Skip to content

Commit 74fc638

Browse files
egregius313egregius313
committed
Add improper validation of array size query libraries
1 parent c319ee4 commit 74fc638

14 files changed

+145
-89
lines changed

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/** Provides a dataflow configuration to reason about improper validation of code-specified size used for array construction. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.dataflow.TaintTracking
6+
7+
/**
8+
* A dataflow configuration to reason about improper validation of code-specified size used for array construction.
9+
*/
10+
module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
11+
predicate isSource(DataFlow::Node source) {
12+
source instanceof BoundedFlowSource and
13+
// There is not a fixed lower bound which is greater than zero.
14+
not source.(BoundedFlowSource).lowerBound() > 0
15+
}
16+
17+
predicate isSink(DataFlow::Node sink) {
18+
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
19+
}
20+
}
21+
22+
/**
23+
* Dataflow flow for improper validation of code-specified size used for array construction.
24+
*/
25+
module BoundedFlowSourceFlow = DataFlow::Global<BoundedFlowSourceConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionLocalQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/** Provides a taint-tracking configuration to reason about improper validation of local user-provided size used for array construction. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.dataflow.FlowSources
6+
7+
/**
8+
* A taint-tracking configuration to reason about improper validation of local user-provided size used for array construction.
9+
*/
10+
module ImproperValidationOfArrayConstructionLocalConfig implements DataFlow::ConfigSig {
11+
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
12+
13+
predicate isSink(DataFlow::Node sink) {
14+
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
15+
}
16+
}
17+
18+
/**
19+
* Taint-tracking flow for improper validation of local user-provided size used for array construction.
20+
*/
21+
module ImproperValidationOfArrayConstructionLocalFlow =
22+
TaintTracking::Global<ImproperValidationOfArrayConstructionLocalConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/** Provides a taint-tracking configuration to reason about improper validation of user-provided size used for array construction. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.dataflow.FlowSources
6+
7+
/**
8+
* A taint-tracking configuration to reason about improper validation of user-provided size used for array construction.
9+
*/
10+
private module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
11+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
12+
13+
predicate isSink(DataFlow::Node sink) {
14+
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
15+
}
16+
}
17+
18+
/**
19+
* Taint-tracking flow for improper validation of user-provided size used for array construction.
20+
*/
21+
module ImproperValidationOfArrayConstructionFlow =
22+
TaintTracking::Global<ImproperValidationOfArrayConstructionConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/** Provides a dataflow configuration to reason about improper validation of code-specified array index. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.security.internal.BoundingChecks
6+
import semmle.code.java.dataflow.TaintTracking
7+
8+
/**
9+
* A dataflow configuration to reason about improper validation of code-specified array index.
10+
*/
11+
module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
12+
predicate isSource(DataFlow::Node source) { source instanceof BoundedFlowSource }
13+
14+
predicate isSink(DataFlow::Node sink) {
15+
exists(CheckableArrayAccess arrayAccess | arrayAccess.canThrowOutOfBounds(sink.asExpr()))
16+
}
17+
}
18+
19+
/**
20+
* Dataflow flow for improper validation of code-specified array index.
21+
*/
22+
module BoundedFlowSourceFlow = DataFlow::Global<BoundedFlowSourceConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexLocalQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/** Provides a taint-tracking configuration to reason about improper validation of local user-provided array index. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.dataflow.FlowSources
6+
7+
/**
8+
* A taint-tracking configuration to reason about improper validation of local user-provided array index.
9+
*/
10+
module ImproperValidationOfArrayIndexLocalConfig implements DataFlow::ConfigSig {
11+
predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
12+
13+
predicate isSink(DataFlow::Node sink) {
14+
any(CheckableArrayAccess caa).canThrowOutOfBounds(sink.asExpr())
15+
}
16+
}
17+
18+
/**
19+
* Taint-tracking flow for improper validation of local user-provided array index.
20+
*/
21+
module ImproperValidationOfArrayIndexLocalFlow =
22+
TaintTracking::Global<ImproperValidationOfArrayIndexLocalConfig>;

‎java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/** Provides a taint-tracking configuration to reason about improper validation of user-provided array index. */
2+
3+
import java
4+
import semmle.code.java.security.internal.ArraySizing
5+
import semmle.code.java.dataflow.FlowSources
6+
7+
/**
8+
* A taint-tracking configuration to reason about improper validation of user-provided array index.
9+
*/
10+
module ImproperValidationOfArrayIndexConfig implements DataFlow::ConfigSig {
11+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
12+
13+
predicate isSink(DataFlow::Node sink) {
14+
any(CheckableArrayAccess caa).canThrowOutOfBounds(sink.asExpr())
15+
}
16+
17+
predicate isBarrier(DataFlow::Node node) { node.getType() instanceof BooleanType }
18+
}
19+
20+
/**
21+
* Taint-tracking flow for improper validation of user-provided array index.
22+
*/
23+
module ImproperValidationOfArrayIndexFlow =
24+
TaintTracking::Global<ImproperValidationOfArrayIndexConfig>;

‎java/ql/src/Security/CWE/CWE-129/ArraySizing.qll renamed to ‎java/ql/lib/semmle/code/java/security/internal/ArraySizing.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
/** Provides predicates and classes to reason about the sizing and indexing of arrays. */
2+
13
import java
24
import semmle.code.java.dataflow.DataFlow
35
import semmle.code.java.dataflow.DefUse

‎java/ql/src/Security/CWE/CWE-129/BoundingChecks.qll renamed to ‎java/ql/lib/semmle/code/java/security/internal/BoundingChecks.qll

File renamed without changes.

‎java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,7 @@
1111
*/
1212

1313
import java
14-
import ArraySizing
15-
import semmle.code.java.dataflow.FlowSources
16-
17-
private module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
18-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
19-
20-
predicate isSink(DataFlow::Node sink) {
21-
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
22-
}
23-
}
24-
25-
module ImproperValidationOfArrayConstructionFlow =
26-
TaintTracking::Global<ImproperValidationOfArrayConstructionConfig>;
27-
14+
import semmle.code.java.security.ImproperValidationOfArrayConstructionQuery
2815
import ImproperValidationOfArrayConstructionFlow::PathGraph
2916

3017
from

‎java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,7 @@
1212
*/
1313

1414
import java
15-
import ArraySizing
16-
import semmle.code.java.dataflow.TaintTracking
17-
18-
module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
19-
predicate isSource(DataFlow::Node source) {
20-
source instanceof BoundedFlowSource and
21-
// There is not a fixed lower bound which is greater than zero.
22-
not source.(BoundedFlowSource).lowerBound() > 0
23-
}
24-
25-
predicate isSink(DataFlow::Node sink) {
26-
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
27-
}
28-
}
29-
30-
module BoundedFlowSourceFlow = DataFlow::Global<BoundedFlowSourceConfig>;
31-
15+
import semmle.code.java.security.ImproperValidationOfArrayConstructionCodeSpecifiedQuery
3216
import BoundedFlowSourceFlow::PathGraph
3317

3418
from

0 commit comments

Comments
 (0)