Skip to content

Commit d77d0c9

Browse files
atorralbaatorralba
committed
Added summaries for Spring PropertyValues
1 parent 4963a8f commit d77d0c9

File tree

10 files changed

+445
-0
lines changed

10 files changed

+445
-0
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ private module Frameworks {
8787
private import semmle.code.java.security.LdapInjection
8888
private import semmle.code.java.security.XPath
8989
private import semmle.code.java.security.JexlInjection
90+
private import semmle.code.java.frameworks.spring.Spring
9091
}
9192

9293
private predicate sourceModelCsv(string row) {

‎java/ql/src/semmle/code/java/frameworks/spring/Spring.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import semmle.code.java.frameworks.spring.SpringAttribute
66
import semmle.code.java.frameworks.spring.SpringAutowire
77
import semmle.code.java.frameworks.spring.SpringBean
88
import semmle.code.java.frameworks.spring.SpringBeanFile
9+
import semmle.code.java.frameworks.spring.SpringBeans
910
import semmle.code.java.frameworks.spring.SpringBeanRefType
1011
import semmle.code.java.frameworks.spring.SpringComponentScan
1112
import semmle.code.java.frameworks.spring.SpringConstructorArg

‎java/ql/src/semmle/code/java/frameworks/spring/SpringBeans.qll

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import java
2+
import semmle.code.java.dataflow.ExternalFlow
3+
4+
module SpringBeans {
5+
private class FlowSummaries extends SummaryModelCsv {
6+
override predicate row(string row) {
7+
row =
8+
[
9+
"org.springframework.beans;PropertyValue;false;PropertyValue;(String,Object);;Argument[0];MapKey of Argument[-1];value",
10+
"org.springframework.beans;PropertyValue;false;PropertyValue;(String,Object);;Argument[1];MapValue of Argument[-1];value",
11+
"org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue);;Argument[0];Argument[-1];value",
12+
"org.springframework.beans;PropertyValue;false;PropertyValue;(PropertyValue,Object);;MapKey of Argument[0];MapKey of Argument[-1];value",
13+
"org.springframework.beans;PropertyValue;false;getName;;;MapKey of Argument[-1];ReturnValue;value",
14+
"org.springframework.beans;PropertyValue;false;getValue;;;MapValue of Argument[-1];ReturnValue;value",
15+
"org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Argument[-1];ReturnValue;value",
16+
"org.springframework.beans;PropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
17+
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
18+
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of ReturnValue;value",
19+
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
20+
"org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of ReturnValue;value",
21+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of Argument[-1];value",
22+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of ReturnValue;value",
23+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
24+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
25+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of Argument[-1];value",
26+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of ReturnValue;value",
27+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of Argument[-1];value",
28+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of ReturnValue;value",
29+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of Argument[-1];value",
30+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of ReturnValue;value",
31+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of Argument[-1];value",
32+
"org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of ReturnValue;value",
33+
"org.springframework.beans;MutablePropertyValues;true;get;;;MapValue of Element of Argument[-1];ReturnValue;value",
34+
"org.springframework.beans;MutablePropertyValues;true;getPropertyValue;;;Element of Argument[-1];ReturnValue;value",
35+
"org.springframework.beans;MutablePropertyValues;true;getPropertyValueList;;;Element of Argument[-1];Element of ReturnValue;value",
36+
"org.springframework.beans;MutablePropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
37+
"org.springframework.beans;MutablePropertyValues;true;setPropertyValueAt;;;Argument[0];Element of Argument[-1];value"
38+
]
39+
}
40+
}
41+
}

‎java/ql/test/library-tests/frameworks/spring/beans/Test.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package generatedtest;
2+
3+
import org.springframework.beans.PropertyValue;
4+
5+
6+
public class Test {
7+
Object getMapKey(Object container) {
8+
return null;
9+
}
10+
11+
Object getMapValue(Object container) {
12+
return null;
13+
}
14+
15+
Object newWithMapKey(Object element) {
16+
return null;
17+
}
18+
19+
Object newWithMapValue(Object element) {
20+
return null;
21+
}
22+
23+
Object source() {
24+
return null;
25+
}
26+
27+
void sink(Object o) {}
28+
29+
public void test() {
30+
// @formatter:off
31+
// "org.springframework.beans;PropertyValue;false;;(String,Object);;Argument[0];MapKey of Argument[-1];value",
32+
{
33+
PropertyValue v = new PropertyValue((String) source(), null);
34+
sink(newWithMapKey(v)); // $hasValueFlow
35+
sink(newWithMapValue(v)); // Safe
36+
}
37+
// "org.springframework.beans;PropertyValue;false;;(String,Object);;Argument[1];MapValue of Argument[-1];value",
38+
{
39+
PropertyValue v = new PropertyValue("", source());
40+
sink(newWithMapKey(v)); // Safe
41+
sink(newWithMapValue(v)); // $hasValueFlow
42+
}
43+
// "org.springframework.beans;PropertyValue;false;;(PropertyValue);;Argument[0];Argument[-1];value",
44+
{
45+
PropertyValue v1 = new PropertyValue((String) source(), null);
46+
PropertyValue v2 = new PropertyValue(v1);
47+
sink(newWithMapKey(v2)); // $hasValueFlow
48+
sink(newWithMapValue(v2)); // Safe
49+
PropertyValue v3 = new PropertyValue("", source());
50+
PropertyValue v4 = new PropertyValue(v3);
51+
sink(newWithMapKey(v4)); // Safe
52+
sink(newWithMapValue(v4)); // $hasValueFlow
53+
}
54+
// "org.springframework.beans;PropertyValue;false;;(PropertyValue,Object);;MapKey of Argument[0];MapKey of Argument[-1];value",
55+
// "org.springframework.beans;PropertyValue;false;getName;;;MapKey of Argument[-1];ReturnValue;value",
56+
// "org.springframework.beans;PropertyValue;false;getValue;;;MapValue of Argument[-1];ReturnValue;value",
57+
// "org.springframework.beans;PropertyValues;true;getPropertyValue;;;MapValue of Argument[-1];ReturnValue;value",
58+
// "org.springframework.beans;PropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
59+
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
60+
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[0];MapKey of Element of ReturnValue;value",
61+
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
62+
// "org.springframework.beans;MutablePropertyValues;true;add;(String,Object);;Argument[1];MapValue of Element of ReturnValue;value",
63+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of Argument[-1];value",
64+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(PropertyValue);;Argument[0];Element of ReturnValue;value",
65+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[0];MapKey of Element of Argument[-1];value",
66+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValue;(String,Object);;Argument[1];MapValue of Element of Argument[-1];value",
67+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of Argument[-1];value",
68+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapKey of Argument[0];MapKey of Element of ReturnValue;value",
69+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of Argument[-1];value",
70+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(Map);;MapValue of Argument[0];MapValue of Element of ReturnValue;value",
71+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of Argument[-1];value",
72+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapKey of Element of Argument[0];MapKey of Element of ReturnValue;value",
73+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of Argument[-1];value",
74+
// "org.springframework.beans;MutablePropertyValues;true;addPropertyValues;(PropertyValues);;MapValue of Element of Argument[0];MapValue of Element of ReturnValue;value",
75+
// "org.springframework.beans;MutablePropertyValues;true;get;;;MapValue of Element of Argument[-1];ReturnValue;value",
76+
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValue;;;Element of Argument[-1];ReturnValue;value",
77+
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValueList;;;Element of Argument[-1];Element of ReturnValue;value",
78+
// "org.springframework.beans;MutablePropertyValues;true;getPropertyValues;;;Element of Argument[-1];ArrayElement of ReturnValue;value",
79+
// "org.springframework.beans;MutablePropertyValues;true;setPropertyValueAt;;;Argument[0];Element of Argument[-1];value"
80+
// @formatter:on
81+
82+
}
83+
}

‎java/ql/test/library-tests/frameworks/spring/beans/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3

‎java/ql/test/library-tests/frameworks/spring/beans/test.expected

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/spring/beans/test.ql

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
import java
2+
import semmle.code.java.dataflow.ExternalFlow
3+
import semmle.code.java.dataflow.TaintTracking
4+
import TestUtilities.InlineExpectationsTest
5+
import semmle.code.java.dataflow.internal.FlowSummaryImpl
6+
7+
class SummaryModelTest extends SummaryModelCsv {
8+
override predicate row(string row) {
9+
row =
10+
[
11+
//"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
12+
"generatedtest;Test;false;getMapKey;;;MapKey of Argument[0];ReturnValue;value",
13+
"generatedtest;Test;false;getMapValue;;;MapValue of Argument[0];ReturnValue;value",
14+
"generatedtest;Test;false;newWithElement;;;Argument[0];Element of ReturnValue;value",
15+
"generatedtest;Test;false;newWithMapKey;;;Argument[0];MapKey of ReturnValue;value",
16+
"generatedtest;Test;false;newWithMapValue;;;Argument[0];MapValue of ReturnValue;value"
17+
]
18+
}
19+
}
20+
21+
class ValueFlowConf extends DataFlow::Configuration {
22+
ValueFlowConf() { this = "qltest:valueFlowConf" }
23+
24+
override predicate isSource(DataFlow::Node n) {
25+
n.asExpr().(MethodAccess).getMethod().hasName("source")
26+
}
27+
28+
override predicate isSink(DataFlow::Node n) {
29+
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
30+
}
31+
}
32+
33+
class TaintFlowConf extends TaintTracking::Configuration {
34+
TaintFlowConf() { this = "qltest:taintFlowConf" }
35+
36+
override predicate isSource(DataFlow::Node n) {
37+
n.asExpr().(MethodAccess).getMethod().hasName("source")
38+
}
39+
40+
override predicate isSink(DataFlow::Node n) {
41+
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
42+
}
43+
}
44+
45+
class HasFlowTest extends InlineExpectationsTest {
46+
HasFlowTest() { this = "HasFlowTest" }
47+
48+
override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
49+
50+
override predicate hasActualResult(Location location, string element, string tag, string value) {
51+
tag = "hasValueFlow" and
52+
exists(DataFlow::Node src, DataFlow::Node sink, ValueFlowConf conf | conf.hasFlow(src, sink) |
53+
sink.getLocation() = location and
54+
element = sink.toString() and
55+
value = ""
56+
)
57+
or
58+
tag = "hasTaintFlow" and
59+
exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf |
60+
conf.hasFlow(src, sink) and not any(ValueFlowConf c).hasFlow(src, sink)
61+
|
62+
sink.getLocation() = location and
63+
element = sink.toString() and
64+
value = ""
65+
)
66+
}
67+
}

‎java/ql/test/stubs/springframework-5.2.3/org/springframework/beans/MutablePropertyValues.java

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
/*
2+
* Copyright 2002-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
5+
* in compliance with the License. You may obtain a copy of the License at
6+
*
7+
* https://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* Unless required by applicable law or agreed to in writing, software distributed under the License
10+
* is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
11+
* or implied. See the License for the specific language governing permissions and limitations under
12+
* the License.
13+
*/
14+
15+
package org.springframework.beans;
16+
17+
import java.io.Serializable;
18+
import java.util.Iterator;
19+
import java.util.List;
20+
import java.util.Map;
21+
import java.util.Spliterator;
22+
import java.util.stream.Stream;
23+
import org.springframework.lang.Nullable;
24+
25+
public class MutablePropertyValues implements PropertyValues, Serializable {
26+
public MutablePropertyValues() {}
27+
28+
public MutablePropertyValues(@Nullable PropertyValues original) {}
29+
30+
public MutablePropertyValues(@Nullable Map<?, ?> original) {}
31+
32+
public MutablePropertyValues(@Nullable List<PropertyValue> propertyValueList) {}
33+
34+
public List<PropertyValue> getPropertyValueList() {
35+
return null;
36+
}
37+
38+
public int size() {
39+
return 0;
40+
}
41+
42+
public MutablePropertyValues addPropertyValues(@Nullable PropertyValues other) {
43+
return null;
44+
}
45+
46+
public MutablePropertyValues addPropertyValues(@Nullable Map<?, ?> other) {
47+
return null;
48+
}
49+
50+
public MutablePropertyValues addPropertyValue(PropertyValue pv) {
51+
return null;
52+
}
53+
54+
public void addPropertyValue(String propertyName, Object propertyValue) {}
55+
56+
public MutablePropertyValues add(String propertyName, @Nullable Object propertyValue) {
57+
return null;
58+
}
59+
60+
public void setPropertyValueAt(PropertyValue pv, int i) {}
61+
62+
public void removePropertyValue(PropertyValue pv) {}
63+
64+
public void removePropertyValue(String propertyName) {}
65+
66+
@Override
67+
public Iterator<PropertyValue> iterator() {
68+
return null;
69+
}
70+
71+
@Override
72+
public Spliterator<PropertyValue> spliterator() {
73+
return null;
74+
}
75+
76+
@Override
77+
public Stream<PropertyValue> stream() {
78+
return null;
79+
}
80+
81+
@Override
82+
public PropertyValue[] getPropertyValues() {
83+
return null;
84+
}
85+
86+
@Override
87+
public PropertyValue getPropertyValue(String propertyName) {
88+
return null;
89+
}
90+
91+
public Object get(String propertyName) {
92+
return null;
93+
}
94+
95+
@Override
96+
public PropertyValues changesSince(PropertyValues old) {
97+
return null;
98+
}
99+
100+
@Override
101+
public boolean contains(String propertyName) {
102+
return false;
103+
}
104+
105+
@Override
106+
public boolean isEmpty() {
107+
return false;
108+
}
109+
110+
public void registerProcessedProperty(String propertyName) {}
111+
112+
public void clearProcessedProperty(String propertyName) {}
113+
114+
public void setConverted() {}
115+
116+
public boolean isConverted() {
117+
return false;
118+
}
119+
120+
@Override
121+
public boolean equals(@Nullable Object other) {
122+
return false;
123+
}
124+
125+
@Override
126+
public int hashCode() {
127+
return 0;
128+
}
129+
130+
@Override
131+
public String toString() {
132+
return null;
133+
}
134+
135+
}

0 commit comments

Comments
 (0)