Skip to content

Commit b6bd4f9

Browse files
artem-smotrakovsmowton
artem-smotrakov
authored and
smowton
committed
Added sources and steps for JMS API
1 parent 5c6aa15 commit b6bd4f9

19 files changed

+306
-0
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ private module Frameworks {
138138
private import semmle.code.java.frameworks.MyBatis
139139
private import semmle.code.java.frameworks.Hibernate
140140
private import semmle.code.java.frameworks.jOOQ
141+
private import semmle.code.java.frameworks.JMS
141142
private import semmle.code.java.frameworks.RabbitMQ
142143
}
143144

‎java/ql/lib/semmle/code/java/frameworks/JMS.qll

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
/*
2+
* This model covers JMS API versions 1 and 2.
3+
*
4+
* https://docs.oracle.com/javaee/6/api/javax/jms/package-summary.html
5+
* https://docs.oracle.com/javaee/7/api/javax/jms/package-summary.html
6+
*/
7+
8+
import java
9+
import semmle.code.java.dataflow.ExternalFlow
10+
11+
/** Defines sources of taited data in JMS 1. */
12+
private class Jms1Source extends SourceModelCsv {
13+
override predicate row(string row) {
14+
row =
15+
[
16+
// incoming messages are considered tainted
17+
"javax.jms;MessageListener;true;onMessage;(Message);;Parameter[0];remote",
18+
"javax.jms;MessageConsumer;true;receive;;;ReturnValue;remote",
19+
"javax.jms;MessageConsumer;true;receiveNoWait;();;ReturnValue;remote",
20+
"javax.jms;QueueRequestor;true;request;(Message);;ReturnValue;remote",
21+
"javax.jms;TopicRequestor;true;request;(Message);;ReturnValue;remote",
22+
]
23+
}
24+
}
25+
26+
/** Defines taint propagation steps in JMS 1. */
27+
private class Jms1FlowStep extends SummaryModelCsv {
28+
override predicate row(string row) {
29+
row =
30+
[
31+
// if a message is tainted, then it returns tainted data
32+
"javax.jms;Message;true;getBody;();;Argument[-1];ReturnValue;taint",
33+
"javax.jms;Message;true;getJMSCorrelationIDAsBytes;();;Argument[-1];ReturnValue;taint",
34+
"javax.jms;Message;true;getJMSCorrelationID;();;Argument[-1];ReturnValue;taint",
35+
"javax.jms;Message;true;getJMSReplyTo;();;Argument[-1];ReturnValue;taint",
36+
"javax.jms;Message;true;getJMSDestination;();;Argument[-1];ReturnValue;taint",
37+
"javax.jms;Message;true;getJMSType;();;Argument[-1];ReturnValue;taint",
38+
"javax.jms;Message;true;getBooleanProperty;();;Argument[-1];ReturnValue;taint",
39+
"javax.jms;Message;true;getByteProperty;();;Argument[-1];ReturnValue;taint",
40+
"javax.jms;Message;true;getShortProperty;();;Argument[-1];ReturnValue;taint",
41+
"javax.jms;Message;true;getIntProperty;();;Argument[-1];ReturnValue;taint",
42+
"javax.jms;Message;true;getLongProperty;();;Argument[-1];ReturnValue;taint",
43+
"javax.jms;Message;true;getFloatProperty;();;Argument[-1];ReturnValue;taint",
44+
"javax.jms;Message;true;getDoubleProperty;();;Argument[-1];ReturnValue;taint",
45+
"javax.jms;Message;true;getStringProperty;();;Argument[-1];ReturnValue;taint",
46+
"javax.jms;Message;true;getObjectProperty;();;Argument[-1];ReturnValue;taint",
47+
"javax.jms;Message;true;getPropertyNames;();;Argument[-1];ReturnValue;taint",
48+
"javax.jms;BytesMessage;true;readBoolean;();;Argument[-1];ReturnValue;taint",
49+
"javax.jms;BytesMessage;true;readByte;();;Argument[-1];ReturnValue;taint",
50+
"javax.jms;BytesMessage;true;readUnsignedByte;();;Argument[-1];ReturnValue;taint",
51+
"javax.jms;BytesMessage;true;readShort;();;Argument[-1];ReturnValue;taint",
52+
"javax.jms;BytesMessage;true;readUnsignedShort;();;Argument[-1];ReturnValue;taint",
53+
"javax.jms;BytesMessage;true;readChar;();;Argument[-1];ReturnValue;taint",
54+
"javax.jms;BytesMessage;true;readInt;();;Argument[-1];ReturnValue;taint",
55+
"javax.jms;BytesMessage;true;readLong;();;Argument[-1];ReturnValue;taint",
56+
"javax.jms;BytesMessage;true;readFloat;();;Argument[-1];ReturnValue;taint",
57+
"javax.jms;BytesMessage;true;readDouble;();;Argument[-1];ReturnValue;taint",
58+
"javax.jms;BytesMessage;true;readUTF;();;Argument[-1];ReturnValue;taint",
59+
"javax.jms;BytesMessage;true;readBytes;;;Argument[-1];Argument[0];taint",
60+
"javax.jms;MapMessage;true;getBoolean;(String);;Argument[-1];ReturnValue;taint",
61+
"javax.jms;MapMessage;true;getByte;(String);;Argument[-1];ReturnValue;taint",
62+
"javax.jms;MapMessage;true;getShort;(String);;Argument[-1];ReturnValue;taint",
63+
"javax.jms;MapMessage;true;getChar;(String);;Argument[-1];ReturnValue;taint",
64+
"javax.jms;MapMessage;true;getInt;(String);;Argument[-1];ReturnValue;taint",
65+
"javax.jms;MapMessage;true;getLong;(String);;Argument[-1];ReturnValue;taint",
66+
"javax.jms;MapMessage;true;getFloat;(String);;Argument[-1];ReturnValue;taint",
67+
"javax.jms;MapMessage;true;getDouble;(String);;Argument[-1];ReturnValue;taint",
68+
"javax.jms;MapMessage;true;getString;(String);;Argument[-1];ReturnValue;taint",
69+
"javax.jms;MapMessage;true;getBytes;(String);;Argument[-1];ReturnValue;taint",
70+
"javax.jms;MapMessage;true;getObject;(String);;Argument[-1];ReturnValue;taint",
71+
"javax.jms;MapMessage;true;getMapNames;();;Argument[-1];ReturnValue;taint",
72+
"javax.jms;ObjectMessage;true;getObject;();;Argument[-1];ReturnValue;taint",
73+
"javax.jms;StreamMessage;true;readBoolean;();;Argument[-1];ReturnValue;taint",
74+
"javax.jms;StreamMessage;true;readByte;();;Argument[-1];ReturnValue;taint",
75+
"javax.jms;StreamMessage;true;readShort;();;Argument[-1];ReturnValue;taint",
76+
"javax.jms;StreamMessage;true;readChar;();;Argument[-1];ReturnValue;taint",
77+
"javax.jms;StreamMessage;true;readInt;();;Argument[-1];ReturnValue;taint",
78+
"javax.jms;StreamMessage;true;readLong;();;Argument[-1];ReturnValue;taint",
79+
"javax.jms;StreamMessage;true;readFloat;();;Argument[-1];ReturnValue;taint",
80+
"javax.jms;StreamMessage;true;readDouble;();;Argument[-1];ReturnValue;taint",
81+
"javax.jms;StreamMessage;true;readString;();;Argument[-1];ReturnValue;taint",
82+
"javax.jms;StreamMessage;true;readBytes;(byte[]);;Argument[-1];Argument[0];taint",
83+
"javax.jms;StreamMessage;true;readObject;();;Argument[-1];ReturnValue;taint",
84+
"javax.jms;TextMessage;true;getText;();;Argument[-1];ReturnValue;taint",
85+
// if a destination is tainted, then it returns tainted data
86+
"javax.jms;Queue;true;getQueueName;();;Argument[-1];ReturnValue;taint",
87+
"javax.jms;Queue;true;toString;();;Argument[-1];ReturnValue;taint",
88+
"javax.jms;Topic;true;getTopicName;();;Argument[-1];ReturnValue;taint",
89+
"javax.jms;Topic;true;toString;();;Argument[-1];ReturnValue;taint",
90+
]
91+
}
92+
}
93+
94+
/** Defines additional sources of taited data in JMS 2. */
95+
private class Jms2Source extends SourceModelCsv {
96+
override predicate row(string row) {
97+
row =
98+
[
99+
"javax.jms;JMSConsumer;true;receive;;;ReturnValue;remote",
100+
"javax.jms;JMSConsumer;true;receiveBody;;;ReturnValue;remote",
101+
"javax.jms;JMSConsumer;true;receiveNoWait;();;ReturnValue;remote",
102+
"javax.jms;JMSConsumer;true;receiveBodyNoWait;();;ReturnValue;remote",
103+
]
104+
}
105+
}
106+
107+
/** Defines additional taint propagation steps in JMS 2. */
108+
private class Jms2FlowStep extends SummaryModelCsv {
109+
override predicate row(string row) {
110+
row = ["javax.jms;Message;true;getBody;();;Argument[-1];ReturnValue;taint",]
111+
}
112+
}

‎java/ql/test/library-tests/frameworks/jms/FlowTest.expected

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/jms/FlowTest.ql

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
import java
2+
import semmle.code.java.dataflow.FlowSources
3+
import TestUtilities.InlineExpectationsTest
4+
5+
class TestConfig extends TaintTracking::Configuration {
6+
TestConfig() { this = "TestConfig" }
7+
8+
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
9+
10+
override predicate isSink(DataFlow::Node sink) {
11+
exists(MethodAccess call |
12+
call.getMethod().hasName("sink") and call.getArgument(0) = sink.asExpr()
13+
)
14+
}
15+
}
16+
17+
class JmsFlowTest extends InlineExpectationsTest {
18+
JmsFlowTest() { this = "JmsFlowTest" }
19+
20+
override string getARelevantTag() { result = "detected" }
21+
22+
override predicate hasActualResult(Location location, string element, string tag, string value) {
23+
tag = "detected" and
24+
exists(DataFlow::PathNode source, DataFlow::PathNode sink, TestConfig conf |
25+
conf.hasFlowPath(source, sink)
26+
|
27+
location = sink.getNode().getLocation() and element = sink.getNode().toString() and value = ""
28+
)
29+
}
30+
}

‎java/ql/test/library-tests/frameworks/jms/MessageListenerImpl.java

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
import javax.jms.MessageListener;
2+
import javax.jms.TextMessage;
3+
import javax.jms.BytesMessage;
4+
import javax.jms.MapMessage;
5+
import javax.jms.ObjectMessage;
6+
import javax.jms.StreamMessage;
7+
import javax.jms.Message;
8+
import javax.jms.MessageConsumer;
9+
import javax.jms.QueueReceiver;
10+
import javax.jms.QueueRequestor;
11+
import javax.jms.TopicRequestor;
12+
13+
public class MessageListenerImpl implements MessageListener {
14+
15+
@Override
16+
public void onMessage(Message message) { // $source
17+
try {
18+
if (message instanceof TextMessage) {
19+
TextMessage textMessage = (TextMessage) message;
20+
String text = textMessage.getText();
21+
sink(text); // $detected
22+
} else if (message instanceof BytesMessage) {
23+
BytesMessage bytesMessage = (BytesMessage) message;
24+
byte[] data = new byte[1024];
25+
bytesMessage.readBytes(data, 42);
26+
sink(new String(data)); // $detected
27+
sink(bytesMessage.readUTF()); // $detected
28+
} else if (message instanceof MapMessage) {
29+
MapMessage mapMessage = (MapMessage) message;
30+
sink(mapMessage.getString("data")); // $detected
31+
sink(new String(mapMessage.getBytes("bytes"))); // $detected
32+
} else if (message instanceof ObjectMessage) {
33+
ObjectMessage objectMessage = (ObjectMessage) message;
34+
sink((String) objectMessage.getObject()); // $detected
35+
} else if (message instanceof StreamMessage) {
36+
StreamMessage streamMessage = (StreamMessage) message;
37+
byte[] data = new byte[1024];
38+
streamMessage.readBytes(data);
39+
sink(new String(data)); // $detected
40+
sink(streamMessage.readString()); // $detected
41+
sink((String) streamMessage.readObject()); // $detected
42+
}
43+
} catch (Exception e) {
44+
}
45+
}
46+
47+
public void readFromCounsumer(MessageConsumer consumer) throws Exception {
48+
TextMessage message = (TextMessage) consumer.receive(5000); // $source
49+
String text = message.getText();
50+
sink(text); // $detected
51+
message = (TextMessage) consumer.receive(); // $source
52+
text = message.getText();
53+
sink(text); // $detected
54+
message = (TextMessage) consumer.receiveNoWait(); // $source
55+
text = message.getText();
56+
sink(text); // $detected
57+
}
58+
59+
public void readFromQueueRequestor(QueueRequestor requestor, Message message) throws Exception {
60+
TextMessage reply = (TextMessage) requestor.request(message); // $source
61+
String text = reply.getText();
62+
sink(text); // $detected
63+
}
64+
65+
public void readFromTopicRequestor(TopicRequestor requestor, Message message) throws Exception {
66+
TextMessage reply = (TextMessage) requestor.request(message); // $source
67+
String text = reply.getText();
68+
sink(text); // $detected
69+
}
70+
71+
private void sink(String data) {
72+
}
73+
}

‎java/ql/test/library-tests/frameworks/jms/RemoteSourcesTest.expected

Whitespace-only changes.

‎java/ql/test/library-tests/frameworks/jms/RemoteSourcesTest.ql

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import java
2+
import semmle.code.java.dataflow.FlowSources
3+
import TestUtilities.InlineExpectationsTest
4+
5+
class JmsRemoteSourcesTest extends InlineExpectationsTest {
6+
JmsRemoteSourcesTest() { this = "JmsRemoteSourcesTest" }
7+
8+
override string getARelevantTag() { result = "source" }
9+
10+
override predicate hasActualResult(Location location, string element, string tag, string value) {
11+
tag = "source" and
12+
exists(RemoteFlowSource source |
13+
location = source.getLocation() and element = source.toString() and value = ""
14+
)
15+
}
16+
}

‎java/ql/test/library-tests/frameworks/jms/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jms-api-1

‎java/ql/test/stubs/jms-api-1/javax/jms/BytesMessage.java

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/jms-api-1/javax/jms/MapMessage.java

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)