Skip to content

Commit 7bd7ecd

Browse files
egregius313egregius313
committed
Refactor Security.CWE.CWE-190 Arithmetic queries
1 parent 4a202b4 commit 7bd7ecd

File tree

3 files changed

+64
-48
lines changed

3 files changed

+64
-48
lines changed

‎java/ql/src/Security/CWE/CWE-190/ArithmeticTaintedLocal.ql

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,35 +15,41 @@
1515
import java
1616
import semmle.code.java.dataflow.FlowSources
1717
import ArithmeticCommon
18-
import DataFlow::PathGraph
1918

20-
class ArithmeticTaintedLocalOverflowConfig extends TaintTracking::Configuration {
21-
ArithmeticTaintedLocalOverflowConfig() { this = "ArithmeticTaintedLocalOverflowConfig" }
19+
private module ArithmeticTaintedLocalOverflowConfig implements DataFlow::ConfigSig {
20+
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
2221

23-
override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
22+
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
2423

25-
override predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
26-
27-
override predicate isSanitizer(DataFlow::Node n) { overflowBarrier(n) }
24+
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
2825
}
2926

30-
class ArithmeticTaintedLocalUnderflowConfig extends TaintTracking::Configuration {
31-
ArithmeticTaintedLocalUnderflowConfig() { this = "ArithmeticTaintedLocalUnderflowConfig" }
27+
module ArithmeticTaintedLocalOverflowFlow =
28+
TaintTracking::Make<ArithmeticTaintedLocalOverflowConfig>;
3229

33-
override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
30+
private module ArithmeticTaintedLocalUnderflowConfig implements DataFlow::ConfigSig {
31+
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
3432

35-
override predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
33+
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
3634

37-
override predicate isSanitizer(DataFlow::Node n) { underflowBarrier(n) }
35+
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
3836
}
3937

40-
from DataFlow::PathNode source, DataFlow::PathNode sink, ArithExpr exp, string effect
38+
module ArithmeticTaintedLocalUnderflowFlow =
39+
TaintTracking::Make<ArithmeticTaintedLocalUnderflowConfig>;
40+
41+
module Flow =
42+
DataFlow::MergePathGraph<ArithmeticTaintedLocalOverflowFlow::PathNode, ArithmeticTaintedLocalUnderflowFlow::PathNode, ArithmeticTaintedLocalOverflowFlow::PathGraph, ArithmeticTaintedLocalUnderflowFlow::PathGraph>;
43+
44+
import Flow::PathGraph
45+
46+
from Flow::PathNode source, Flow::PathNode sink, ArithExpr exp, string effect
4147
where
42-
any(ArithmeticTaintedLocalOverflowConfig c).hasFlowPath(source, sink) and
48+
ArithmeticTaintedLocalOverflowFlow::hasFlowPath(source.asPathNode1(), sink.asPathNode1()) and
4349
overflowSink(exp, sink.getNode().asExpr()) and
4450
effect = "overflow"
4551
or
46-
any(ArithmeticTaintedLocalUnderflowConfig c).hasFlowPath(source, sink) and
52+
ArithmeticTaintedLocalUnderflowFlow::hasFlowPath(source.asPathNode2(), sink.asPathNode2()) and
4753
underflowSink(exp, sink.getNode().asExpr()) and
4854
effect = "underflow"
4955
select exp, source, sink,

‎java/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,41 +17,47 @@ import semmle.code.java.dataflow.TaintTracking
1717
import semmle.code.java.security.RandomQuery
1818
import semmle.code.java.security.SecurityTests
1919
import ArithmeticCommon
20-
import DataFlow::PathGraph
2120

2221
class TaintSource extends DataFlow::ExprNode {
2322
TaintSource() {
2423
exists(RandomDataSource m | not m.resultMayBeBounded() | m.getOutput() = this.getExpr())
2524
}
2625
}
2726

28-
class ArithmeticUncontrolledOverflowConfig extends TaintTracking::Configuration {
29-
ArithmeticUncontrolledOverflowConfig() { this = "ArithmeticUncontrolledOverflowConfig" }
27+
private module ArithmeticUncontrolledOverflowConfig implements DataFlow::ConfigSig {
28+
predicate isSource(DataFlow::Node source) { source instanceof TaintSource }
3029

31-
override predicate isSource(DataFlow::Node source) { source instanceof TaintSource }
30+
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
3231

33-
override predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
34-
35-
override predicate isSanitizer(DataFlow::Node n) { overflowBarrier(n) }
32+
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
3633
}
3734

38-
class ArithmeticUncontrolledUnderflowConfig extends TaintTracking::Configuration {
39-
ArithmeticUncontrolledUnderflowConfig() { this = "ArithmeticUncontrolledUnderflowConfig" }
35+
module ArithmeticUncontrolledOverflowFlow =
36+
TaintTracking::Make<ArithmeticUncontrolledOverflowConfig>;
4037

41-
override predicate isSource(DataFlow::Node source) { source instanceof TaintSource }
38+
private module ArithmeticUncontrolledUnderflowConfig implements DataFlow::ConfigSig {
39+
predicate isSource(DataFlow::Node source) { source instanceof TaintSource }
4240

43-
override predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
41+
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
4442

45-
override predicate isSanitizer(DataFlow::Node n) { underflowBarrier(n) }
43+
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
4644
}
4745

48-
from DataFlow::PathNode source, DataFlow::PathNode sink, ArithExpr exp, string effect
46+
module ArithmeticUncontrolledUnderflowFlow =
47+
TaintTracking::Make<ArithmeticUncontrolledUnderflowConfig>;
48+
49+
module Flow =
50+
DataFlow::MergePathGraph<ArithmeticUncontrolledOverflowFlow::PathNode, ArithmeticUncontrolledUnderflowFlow::PathNode, ArithmeticUncontrolledOverflowFlow::PathGraph, ArithmeticUncontrolledUnderflowFlow::PathGraph>;
51+
52+
import Flow::PathGraph
53+
54+
from Flow::PathNode source, Flow::PathNode sink, ArithExpr exp, string effect
4955
where
50-
any(ArithmeticUncontrolledOverflowConfig c).hasFlowPath(source, sink) and
56+
ArithmeticUncontrolledOverflowFlow::hasFlowPath(source.asPathNode1(), sink.asPathNode1()) and
5157
overflowSink(exp, sink.getNode().asExpr()) and
5258
effect = "overflow"
5359
or
54-
any(ArithmeticUncontrolledUnderflowConfig c).hasFlowPath(source, sink) and
60+
ArithmeticUncontrolledUnderflowFlow::hasFlowPath(source.asPathNode2(), sink.asPathNode2()) and
5561
underflowSink(exp, sink.getNode().asExpr()) and
5662
effect = "underflow"
5763
select exp, source, sink,

‎java/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
import java
1717
import semmle.code.java.dataflow.DataFlow
1818
import ArithmeticCommon
19-
import DataFlow::PathGraph
2019

2120
abstract class ExtremeValueField extends Field {
2221
ExtremeValueField() { this.getType() instanceof IntegralType }
@@ -34,51 +33,56 @@ class ExtremeSource extends VarAccess {
3433
ExtremeSource() { this.getVariable() instanceof ExtremeValueField }
3534
}
3635

37-
class MaxValueFlowConfig extends DataFlow::Configuration {
38-
MaxValueFlowConfig() { this = "MaxValueFlowConfig" }
39-
40-
override predicate isSource(DataFlow::Node source) {
36+
private module MaxValueFlowConfig implements DataFlow::ConfigSig {
37+
predicate isSource(DataFlow::Node source) {
4138
source.asExpr().(ExtremeSource).getVariable() instanceof MaxValueField
4239
}
4340

44-
override predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
41+
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
4542

46-
override predicate isBarrierIn(DataFlow::Node n) { this.isSource(n) }
43+
predicate isBarrierIn(DataFlow::Node n) { isSource(n) }
4744

48-
override predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
45+
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
4946
}
5047

51-
class MinValueFlowConfig extends DataFlow::Configuration {
52-
MinValueFlowConfig() { this = "MinValueFlowConfig" }
48+
module MaxValueFlow = DataFlow::Make<MaxValueFlowConfig>;
5349

54-
override predicate isSource(DataFlow::Node source) {
50+
private module MinValueFlowConfig implements DataFlow::ConfigSig {
51+
predicate isSource(DataFlow::Node source) {
5552
source.asExpr().(ExtremeSource).getVariable() instanceof MinValueField
5653
}
5754

58-
override predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
55+
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
5956

60-
override predicate isBarrierIn(DataFlow::Node n) { this.isSource(n) }
57+
predicate isBarrierIn(DataFlow::Node n) { isSource(n) }
6158

62-
override predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
59+
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
6360
}
6461

62+
module MinValueFlow = DataFlow::Make<MinValueFlowConfig>;
63+
64+
module Flow =
65+
DataFlow::MergePathGraph<MaxValueFlow::PathNode, MinValueFlow::PathNode, MaxValueFlow::PathGraph, MinValueFlow::PathGraph>;
66+
67+
import Flow::PathGraph
68+
6569
predicate query(
66-
DataFlow::PathNode source, DataFlow::PathNode sink, ArithExpr exp, string effect, Type srctyp
70+
Flow::PathNode source, Flow::PathNode sink, ArithExpr exp, string effect, Type srctyp
6771
) {
6872
(
69-
any(MaxValueFlowConfig c).hasFlowPath(source, sink) and
73+
MaxValueFlow::hasFlowPath(source.asPathNode1(), sink.asPathNode1()) and
7074
overflowSink(exp, sink.getNode().asExpr()) and
7175
effect = "overflow"
7276
or
73-
any(MinValueFlowConfig c).hasFlowPath(source, sink) and
77+
MinValueFlow::hasFlowPath(source.asPathNode2(), sink.asPathNode2()) and
7478
underflowSink(exp, sink.getNode().asExpr()) and
7579
effect = "underflow"
7680
) and
7781
srctyp = source.getNode().asExpr().getType()
7882
}
7983

8084
from
81-
DataFlow::PathNode source, DataFlow::PathNode sink, ArithExpr exp, Variable v, ExtremeSource s,
85+
Flow::PathNode source, Flow::PathNode sink, ArithExpr exp, Variable v, ExtremeSource s,
8286
string effect, Type srctyp
8387
where
8488
query(source, sink, exp, effect, srctyp) and

0 commit comments

Comments
 (0)