Skip to content

Commit fc017b7

Browse files
joefarebrotherjoefarebrother
committed
Use ArrayElement of in flow step specifications
1 parent 1541593 commit fc017b7

File tree

2 files changed

+45
-25
lines changed
  • java/ql

2 files changed

+45
-25
lines changed

‎java/ql/src/semmle/code/java/frameworks/android/SQLite.qll

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -118,26 +118,39 @@ private class SqlFlowStep extends SummaryModelCsv {
118118
// buildQuery(String[] projectionIn, String selection, String groupBy, String having, String sortOrder, String limit)
119119
// buildQuery(String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit)
120120
// buildUnionQuery(String[] subQueries, String sortOrder, String limit)
121-
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String,String,String,String);;Argument[-1..5];ReturnValue;taint",
122-
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;Argument[-1..1];ReturnValue;taint",
121+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String,String,String,String);;Argument[-1];ReturnValue;taint",
122+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String,String,String,String);;ArrayElement of Argument[0];ReturnValue;taint",
123+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String,String,String,String);;Argument[1..5];ReturnValue;taint",
124+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;Argument[-1];ReturnValue;taint",
125+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;ArrayElement of Argument[0];ReturnValue;taint",
126+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;Argument[1];ReturnValue;taint",
123127
"android.database.sqlite;SQLiteQueryBuilder;true;buildQuery;(String[],String,String[],String,String,String,String);;Argument[3..6];ReturnValue;taint",
124-
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionQuery;(String[],String,String);;Argument[-1..2];ReturnValue;taint",
128+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionQuery;(String[],String,String);;Argument[-1];ReturnValue;taint",
129+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionQuery;(String[],String,String);;ArrayElement of Argument[0];ReturnValue;taint",
130+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionQuery;(String[],String,String);;Argument[1..2];ReturnValue;taint",
125131
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String[] selectionArgs, String groupBy, String having)
126132
// buildUnionSubQuery(String typeDiscriminatorColumn, String[] unionColumns, Set<String> columnsPresentInTable, int computedColumnsOffset, String typeDiscriminatorValue, String selection, String groupBy, String having)
127-
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[-1..2];ReturnValue;taint",
133+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[-1..0];ReturnValue;taint",
134+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;ArrayElement of Argument[1];ReturnValue;taint",
135+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Element of Argument[2];ReturnValue;taint",
128136
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[4..5];ReturnValue;taint",
129137
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String[],String,String);;Argument[7..8];ReturnValue;taint",
130-
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[-1..2];ReturnValue;taint",
138+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[-1..0];ReturnValue;taint",
139+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;ArrayElement of Argument[1];ReturnValue;taint",
140+
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Element of Argument[2];ReturnValue;taint",
131141
"android.database.sqlite;SQLiteQueryBuilder;true;buildUnionSubQuery;(String,String[],Set<String>,int,String,String,String,String);;Argument[4..7];ReturnValue;taint",
132142
// static buildQueryString(boolean distinct, String tables, String[] columns, String where, String groupBy, String having, String orderBy, String limit)
133-
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[1..7];ReturnValue;taint",
134-
"android.database.sqlite;SQLiteQueryBuilder;true;setProjectionMap;(Map<String,String>);;Argument[0];Argument[-1];taint",
143+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[1];ReturnValue;taint",
144+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;ArrayElement of Argument[2];ReturnValue;taint",
145+
"android.database.sqlite;SQLiteQueryBuilder;true;buildQueryString;(boolean,String,String[],String,String,String,String,String);;Argument[3..7];ReturnValue;taint",
146+
"android.database.sqlite;SQLiteQueryBuilder;true;setProjectionMap;(Map<String,String>);;MapKey of Argument[0];Argument[-1];taint",
147+
"android.database.sqlite;SQLiteQueryBuilder;true;setProjectionMap;(Map<String,String>);;MapValue of Argument[0];Argument[-1];taint",
135148
"android.database.sqlite;SQLiteQueryBuilder;true;setTables;(String);;Argument[0];Argument[-1];taint",
136149
"android.database.sqlite;SQLiteQueryBuilder;true;appendWhere;(CharSequence);;Argument[0];Argument[-1];taint",
137150
"android.database.sqlite;SQLiteQueryBuilder;true;appendWhereStandalone;(CharSequence);;Argument[0];Argument[-1];taint",
138151
"android.database.sqlite;SQLiteQueryBuilder;true;appendColumns;(StringBuilder,String[]);;Argument[1];Argument[0];taint",
139-
"android.database;DatabaseUtils;false;appendSelectionArgs;(String[],String[]);;Argument;ReturnValue;taint",
140-
"android.database;DatabaseUtils;false;concatenateWhere;(String,String);;Argument;ReturnValue;taint",
152+
"android.database;DatabaseUtils;false;appendSelectionArgs;(String[],String[]);;ArrayElement of Argument[0..1];ArrayElement of ReturnValue;taint",
153+
"android.database;DatabaseUtils;false;concatenateWhere;(String,String);;Argument[0..1];ReturnValue;taint",
141154
"android.content;ContentProvider;true;query;(Uri,String[],String,String[],String);;Argument[0];ReturnValue;taint",
142155
"android.content;ContentProvider;true;query;(Uri,String[],String,String[],String,CancellationSignal);;Argument[0];ReturnValue;taint",
143156
"android.content;ContentResolver;true;query;(Uri,String[],String,String[],String);;Argument[0];ReturnValue;taint",

‎java/ql/test/library-tests/frameworks/android/taint-database/FlowSteps.java

Lines changed: 23 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
import java.util.Map;
22
import java.util.Set;
3+
import java.util.HashSet;
4+
import java.util.HashMap;
35

46
import android.content.ContentProvider;
57
import android.content.ContentResolver;
@@ -26,10 +28,10 @@ private static abstract class MySQLiteQueryBuilder extends SQLiteQueryBuilder {
2628
// Dummy class to test for sub classes
2729
}
2830

29-
public static String[] appendSelectionArgs() {
30-
String[] originalValues = {taint()}; // $ MISSING: taintReachesReturn
31-
String[] newValues = {taint()}; // $ MISSING: taintReachesReturn
32-
return DatabaseUtils.appendSelectionArgs(originalValues, newValues);
31+
public static String appendSelectionArgs() {
32+
String[] originalValues = {taint()}; // $taintReachesReturn
33+
String[] newValues = {taint()}; // $taintReachesReturn
34+
return DatabaseUtils.appendSelectionArgs(originalValues, newValues)[0];
3335
}
3436

3537
public static String concatenateWhere() {
@@ -42,7 +44,7 @@ public static String buildQueryString(MySQLiteQueryBuilder target) {
4244
target = taint();
4345
boolean distinct = taint();
4446
String tables = taint(); // $taintReachesReturn
45-
String[] columns = {taint()}; // $ MISSING: taintReachesReturn
47+
String[] columns = {taint()}; // $taintReachesReturn
4648
String where = taint(); // $taintReachesReturn
4749
String groupBy = taint(); // $taintReachesReturn
4850
String having = taint(); // $taintReachesReturn
@@ -53,7 +55,7 @@ public static String buildQueryString(MySQLiteQueryBuilder target) {
5355

5456
public static String buildQuery(MySQLiteQueryBuilder target) {
5557
target = taint(); // $taintReachesReturn
56-
String[] projectionIn = {taint()};// $ MISSING: taintReachesReturn
58+
String[] projectionIn = {taint()}; // $taintReachesReturn
5759
String selection = taint(); // $taintReachesReturn
5860
String groupBy = taint(); // $taintReachesReturn
5961
String having = taint(); // $taintReachesReturn
@@ -64,9 +66,9 @@ public static String buildQuery(MySQLiteQueryBuilder target) {
6466

6567
public static String buildQuery2(MySQLiteQueryBuilder target) {
6668
target = taint(); // $taintReachesReturn
67-
String[] projectionIn = {taint()}; // $ MISSING: taintReachesReturn
69+
String[] projectionIn = {taint()}; // $taintReachesReturn
6870
String selection = taint(); // $taintReachesReturn
69-
String[] selectionArgs = {taint()}; // $ MISSING: taintReachesReturn
71+
String[] selectionArgs = {taint()};
7072
String groupBy = taint(); // $taintReachesReturn
7173
String having = taint(); // $taintReachesReturn
7274
String sortOrder = taint(); // $taintReachesReturn
@@ -76,7 +78,7 @@ public static String buildQuery2(MySQLiteQueryBuilder target) {
7678

7779
public static String buildUnionQuery(MySQLiteQueryBuilder target) {
7880
target = taint(); // $taintReachesReturn
79-
String[] subQueries = {taint()}; // $ MISSING: taintReachesReturn
81+
String[] subQueries = {taint()}; // $taintReachesReturn
8082
String sortOrder = taint(); // $taintReachesReturn
8183
String limit = taint(); // $taintReachesReturn
8284
return target.buildUnionQuery(subQueries, sortOrder, limit);
@@ -85,12 +87,13 @@ public static String buildUnionQuery(MySQLiteQueryBuilder target) {
8587
public static String buildUnionSubQuery2(MySQLiteQueryBuilder target) {
8688
target = taint(); // $taintReachesReturn
8789
String typeDiscriminatorColumn = taint(); // $taintReachesReturn
88-
String[] unionColumns = {taint()}; // $ MISSING: taintReachesReturn
89-
Set<String> columnsPresentInTable = taint(); // $taintReachesReturn
90+
String[] unionColumns = {taint()}; // $taintReachesReturn
91+
Set<String> columnsPresentInTable = new HashSet();
92+
columnsPresentInTable.add(taint()); // $taintReachesReturn
9093
int computedColumnsOffset = taint();
9194
String typeDiscriminatorValue = taint(); // $taintReachesReturn
9295
String selection = taint(); // $taintReachesReturn
93-
String[] selectionArgs = {taint()}; // $ MISSING: taintReachesReturn
96+
String[] selectionArgs = {taint()};
9497
String groupBy = taint(); // $taintReachesReturn
9598
String having = taint(); // $taintReachesReturn
9699
return target.buildUnionSubQuery(typeDiscriminatorColumn, unionColumns, columnsPresentInTable,
@@ -100,8 +103,9 @@ public static String buildUnionSubQuery2(MySQLiteQueryBuilder target) {
100103
public static String buildUnionSubQuery3(MySQLiteQueryBuilder target) {
101104
target = taint(); // $taintReachesReturn
102105
String typeDiscriminatorColumn = taint(); // $taintReachesReturn
103-
String[] unionColumns = {taint()}; // $ MISSING: taintReachesReturn
104-
Set<String> columnsPresentInTable = taint(); // $taintReachesReturn
106+
String[] unionColumns = {taint()}; // $taintReachesReturn
107+
Set<String> columnsPresentInTable = new HashSet();
108+
columnsPresentInTable.add(taint()); // $taintReachesReturn
105109
int computedColumnsOffset = taint();
106110
String typeDiscriminatorValue = taint(); // $taintReachesReturn
107111
String selection = taint(); // $taintReachesReturn
@@ -151,14 +155,17 @@ public static Cursor query2(MyContentProvider target) {
151155

152156
public static StringBuilder appendColumns() {
153157
StringBuilder s = taint(); // $taintReachesReturn
154-
String[] columns = {taint()}; // $ MISSING: taintReachesReturn
158+
String[] columns = {taint()}; // $taintReachesReturn
155159
SQLiteQueryBuilder.appendColumns(s, columns);
156160
return s;
157161
}
158162

159163
public static SQLiteQueryBuilder setProjectionMap(MySQLiteQueryBuilder target) {
160164
target = taint(); // $taintReachesReturn
161-
Map<String, String> columnMap = taint(); // $taintReachesReturn
165+
Map<String, String> columnMap = new HashMap();
166+
String k = taint(); // $taintReachesReturn
167+
String v = taint(); // $taintReachesReturn
168+
columnMap.put(k, v);
162169
target.setProjectionMap(columnMap);
163170
return target;
164171
}

0 commit comments

Comments
 (0)