument[-1];ReturnValue;value",
35+
"java.lang;String;false;toUpperCase;;;Argument[-1];ReturnValue;taint",
36+
"java.lang;String;false;trim;;;Argument[-1];ReturnValue;taint",
37+
"java.lang;String;false;valueOf;(char);;Argument[0];ReturnValue;taint",
38+
"java.lang;String;false;valueOf;(char[],int,int);;Argument[0];ReturnValue;taint",
39+
"java.lang;String;false;valueOf;(char[]);;Argument[0];ReturnValue;taint"
40+
]
41+
}
42+
}

0 commit comments

Comments
 (0)