Skip to content

Commit 7ddf7ff

Browse files
author
Benjamin Muskalla
committed
Track taint from concatenated string
1 parent d178fe4 commit 7ddf7ff

File tree

3 files changed

+27
-22
lines changed

3 files changed

+27
-22
lines changed

‎java/ql/src/semmle/code/java/frameworks/Strings.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ private class StringSummaryCsv extends SummaryModelCsv {
99
[
1010
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
1111
"java.lang;String;false;concat;(String);;Argument[0];ReturnValue;taint",
12+
"java.lang;String;false;concat;(String);;Argument[-1];ReturnValue;taint",
1213
"java.lang;String;false;copyValueOf;;;Argument[0];ReturnValue;taint",
1314
"java.lang;String;false;endsWith;;;Argument[-1];ReturnValue;taint",
1415
"java.lang;String;false;format;(Locale,String,Object[]);;Argument[1];ReturnValue;taint",

‎java/ql/test/library-tests/dataflow/taint/B.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ public static void maintest() throws java.io.UnsupportedEncodingException, java.
4646
// tainted - tokenized string
4747
String token = new StringTokenizer(badEscape).nextToken();
4848
sink(token);
49+
// tainted - fluent concatenation
50+
String fluentConcat = "".concat("str").concat(token).concat("bar");
51+
sink(fluentConcat);
4952

5053
// not tainted
5154
String safe = notTainty(complex);

‎java/ql/test/library-tests/dataflow/taint/test.expected

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,30 @@
1414
| B.java:15:21:15:27 | taint(...) | B.java:42:10:42:25 | valueOfSubstring |
1515
| B.java:15:21:15:27 | taint(...) | B.java:45:10:45:18 | badEscape |
1616
| B.java:15:21:15:27 | taint(...) | B.java:48:10:48:14 | token |
17-
| B.java:15:21:15:27 | taint(...) | B.java:65:10:65:13 | cond |
18-
| B.java:15:21:15:27 | taint(...) | B.java:68:10:68:14 | logic |
19-
| B.java:15:21:15:27 | taint(...) | B.java:70:10:70:39 | endsWith(...) |
20-
| B.java:15:21:15:27 | taint(...) | B.java:73:10:73:14 | logic |
17+
| B.java:15:21:15:27 | taint(...) | B.java:51:10:51:21 | fluentConcat |
18+
| B.java:15:21:15:27 | taint(...) | B.java:68:10:68:13 | cond |
19+
| B.java:15:21:15:27 | taint(...) | B.java:71:10:71:14 | logic |
20+
| B.java:15:21:15:27 | taint(...) | B.java:73:10:73:39 | endsWith(...) |
2121
| B.java:15:21:15:27 | taint(...) | B.java:76:10:76:14 | logic |
22-
| B.java:15:21:15:27 | taint(...) | B.java:84:10:84:16 | trimmed |
23-
| B.java:15:21:15:27 | taint(...) | B.java:86:10:86:14 | split |
24-
| B.java:15:21:15:27 | taint(...) | B.java:88:10:88:14 | lower |
25-
| B.java:15:21:15:27 | taint(...) | B.java:90:10:90:14 | upper |
26-
| B.java:15:21:15:27 | taint(...) | B.java:92:10:92:14 | bytes |
27-
| B.java:15:21:15:27 | taint(...) | B.java:94:10:94:17 | toString |
28-
| B.java:15:21:15:27 | taint(...) | B.java:96:10:96:13 | subs |
29-
| B.java:15:21:15:27 | taint(...) | B.java:98:10:98:13 | repl |
30-
| B.java:15:21:15:27 | taint(...) | B.java:100:10:100:16 | replAll |
31-
| B.java:15:21:15:27 | taint(...) | B.java:102:10:102:18 | replFirst |
32-
| B.java:15:21:15:27 | taint(...) | B.java:115:12:115:25 | serializedData |
33-
| B.java:15:21:15:27 | taint(...) | B.java:127:12:127:27 | deserializedData |
34-
| B.java:15:21:15:27 | taint(...) | B.java:136:10:136:21 | taintedArray |
35-
| B.java:15:21:15:27 | taint(...) | B.java:138:10:138:22 | taintedArray2 |
36-
| B.java:15:21:15:27 | taint(...) | B.java:140:10:140:22 | taintedArray3 |
37-
| B.java:15:21:15:27 | taint(...) | B.java:143:10:143:44 | toURL(...) |
38-
| B.java:15:21:15:27 | taint(...) | B.java:146:10:146:37 | toPath(...) |
39-
| B.java:15:21:15:27 | taint(...) | B.java:149:10:149:46 | toFile(...) |
22+
| B.java:15:21:15:27 | taint(...) | B.java:79:10:79:14 | logic |
23+
| B.java:15:21:15:27 | taint(...) | B.java:87:10:87:16 | trimmed |
24+
| B.java:15:21:15:27 | taint(...) | B.java:89:10:89:14 | split |
25+
| B.java:15:21:15:27 | taint(...) | B.java:91:10:91:14 | lower |
26+
| B.java:15:21:15:27 | taint(...) | B.java:93:10:93:14 | upper |
27+
| B.java:15:21:15:27 | taint(...) | B.java:95:10:95:14 | bytes |
28+
| B.java:15:21:15:27 | taint(...) | B.java:97:10:97:17 | toString |
29+
| B.java:15:21:15:27 | taint(...) | B.java:99:10:99:13 | subs |
30+
| B.java:15:21:15:27 | taint(...) | B.java:101:10:101:13 | repl |
31+
| B.java:15:21:15:27 | taint(...) | B.java:103:10:103:16 | replAll |
32+
| B.java:15:21:15:27 | taint(...) | B.java:105:10:105:18 | replFirst |
33+
| B.java:15:21:15:27 | taint(...) | B.java:118:12:118:25 | serializedData |
34+
| B.java:15:21:15:27 | taint(...) | B.java:130:12:130:27 | deserializedData |
35+
| B.java:15:21:15:27 | taint(...) | B.java:139:10:139:21 | taintedArray |
36+
| B.java:15:21:15:27 | taint(...) | B.java:141:10:141:22 | taintedArray2 |
37+
| B.java:15:21:15:27 | taint(...) | B.java:143:10:143:22 | taintedArray3 |
38+
| B.java:15:21:15:27 | taint(...) | B.java:146:10:146:44 | toURL(...) |
39+
| B.java:15:21:15:27 | taint(...) | B.java:149:10:149:37 | toPath(...) |
40+
| B.java:15:21:15:27 | taint(...) | B.java:152:10:152:46 | toFile(...) |
4041
| CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:8:12:8:14 | seq |
4142
| CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:11:12:11:21 | seqFromSeq |
4243
| MethodFlow.java:7:22:7:28 | taint(...) | MethodFlow.java:8:10:8:16 | tainted |

0 commit comments

Comments
 (0)