Skip to content

Commit a85d0ea

Browse files
owen-mcowen-mc
committed
Make tests pass
1 parent 8fd8fc0 commit a85d0ea

File tree

3 files changed

+54
-46
lines changed

3 files changed

+54
-46
lines changed

‎java/ql/lib/semmle/code/java/frameworks/Regex.qll‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,46 @@ module;
44

55
import java
66

7+
/** The class `java.util.regex.Matcher`. */
8+
class TypeRegexMatcher extends Class {
9+
TypeRegexMatcher() { this.hasQualifiedName("java.util.regex", "Matcher") }
10+
}
11+
12+
/**
13+
* The `matches` method of `java.util.regex.Matcher`.
14+
*/
15+
class MatcherMatchesMethod extends Method {
16+
MatcherMatchesMethod() {
17+
this.getDeclaringType() instanceof TypeRegexMatcher and
18+
this.hasName("matches")
19+
}
20+
}
21+
722
/** The class `java.util.regex.Pattern`. */
823
class TypeRegexPattern extends Class {
924
TypeRegexPattern() { this.hasQualifiedName("java.util.regex", "Pattern") }
1025
}
1126

27+
/**
28+
* The `matches` method of `java.util.regex.Pattern`.
29+
*/
30+
class PatternMatchesMethod extends Method {
31+
PatternMatchesMethod() {
32+
this.getDeclaringType() instanceof TypeRegexPattern and
33+
this.hasName("matches")
34+
}
35+
}
36+
37+
/**
38+
* The `matcher` method of `java.util.regex.Pattern`.
39+
*/
40+
class PatternMatcherMethod extends Method {
41+
PatternMatcherMethod() {
42+
this.getDeclaringType() instanceof TypeRegexPattern and
43+
this.hasName("matcher")
44+
}
45+
}
46+
1247
/** The `quote` method of the `java.util.regex.Pattern` class. */
1348
class PatternQuoteMethod extends Method {
1449
PatternQuoteMethod() {

‎java/ql/lib/semmle/code/java/security/Sanitizers.qll‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module;
55
import java
66
private import semmle.code.java.controlflow.Guards
77
private import semmle.code.java.dataflow.DataFlow
8+
private import semmle.code.java.frameworks.Regex
89

910
/**
1011
* A node whose type is a simple type unlikely to carry taint, such as primitives and their boxed counterparts,
@@ -40,12 +41,25 @@ class SimpleTypeSanitizer extends DataFlow::Node {
4041
* make the type recursive. Otherwise use `RegexpCheckBarrier`.
4142
*/
4243
predicate regexpMatchGuardChecks(Guard guard, Expr e, boolean branch) {
43-
guard =
44-
any(MethodCall method |
45-
method.getMethod().getName() = "matches" and
46-
e = method.getQualifier() and
47-
branch = true
44+
exists(Method method, MethodCall mc |
45+
method = mc.getMethod() and
46+
guard = mc and
47+
branch = true
48+
|
49+
// `String.matches` and other `matches` methods.
50+
method.getName() = "matches" and
51+
e = mc.getQualifier()
52+
or
53+
method instanceof PatternMatchesMethod and
54+
e = mc.getArgument(1)
55+
or
56+
method instanceof MatcherMatchesMethod and
57+
exists(MethodCall matcherCall |
58+
matcherCall.getMethod() instanceof PatternMatcherMethod and
59+
e = matcherCall.getArgument(0) and
60+
DataFlow::localExprFlow(matcherCall, mc.getQualifier())
4861
)
62+
)
4963
}
5064

5165
/**

‎java/ql/test/query-tests/security/CWE-918/RequestForgery.expected‎

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -252,10 +252,6 @@
252252
| SanitizationTests.java:119:25:119:32 | unsafer9 | SanitizationTests.java:117:33:117:63 | getParameter(...) : String | SanitizationTests.java:119:25:119:32 | unsafer9 | Potential server-side request forgery due to a $@. | SanitizationTests.java:117:33:117:63 | getParameter(...) | user-provided value |
253253
| SanitizationTests.java:122:60:122:79 | new URI(...) | SanitizationTests.java:121:94:121:125 | getParameter(...) : String | SanitizationTests.java:122:60:122:79 | new URI(...) | Potential server-side request forgery due to a $@. | SanitizationTests.java:121:94:121:125 | getParameter(...) | user-provided value |
254254
| SanitizationTests.java:123:25:123:33 | unsafer10 | SanitizationTests.java:121:94:121:125 | getParameter(...) : String | SanitizationTests.java:123:25:123:33 | unsafer10 | Potential server-side request forgery due to a $@. | SanitizationTests.java:121:94:121:125 | getParameter(...) | user-provided value |
255-
| SanitizationTests.java:139:58:139:73 | new URI(...) | SanitizationTests.java:137:30:137:58 | getParameter(...) : String | SanitizationTests.java:139:58:139:73 | new URI(...) | Potential server-side request forgery due to a $@. | SanitizationTests.java:137:30:137:58 | getParameter(...) | user-provided value |
256-
| SanitizationTests.java:140:29:140:31 | r12 | SanitizationTests.java:137:30:137:58 | getParameter(...) : String | SanitizationTests.java:140:29:140:31 | r12 | Potential server-side request forgery due to a $@. | SanitizationTests.java:137:30:137:58 | getParameter(...) | user-provided value |
257-
| SanitizationTests.java:147:58:147:73 | new URI(...) | SanitizationTests.java:144:30:144:58 | getParameter(...) : String | SanitizationTests.java:147:58:147:73 | new URI(...) | Potential server-side request forgery due to a $@. | SanitizationTests.java:144:30:144:58 | getParameter(...) | user-provided value |
258-
| SanitizationTests.java:148:29:148:31 | r13 | SanitizationTests.java:144:30:144:58 | getParameter(...) : String | SanitizationTests.java:148:29:148:31 | r13 | Potential server-side request forgery due to a $@. | SanitizationTests.java:144:30:144:58 | getParameter(...) | user-provided value |
259255
| SpringSSRF.java:32:39:32:59 | ... + ... | SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | Potential server-side request forgery due to a $@. | SpringSSRF.java:28:33:28:60 | getParameter(...) | user-provided value |
260256
| SpringSSRF.java:33:35:33:48 | fooResourceUrl | SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:35:33:48 | fooResourceUrl | Potential server-side request forgery due to a $@. | SpringSSRF.java:28:33:28:60 | getParameter(...) | user-provided value |
261257
| SpringSSRF.java:34:34:34:47 | fooResourceUrl | SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:34:34:47 | fooResourceUrl | Potential server-side request forgery due to a $@. | SpringSSRF.java:28:33:28:60 | getParameter(...) | user-provided value |
@@ -781,22 +777,6 @@ edges
781777
| SanitizationTests.java:122:68:122:78 | unsafeUri10 : String | SanitizationTests.java:122:60:122:79 | new URI(...) | provenance | MaD:285 Sink:MaD:6 |
782778
| SanitizationTests.java:122:68:122:78 | unsafeUri10 : String | SanitizationTests.java:122:60:122:79 | new URI(...) : URI | provenance | Config |
783779
| SanitizationTests.java:122:68:122:78 | unsafeUri10 : String | SanitizationTests.java:122:60:122:79 | new URI(...) : URI | provenance | MaD:285 |
784-
| SanitizationTests.java:137:30:137:58 | getParameter(...) : String | SanitizationTests.java:139:66:139:72 | param12 : String | provenance | Src:MaD:277 |
785-
| SanitizationTests.java:139:35:139:74 | newBuilder(...) : Builder | SanitizationTests.java:139:35:139:82 | build(...) : HttpRequest | provenance | MaD:283 |
786-
| SanitizationTests.java:139:35:139:82 | build(...) : HttpRequest | SanitizationTests.java:140:29:140:31 | r12 | provenance | Sink:MaD:4 |
787-
| SanitizationTests.java:139:58:139:73 | new URI(...) : URI | SanitizationTests.java:139:35:139:74 | newBuilder(...) : Builder | provenance | MaD:284 |
788-
| SanitizationTests.java:139:66:139:72 | param12 : String | SanitizationTests.java:139:58:139:73 | new URI(...) | provenance | Config Sink:MaD:6 |
789-
| SanitizationTests.java:139:66:139:72 | param12 : String | SanitizationTests.java:139:58:139:73 | new URI(...) | provenance | MaD:285 Sink:MaD:6 |
790-
| SanitizationTests.java:139:66:139:72 | param12 : String | SanitizationTests.java:139:58:139:73 | new URI(...) : URI | provenance | Config |
791-
| SanitizationTests.java:139:66:139:72 | param12 : String | SanitizationTests.java:139:58:139:73 | new URI(...) : URI | provenance | MaD:285 |
792-
| SanitizationTests.java:144:30:144:58 | getParameter(...) : String | SanitizationTests.java:147:66:147:72 | param13 : String | provenance | Src:MaD:277 |
793-
| SanitizationTests.java:147:35:147:74 | newBuilder(...) : Builder | SanitizationTests.java:147:35:147:82 | build(...) : HttpRequest | provenance | MaD:283 |
794-
| SanitizationTests.java:147:35:147:82 | build(...) : HttpRequest | SanitizationTests.java:148:29:148:31 | r13 | provenance | Sink:MaD:4 |
795-
| SanitizationTests.java:147:58:147:73 | new URI(...) : URI | SanitizationTests.java:147:35:147:74 | newBuilder(...) : Builder | provenance | MaD:284 |
796-
| SanitizationTests.java:147:66:147:72 | param13 : String | SanitizationTests.java:147:58:147:73 | new URI(...) | provenance | Config Sink:MaD:6 |
797-
| SanitizationTests.java:147:66:147:72 | param13 : String | SanitizationTests.java:147:58:147:73 | new URI(...) | provenance | MaD:285 Sink:MaD:6 |
798-
| SanitizationTests.java:147:66:147:72 | param13 : String | SanitizationTests.java:147:58:147:73 | new URI(...) : URI | provenance | Config |
799-
| SanitizationTests.java:147:66:147:72 | param13 : String | SanitizationTests.java:147:58:147:73 | new URI(...) : URI | provenance | MaD:285 |
800780
| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | provenance | Src:MaD:277 Sink:MaD:264 |
801781
| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:35:33:48 | fooResourceUrl | provenance | Src:MaD:277 Sink:MaD:262 |
802782
| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:34:34:47 | fooResourceUrl | provenance | Src:MaD:277 Sink:MaD:263 |
@@ -1701,20 +1681,6 @@ nodes
17011681
| SanitizationTests.java:122:60:122:79 | new URI(...) : URI | semmle.label | new URI(...) : URI |
17021682
| SanitizationTests.java:122:68:122:78 | unsafeUri10 : String | semmle.label | unsafeUri10 : String |
17031683
| SanitizationTests.java:123:25:123:33 | unsafer10 | semmle.label | unsafer10 |
1704-
| SanitizationTests.java:137:30:137:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
1705-
| SanitizationTests.java:139:35:139:74 | newBuilder(...) : Builder | semmle.label | newBuilder(...) : Builder |
1706-
| SanitizationTests.java:139:35:139:82 | build(...) : HttpRequest | semmle.label | build(...) : HttpRequest |
1707-
| SanitizationTests.java:139:58:139:73 | new URI(...) | semmle.label | new URI(...) |
1708-
| SanitizationTests.java:139:58:139:73 | new URI(...) : URI | semmle.label | new URI(...) : URI |
1709-
| SanitizationTests.java:139:66:139:72 | param12 : String | semmle.label | param12 : String |
1710-
| SanitizationTests.java:140:29:140:31 | r12 | semmle.label | r12 |
1711-
| SanitizationTests.java:144:30:144:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
1712-
| SanitizationTests.java:147:35:147:74 | newBuilder(...) : Builder | semmle.label | newBuilder(...) : Builder |
1713-
| SanitizationTests.java:147:35:147:82 | build(...) : HttpRequest | semmle.label | build(...) : HttpRequest |
1714-
| SanitizationTests.java:147:58:147:73 | new URI(...) | semmle.label | new URI(...) |
1715-
| SanitizationTests.java:147:58:147:73 | new URI(...) : URI | semmle.label | new URI(...) : URI |
1716-
| SanitizationTests.java:147:66:147:72 | param13 : String | semmle.label | param13 : String |
1717-
| SanitizationTests.java:148:29:148:31 | r13 | semmle.label | r13 |
17181684
| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | semmle.label | getParameter(...) : String |
17191685
| SpringSSRF.java:32:39:32:59 | ... + ... | semmle.label | ... + ... |
17201686
| SpringSSRF.java:33:35:33:48 | fooResourceUrl | semmle.label | fooResourceUrl |
@@ -1857,10 +1823,3 @@ nodes
18571823
| mad/Test.java:112:15:112:31 | (...)... | semmle.label | (...)... |
18581824
| mad/Test.java:112:24:112:31 | source(...) : String | semmle.label | source(...) : String |
18591825
subpaths
1860-
testFailures
1861-
| SanitizationTests.java:137:30:137:58 | getParameter(...) : String | Unexpected result: Source |
1862-
| SanitizationTests.java:139:58:139:73 | new URI(...) | Unexpected result: Alert |
1863-
| SanitizationTests.java:140:29:140:31 | r12 | Unexpected result: Alert |
1864-
| SanitizationTests.java:144:30:144:58 | getParameter(...) : String | Unexpected result: Source |
1865-
| SanitizationTests.java:147:58:147:73 | new URI(...) | Unexpected result: Alert |
1866-
| SanitizationTests.java:148:29:148:31 | r13 | Unexpected result: Alert |

0 commit comments

Comments
 (0)