Skip to content

Commit 6213c20

Browse files
yo-hyo-h
authored
Merge pull request github#5136 from aschackmull/java/csv-models
Java: Add support for framework modelling through csv data.
2 parents 73e7b54 + 74d35f4 commit 6213c20

File tree

13 files changed

+784
-0
lines changed

13 files changed

+784
-0
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 519 additions & 0 deletions
Large diffs are not rendered by default.

‎java/ql/src/semmle/code/java/dataflow/FlowSources.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,20 @@ import semmle.code.java.frameworks.spring.SpringWebClient
2424
import semmle.code.java.frameworks.Guice
2525
import semmle.code.java.frameworks.struts.StrutsActions
2626
import semmle.code.java.frameworks.Thrift
27+
private import semmle.code.java.dataflow.ExternalFlow
2728

2829
/** A data flow source of remote user input. */
2930
abstract class RemoteFlowSource extends DataFlow::Node {
3031
/** Gets a string that describes the type of this remote flow source. */
3132
abstract string getSourceType();
3233
}
3334

35+
private class ExternalRemoteFlowSource extends RemoteFlowSource {
36+
ExternalRemoteFlowSource() { sourceNode(this, "remote") }
37+
38+
override string getSourceType() { result = "external" }
39+
}
40+
3441
private class RemoteTaintedMethodAccessSource extends RemoteFlowSource {
3542
RemoteTaintedMethodAccessSource() {
3643
this.asExpr().(MethodAccess).getMethod() instanceof RemoteTaintedMethod

‎java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ private import DataFlowPrivate
77
private import semmle.code.java.dataflow.SSA
88
private import semmle.code.java.dataflow.TypeFlow
99
private import semmle.code.java.controlflow.Guards
10+
private import semmle.code.java.dataflow.ExternalFlow
1011
import semmle.code.java.dataflow.InstanceAccess
1112

1213
cached
@@ -405,6 +406,8 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
405406
or
406407
node2.asExpr().(AssignExpr).getSource() = node1.asExpr()
407408
or
409+
summaryStep(node1, node2, "value")
410+
or
408411
exists(MethodAccess ma, Method m |
409412
ma = node2.asExpr() and
410413
m = ma.getMethod() and

‎java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ private import semmle.code.java.dataflow.internal.ContainerFlow
1010
private import semmle.code.java.frameworks.spring.SpringController
1111
private import semmle.code.java.frameworks.spring.SpringHttp
1212
private import semmle.code.java.frameworks.Networking
13+
private import semmle.code.java.dataflow.ExternalFlow
1314
import semmle.code.java.dataflow.FlowSteps
1415

1516
/**
@@ -45,6 +46,8 @@ predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
4546
localAdditionalTaintUpdateStep(src.asExpr(),
4647
sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
4748
or
49+
summaryStep(src, sink, "taint")
50+
or
4851
exists(Argument arg |
4952
src.asExpr() = arg and
5053
arg.isVararg() and

‎java/ql/test/library-tests/dataflow/external-models/A.java

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package my.qltest;
2+
3+
public class A {
4+
void foo() {
5+
Object x;
6+
x = src1();
7+
x = src1("");
8+
9+
Sub sub = new Sub();
10+
x = sub.src2();
11+
x = sub.src3();
12+
13+
srcArg(x);
14+
15+
Handler h = srcparam1 -> { };
16+
17+
Handler h2 = new Handler() {
18+
@Override public void handle(Object srcparam2) { }
19+
};
20+
21+
x = taggedSrcMethod();
22+
x = taggedSrcField;
23+
24+
x = srcTwoArg("", "");
25+
}
26+
27+
@Tag
28+
void tagged1(Object taggedMethodParam) {
29+
}
30+
31+
void tagged2(@Tag Object taggedSrcParam) {
32+
}
33+
34+
Object src1() { return null; }
35+
36+
Object src1(String s) { return null; }
37+
38+
Object src2() { return null; }
39+
40+
Object src3() { return null; }
41+
42+
static class Sub extends A {
43+
// inherit src2
44+
@Override Object src3() { return null; }
45+
}
46+
47+
void srcArg(Object src) { }
48+
49+
interface Handler {
50+
void handle(Object src);
51+
}
52+
53+
@interface Tag { }
54+
55+
@Tag
56+
Object taggedSrcMethod() { return null; }
57+
58+
@Tag
59+
Object taggedSrcField;
60+
61+
Object srcTwoArg(String s1, String s2) { return null; }
62+
}

‎java/ql/test/library-tests/dataflow/external-models/B.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
package my.qltest;
2+
3+
public class B {
4+
void foo() {
5+
Object arg1 = new Object();
6+
sink1(arg1);
7+
8+
Object argToTagged = new Object();
9+
taggedSinkMethod(argToTagged);
10+
11+
Object fieldWrite = new Object();
12+
taggedField = fieldWrite;
13+
}
14+
15+
Object sinkMethod() {
16+
Object res = new Object();
17+
return res;
18+
}
19+
20+
@Tag
21+
Object taggedSinkMethod() {
22+
Object resTag = new Object();
23+
return resTag;
24+
}
25+
26+
void sink1(Object x) { }
27+
28+
@interface Tag { }
29+
30+
@Tag
31+
void taggedSinkMethod(Object x) { }
32+
33+
@Tag
34+
Object taggedField;
35+
}

‎java/ql/test/library-tests/dataflow/external-models/C.java

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package my.qltest;
2+
3+
public class C {
4+
void foo() {
5+
Object arg1 = new Object();
6+
stepArgRes(arg1);
7+
8+
Object argIn1 = new Object();
9+
Object argOut1 = new Object();
10+
stepArgArg(argIn1, argOut1);
11+
Object argIn2 = new Object();
12+
Object argOut2 = new Object();
13+
stepArgArg(argIn2, argOut2);
14+
15+
Object arg2 = new Object();
16+
stepArgQual(arg2);
17+
Object arg3 = new Object();
18+
this.stepArgQual(arg3);
19+
20+
this.stepQualRes();
21+
stepQualRes();
22+
23+
Object argOut = new Object();
24+
stepQualArg(argOut);
25+
}
26+
27+
Object stepArgRes(Object x) { return null; }
28+
29+
void stepArgArg(Object in, Object out) { }
30+
31+
void stepArgQual(Object x) { }
32+
33+
Object stepQualRes() { return null; }
34+
35+
void stepQualArg(Object out) { }
36+
}

‎java/ql/test/library-tests/dataflow/external-models/sinks.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
invalidModelRow
2+
#select
3+
| B.java:6:11:6:14 | arg1 | qltest |
4+
| B.java:9:5:9:33 | this <.method> | qltest-arg |
5+
| B.java:9:22:9:32 | argToTagged | qltest-arg |
6+
| B.java:12:19:12:28 | fieldWrite | qltest-nospec |
7+
| B.java:17:12:17:14 | res | qltest |
8+
| B.java:23:12:23:17 | resTag | qltest-retval |

‎java/ql/test/library-tests/dataflow/external-models/sinks.ql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import java
2+
import semmle.code.java.dataflow.DataFlow
3+
import semmle.code.java.dataflow.ExternalFlow
4+
import CsvValidation
5+
6+
class SinkModelTest extends SinkModelCsv {
7+
override predicate row(string row) {
8+
row =
9+
[
10+
//"package;type;overrides;name;signature;ext;spec;kind",
11+
"my.qltest;B;false;sink1;(Object);;Argument[0];qltest",
12+
"my.qltest;B;false;sinkMethod;();;ReturnValue;qltest",
13+
"my.qltest;B$Tag;false;;;Annotated;ReturnValue;qltest-retval",
14+
"my.qltest;B$Tag;false;;;Annotated;Argument;qltest-arg",
15+
"my.qltest;B$Tag;false;;;Annotated;;qltest-nospec"
16+
]
17+
}
18+
}
19+
20+
from DataFlow::Node node, string kind
21+
where sinkNode(node, kind)
22+
select node, kind

‎java/ql/test/library-tests/dataflow/external-models/srcs.expected

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
invalidModelRow
2+
#select
3+
| A.java:6:9:6:14 | src1(...) | qltest |
4+
| A.java:6:9:6:14 | src1(...) | qltest-all-overloads |
5+
| A.java:7:9:7:16 | src1(...) | qltest |
6+
| A.java:7:9:7:16 | src1(...) | qltest-all-overloads |
7+
| A.java:7:9:7:16 | src1(...) | qltest-alt |
8+
| A.java:10:9:10:18 | src2(...) | qltest |
9+
| A.java:10:9:10:18 | src2(...) | qltest-w-subtypes |
10+
| A.java:11:9:11:18 | src3(...) | qltest-w-subtypes |
11+
| A.java:13:5:13:13 | this <.method> [post update] | qltest-argany |
12+
| A.java:13:12:13:12 | x [post update] | qltest-argany |
13+
| A.java:13:12:13:12 | x [post update] | qltest-argnum |
14+
| A.java:15:17:15:25 | srcparam1 | qltest-param-override |
15+
| A.java:18:36:18:51 | srcparam2 | qltest-param-override |
16+
| A.java:21:9:21:25 | taggedSrcMethod(...) | qltest-retval |
17+
| A.java:22:9:22:22 | taggedSrcField | qltest-nospec |
18+
| A.java:24:9:24:25 | srcTwoArg(...) | qltest-longsig |
19+
| A.java:24:9:24:25 | srcTwoArg(...) | qltest-shortsig |
20+
| A.java:28:8:28:14 | parameter this | qltest-param |
21+
| A.java:28:16:28:39 | taggedMethodParam | qltest-param |
22+
| A.java:31:16:31:41 | taggedSrcParam | qltest-nospec |
23+
| A.java:31:16:31:41 | taggedSrcParam | qltest-param |
24+
| A.java:56:10:56:24 | parameter this | qltest-param |

0 commit comments

Comments
 (0)