Skip to content

Commit 10bab71

Browse files
jcogs33jcogs33
authored
Merge pull request github#12249 from jcogs33/jcogs33/add-heuristic-neutral-models
Java: add some neutral models discovered with heuristics
2 parents c1bd04e + 82f208c commit 10bab71

File tree

11 files changed

+265
-0
lines changed

11 files changed

+265
-0
lines changed

‎java/ql/lib/ext/java.io.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ extensions:
100100
pack: codeql/java-all
101101
extensible: neutralModel
102102
data:
103+
# summary neutrals
103104
- ["java.io", "Closeable", "close", "()", "summary", "manual"]
104105
- ["java.io", "DataOutput", "writeBoolean", "(boolean)", "summary", "manual"]
105106
- ["java.io", "File", "delete", "()", "summary", "manual"]
@@ -117,3 +118,7 @@ extensions:
117118
- ["java.io", "DataInput", "readLong", "()", "summary", "manual"] # taint-numeric
118119
- ["java.io", "DataOutput", "writeInt", "(int)", "summary", "manual"] # taint-numeric
119120
- ["java.io", "DataOutput", "writeLong", "(long)", "summary", "manual"] # taint-numeric
121+
122+
# sink neutrals
123+
- ["java.io", "File", "compareTo", "", "sink", "hq-manual"]
124+
- ["java.io", "File", "exists", "()", "sink", "hq-manual"]

‎java/ql/lib/ext/java.nio.file.model.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,4 +81,22 @@ extensions:
8181
pack: codeql/java-all
8282
extensible: neutralModel
8383
data:
84+
# summary neutrals
8485
- ["java.nio.file", "Files", "exists", "(Path,LinkOption[])", "summary", "manual"]
86+
87+
# sink neutrals
88+
- ["java.nio.file", "Files", "exists", "", "sink", "hq-manual"]
89+
- ["java.nio.file", "Files", "getLastModifiedTime", "", "sink", "hq-manual"]
90+
- ["java.nio.file", "Files", "getOwner", "", "sink", "hq-manual"]
91+
- ["java.nio.file", "Files", "getPosixFilePermissions", "", "sink", "hq-manual"]
92+
- ["java.nio.file", "Files", "isDirectory", "", "sink", "hq-manual"]
93+
- ["java.nio.file", "Files", "isExecutable", "", "sink", "hq-manual"]
94+
- ["java.nio.file", "Files", "isHidden", "", "sink", "hq-manual"]
95+
- ["java.nio.file", "Files", "isReadable", "", "sink", "hq-manual"]
96+
- ["java.nio.file", "Files", "isRegularFile", "", "sink", "hq-manual"]
97+
- ["java.nio.file", "Files", "isSameFile", "", "sink", "hq-manual"]
98+
- ["java.nio.file", "Files", "isSymbolicLink", "", "sink", "hq-manual"]
99+
- ["java.nio.file", "Files", "isWritable", "", "sink", "hq-manual"]
100+
- ["java.nio.file", "Files", "notExists", "", "sink", "hq-manual"]
101+
- ["java.nio.file", "Files", "setLastModifiedTime", "", "sink", "hq-manual"]
102+
- ["java.nio.file", "Files", "size", "", "sink", "hq-manual"]

‎java/ql/lib/ext/java.nio.file.spi.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: neutralModel
5+
data:
6+
# sink neutrals
7+
- ["java.nio.file.spi", "FileSystemProvider", "isHidden", "", "sink", "hq-manual"]
8+
- ["java.nio.file.spi", "FileSystemProvider", "isSameFile", "", "sink", "hq-manual"]

‎java/ql/lib/ext/java.text.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,14 @@ extensions:
33
pack: codeql/java-all
44
extensible: neutralModel
55
data:
6+
# summary neutrals
67
# The below APIs have numeric flow and are currently being stored as neutral models.
78
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
89
- ["java.text", "DateFormat", "format", "(Date)", "summary", "manual"] # taint-numeric
910
- ["java.text", "DateFormat", "parse", "(String)", "summary", "manual"] # taint-numeric
1011
- ["java.text", "SimpleDateFormat", "SimpleDateFormat", "(String)", "summary", "manual"] # taint-numeric
12+
13+
# sink neutrals
14+
- ["java.text", "Collator", "compare", "", "sink", "hq-manual"]
15+
- ["java.text", "Collator", "equals", "", "sink", "hq-manual"]
16+
- ["java.text", "RuleBasedCollator", "compare", "", "sink", "hq-manual"]

‎java/ql/lib/ext/java.util.prefs.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: neutralModel
5+
data:
6+
# sink neutrals
7+
- ["java.util.prefs", "AbstractPreferences", "nodeExists", "", "sink", "hq-manual"]
8+
- ["java.util.prefs", "Preferences", "nodeExists", "", "sink", "hq-manual"]

‎java/ql/lib/ext/org.apache.hc.client5.http.protocol.model.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: neutralModel
5+
data:
6+
# sink neutrals
7+
- ["org.apache.hc.client5.http.protocol", "RedirectLocations", "contains", "", "sink", "hq-manual"]

‎java/ql/test/library-tests/neutrals/neutralsinks/NeutralSinksTest.expected

Whitespace-only changes.

‎java/ql/test/library-tests/neutrals/neutralsinks/NeutralSinksTest.ql

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
import java
2+
import TestUtilities.InlineExpectationsTest
3+
import semmle.code.java.dataflow.DataFlow
4+
import semmle.code.java.dataflow.ExternalFlow
5+
import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
6+
7+
class SinkTest extends InlineExpectationsTest {
8+
SinkTest() { this = "SinkTest" }
9+
10+
override string getARelevantTag() { result = "isSink" }
11+
12+
override predicate hasActualResult(Location location, string element, string tag, string value) {
13+
tag = "isSink" and
14+
exists(DataFlow::Node sink |
15+
sinkNode(sink, _) and
16+
sink.getLocation() = location and
17+
element = sink.toString() and
18+
value = ""
19+
)
20+
}
21+
}
22+
23+
class NeutralSinkTest extends InlineExpectationsTest {
24+
NeutralSinkTest() { this = "NeutralSinkTest" }
25+
26+
override string getARelevantTag() { result = "isNeutralSink" }
27+
28+
override predicate hasActualResult(Location location, string element, string tag, string value) {
29+
tag = "isNeutralSink" and
30+
exists(Call call, Callable callable |
31+
call.getCallee() = callable and
32+
neutralModel(callable.getDeclaringType().getCompilationUnit().getPackage().getName(),
33+
callable.getDeclaringType().getSourceDeclaration().nestedName(), callable.getName(),
34+
[paramsString(callable), ""], "sink", _) and
35+
call.getLocation() = location and
36+
element = call.toString() and
37+
value = ""
38+
)
39+
}
40+
}

‎java/ql/test/library-tests/neutrals/neutralsinks/Test.java

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
import java.io.File;
2+
import java.nio.file.Files;
3+
import java.nio.file.spi.FileSystemProvider;
4+
import java.nio.file.LinkOption;
5+
import java.text.Collator;
6+
import java.text.RuleBasedCollator;
7+
import java.util.prefs.AbstractPreferences;
8+
import java.util.prefs.Preferences;
9+
import org.apache.hc.client5.http.protocol.RedirectLocations;
10+
11+
public class Test {
12+
13+
public void test() throws Exception {
14+
15+
// java.io
16+
File file = null;
17+
file.exists(); // $ isNeutralSink
18+
file.compareTo(null); // $ isNeutralSink
19+
20+
// java.nio.file
21+
Files.exists(null, (LinkOption[])null); // $ isNeutralSink
22+
Files.getLastModifiedTime(null, (LinkOption[])null); // $ isNeutralSink
23+
Files.getOwner(null, (LinkOption[])null); // $ isNeutralSink
24+
Files.getPosixFilePermissions(null, (LinkOption[])null); // $ isNeutralSink
25+
Files.isDirectory(null, (LinkOption[])null); // $ isNeutralSink
26+
Files.isExecutable(null); // $ isNeutralSink
27+
Files.isHidden(null); // $ isNeutralSink
28+
Files.isReadable(null); // $ isNeutralSink
29+
Files.isRegularFile(null, (LinkOption[])null); // $ isNeutralSink
30+
Files.isSameFile(null, null); // $ isNeutralSink
31+
Files.isSymbolicLink(null); // $ isNeutralSink
32+
Files.isWritable(null); // $ isNeutralSink
33+
Files.notExists(null, (LinkOption[])null); // $ isNeutralSink
34+
Files.setLastModifiedTime(null, null); // $ isNeutralSink
35+
Files.size(null); // $ isNeutralSink
36+
37+
// java.nio.file.spi
38+
FileSystemProvider fsp = null;
39+
fsp.isHidden(null); // $ isNeutralSink
40+
fsp.isSameFile(null, null); // $ isNeutralSink
41+
42+
// java.text
43+
Collator c = null;
44+
c.compare(null, null); // $ isNeutralSink
45+
c.equals(null); // $ isNeutralSink
46+
c.equals(null, null); // $ isNeutralSink
47+
RuleBasedCollator rbc = null;
48+
rbc.compare(null, null); // $ isNeutralSink
49+
50+
// java.util.prefs
51+
AbstractPreferences ap = null;
52+
ap.nodeExists(null); // $ isNeutralSink
53+
Preferences p = null;
54+
p.nodeExists(null); // $ isNeutralSink
55+
56+
// org.apache.hc.client5.http.protocol
57+
RedirectLocations rl = null;
58+
rl.contains(null); // $ isNeutralSink
59+
}
60+
61+
}

‎java/ql/test/library-tests/neutrals/neutralsinks/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/apache-http-5

0 commit comments

Comments
 (0)