Skip to content

Commit 5c700af

Browse files
michaelnebelmichaelnebel
committed
Java: Add some threat model dataflow tests.
1 parent 537965c commit 5c700af

16 files changed

+387
-0
lines changed

‎java/ql/test/library-tests/dataflow/threat-models/Test.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
private import java
2+
private import semmle.code.java.dataflow.DataFlow
3+
private import semmle.code.java.dataflow.ExternalFlow
4+
private import semmle.code.java.dataflow.FlowSources
5+
private import semmle.code.java.dataflow.TaintTracking
6+
7+
private module ThreatModelConfig implements DataFlow::ConfigSig {
8+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
9+
10+
predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) }
11+
}
12+
13+
module ThreatModel = TaintTracking::Global<ThreatModelConfig>;

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.expected

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
edges
2+
| Test.java:10:31:10:41 | data : byte[] | Test.java:11:23:11:26 | data : byte[] |
3+
| Test.java:11:23:11:26 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String |
4+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:19:32:19:35 | data [post update] : byte[] |
5+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:22:49:22:52 | data : byte[] |
6+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:25:69:25:72 | data : byte[] |
7+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
8+
| Test.java:22:49:22:52 | data : byte[] | Test.java:22:36:22:53 | byteToString(...) |
9+
| Test.java:25:56:25:73 | byteToString(...) : String | Test.java:25:26:25:80 | ... + ... |
10+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
11+
| Test.java:25:69:25:72 | data : byte[] | Test.java:25:56:25:73 | byteToString(...) : String |
12+
nodes
13+
| Test.java:10:31:10:41 | data : byte[] | semmle.label | data : byte[] |
14+
| Test.java:11:12:11:51 | new String(...) : String | semmle.label | new String(...) : String |
15+
| Test.java:11:23:11:26 | data : byte[] | semmle.label | data : byte[] |
16+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
17+
| Test.java:19:32:19:35 | data [post update] : byte[] | semmle.label | data [post update] : byte[] |
18+
| Test.java:22:36:22:53 | byteToString(...) | semmle.label | byteToString(...) |
19+
| Test.java:22:49:22:52 | data : byte[] | semmle.label | data : byte[] |
20+
| Test.java:25:26:25:80 | ... + ... | semmle.label | ... + ... |
21+
| Test.java:25:56:25:73 | byteToString(...) : String | semmle.label | byteToString(...) : String |
22+
| Test.java:25:69:25:72 | data : byte[] | semmle.label | data : byte[] |
23+
subpaths
24+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:22:36:22:53 | byteToString(...) |
25+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:25:56:25:73 | byteToString(...) : String |
26+
#select
27+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:22:36:22:53 | byteToString(...) |
28+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:25:26:25:80 | ... + ... |

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.ext.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/java-all
5+
extensible: supportedThreatModels
6+
data: []
7+
8+
- addsTo:
9+
pack: codeql/java-all
10+
extensible: sourceModel
11+
data:
12+
- ["testlib", "TestSources", False, "executeQuery", "(String)", "", "ReturnValue", "database", "manual"]
13+
- ["testlib", "TestSources", False, "readEnv", "(String)", "", "ReturnValue", "environment", "manual"]
14+
- ["testlib", "TestSources", False, "getCustom", "(String)", "", "ReturnValue", "custom", "manual"]

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest1.ql

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
/**
2+
* This is a dataflow test using the "default" threat model.
3+
*/
4+
5+
import Test
6+
import ThreatModel::PathGraph
7+
8+
from ThreatModel::PathNode source, ThreatModel::PathNode sink
9+
where ThreatModel::flowPath(source, sink)
10+
select source, sink

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.expected

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
edges
2+
| Test.java:10:31:10:41 | data : byte[] | Test.java:11:23:11:26 | data : byte[] |
3+
| Test.java:11:23:11:26 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String |
4+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:19:32:19:35 | data [post update] : byte[] |
5+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:22:49:22:52 | data : byte[] |
6+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:25:69:25:72 | data : byte[] |
7+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
8+
| Test.java:22:49:22:52 | data : byte[] | Test.java:22:36:22:53 | byteToString(...) |
9+
| Test.java:25:56:25:73 | byteToString(...) : String | Test.java:25:26:25:80 | ... + ... |
10+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
11+
| Test.java:25:69:25:72 | data : byte[] | Test.java:25:56:25:73 | byteToString(...) : String |
12+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:33:26:33:68 | ... + ... |
13+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:36:36:36:41 | result |
14+
nodes
15+
| Test.java:10:31:10:41 | data : byte[] | semmle.label | data : byte[] |
16+
| Test.java:11:12:11:51 | new String(...) : String | semmle.label | new String(...) : String |
17+
| Test.java:11:23:11:26 | data : byte[] | semmle.label | data : byte[] |
18+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
19+
| Test.java:19:32:19:35 | data [post update] : byte[] | semmle.label | data [post update] : byte[] |
20+
| Test.java:22:36:22:53 | byteToString(...) | semmle.label | byteToString(...) |
21+
| Test.java:22:49:22:52 | data : byte[] | semmle.label | data : byte[] |
22+
| Test.java:25:26:25:80 | ... + ... | semmle.label | ... + ... |
23+
| Test.java:25:56:25:73 | byteToString(...) : String | semmle.label | byteToString(...) : String |
24+
| Test.java:25:69:25:72 | data : byte[] | semmle.label | data : byte[] |
25+
| Test.java:30:21:30:61 | executeQuery(...) : String | semmle.label | executeQuery(...) : String |
26+
| Test.java:33:26:33:68 | ... + ... | semmle.label | ... + ... |
27+
| Test.java:36:36:36:41 | result | semmle.label | result |
28+
subpaths
29+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:22:36:22:53 | byteToString(...) |
30+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:25:56:25:73 | byteToString(...) : String |
31+
#select
32+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:22:36:22:53 | byteToString(...) |
33+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:25:26:25:80 | ... + ... |
34+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:33:26:33:68 | ... + ... |
35+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:36:36:36:41 | result |

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.ext.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/java-all
5+
extensible: supportedThreatModels
6+
data:
7+
- ["database"]
8+
9+
- addsTo:
10+
pack: codeql/java-all
11+
extensible: sourceModel
12+
data:
13+
- ["testlib", "TestSources", False, "executeQuery", "(String)", "", "ReturnValue", "database", "manual"]
14+
- ["testlib", "TestSources", False, "readEnv", "(String)", "", "ReturnValue", "environment", "manual"]
15+
- ["testlib", "TestSources", False, "getCustom", "(String)", "", "ReturnValue", "custom", "manual"]

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest2.ql

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/**
2+
* This is a dataflow test using the "default" threat model with the
3+
* addition of "database".
4+
*/
5+
6+
import Test
7+
import ThreatModel::PathGraph
8+
9+
from ThreatModel::PathNode source, ThreatModel::PathNode sink
10+
where ThreatModel::flowPath(source, sink)
11+
select source, sink

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.expected

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
edges
2+
| Test.java:10:31:10:41 | data : byte[] | Test.java:11:23:11:26 | data : byte[] |
3+
| Test.java:11:23:11:26 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String |
4+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:19:32:19:35 | data [post update] : byte[] |
5+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:22:49:22:52 | data : byte[] |
6+
| Test.java:19:32:19:35 | data [post update] : byte[] | Test.java:25:69:25:72 | data : byte[] |
7+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
8+
| Test.java:22:49:22:52 | data : byte[] | Test.java:22:36:22:53 | byteToString(...) |
9+
| Test.java:25:56:25:73 | byteToString(...) : String | Test.java:25:26:25:80 | ... + ... |
10+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
11+
| Test.java:25:69:25:72 | data : byte[] | Test.java:25:56:25:73 | byteToString(...) : String |
12+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:33:26:33:68 | ... + ... |
13+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:36:36:36:41 | result |
14+
| Test.java:41:21:41:49 | readEnv(...) : String | Test.java:44:26:44:68 | ... + ... |
15+
| Test.java:41:21:41:49 | readEnv(...) : String | Test.java:47:36:47:41 | result |
16+
| Test.java:64:5:64:13 | System.in : InputStream | Test.java:64:20:64:23 | data [post update] : byte[] |
17+
| Test.java:64:20:64:23 | data [post update] : byte[] | Test.java:67:69:67:72 | data : byte[] |
18+
| Test.java:64:20:64:23 | data [post update] : byte[] | Test.java:70:49:70:52 | data : byte[] |
19+
| Test.java:67:56:67:73 | byteToString(...) : String | Test.java:67:26:67:80 | ... + ... |
20+
| Test.java:67:69:67:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
21+
| Test.java:67:69:67:72 | data : byte[] | Test.java:67:56:67:73 | byteToString(...) : String |
22+
| Test.java:70:49:70:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] |
23+
| Test.java:70:49:70:52 | data : byte[] | Test.java:70:36:70:53 | byteToString(...) |
24+
nodes
25+
| Test.java:10:31:10:41 | data : byte[] | semmle.label | data : byte[] |
26+
| Test.java:11:12:11:51 | new String(...) : String | semmle.label | new String(...) : String |
27+
| Test.java:11:23:11:26 | data : byte[] | semmle.label | data : byte[] |
28+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
29+
| Test.java:19:32:19:35 | data [post update] : byte[] | semmle.label | data [post update] : byte[] |
30+
| Test.java:22:36:22:53 | byteToString(...) | semmle.label | byteToString(...) |
31+
| Test.java:22:49:22:52 | data : byte[] | semmle.label | data : byte[] |
32+
| Test.java:25:26:25:80 | ... + ... | semmle.label | ... + ... |
33+
| Test.java:25:56:25:73 | byteToString(...) : String | semmle.label | byteToString(...) : String |
34+
| Test.java:25:69:25:72 | data : byte[] | semmle.label | data : byte[] |
35+
| Test.java:30:21:30:61 | executeQuery(...) : String | semmle.label | executeQuery(...) : String |
36+
| Test.java:33:26:33:68 | ... + ... | semmle.label | ... + ... |
37+
| Test.java:36:36:36:41 | result | semmle.label | result |
38+
| Test.java:41:21:41:49 | readEnv(...) : String | semmle.label | readEnv(...) : String |
39+
| Test.java:44:26:44:68 | ... + ... | semmle.label | ... + ... |
40+
| Test.java:47:36:47:41 | result | semmle.label | result |
41+
| Test.java:64:5:64:13 | System.in : InputStream | semmle.label | System.in : InputStream |
42+
| Test.java:64:20:64:23 | data [post update] : byte[] | semmle.label | data [post update] : byte[] |
43+
| Test.java:67:26:67:80 | ... + ... | semmle.label | ... + ... |
44+
| Test.java:67:56:67:73 | byteToString(...) : String | semmle.label | byteToString(...) : String |
45+
| Test.java:67:69:67:72 | data : byte[] | semmle.label | data : byte[] |
46+
| Test.java:70:36:70:53 | byteToString(...) | semmle.label | byteToString(...) |
47+
| Test.java:70:49:70:52 | data : byte[] | semmle.label | data : byte[] |
48+
subpaths
49+
| Test.java:22:49:22:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:22:36:22:53 | byteToString(...) |
50+
| Test.java:25:69:25:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:25:56:25:73 | byteToString(...) : String |
51+
| Test.java:67:69:67:72 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:67:56:67:73 | byteToString(...) : String |
52+
| Test.java:70:49:70:52 | data : byte[] | Test.java:10:31:10:41 | data : byte[] | Test.java:11:12:11:51 | new String(...) : String | Test.java:70:36:70:53 | byteToString(...) |
53+
#select
54+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:22:36:22:53 | byteToString(...) |
55+
| Test.java:19:5:19:25 | getInputStream(...) : InputStream | Test.java:25:26:25:80 | ... + ... |
56+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:33:26:33:68 | ... + ... |
57+
| Test.java:30:21:30:61 | executeQuery(...) : String | Test.java:36:36:36:41 | result |
58+
| Test.java:41:21:41:49 | readEnv(...) : String | Test.java:44:26:44:68 | ... + ... |
59+
| Test.java:41:21:41:49 | readEnv(...) : String | Test.java:47:36:47:41 | result |
60+
| Test.java:64:5:64:13 | System.in : InputStream | Test.java:67:26:67:80 | ... + ... |
61+
| Test.java:64:5:64:13 | System.in : InputStream | Test.java:70:36:70:53 | byteToString(...) |

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.ext.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
extensions:
2+
3+
- addsTo:
4+
pack: codeql/java-all
5+
extensible: supportedThreatModels
6+
data:
7+
- ["local"]
8+
9+
- addsTo:
10+
pack: codeql/java-all
11+
extensible: sourceModel
12+
data:
13+
- ["testlib", "TestSources", False, "executeQuery", "(String)", "", "ReturnValue", "database", "manual"]
14+
- ["testlib", "TestSources", False, "readEnv", "(String)", "", "ReturnValue", "environment", "manual"]
15+
- ["testlib", "TestSources", False, "getCustom", "(String)", "", "ReturnValue", "custom", "manual"]

‎java/ql/test/library-tests/dataflow/threat-models/threat-models-flowtest3.ql

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/**
2+
* This is a dataflow test using the "default" threat model with the
3+
* addition of the threat model group "local".
4+
*/
5+
6+
import Test
7+
import ThreatModel::PathGraph
8+
9+
from ThreatModel::PathNode source, ThreatModel::PathNode sink
10+
where ThreatModel::flowPath(source, sink)
11+
select source, sink

0 commit comments

Comments
 (0)