Skip to content

Commit 7d0b02e

Browse files
atorralbaatorralba
authored
Merge pull request github#13248 from atorralba/atorralba/java/nio-files-copy-models-fix
Java: Tweak java.nio.file.Files.copy models
2 parents 5dc3789 + 5c5f910 commit 7d0b02e

File tree

4 files changed

+18
-22
lines changed

4 files changed

+18
-22
lines changed

‎java/ql/lib/change-notes/2023-05-23-java-nio-file-files-copy-models-tweak.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
Modified the models related to `java.nio.file.Files.copy` so that generic `[Input|Output]Stream` arguments are not considered file-related sinks.

‎java/ql/lib/ext/java.nio.file.model.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["java.nio.file", "Files", False, "copy", "", "", "Argument[0]", "read-file", "manual"]
6+
- ["java.nio.file", "Files", False, "copy", "(Path,OutputStream)", "", "Argument[0]", "read-file", "manual"]
7+
- ["java.nio.file", "Files", False, "copy", "(Path,Path,CopyOption[])", "", "Argument[0]", "read-file", "manual"]
8+
- ["java.nio.file", "Files", False, "copy", "(Path,Path,CopyOption[])", "", "Argument[1]", "create-file", "manual"]
79
- ["java.nio.file", "Files", False, "copy", "(InputStream,Path,CopyOption[])", "", "Argument[0]", "write-file", "manual"]
8-
- ["java.nio.file", "Files", False, "copy", "", "", "Argument[1]", "create-file", "manual"]
10+
- ["java.nio.file", "Files", False, "copy", "(InputStream,Path,CopyOption[])", "", "Argument[1]", "create-file", "manual"]
911
- ["java.nio.file", "Files", False, "createDirectories", "", "", "Argument[0]", "create-file", "manual"]
1012
- ["java.nio.file", "Files", False, "createDirectory", "", "", "Argument[0]", "create-file", "manual"]
1113
- ["java.nio.file", "Files", False, "createFile", "", "", "Argument[0]", "create-file", "manual"]

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,8 @@ edges
2323
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:46:31:46:38 | source(...) : String |
2424
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:48:33:48:40 | source(...) : String |
2525
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:50:27:50:34 | source(...) : String |
26-
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:51:27:51:34 | source(...) : String |
27-
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:52:34:52:41 | source(...) : String |
26+
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:52:27:52:34 | source(...) : String |
2827
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:54:40:54:47 | source(...) : String |
29-
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:55:48:55:55 | source(...) : String |
3028
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:56:47:56:54 | source(...) : String |
3129
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:58:40:58:47 | source(...) : String |
3230
| mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:60:38:60:45 | source(...) : String |
@@ -77,10 +75,8 @@ edges
7775
| mad/Test.java:46:31:46:38 | source(...) : String | mad/Test.java:46:24:46:38 | (...)... |
7876
| mad/Test.java:48:33:48:40 | source(...) : String | mad/Test.java:48:24:48:40 | (...)... |
7977
| mad/Test.java:50:27:50:34 | source(...) : String | mad/Test.java:50:20:50:34 | (...)... |
80-
| mad/Test.java:51:27:51:34 | source(...) : String | mad/Test.java:51:20:51:34 | (...)... |
81-
| mad/Test.java:52:34:52:41 | source(...) : String | mad/Test.java:52:20:52:41 | (...)... |
78+
| mad/Test.java:52:27:52:34 | source(...) : String | mad/Test.java:52:20:52:34 | (...)... |
8279
| mad/Test.java:54:40:54:47 | source(...) : String | mad/Test.java:54:33:54:47 | (...)... |
83-
| mad/Test.java:55:48:55:55 | source(...) : String | mad/Test.java:55:33:55:55 | (...)... |
8480
| mad/Test.java:56:47:56:54 | source(...) : String | mad/Test.java:56:40:56:54 | (...)... |
8581
| mad/Test.java:58:40:58:47 | source(...) : String | mad/Test.java:58:33:58:47 | (...)... |
8682
| mad/Test.java:60:38:60:45 | source(...) : String | mad/Test.java:60:31:60:45 | (...)... |
@@ -161,14 +157,10 @@ nodes
161157
| mad/Test.java:48:33:48:40 | source(...) : String | semmle.label | source(...) : String |
162158
| mad/Test.java:50:20:50:34 | (...)... | semmle.label | (...)... |
163159
| mad/Test.java:50:27:50:34 | source(...) : String | semmle.label | source(...) : String |
164-
| mad/Test.java:51:20:51:34 | (...)... | semmle.label | (...)... |
165-
| mad/Test.java:51:27:51:34 | source(...) : String | semmle.label | source(...) : String |
166-
| mad/Test.java:52:20:52:41 | (...)... | semmle.label | (...)... |
167-
| mad/Test.java:52:34:52:41 | source(...) : String | semmle.label | source(...) : String |
160+
| mad/Test.java:52:20:52:34 | (...)... | semmle.label | (...)... |
161+
| mad/Test.java:52:27:52:34 | source(...) : String | semmle.label | source(...) : String |
168162
| mad/Test.java:54:33:54:47 | (...)... | semmle.label | (...)... |
169163
| mad/Test.java:54:40:54:47 | source(...) : String | semmle.label | source(...) : String |
170-
| mad/Test.java:55:33:55:55 | (...)... | semmle.label | (...)... |
171-
| mad/Test.java:55:48:55:55 | source(...) : String | semmle.label | source(...) : String |
172164
| mad/Test.java:56:40:56:54 | (...)... | semmle.label | (...)... |
173165
| mad/Test.java:56:47:56:54 | source(...) : String | semmle.label | source(...) : String |
174166
| mad/Test.java:58:33:58:47 | (...)... | semmle.label | (...)... |
@@ -273,10 +265,8 @@ subpaths
273265
| mad/Test.java:46:24:46:38 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:46:24:46:38 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
274266
| mad/Test.java:48:9:48:41 | new FileReader(...) | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:48:24:48:40 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
275267
| mad/Test.java:50:20:50:34 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:50:20:50:34 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
276-
| mad/Test.java:51:20:51:34 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:51:20:51:34 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
277-
| mad/Test.java:52:20:52:41 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:52:20:52:41 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
268+
| mad/Test.java:52:20:52:34 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:52:20:52:34 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
278269
| mad/Test.java:54:33:54:47 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:54:33:54:47 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
279-
| mad/Test.java:55:33:55:55 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:55:33:55:55 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
280270
| mad/Test.java:56:40:56:54 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:56:40:56:54 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
281271
| mad/Test.java:58:33:58:47 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:58:33:58:47 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |
282272
| mad/Test.java:60:31:60:45 | (...)... | mad/Test.java:29:16:29:36 | getHostName(...) : String | mad/Test.java:60:31:60:45 | (...)... | This path depends on a $@. | mad/Test.java:29:16:29:36 | getHostName(...) | user-provided value |

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,13 @@ void test() throws IOException {
4646
new FileReader((File) source());
4747
// "java.io;FileReader;true;FileReader;(String);;Argument[0];read-file;ai-generated"
4848
new FileReader((String) source());
49-
// "java.nio.file;Files;false;copy;;;Argument[0];read-file;manual"
50-
Files.copy((Path) source(), (Path) null);
49+
// "java.nio.file;Files;false;copy;(Path,OutputStream);;Argument[0];read-file;manual"
5150
Files.copy((Path) source(), (OutputStream) null);
52-
Files.copy((InputStream) source(), null);
53-
// "java.nio.file;Files;false;copy;;;Argument[1];create-file;manual"
51+
// "java.nio.file;Files;false;copy;(Path,Path,CopyOption[]);;Argument[0];read-file;manual"
52+
Files.copy((Path) source(), (Path) null);
53+
// "java.nio.file;Files;false;copy;(Path,Path,CopyOption[]);;Argument[1];create-file;manual"
5454
Files.copy((Path) null, (Path) source());
55-
Files.copy((Path) null, (OutputStream) source());
55+
// "java.nio.file;Files;false;copy;(InputStream,Path,CopyOption[]);;Argument[1];create-file;manual"
5656
Files.copy((InputStream) null, (Path) source());
5757
// "java.nio.file;Files;false;createDirectories;;;Argument[0];create-file;manual"
5858
Files.createDirectories((Path) source());

0 commit comments

Comments
 (0)