Skip to content

Commit 97186b3

Browse files
artem-smotrakovartem-smotrakov
committed
Added comments for tests
1 parent b96b665 commit 97186b3

File tree

2 files changed

+52
-43
lines changed

2 files changed

+52
-43
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,46 @@
11
edges
2-
| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:24:31:24:40 | expression : String |
3-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:30:24:30:33 | expression : String |
4-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:37:24:37:33 | expression : String |
5-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:44:24:44:33 | expression : String |
6-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:54:24:54:33 | expression : String |
7-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:61:24:61:33 | expression : String |
8-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:68:24:68:33 | expression : String |
9-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:77:24:77:33 | expression : String |
10-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | JakartaExpressionInjection.java:86:24:86:33 | expression : String |
11-
| JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
12-
| JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
13-
| JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
14-
| JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
15-
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:63:43:63:52 | expression |
16-
| JakartaExpressionInjection.java:68:24:68:33 | expression : String | JakartaExpressionInjection.java:72:13:72:13 | e |
17-
| JakartaExpressionInjection.java:77:24:77:33 | expression : String | JakartaExpressionInjection.java:81:13:81:13 | e |
18-
| JakartaExpressionInjection.java:86:24:86:33 | expression : String | JakartaExpressionInjection.java:90:13:90:13 | e |
2+
| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
3+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:32:24:32:33 | expression : String |
4+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:40:24:40:33 | expression : String |
5+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:48:24:48:33 | expression : String |
6+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:59:24:59:33 | expression : String |
7+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:67:24:67:33 | expression : String |
8+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:75:24:75:33 | expression : String |
9+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:85:24:85:33 | expression : String |
10+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:95:24:95:33 | expression : String |
11+
| JakartaExpressionInjection.java:32:24:32:33 | expression : String | JakartaExpressionInjection.java:34:28:34:37 | expression |
12+
| JakartaExpressionInjection.java:40:24:40:33 | expression : String | JakartaExpressionInjection.java:42:32:42:41 | expression |
13+
| JakartaExpressionInjection.java:48:24:48:33 | expression : String | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression |
14+
| JakartaExpressionInjection.java:59:24:59:33 | expression : String | JakartaExpressionInjection.java:61:32:61:41 | expression |
15+
| JakartaExpressionInjection.java:67:24:67:33 | expression : String | JakartaExpressionInjection.java:69:43:69:52 | expression |
16+
| JakartaExpressionInjection.java:75:24:75:33 | expression : String | JakartaExpressionInjection.java:79:13:79:13 | e |
17+
| JakartaExpressionInjection.java:85:24:85:33 | expression : String | JakartaExpressionInjection.java:89:13:89:13 | e |
18+
| JakartaExpressionInjection.java:95:24:95:33 | expression : String | JakartaExpressionInjection.java:99:13:99:13 | e |
1919
nodes
20-
| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
21-
| JakartaExpressionInjection.java:24:31:24:40 | expression : String | semmle.label | expression : String |
22-
| JakartaExpressionInjection.java:30:24:30:33 | expression : String | semmle.label | expression : String |
23-
| JakartaExpressionInjection.java:32:28:32:37 | expression | semmle.label | expression |
24-
| JakartaExpressionInjection.java:37:24:37:33 | expression : String | semmle.label | expression : String |
25-
| JakartaExpressionInjection.java:39:32:39:41 | expression | semmle.label | expression |
26-
| JakartaExpressionInjection.java:44:24:44:33 | expression : String | semmle.label | expression : String |
27-
| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | semmle.label | lambdaExpression |
28-
| JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
29-
| JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
30-
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
31-
| JakartaExpressionInjection.java:63:43:63:52 | expression | semmle.label | expression |
32-
| JakartaExpressionInjection.java:68:24:68:33 | expression : String | semmle.label | expression : String |
33-
| JakartaExpressionInjection.java:72:13:72:13 | e | semmle.label | e |
34-
| JakartaExpressionInjection.java:77:24:77:33 | expression : String | semmle.label | expression : String |
35-
| JakartaExpressionInjection.java:81:13:81:13 | e | semmle.label | e |
36-
| JakartaExpressionInjection.java:86:24:86:33 | expression : String | semmle.label | expression : String |
37-
| JakartaExpressionInjection.java:90:13:90:13 | e | semmle.label | e |
20+
| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
21+
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | semmle.label | expression : String |
22+
| JakartaExpressionInjection.java:32:24:32:33 | expression : String | semmle.label | expression : String |
23+
| JakartaExpressionInjection.java:34:28:34:37 | expression | semmle.label | expression |
24+
| JakartaExpressionInjection.java:40:24:40:33 | expression : String | semmle.label | expression : String |
25+
| JakartaExpressionInjection.java:42:32:42:41 | expression | semmle.label | expression |
26+
| JakartaExpressionInjection.java:48:24:48:33 | expression : String | semmle.label | expression : String |
27+
| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | semmle.label | lambdaExpression |
28+
| JakartaExpressionInjection.java:59:24:59:33 | expression : String | semmle.label | expression : String |
29+
| JakartaExpressionInjection.java:61:32:61:41 | expression | semmle.label | expression |
30+
| JakartaExpressionInjection.java:67:24:67:33 | expression : String | semmle.label | expression : String |
31+
| JakartaExpressionInjection.java:69:43:69:52 | expression | semmle.label | expression |
32+
| JakartaExpressionInjection.java:75:24:75:33 | expression : String | semmle.label | expression : String |
33+
| JakartaExpressionInjection.java:79:13:79:13 | e | semmle.label | e |
34+
| JakartaExpressionInjection.java:85:24:85:33 | expression : String | semmle.label | expression : String |
35+
| JakartaExpressionInjection.java:89:13:89:13 | e | semmle.label | e |
36+
| JakartaExpressionInjection.java:95:24:95:33 | expression : String | semmle.label | expression : String |
37+
| JakartaExpressionInjection.java:99:13:99:13 | e | semmle.label | e |
3838
#select
39-
| JakartaExpressionInjection.java:32:28:32:37 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:32:28:32:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
40-
| JakartaExpressionInjection.java:39:32:39:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:39:32:39:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
41-
| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
42-
| JakartaExpressionInjection.java:56:32:56:41 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:56:32:56:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
43-
| JakartaExpressionInjection.java:63:43:63:52 | expression | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:63:43:63:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
44-
| JakartaExpressionInjection.java:72:13:72:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:72:13:72:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
45-
| JakartaExpressionInjection.java:81:13:81:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:81:13:81:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
46-
| JakartaExpressionInjection.java:90:13:90:13 | e | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:90:13:90:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) | this user input |
39+
| JakartaExpressionInjection.java:34:28:34:37 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:34:28:34:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
40+
| JakartaExpressionInjection.java:42:32:42:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:42:32:42:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
41+
| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
42+
| JakartaExpressionInjection.java:61:32:61:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:61:32:61:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
43+
| JakartaExpressionInjection.java:69:43:69:52 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:69:43:69:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
44+
| JakartaExpressionInjection.java:79:13:79:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:79:13:79:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
45+
| JakartaExpressionInjection.java:89:13:89:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:89:13:89:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
46+
| JakartaExpressionInjection.java:99:13:99:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:99:13:99:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |

‎java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
public class JakartaExpressionInjection {
1717

18+
// calls a consumer with a string received from a socket
1819
private static void testWithSocket(Consumer<String> action) throws IOException {
1920
try (ServerSocket serverSocket = new ServerSocket(0)) {
2021
try (Socket socket = serverSocket.accept()) {
@@ -26,20 +27,23 @@ private static void testWithSocket(Consumer<String> action) throws IOException {
2627
}
2728
}
2829

30+
// BAD (untrusted input to ELProcessor.eval)
2931
private static void testWithELProcessorEval() throws IOException {
3032
testWithSocket(expression -> {
3133
ELProcessor processor = new ELProcessor();
3234
processor.eval(expression);
3335
});
3436
}
3537

38+
// BAD (untrusted input to ELProcessor.getValue)
3639
private static void testWithELProcessorGetValue() throws IOException {
3740
testWithSocket(expression -> {
3841
ELProcessor processor = new ELProcessor();
3942
processor.getValue(expression, Object.class);
4043
});
4144
}
4245

46+
// BAD (untrusted input to LambdaExpression.invoke)
4347
private static void testWithLambdaExpressionInvoke() throws IOException {
4448
testWithSocket(expression -> {
4549
ExpressionFactory factory = ELManager.getExpressionFactory();
@@ -50,20 +54,23 @@ private static void testWithLambdaExpressionInvoke() throws IOException {
5054
});
5155
}
5256

57+
// BAD (untrusted input to ELProcessor.setValue)
5358
private static void testWithELProcessorSetValue() throws IOException {
5459
testWithSocket(expression -> {
5560
ELProcessor processor = new ELProcessor();
5661
processor.setValue(expression, new Object());
5762
});
5863
}
5964

65+
// BAD (untrusted input to ELProcessor.setVariable)
6066
private static void testWithELProcessorSetVariable() throws IOException {
6167
testWithSocket(expression -> {
6268
ELProcessor processor = new ELProcessor();
6369
processor.setVariable("test", expression);
6470
});
6571
}
6672

73+
// BAD (untrusted input to ValueExpression.getValue when it was created by JUEL)
6774
private static void testWithJuelValueExpressionGetValue() throws IOException {
6875
testWithSocket(expression -> {
6976
ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
@@ -73,6 +80,7 @@ private static void testWithJuelValueExpressionGetValue() throws IOException {
7380
});
7481
}
7582

83+
// BAD (untrusted input to ValueExpression.setValue when it was created by JUEL)
7684
private static void testWithJuelValueExpressionSetValue() throws IOException {
7785
testWithSocket(expression -> {
7886
ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
@@ -82,6 +90,7 @@ private static void testWithJuelValueExpressionSetValue() throws IOException {
8290
});
8391
}
8492

93+
// BAD (untrusted input to MethodExpression.invoke when it was created by JUEL)
8594
private static void testWithJuelMethodExpressionInvoke() throws IOException {
8695
testWithSocket(expression -> {
8796
ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();

0 commit comments

Comments
 (0)