Skip to content

Commit c9258ef

Browse files
jcogs33jcogs33
authored
Merge pull request github#11572 from jcogs33/jcogs33/model-top-jdk-apis
Java: model top 100 JDK APIs
2 parents 073e9bc + dc0bad3 commit c9258ef

File tree

26 files changed

+328
-2
lines changed

26 files changed

+328
-2
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,12 @@ module Public {
260260
* Holds if the neutral is auto generated.
261261
*/
262262
predicate isAutoGenerated() { neutralElement(this, true) }
263+
264+
/**
265+
* Holds if the neutral has the given provenance where `true` is
266+
* `generated` and `false` is `manual`.
267+
*/
268+
predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
263269
}
264270
}
265271

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,12 @@ module Public {
260260
* Holds if the neutral is auto generated.
261261
*/
262262
predicate isAutoGenerated() { neutralElement(this, true) }
263+
264+
/**
265+
* Holds if the neutral has the given provenance where `true` is
266+
* `generated` and `false` is `manual`.
267+
*/
268+
predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
263269
}
264270
}
265271

‎java/ql/lib/change-notes/2022-12-16-add-top-jdk-models.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added more dataflow models for frequently-used JDK APIs.

‎java/ql/lib/ext/java.lang.model.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,17 @@ extensions:
3737
- ["java.lang", "CharSequence", True, "charAt", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3838
- ["java.lang", "CharSequence", True, "subSequence", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3939
- ["java.lang", "CharSequence", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
40+
- ["java.lang", "IllegalArgumentException", False, "IllegalArgumentException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
41+
- ["java.lang", "IllegalStateException", False, "IllegalStateException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
42+
- ["java.lang", "Integer", False, "parseInt", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
4043
- ["java.lang", "Iterable", True, "forEach", "(Consumer)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
4144
- ["java.lang", "Iterable", True, "iterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4245
- ["java.lang", "Iterable", True, "spliterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4346
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4447
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapKey", "ReturnValue.MapKey", "value", "manual"]
4548
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapValue", "ReturnValue.MapValue", "value", "manual"]
49+
- ["java.lang", "RuntimeException", False, "RuntimeException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
50+
- ["java.lang", "RuntimeException", False, "RuntimeException", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
4651
- ["java.lang", "String", False, "String", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
4752
- ["java.lang", "String", False, "concat", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
4853
- ["java.lang", "String", False, "concat", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
@@ -82,7 +87,34 @@ extensions:
8287
- ["java.lang", "String", False, "valueOf", "(char)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8388
- ["java.lang", "String", False, "valueOf", "(char[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8489
- ["java.lang", "String", False, "valueOf", "(char[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
90+
- ["java.lang", "String", False, "valueOf", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8591
- ["java.lang", "StringBuffer", True, "StringBuffer", "(CharSequence)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8692
- ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8793
- ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8894
- ["java.lang", "System", False, "arraycopy", "", "", "Argument[0]", "Argument[2]", "taint", "manual"]
95+
- ["java.lang", "Throwable", False, "Throwable", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
96+
- ["java.lang", "Throwable", False, "getCause", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "ReturnValue", "value", "manual"]
97+
- ["java.lang", "Throwable", False, "getMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
98+
99+
- addsTo:
100+
pack: codeql/java-all
101+
extensible: neutralModel
102+
data:
103+
- ["java.lang", "Class", "getName", "()", "manual"]
104+
- ["java.lang", "Class", "getSimpleName", "()", "manual"]
105+
- ["java.lang", "Enum", "Enum", "(String,int)", "manual"]
106+
- ["java.lang", "Enum", "equals", "(Object)", "manual"]
107+
- ["java.lang", "Enum", "name", "()", "manual"]
108+
- ["java.lang", "Enum", "toString", "()", "manual"]
109+
- ["java.lang", "Object", "equals", "(Object)", "manual"]
110+
- ["java.lang", "Object", "getClass", "()", "manual"]
111+
- ["java.lang", "Object", "hashCode", "()", "manual"]
112+
- ["java.lang", "Object", "toString", "()", "manual"]
113+
- ["java.lang", "String", "contains", "(CharSequence)", "manual"]
114+
- ["java.lang", "String", "equals", "(Object)", "manual"]
115+
- ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"]
116+
- ["java.lang", "String", "hashCode", "()", "manual"]
117+
- ["java.lang", "String", "isEmpty", "()", "manual"]
118+
- ["java.lang", "String", "length", "()", "manual"]
119+
- ["java.lang", "String", "startsWith", "(String)", "manual"]
120+
- ["java.lang", "System", "currentTimeMillis", "()", "manual"]

‎java/ql/lib/ext/java.math.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["java.math", "BigDecimal", False, "BigDecimal", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]

‎java/ql/lib/ext/java.sql.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,9 @@ extensions:
1414
- ["java.sql", "Statement", True, "executeLargeUpdate", "", "", "Argument[0]", "sql", "manual"]
1515
- ["java.sql", "Statement", True, "executeQuery", "", "", "Argument[0]", "sql", "manual"]
1616
- ["java.sql", "Statement", True, "executeUpdate", "", "", "Argument[0]", "sql", "manual"]
17+
18+
- addsTo:
19+
pack: codeql/java-all
20+
extensible: summaryModel
21+
data:
22+
- ["java.sql", "ResultSet", True, "getString", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]

‎java/ql/lib/ext/java.util.model.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,3 +355,26 @@ extensions:
355355
- ["java.util", "Vector", True, "setElementAt", "(Object,int)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
356356
- ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapKey", "Argument[-1].MapKey", "value", "manual"]
357357
- ["java.util", "WeakHashMap", False, "WeakHashMap", "(Map)", "", "Argument[0].MapValue", "Argument[-1].MapValue", "value", "manual"]
358+
359+
- addsTo:
360+
pack: codeql/java-all
361+
extensible: neutralModel
362+
data:
363+
- ["java.util", "Collections", "emptyList", "()", "manual"]
364+
- ["java.util", "Collection", "size", "()", "manual"]
365+
- ["java.util", "Iterator", "hasNext", "()", "manual"]
366+
- ["java.util", "List", "contains", "(Object)", "manual"]
367+
- ["java.util", "List", "isEmpty", "()", "manual"]
368+
- ["java.util", "List", "size", "()", "manual"]
369+
- ["java.util", "Map", "containsKey", "(Object)", "manual"]
370+
- ["java.util", "Map", "isEmpty", "()", "manual"]
371+
- ["java.util", "Map", "size", "()", "manual"]
372+
- ["java.util", "Objects", "equals", "(Object,Object)", "manual"]
373+
- ["java.util", "Objects", "hash", "(Object[])", "manual"]
374+
- ["java.util", "Optional", "empty", "()", "manual"]
375+
- ["java.util", "Optional", "isPresent", "()", "manual"]
376+
- ["java.util", "Set", "contains", "(Object)", "manual"]
377+
- ["java.util", "Set", "isEmpty", "()", "manual"]
378+
- ["java.util", "Set", "size", "()", "manual"]
379+
- ["java.util", "UUID", "randomUUID", "()", "manual"]
380+
- ["java.util", "UUID", "toString", "()", "manual"]

‎java/ql/lib/ext/java.util.stream.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,9 @@ extensions:
8787
- ["java.util.stream", "Stream", True, "takeWhile", "(Predicate)", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
8888
- ["java.util.stream", "Stream", True, "toArray", "", "", "Argument[-1].Element", "ReturnValue.ArrayElement", "value", "manual"]
8989
- ["java.util.stream", "Stream", True, "toList", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
90+
91+
- addsTo:
92+
pack: codeql/java-all
93+
extensible: neutralModel
94+
data:
95+
- ["java.util.stream", "Collectors", "toList", "()", "manual"]

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,12 @@ module Public {
260260
* Holds if the neutral is auto generated.
261261
*/
262262
predicate isAutoGenerated() { neutralElement(this, true) }
263+
264+
/**
265+
* Holds if the neutral has the given provenance where `true` is
266+
* `generated` and `false` is `manual`.
267+
*/
268+
predicate hasProvenance(boolean generated) { neutralElement(this, generated) }
263269
}
264270
}
265271

‎java/ql/test/experimental/query-tests/security/CWE-400/ThreadResourceAbuse.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,14 @@ edges
1212
| ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number |
1313
| ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | waitTime |
1414
| ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | ThreadResourceAbuse.java:144:34:144:42 | delayTime |
15+
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:173:37:173:42 | header : String |
1516
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:176:17:176:26 | retryAfter |
17+
| ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number | ThreadResourceAbuse.java:176:17:176:26 | retryAfter |
18+
| ThreadResourceAbuse.java:173:37:173:42 | header : String | ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number |
19+
| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String |
1620
| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number |
21+
| ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number |
22+
| ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String | ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number |
1723
| ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | UploadListener.java:28:14:28:19 | parameter this [slowUploads] : Number |
1824
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number |
1925
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number |
@@ -42,8 +48,12 @@ nodes
4248
| ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | semmle.label | getValue(...) : String |
4349
| ThreadResourceAbuse.java:144:34:144:42 | delayTime | semmle.label | delayTime |
4450
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
51+
| ThreadResourceAbuse.java:173:20:173:43 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
52+
| ThreadResourceAbuse.java:173:37:173:42 | header : String | semmle.label | header : String |
4553
| ThreadResourceAbuse.java:176:17:176:26 | retryAfter | semmle.label | retryAfter |
4654
| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | semmle.label | getParameter(...) : String |
55+
| ThreadResourceAbuse.java:207:22:207:53 | parseInt(...) : Number | semmle.label | parseInt(...) : Number |
56+
| ThreadResourceAbuse.java:207:39:207:52 | uploadDelayStr : String | semmle.label | uploadDelayStr : String |
4757
| ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | semmle.label | new UploadListener(...) [slowUploads] : Number |
4858
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | semmle.label | uploadDelay : Number |
4959
| UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | semmle.label | sleepMilliseconds : Number |

0 commit comments

Comments
 (0)