Skip to content

Commit e54eaed

Browse files
atorralbaatorralba
committed
Refactor tests to use InlineFlowTest
1 parent db73e16 commit e54eaed

19 files changed

+246
-605
lines changed

‎java/ql/test/query-tests/security/CWE-611/DigesterTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ public class DigesterTests {
1313
public void bad1(HttpServletRequest request, HttpServletResponse response) throws Exception {
1414
ServletInputStream servletInputStream = request.getInputStream();
1515
Digester digester = new Digester();
16-
digester.parse(servletInputStream); // bad
16+
digester.parse(servletInputStream); // $ hasTaintFlow
1717
}
1818

1919
@PostMapping(value = "good")

‎java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -11,95 +11,97 @@ class DocumentBuilderTests {
1111
public void unconfiguredParse(Socket sock) throws Exception {
1212
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
1313
DocumentBuilder builder = factory.newDocumentBuilder();
14-
builder.parse(sock.getInputStream()); //unsafe
14+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
1515
}
1616

1717
public void disableDTD(Socket sock) throws Exception {
1818
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
1919
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
2020
DocumentBuilder builder = factory.newDocumentBuilder();
21-
builder.parse(sock.getInputStream()); //safe
21+
builder.parse(sock.getInputStream()); // safe
2222
}
2323

2424
public void enableSecurityFeature(Socket sock) throws Exception {
2525
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
2626
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
2727
DocumentBuilder builder = factory.newDocumentBuilder();
28-
builder.parse(sock.getInputStream()); //unsafe -- secure-processing by itself is insufficient
28+
builder.parse(sock.getInputStream()); // $ hasTaintFlow -- secure-processing by itself is
29+
// insufficient
2930
}
3031

3132
public void enableSecurityFeature2(Socket sock) throws Exception {
3233
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
3334
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
3435
DocumentBuilder builder = factory.newDocumentBuilder();
35-
builder.parse(sock.getInputStream()); //unsafe -- secure-processing by itself is insufficient
36+
builder.parse(sock.getInputStream()); // $ hasTaintFlow -- secure-processing by itself is
37+
// insufficient
3638
}
3739

3840
public void enableDTD(Socket sock) throws Exception {
3941
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
4042
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
4143
DocumentBuilder builder = factory.newDocumentBuilder();
42-
builder.parse(sock.getInputStream()); //unsafe
44+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
4345
}
4446

4547
public void disableSecurityFeature(Socket sock) throws Exception {
4648
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
4749
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", false);
4850
DocumentBuilder builder = factory.newDocumentBuilder();
49-
builder.parse(sock.getInputStream()); //unsafe
51+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
5052
}
5153

5254
public void disableExternalEntities(Socket sock) throws Exception {
5355
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
5456
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
5557
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
5658
DocumentBuilder builder = factory.newDocumentBuilder();
57-
builder.parse(sock.getInputStream()); //safe
59+
builder.parse(sock.getInputStream()); // safe
5860
}
5961

6062
public void partialDisableExternalEntities(Socket sock) throws Exception {
6163
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
6264
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
6365
DocumentBuilder builder = factory.newDocumentBuilder();
64-
builder.parse(sock.getInputStream()); //unsafe
66+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
6567
}
6668

6769
public void partialDisableExternalEntities2(Socket sock) throws Exception {
6870
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
6971
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
7072
DocumentBuilder builder = factory.newDocumentBuilder();
71-
builder.parse(sock.getInputStream()); //unsafe
73+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
7274
}
7375

7476
public void misConfigureExternalEntities1(Socket sock) throws Exception {
7577
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
7678
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
7779
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
7880
DocumentBuilder builder = factory.newDocumentBuilder();
79-
builder.parse(sock.getInputStream()); //unsafe
81+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
8082
}
8183

8284
public void misConfigureExternalEntities2(Socket sock) throws Exception {
8385
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
8486
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
8587
factory.setFeature("http://xml.org/sax/features/external-general-entities", true);
8688
DocumentBuilder builder = factory.newDocumentBuilder();
87-
builder.parse(sock.getInputStream()); //unsafe
89+
builder.parse(sock.getInputStream()); // $ hasTaintFlow
8890
}
8991

9092
public void taintedSAXInputSource1(Socket sock) throws Exception {
91-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
92-
DocumentBuilder builder = factory.newDocumentBuilder();
93-
SAXSource source = new SAXSource(new InputSource(sock.getInputStream()));
94-
builder.parse(source.getInputSource()); //unsafe
93+
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
94+
DocumentBuilder builder = factory.newDocumentBuilder();
95+
SAXSource source = new SAXSource(new InputSource(sock.getInputStream()));
96+
builder.parse(source.getInputSource()); // $ hasTaintFlow
9597
}
9698

9799
public void taintedSAXInputSource2(Socket sock) throws Exception {
98-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
99-
DocumentBuilder builder = factory.newDocumentBuilder();
100-
StreamSource source = new StreamSource(sock.getInputStream());
101-
builder.parse(SAXSource.sourceToInputSource(source)); //unsafe
102-
builder.parse(source.getInputStream()); //unsafe
100+
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
101+
DocumentBuilder builder = factory.newDocumentBuilder();
102+
StreamSource source = new StreamSource(sock.getInputStream());
103+
builder.parse(SAXSource.sourceToInputSource(source)); // $ hasTaintFlow
104+
builder.parse(source.getInputStream()); // $ hasTaintFlow
103105
}
104106

105107
private static DocumentBuilderFactory getDocumentBuilderFactory() throws Exception {
@@ -112,21 +114,22 @@ private static DocumentBuilderFactory getDocumentBuilderFactory() throws Excepti
112114
return factory;
113115
}
114116

115-
private static final ThreadLocal<DocumentBuilder> XML_DOCUMENT_BUILDER = new ThreadLocal<DocumentBuilder>() {
116-
@Override
117-
protected DocumentBuilder initialValue() {
118-
try {
119-
DocumentBuilderFactory factory = getDocumentBuilderFactory();
120-
return factory.newDocumentBuilder();
121-
} catch (Exception ex) {
122-
throw new RuntimeException(ex);
123-
}
124-
}
125-
};
117+
private static final ThreadLocal<DocumentBuilder> XML_DOCUMENT_BUILDER =
118+
new ThreadLocal<DocumentBuilder>() {
119+
@Override
120+
protected DocumentBuilder initialValue() {
121+
try {
122+
DocumentBuilderFactory factory = getDocumentBuilderFactory();
123+
return factory.newDocumentBuilder();
124+
} catch (Exception ex) {
125+
throw new RuntimeException(ex);
126+
}
127+
}
128+
};
126129

127130
public void disableExternalEntities2(Socket sock) throws Exception {
128131
DocumentBuilder builder = XML_DOCUMENT_BUILDER.get();
129-
builder.parse(sock.getInputStream()); //safe
132+
builder.parse(sock.getInputStream()); // safe
130133
}
131134

132135
}

‎java/ql/test/query-tests/security/CWE-611/ParserHelperTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ public class ParserHelperTests {
99

1010
@PostMapping(value = "bad4")
1111
public void bad4(HttpServletRequest request) throws Exception {
12-
Document document = ParserHelper.loadDocument(request.getInputStream()); // bad
12+
Document document = ParserHelper.loadDocument(request.getInputStream()); // $ hasTaintFlow
1313
}
1414
}

‎java/ql/test/query-tests/security/CWE-611/SAXBuilderTests.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@ public class SAXBuilderTests {
55

66
public void unconfiguredSAXBuilder(Socket sock) throws Exception {
77
SAXBuilder builder = new SAXBuilder();
8-
builder.build(sock.getInputStream()); //unsafe
8+
builder.build(sock.getInputStream()); // $ hasTaintFlow
99
}
10-
10+
1111
public void safeBuilder(Socket sock) throws Exception {
1212
SAXBuilder builder = new SAXBuilder();
13-
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
14-
builder.build(sock.getInputStream()); //safe
13+
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
14+
builder.build(sock.getInputStream()); // safe
1515
}
1616

1717
public void misConfiguredBuilder(Socket sock) throws Exception {
1818
SAXBuilder builder = new SAXBuilder();
19-
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl",false);
20-
builder.build(sock.getInputStream()); //unsafe
19+
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
20+
builder.build(sock.getInputStream()); // $ hasTaintFlow
2121
}
2222
}

‎java/ql/test/query-tests/security/CWE-611/SAXParserTests.java

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,78 +6,78 @@
66
import org.xml.sax.helpers.DefaultHandler;
77

88
public class SAXParserTests {
9-
9+
1010
public void unconfiguredParser(Socket sock) throws Exception {
1111
SAXParserFactory factory = SAXParserFactory.newInstance();
1212
SAXParser parser = factory.newSAXParser();
13-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
13+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
1414
}
15-
15+
1616
public void safeParser(Socket sock) throws Exception {
1717
SAXParserFactory factory = SAXParserFactory.newInstance();
1818
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
1919
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
2020
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
2121
SAXParser parser = factory.newSAXParser();
22-
parser.parse(sock.getInputStream(), new DefaultHandler()); //safe
22+
parser.parse(sock.getInputStream(), new DefaultHandler()); // safe
2323
}
24-
24+
2525
public void partialConfiguredParser1(Socket sock) throws Exception {
2626
SAXParserFactory factory = SAXParserFactory.newInstance();
2727
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
2828
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
2929
SAXParser parser = factory.newSAXParser();
30-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
30+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
3131
}
32-
32+
3333
public void partialConfiguredParser2(Socket sock) throws Exception {
3434
SAXParserFactory factory = SAXParserFactory.newInstance();
3535
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
3636
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
3737
SAXParser parser = factory.newSAXParser();
38-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
38+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
3939
}
40-
40+
4141
public void partialConfiguredParser3(Socket sock) throws Exception {
4242
SAXParserFactory factory = SAXParserFactory.newInstance();
4343
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
4444
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
4545
SAXParser parser = factory.newSAXParser();
46-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
46+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
4747
}
48-
48+
4949
public void misConfiguredParser1(Socket sock) throws Exception {
5050
SAXParserFactory factory = SAXParserFactory.newInstance();
5151
factory.setFeature("http://xml.org/sax/features/external-general-entities", true);
5252
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
5353
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
5454
SAXParser parser = factory.newSAXParser();
55-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
55+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
5656
}
57-
57+
5858
public void misConfiguredParser2(Socket sock) throws Exception {
5959
SAXParserFactory factory = SAXParserFactory.newInstance();
6060
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
6161
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
6262
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
6363
SAXParser parser = factory.newSAXParser();
64-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
64+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
6565
}
66-
66+
6767
public void misConfiguredParser3(Socket sock) throws Exception {
6868
SAXParserFactory factory = SAXParserFactory.newInstance();
6969
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
7070
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
7171
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true);
7272
SAXParser parser = factory.newSAXParser();
73-
parser.parse(sock.getInputStream(), new DefaultHandler()); //unsafe
73+
parser.parse(sock.getInputStream(), new DefaultHandler()); // $ hasTaintFlow
7474
}
7575

7676
public void safeParser2(Socket sock) throws Exception {
7777
SAXParserFactory factory = SAXParserFactory.newInstance();
7878
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
79-
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
79+
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
8080
SAXParser parser = factory.newSAXParser();
81-
parser.parse(sock.getInputStream(), new DefaultHandler()); //safe
81+
parser.parse(sock.getInputStream(), new DefaultHandler()); // safe
8282
}
8383
}

‎java/ql/test/query-tests/security/CWE-611/SAXReaderTests.java

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,59 +5,59 @@ public class SAXReaderTests {
55

66
public void unconfiguredReader(Socket sock) throws Exception {
77
SAXReader reader = new SAXReader();
8-
reader.read(sock.getInputStream()); //unsafe
8+
reader.read(sock.getInputStream()); // $ hasTaintFlow
99
}
10-
10+
1111
public void safeReader(Socket sock) throws Exception {
1212
SAXReader reader = new SAXReader();
1313
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
1414
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
15-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
16-
reader.read(sock.getInputStream()); //safe
15+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
16+
reader.read(sock.getInputStream()); // safe
1717
}
18-
18+
1919
public void partialConfiguredReader1(Socket sock) throws Exception {
2020
SAXReader reader = new SAXReader();
2121
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
2222
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
23-
reader.read(sock.getInputStream()); //unsafe
23+
reader.read(sock.getInputStream()); // $ hasTaintFlow
2424
}
25-
25+
2626
public void partialConfiguredReader2(Socket sock) throws Exception {
2727
SAXReader reader = new SAXReader();
2828
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
29-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
30-
reader.read(sock.getInputStream()); //unsafe
29+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
30+
reader.read(sock.getInputStream()); // $ hasTaintFlow
3131
}
32-
32+
3333
public void partialConfiguredReader3(Socket sock) throws Exception {
3434
SAXReader reader = new SAXReader();
3535
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
36-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
37-
reader.read(sock.getInputStream()); //unsafe
36+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
37+
reader.read(sock.getInputStream()); // $ hasTaintFlow
3838
}
39-
39+
4040
public void misConfiguredReader1(Socket sock) throws Exception {
4141
SAXReader reader = new SAXReader();
4242
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
4343
reader.setFeature("http://xml.org/sax/features/external-general-entities", true);
44-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
45-
reader.read(sock.getInputStream()); //unsafe
44+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
45+
reader.read(sock.getInputStream()); // $ hasTaintFlow
4646
}
47-
47+
4848
public void misConfiguredReader2(Socket sock) throws Exception {
4949
SAXReader reader = new SAXReader();
5050
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
5151
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
52-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
53-
reader.read(sock.getInputStream()); //unsafe
52+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
53+
reader.read(sock.getInputStream()); // $ hasTaintFlow
5454
}
55-
55+
5656
public void misConfiguredReader3(Socket sock) throws Exception {
5757
SAXReader reader = new SAXReader();
5858
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
5959
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
60-
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
61-
reader.read(sock.getInputStream()); //unsafe
60+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", true);
61+
reader.read(sock.getInputStream()); // $ hasTaintFlow
6262
}
6363
}

‎java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@ public void unsafeSource(Socket sock) throws Exception {
1717
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
1818
JAXBContext jc = JAXBContext.newInstance(Object.class);
1919
Unmarshaller um = jc.createUnmarshaller();
20-
um.unmarshal(source); // BAD
20+
um.unmarshal(source); // $ hasTaintFlow
2121
}
2222

2323
public void explicitlySafeSource1(Socket sock) throws Exception {
2424
XMLReader reader = XMLReaderFactory.createXMLReader();
2525
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
2626
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
27-
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
27+
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
2828
SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
2929
}
3030

0 commit comments

Comments
 (0)