Skip to content

Commit f749c31

Browse files
smowtonsmowton
committed
Add models for commons lang/text's Str[ing]Lookup class
1 parent 1580d23 commit f749c31

File tree

7 files changed

+319
-0
lines changed

7 files changed

+319
-0
lines changed

‎java/ql/src/semmle/code/java/frameworks/apache/Lang.qll

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,3 +266,43 @@ private class ApacheStrTokenizerTaintGetter extends TaintPreservingCallable {
266266

267267
override predicate returnsTaintFrom(int arg) { arg = -1 }
268268
}
269+
270+
private class ApacheStrLookup extends RefType {
271+
ApacheStrLookup() {
272+
this.hasQualifiedName("org.apache.commons.lang3.text", "StrLookup") or
273+
this.hasQualifiedName("org.apache.commons.text.lookup", "StringLookup")
274+
}
275+
}
276+
277+
private class ApacheStringLookupFactory extends RefType {
278+
ApacheStringLookupFactory() {
279+
this.hasQualifiedName("org.apache.commons.text.lookup", "StringLookupFactory")
280+
}
281+
}
282+
283+
/**
284+
* A callable that constructs an Apache Commons `Str[ing]Lookup` from a map.
285+
*/
286+
private class ApacheStrLookupTaintingMethod extends TaintPreservingCallable {
287+
ApacheStrLookupTaintingMethod() {
288+
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrLookup and
289+
this.getName() = "mapLookup"
290+
or
291+
this.getDeclaringType() instanceof ApacheStringLookupFactory and
292+
this.getName() = "mapStringLookup"
293+
}
294+
295+
override predicate returnsTaintFrom(int arg) { arg = 0 }
296+
}
297+
298+
/**
299+
* A callable that looks up a value in a Apache Commons `Str[ing]Lookup` map.
300+
*/
301+
private class ApacheStrLookupTaintGetter extends TaintPreservingCallable {
302+
ApacheStrLookupTaintGetter() {
303+
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrLookup and
304+
this.getName() = "lookup"
305+
}
306+
307+
override predicate returnsTaintFrom(int arg) { arg = -1 }
308+
}

‎java/ql/test/library-tests/frameworks/apache-commons-lang3/StrLookupTest.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import org.apache.commons.lang3.text.StrLookup;
2+
import java.util.HashMap;
3+
import java.util.Map;
4+
5+
class StrLookupTest {
6+
String taint() { return "tainted"; }
7+
8+
void sink(Object o) {}
9+
10+
void test() throws Exception {
11+
Map<String, String> map = new HashMap<String, String>();
12+
map.put("key", taint());
13+
StrLookup<String> lookup = StrLookup.mapLookup(map);
14+
sink(lookup.lookup("key")); // $hasTaintFlow=y
15+
}
16+
17+
}

‎java/ql/test/library-tests/frameworks/apache-commons-lang3/StringLookupTextTest.java

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import org.apache.commons.text.lookup.StringLookup;
2+
import org.apache.commons.text.lookup.StringLookupFactory;
3+
import java.util.HashMap;
4+
import java.util.Map;
5+
6+
class StringLookupTextTest {
7+
String taint() { return "tainted"; }
8+
9+
void sink(Object o) {}
10+
11+
void test() throws Exception {
12+
Map<String, String> map = new HashMap<String, String>();
13+
map.put("key", taint());
14+
StringLookup lookup = StringLookupFactory.INSTANCE.mapStringLookup(map);
15+
sink(lookup.lookup("key")); // $hasTaintFlow=y
16+
}
17+
18+
}

‎java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrLookup.java

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.commons.lang3.text;
18+
19+
import java.util.Map;
20+
21+
public abstract class StrLookup<V> {
22+
public static StrLookup<?> noneLookup() {
23+
return null;
24+
}
25+
26+
public static StrLookup<String> systemPropertiesLookup() {
27+
return null;
28+
}
29+
30+
public static <V> StrLookup<V> mapLookup(final Map<String, V> map) {
31+
return null;
32+
}
33+
34+
public abstract String lookup(String key);
35+
36+
}

‎java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/lookup/BiStringLookup.java

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache license, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the license for the specific language governing permissions and
15+
* limitations under the license.
16+
*/
17+
18+
package org.apache.commons.text.lookup;
19+
20+
import java.util.function.BiFunction;
21+
import java.util.function.Function;
22+
23+
public interface BiStringLookup<U> extends StringLookup {
24+
default String lookup(final String key, final U object) {
25+
return null;
26+
}
27+
28+
}

‎java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/lookup/StringLookup.java

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache license, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the license for the specific language governing permissions and
15+
* limitations under the license.
16+
*/
17+
18+
package org.apache.commons.text.lookup;
19+
20+
/**
21+
* Lookups a String key for a String value.
22+
* <p>
23+
* This class represents the simplest form of a string to string map. It has a benefit over a map in that it can create
24+
* the result on demand based on the key.
25+
* </p>
26+
* <p>
27+
* For example, it would be possible to implement a lookup that used the key as a primary key, and looked up the value
28+
* on demand from the database.
29+
* </p>
30+
*
31+
* @since 1.3
32+
*/
33+
@FunctionalInterface
34+
public interface StringLookup {
35+
String lookup(String key);
36+
37+
}

‎java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/lookup/StringLookupFactory.java

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache license, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the license for the specific language governing permissions and
15+
* limitations under the license.
16+
*/
17+
18+
package org.apache.commons.text.lookup;
19+
20+
import java.util.Map;
21+
import java.util.function.BiFunction;
22+
import java.util.function.Function;
23+
24+
25+
public final class StringLookupFactory {
26+
public static final StringLookupFactory INSTANCE = new StringLookupFactory();
27+
28+
public static void clear() {
29+
}
30+
31+
public void addDefaultStringLookups(final Map<String, StringLookup> stringLookupMap) {
32+
}
33+
34+
public StringLookup base64DecoderStringLookup() {
35+
return null;
36+
}
37+
38+
public StringLookup base64EncoderStringLookup() {
39+
return null;
40+
}
41+
42+
public StringLookup base64StringLookup() {
43+
return null;
44+
}
45+
46+
public <R, U> BiStringLookup<U> biFunctionStringLookup(final BiFunction<String, U, R> biFunction) {
47+
return null;
48+
}
49+
50+
public StringLookup constantStringLookup() {
51+
return null;
52+
}
53+
54+
public StringLookup dateStringLookup() {
55+
return null;
56+
}
57+
58+
public StringLookup dnsStringLookup() {
59+
return null;
60+
}
61+
62+
public StringLookup environmentVariableStringLookup() {
63+
return null;
64+
}
65+
66+
public StringLookup fileStringLookup() {
67+
return null;
68+
}
69+
70+
public <R> StringLookup functionStringLookup(final Function<String, R> function) {
71+
return null;
72+
}
73+
74+
public StringLookup interpolatorStringLookup() {
75+
return null;
76+
}
77+
78+
public StringLookup interpolatorStringLookup(final Map<String, StringLookup> stringLookupMap,
79+
final StringLookup defaultStringLookup, final boolean addDefaultLookups) {
80+
return null;
81+
}
82+
83+
public <V> StringLookup interpolatorStringLookup(final Map<String, V> map) {
84+
return null;
85+
}
86+
87+
public StringLookup interpolatorStringLookup(final StringLookup defaultStringLookup) {
88+
return null;
89+
}
90+
91+
public StringLookup javaPlatformStringLookup() {
92+
return null;
93+
}
94+
95+
public StringLookup localHostStringLookup() {
96+
return null;
97+
}
98+
99+
public <V> StringLookup mapStringLookup(final Map<String, V> map) {
100+
return null;
101+
}
102+
103+
public StringLookup nullStringLookup() {
104+
return null;
105+
}
106+
107+
public StringLookup propertiesStringLookup() {
108+
return null;
109+
}
110+
111+
public StringLookup resourceBundleStringLookup() {
112+
return null;
113+
}
114+
115+
public StringLookup resourceBundleStringLookup(final String bundleName) {
116+
return null;
117+
}
118+
119+
public StringLookup scriptStringLookup() {
120+
return null;
121+
}
122+
123+
public StringLookup systemPropertyStringLookup() {
124+
return null;
125+
}
126+
127+
public StringLookup urlDecoderStringLookup() {
128+
return null;
129+
}
130+
131+
public StringLookup urlEncoderStringLookup() {
132+
return null;
133+
}
134+
135+
public StringLookup urlStringLookup() {
136+
return null;
137+
}
138+
139+
public StringLookup xmlStringLookup() {
140+
return null;
141+
}
142+
143+
}

0 commit comments

Comments
 (0)