Skip to content

Commit c4e9b1f

Browse files
author
Sauyon Lee
committed
Model Spring util 
1 parent ca4c519 commit c4e9b1f

File tree

3 files changed

+161
-0
lines changed

3 files changed

+161
-0
lines changed

‎java/change-notes/2021-05-31-add-spring-stringutils.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added additional taint steps modeling the Spring `util` package (`org.springframework.util`).

‎java/ql/src/semmle/code/java/frameworks/spring/Spring.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import semmle.code.java.frameworks.spring.SpringQualifier
3232
import semmle.code.java.frameworks.spring.SpringRef
3333
import semmle.code.java.frameworks.spring.SpringReplacedMethod
3434
import semmle.code.java.frameworks.spring.SpringSet
35+
import semmle.code.java.frameworks.spring.SpringUtil
3536
import semmle.code.java.frameworks.spring.SpringValue
3637
import semmle.code.java.frameworks.spring.SpringXMLElement
3738
import semmle.code.java.frameworks.spring.metrics.MetricSpringBean

‎java/ql/src/semmle/code/java/frameworks/spring/SpringUtil.qll

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
/**
2+
* Provides models for the `org.springframework.util` package.
3+
*/
4+
import java
5+
import semmle.code.java.dataflow.ExternalFlow
6+
7+
/**
8+
* Provides models for the `org.springframework.util` package.
9+
*/
10+
module SpringUtil {
11+
private class FlowSummaries extends SummaryModelCsv {
12+
override predicate row(string row) {
13+
row = [
14+
"org.springframework.util;AutoPopulatingList;false;AutoPopulatingList;(java.util.List,org.springframework.util.AutoPopulatingList.ElementFactory);;Element of Argument[0];Element of Argument[-1];value",
15+
"org.springframework.util;AutoPopulatingList;false;AutoPopulatingList;(java.util.List,java.lang.Class);;Element of Argument[0];Element of Argument[-1];value",
16+
"org.springframework.util;Base64Utils;false;decode;;;Argument[0];ReturnValue;taint",
17+
"org.springframework.util;Base64Utils;false;decodeFromString;;;Argument[0];ReturnValue;taint",
18+
"org.springframework.util;Base64Utils;false;decodeFromUrlSafeString;;;Argument[0];ReturnValue;taint",
19+
"org.springframework.util;Base64Utils;false;decodeUrlSafe;;;Argument[0];ReturnValue;taint",
20+
"org.springframework.util;Base64Utils;false;encode;;;Argument[0];ReturnValue;taint",
21+
"org.springframework.util;Base64Utils;false;encodeToString;;;Argument[0];ReturnValue;taint",
22+
"org.springframework.util;Base64Utils;false;encodeToUrlSafeString;;;Argument[0];ReturnValue;taint",
23+
"org.springframework.util;Base64Utils;false;encodeUrlSafe;;;Argument[0];ReturnValue;taint",
24+
"org.springframework.util;CollectionUtils;false;arrayToList;;;ArrayElement of Argument[0];Element of ReturnValue;value",
25+
// find in argument[0] an element of argument[1]; I think exclude because it can be used to sanitize.
26+
//"org.springframework.util;CollectionUtils;false;findFirstMatch;;;Element of Argument[0];Element of ReturnValue;value",
27+
"org.springframework.util;CollectionUtils;false;findValueOfType;;;Element of Argument[0];Element of ReturnValue;value",
28+
"org.springframework.util;CollectionUtils;false;firstElement;;;Element of Argument[0];Element of ReturnValue;value",
29+
"org.springframework.util;CollectionUtils;false;lastElement;;;Element of Argument[0];Element of ReturnValue;value",
30+
"org.springframework.util;CollectionUtils;false;mergeArrayIntoCollection;;;ArrayElement of Argument[0];Element of Argument[1];value",
31+
"org.springframework.util;CollectionUtils;false;mergePropertiesIntoMap;;;MapKey of Argument[0];MapKey of Argument[1];value",
32+
"org.springframework.util;CollectionUtils;false;mergePropertiesIntoMap;;;MapValue of Argument[0];MapValue of Argument[1];value",
33+
"org.springframework.util;CollectionUtils;false;toArray;;;Element of Argument[0];ArrayElement of ReturnValue;value",
34+
"org.springframework.util;CollectionUtils;false;toIterator;;;Element of Argument[0];Element of ReturnValue;value",
35+
"org.springframework.util;CollectionUtils;false;toMultiValueMap;;;MapKey of Argument[0];MapKey of ReturnValue;value",
36+
"org.springframework.util;CollectionUtils;false;toMultiValueMap;;;Element of MapValue of Argument[0];Element of MapValue of ReturnValue;value",
37+
"org.springframework.util;CollectionUtils;false;unmodifiableMultiValueMap;;;MapKey of Argument[0];MapKey of ReturnValue;value",
38+
"org.springframework.util;CollectionUtils;false;unmodifiableMultiValueMap;;;MapValue of Argument[0];MapValue of ReturnValue;value",
39+
"org.springframework.util;CompositeIterator;false;add;;;Element of Argument[0];Element of Argument[-1];value",
40+
"org.springframework.util;CompositeIterator;false;next;;;Element of Argument[-1];ReturnValue;value",
41+
"org.springframework.util.ConcurrentReferenceHashMap;Reference;false;get;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
42+
"org.springframework.util.ConcurrentReferenceHashMap;Reference;false;get;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
43+
"org.springframework.util.ConcurrentReferenceHashMap;Reference;false;get;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
44+
"org.springframework.util.ConcurrentReferenceHashMap;Segment;false;getReference;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
45+
"org.springframework.util.ConcurrentReferenceHashMap;Segment;false;getReference;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
46+
"org.springframework.util;ConcurrentReferenceHashMap;false;getReference;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
47+
"org.springframework.util;ConcurrentReferenceHashMap;false;getReference;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
48+
"org.springframework.util;ConcurrentReferenceHashMap;false;getSegment;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
49+
"org.springframework.util;ConcurrentReferenceHashMap;false;getSegment;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
50+
// skipped md5 digest
51+
"org.springframework.util;FastByteArrayOutputStream;false;getInputStream;;;Argument[-1];ReturnValue;taint",
52+
"org.springframework.util;FastByteArrayOutputStream;false;toByteArray;;;Argument[-1];ReturnValue;taint",
53+
"org.springframework.util;FastByteArrayOutputStream;false;write;;;Argument[0];Argument[-1];taint",
54+
"org.springframework.util;FastByteArrayOutputStream;false;writeTo;;;Argument[-1];Argument[0];taint",
55+
"org.springframework.util;FileCopyUtils;false;copy;;;Argument[0];Argument[1];taint",
56+
"org.springframework.util;FileCopyUtils;false;copyToByteArray;;;Argument[0];ReturnValue;taint",
57+
"org.springframework.util;FileCopyUtils;false;copyToString;;;Argument[0];ReturnValue;taint",
58+
"org.springframework.util;FileSystemUtils;false;copyRecursively;(java.io.File,java.io.File);;Argument[0];Argument[1];taint",
59+
"org.springframework.util;LinkedMultiValueMap;false;LinkedMultiValueMap;(java.util.Map);;MapKey of Argument[0];MapKey of Argument[-1];value",
60+
"org.springframework.util;LinkedMultiValueMap;false;LinkedMultiValueMap;(java.util.Map);;Element of MapValue of Argument[0];Element of MapValue of Argument[-1];value",
61+
"org.springframework.util;LinkedMultiValueMap;false;deepCopy;;;MapKey of Argument[-1];MapValue of ReturnValue;value",
62+
"org.springframework.util;LinkedMultiValueMap;false;deepCopy;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
63+
"org.springframework.util;MultiValueMap;true;add;;;Argument[0];MapKey of Argument[-1];value",
64+
"org.springframework.util;MultiValueMap;true;add;;;Argument[1];Element of MapValue of Argument[-1];value",
65+
"org.springframework.util;MultiValueMap;true;addAll;;;Argument[0];MapKey of Argument[-1];value",
66+
"org.springframework.util;MultiValueMap;true;addAll;(java.lang.Object,java.util.List);;Element of Argument[1];Element of MapValue of Argument[-1];value",
67+
"org.springframework.util;MultiValueMap;true;addAll;(org.springframework.util.MultiValueMap);;MapValue of Argument[0];Element of MapValue of Argument[-1];value",
68+
"org.springframework.util;MultiValueMap;true;addIfAbsent;;;Argument[0];MapKey of Argument[-1];value",
69+
"org.springframework.util;MultiValueMap;true;addIfAbsent;;;Argument[1];Element of MapValue of Argument[-1];value",
70+
"org.springframework.util;MultiValueMap;true;getFirst;;;Element of MapValue of Argument[-1];ReturnValue;value",
71+
"org.springframework.util;MultiValueMap;true;set;;;Argument[0];MapKey of Argument[-1];value",
72+
"org.springframework.util;MultiValueMap;true;set;;;Argument[1];Element of MapValue of Argument[-1];value",
73+
"org.springframework.util;MultiValueMap;true;setAll;;;MapKey of Argument[0];MapKey of Argument[-1];value",
74+
"org.springframework.util;MultiValueMap;true;setAll;;;MapValue of Argument[0];Element of MapValue of Argument[-1];value",
75+
"org.springframework.util;MultiValueMap;true;toSingleValueMap;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
76+
"org.springframework.util;MultiValueMap;true;toSingleValueMap;;;Element of MapValue of Argument[-1];MapValue of ReturnValue;value",
77+
"org.springframework.util;MultiValueMapAdapter;false;MultiValueMapAdapter;;;MapKey of Argument[0];MapKey of Argument[-1];value",
78+
"org.springframework.util;MultiValueMapAdapter;false;MultiValueMapAdapter;;;Element of MapValue of Argument[0];Element of MapValue of Argument[-1];value",
79+
"org.springframework.util;ObjectUtils;false;addObjectToArray;;;ArrayElement of Argument[0];ArrayElement of ReturnValue;value",
80+
"org.springframework.util;ObjectUtils;false;addObjectToArray;;;Argument[1];ArrayElement of ReturnValue;value",
81+
"org.springframework.util;ObjectUtils;false;getDisplayString;;;Argument[0];ReturnValue;taint",
82+
"org.springframework.util;ObjectUtils;false;identityToString;;;Argument[0];ReturnValue;taint",
83+
"org.springframework.util;ObjectUtils;false;nullSafeToString;;;Argument[0];ReturnValue;taint",
84+
"org.springframework.util;ObjectUtils;false;toObjectArray;;;Element of Argument[0];Element of ReturnValue;value",
85+
"org.springframework.util;ObjectUtils;false;unwrapOptional;;;Element of Argument[0];ReturnValue;value",
86+
"org.springframework.util;PropertiesPersister;true;load;;;Argument[1];Argument[0];taint",
87+
"org.springframework.util;PropertiesPersister;true;loadFromXml;;;Argument[1];Argument[0];taint",
88+
"org.springframework.util;PropertiesPersister;true;store;;;Argument[0];Argument[1];taint",
89+
"org.springframework.util;PropertiesPersister;true;store;;;Argument[2];Argument[1];taint",
90+
"org.springframework.util;PropertiesPersister;true;storeToXml;;;Argument[0];Argument[1];taint",
91+
"org.springframework.util;PropertiesPersister;true;storeToXml;;;Argument[2];Argument[1];taint",
92+
"org.springframework.util;PropertyPlaceholderHelper;false;PropertyPlaceholderHelper;;;Argument[0..1];Argument[-1];taint",
93+
"org.springframework.util;PropertyPlaceholderHelper;false;parseStringValue;;;Argument[0];ReturnValue;taint",
94+
"org.springframework.util;PropertyPlaceholderHelper;false;replacePlaceholders;;;Argument[0];ReturnValue;taint",
95+
"org.springframework.util;PropertyPlaceholderHelper;false;replacePlaceholders;(java.lang.String,java.util.Properties);;MapValue of Argument[1];ReturnValue;taint",
96+
"org.springframework.util;ResourceUtils;false;extractArchiveURL;;;Argument[0];ReturnValue;taint",
97+
"org.springframework.util;ResourceUtils;false;extractJarFileURL;;;Argument[0];ReturnValue;taint",
98+
"org.springframework.util;ResourceUtils;false;getFile;;;Argument[0];ReturnValue;taint",
99+
"org.springframework.util;ResourceUtils;false;getURL;;;Argument[0];ReturnValue;taint",
100+
"org.springframework.util;ResourceUtils;false;toURI;;;Argument[0];ReturnValue;taint",
101+
"org.springframework.util;RouteMatcher;true;combine;;;Argument[0..1];ReturnValue;taint",
102+
"org.springframework.util;RouteMatcher;true;matchAndExtract;;;Argument[0];MapKey of ReturnValue;taint",
103+
"org.springframework.util;RouteMatcher;true;matchAndExtract;;;Argument[1];MapValue of ReturnValue;taint",
104+
"org.springframework.util;RouteMatcher;true;parseRoute;;;Argument[0];ReturnValue;taint",
105+
"org.springframework.util;SerializationUtils;false;deserialize;;;Argument[0];ReturnValue;taint",
106+
"org.springframework.util;SerializationUtils;false;serialize;;;Argument[0];ReturnValue;taint",
107+
"org.springframework.util;StreamUtils;false;copy;(byte[],java.io.OutputStream);;Argument[0];Argument[1];taint",
108+
"org.springframework.util;StreamUtils;false;copy;(java.io.InputStream,java.io.OutputStream);;Argument[0];Argument[1];taint",
109+
"org.springframework.util;StreamUtils;false;copy;(java.lang.String,java.nio.charset.Charset,java.io.OutputStream);;Argument[0];Argument[2];taint",
110+
"org.springframework.util;StreamUtils;false;copyRange;;;Argument[0];Argument[1];taint",
111+
"org.springframework.util;StreamUtils;false;copyToByteArray;;;Argument[0];ReturnValue;taint",
112+
"org.springframework.util;StreamUtils;false;copyToString;;;Argument[0];ReturnValue;taint",
113+
"org.springframework.util;StringUtils;false;addStringToArray;;;ArrayElement of Argument[0];ArrayElement of ReturnValue;taint",
114+
"org.springframework.util;StringUtils;false;addStringToArray;;;Argument[1];ArrayElement of ReturnValue;taint",
115+
"org.springframework.util;StringUtils;false;applyRelativePath;;;Argument[0..1];ReturnValue;taint",
116+
"org.springframework.util;StringUtils;false;arrayToCommaDelimitedString;;;Argument[0];ReturnValue;taint",
117+
"org.springframework.util;StringUtils;false;arrayToDelimitedString;;;Argument[0..1];ReturnValue;taint",
118+
"org.springframework.util;StringUtils;false;capitalize;;;Argument[0];ReturnValue;taint",
119+
"org.springframework.util;StringUtils;false;cleanPath;;;Argument[0];ReturnValue;taint",
120+
"org.springframework.util;StringUtils;false;collectionToCommaDelimitedString;;;Argument[0];ReturnValue;taint",
121+
"org.springframework.util;StringUtils;false;collectionToDelimitedString;;;Argument[0..1];ReturnValue;taint",
122+
"org.springframework.util;StringUtils;false;collectionToDelimitedString;(java.util.Collection,java.lang.String,java.lang.String,java.lang.String);;Argument[2..3];ReturnValue;taint",
123+
"org.springframework.util;StringUtils;false;commaDelimitedListToSet;;;Argument[0];ReturnValue;taint",
124+
"org.springframework.util;StringUtils;false;commaDelimitedListToStringArray;;;Argument[0];ReturnValue;taint",
125+
"org.springframework.util;StringUtils;false;concatenateStringArrays;;;Argument[0..1];ReturnValue;taint",
126+
"org.springframework.util;StringUtils;false;delete;;;Argument[0];ReturnValue;taint",
127+
"org.springframework.util;StringUtils;false;deleteAny;;;Argument[0];ReturnValue;taint",
128+
"org.springframework.util;StringUtils;false;delimitedListToStringArray;;;Argument[0];ReturnValue;taint",
129+
"org.springframework.util;StringUtils;false;getFilename;;;Argument[0];ReturnValue;taint",
130+
"org.springframework.util;StringUtils;false;getFilenameExtension;;;Argument[0];ReturnValue;taint",
131+
"org.springframework.util;StringUtils;false;mergeStringArrays;;;Argument[0..1];ReturnValue;taint",
132+
"org.springframework.util;StringUtils;false;quote;;;Argument[0];ReturnValue;taint",
133+
"org.springframework.util;StringUtils;false;quoteIfString;;;Argument[0];ReturnValue;taint",
134+
"org.springframework.util;StringUtils;false;removeDuplicateStrings;;;Argument[0];ReturnValue;taint",
135+
"org.springframework.util;StringUtils;false;replace;;;Argument[0];ReturnValue;taint",
136+
"org.springframework.util;StringUtils;false;replace;;;Argument[2];ReturnValue;taint",
137+
"org.springframework.util;StringUtils;false;sortStringArray;;;Argument[0];ReturnValue;taint",
138+
"org.springframework.util;StringUtils;false;split;;;Argument[0];ReturnValue;taint",
139+
"org.springframework.util;StringUtils;false;splitArrayElementsIntoProperties;;;Argument[0];ReturnValue;taint",
140+
"org.springframework.util;StringUtils;false;stripFilenameExtension;;;Argument[0];ReturnValue;taint",
141+
"org.springframework.util;StringUtils;false;tokenizeToStringArray;;;Argument[0];ReturnValue;taint",
142+
"org.springframework.util;StringUtils;false;toStringArray;;;Argument[0];ReturnValue;taint",
143+
"org.springframework.util;StringUtils;false;trimAllWhitespace;;;Argument[0];ReturnValue;taint",
144+
"org.springframework.util;StringUtils;false;trimArrayElements;;;Argument[0];ReturnValue;taint",
145+
"org.springframework.util;StringUtils;false;trimLeadingCharacter;;;Argument[0];ReturnValue;taint",
146+
"org.springframework.util;StringUtils;false;trimLeadingWhitespace;;;Argument[0];ReturnValue;taint",
147+
"org.springframework.util;StringUtils;false;trimTrailingCharacter;;;Argument[0];ReturnValue;taint",
148+
"org.springframework.util;StringUtils;false;trimTrailingWhitespace;;;Argument[0];ReturnValue;taint",
149+
"org.springframework.util;StringUtils;false;trimWhitespace;;;Argument[0];ReturnValue;taint",
150+
"org.springframework.util;StringUtils;false;uncapitalize;;;Argument[0];ReturnValue;taint",
151+
"org.springframework.util;StringUtils;false;unqualify;;;Argument[0];ReturnValue;taint",
152+
"org.springframework.util;StringUtils;false;uriDecode;;;Argument[0];ReturnValue;taint",
153+
"org.springframework.util;StringValueResolver;false;resolveStringValue;;;Argument[0];ReturnValue;taint",
154+
"org.springframework.util;SystemPropertyUtils;false;resolvePlaceholders;;;Argument[0];ReturnValue;taint"
155+
]
156+
}
157+
}
158+
}

0 commit comments

Comments
 (0)