Skip to content

Commit 27f9820

Browse files
hvitvedhvitved
committed
Java: Adapt to changes in FlowSummaryImpl 
1 parent fa449ce commit 27f9820

File tree

24 files changed

+5695
-6637
lines changed

24 files changed

+5695
-6637
lines changed

‎java/ql/lib/semmle/code/java/ConflictingAccess.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ module Modification {
2323
/** Holds if the call `c` modifies a shared resource. */
2424
predicate isModifyingCall(Call c) {
2525
exists(SummarizedCallable sc, string output | sc.getACall() = c |
26-
sc.propagatesFlow(_, output, _, _) and
26+
sc.propagatesFlow(_, output, _, _, _, _) and
2727
output.matches("Argument[this]%")
2828
)
2929
}

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 14 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -620,48 +620,25 @@ predicate barrierNode(Node node, string kind) { barrierNode(node, kind, _) }
620620

621621
// adapter class for converting Mad summaries to `SummarizedCallable`s
622622
private class SummarizedCallableAdapter extends SummarizedCallable {
623-
SummarizedCallableAdapter() { summaryElement(this, _, _, _, _, _, _) }
623+
string input_;
624+
string output_;
625+
string kind;
626+
Provenance p_;
627+
boolean isExact_;
628+
string model_;
624629

625-
private predicate relevantSummaryElementManual(
626-
string input, string output, string kind, string model
627-
) {
628-
exists(Provenance provenance |
629-
summaryElement(this, input, output, kind, provenance, model, _) and
630-
provenance.isManual()
631-
)
632-
}
633-
634-
private predicate relevantSummaryElementGenerated(
635-
string input, string output, string kind, string model
636-
) {
637-
exists(Provenance provenance |
638-
summaryElement(this, input, output, kind, provenance, model, _) and
639-
provenance.isGenerated()
640-
) and
641-
not exists(Provenance provenance |
642-
neutralElement(this, "summary", provenance, _) and
643-
provenance.isManual()
644-
)
645-
}
630+
SummarizedCallableAdapter() { summaryElement(this, input_, output_, kind, p_, model_, isExact_) }
646631

647632
override predicate propagatesFlow(
648-
string input, string output, boolean preservesValue, string model
633+
string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model
649634
) {
650-
exists(string kind |
651-
this.relevantSummaryElementManual(input, output, kind, model)
652-
or
653-
not this.relevantSummaryElementManual(_, _, _, _) and
654-
this.relevantSummaryElementGenerated(input, output, kind, model)
655-
|
656-
if kind = "value" then preservesValue = true else preservesValue = false
657-
)
635+
input = input_ and
636+
output = output_ and
637+
(if kind = "value" then preservesValue = true else preservesValue = false) and
638+
p = p_ and
639+
isExact = isExact_ and
640+
model = model_
658641
}
659-
660-
override predicate hasProvenance(Provenance provenance) {
661-
summaryElement(this, _, _, _, provenance, _, _)
662-
}
663-
664-
override predicate hasExactModel() { summaryElement(this, _, _, _, _, _, true) }
665642
}
666643

667644
final class SinkCallable = SinkModelCallable;

‎java/ql/lib/semmle/code/java/dataflow/FlowSummary.qll‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -121,24 +121,31 @@ class SummarizedCallableBase extends TSummarizedCallableBase {
121121

122122
class Provenance = Impl::Public::Provenance;
123123

124-
class SummarizedCallable = Impl::Public::SummarizedCallable;
124+
/** Provides the `Range` class used to define the extent of `SummarizedCallable`. */
125+
module SummarizedCallable {
126+
class Range = Impl::Public::SummarizedCallable;
127+
}
128+
129+
final class SummarizedCallable = Impl::Public::RelevantSummarizedCallable;
125130

126131
/**
127132
* An adapter class to add the flow summaries specified on `SyntheticCallable`
128133
* to `SummarizedCallable`.
129134
*/
130-
private class SummarizedSyntheticCallableAdapter extends SummarizedCallable, TSyntheticCallable {
135+
private class SummarizedSyntheticCallableAdapter extends SummarizedCallable::Range,
136+
TSyntheticCallable
137+
{
131138
override predicate propagatesFlow(
132-
string input, string output, boolean preservesValue, string model
139+
string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model
133140
) {
134141
exists(SyntheticCallable sc |
135142
sc = this.asSyntheticCallable() and
136143
sc.propagatesFlow(input, output, preservesValue) and
144+
p = "manual" and
145+
isExact = true and
137146
model = sc
138147
)
139148
}
140-
141-
override predicate hasExactModel() { any() }
142149
}
143150

144151
deprecated class RequiredSummaryComponentStack = Impl::Private::RequiredSummaryComponentStack;

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,11 @@ private import semmle.code.java.dispatch.internal.Unification
1212

1313
private module DispatchImpl {
1414
private predicate hasHighConfidenceTarget(Call c) {
15-
exists(Impl::Public::SummarizedCallable sc | sc.getACall() = c and not sc.applyGeneratedModel())
15+
exists(Impl::Public::SummarizedCallable sc, Impl::Public::Provenance p |
16+
sc.getACall() = c and
17+
sc.propagatesFlow(_, _, _, p, _, _) and
18+
not p.isGenerated()
19+
)
1620
or
1721
exists(Impl::Public::NeutralSummaryCallable nc | nc.getACall() = c and nc.hasManualModel())
1822
or
@@ -25,8 +29,10 @@ private module DispatchImpl {
2529
private predicate hasExactManualModel(Call c, Callable tgt) {
2630
tgt = c.getCallee().getSourceDeclaration() and
2731
(
28-
exists(Impl::Public::SummarizedCallable sc |
29-
sc.getACall() = c and sc.hasExactModel() and sc.hasManualModel()
32+
exists(Impl::Public::SummarizedCallable sc, Impl::Public::Provenance p |
33+
sc.getACall() = c and
34+
sc.propagatesFlow(_, _, _, p, true, _) and
35+
p.isManual()
3036
)
3137
or
3238
exists(Impl::Public::NeutralSummaryCallable nc |
@@ -57,16 +63,6 @@ private module DispatchImpl {
5763
exists(Call call | call = c.asCall() |
5864
result.asCallable() = sourceDispatch(call)
5965
or
60-
not (
61-
// Only use summarized callables with generated summaries in case
62-
// the static call target is not in the source code.
63-
// Note that if `applyGeneratedModel` holds it implies that there doesn't
64-
// exist a manual model.
65-
exists(Callable staticTarget | staticTarget = call.getCallee().getSourceDeclaration() |
66-
staticTarget.fromSource() and not staticTarget.isStub()
67-
) and
68-
result.asSummarizedCallable().applyGeneratedModel()
69-
) and
7066
result.asSummarizedCallable().getACall() = call
7167
)
7268
}

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::JavaDataFlow> {
3333

3434
class SummarizedCallableBase = FlowSummary::SummarizedCallableBase;
3535

36+
predicate callableFromSource(SummarizedCallableBase sc) {
37+
sc.asCallable() = any(Callable c | c.fromSource() and not c.isStub())
38+
}
39+
3640
class SourceBase = Void;
3741

3842
class SinkBase = Void;

‎java/ql/lib/semmle/code/java/dispatch/WrappedInvocation.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,19 +68,19 @@ private predicate mayInvokeCallback(SrcMethod m, int n) {
6868
(not m.fromSource() or m.isNative() or m.getFile().getAbsolutePath().matches("%/test/stubs/%"))
6969
}
7070

71-
private class SummarizedCallableWithCallback extends SummarizedCallable {
71+
private class SummarizedCallableWithCallback extends SummarizedCallable::Range {
7272
private int pos;
7373

7474
SummarizedCallableWithCallback() { mayInvokeCallback(this.asCallable(), pos) }
7575

7676
override predicate propagatesFlow(
77-
string input, string output, boolean preservesValue, string model
77+
string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model
7878
) {
7979
input = "Argument[" + pos + "]" and
8080
output = "Argument[" + pos + "].Parameter[-1]" and
8181
preservesValue = true and
82+
p = "hq-generated" and
83+
isExact = true and
8284
model = "heuristic-callback"
8385
}
84-
85-
override predicate hasProvenance(Provenance provenance) { provenance = "hq-generated" }
8686
}

‎java/ql/src/Metrics/Summaries/GeneratedVsManualCoverageQuery.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ private int getNumMadModeledApis(string package, string provenance, string apiSu
1717
(
1818
// "auto-only"
1919
not sc.hasManualModel() and
20-
sc.hasGeneratedModel() and
20+
any(Provenance p | sc.propagatesFlow(_, _, _, p, _, _)).isGenerated() and
2121
provenance = "generated"
2222
or
2323
sc.hasManualModel() and
2424
(
25-
if sc.hasGeneratedModel()
25+
if any(Provenance p | sc.propagatesFlow(_, _, _, p, _, _)).isGenerated()
2626
then
2727
// "both"
2828
provenance = "both"

‎java/ql/src/utils/modelgenerator/internal/CaptureModels.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ module SummaryModelGeneratorInput implements SummaryModelGeneratorInputSig {
187187
}
188188

189189
private predicate hasManualSummaryModel(Callable api) {
190-
api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()).asCallable() or
190+
api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.hasManualModel()).asCallable() or
191191
api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel()).asCallable()
192192
}
193193

‎java/ql/test/experimental/query-tests/security/CWE-601/SpringUrlRedirect.expected‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,13 @@ edges
1818
| SpringUrlRedirect.java:98:44:98:54 | redirectUrl : String | SpringUrlRedirect.java:98:33:98:55 | create(...) : URI | provenance | MaD:3 |
1919
| SpringUrlRedirect.java:104:39:104:56 | redirectUrl : String | SpringUrlRedirect.java:106:37:106:47 | redirectUrl : String | provenance | |
2020
| SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders | SpringUrlRedirect.java:108:68:108:78 | httpHeaders | provenance | |
21-
| SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | SpringUrlRedirect.java:108:68:108:78 | httpHeaders | provenance | |
2221
| SpringUrlRedirect.java:106:37:106:47 | redirectUrl : String | SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders | provenance | MaD:4 |
23-
| SpringUrlRedirect.java:106:37:106:47 | redirectUrl : String | SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | provenance | MaD:5 |
2422
| SpringUrlRedirect.java:112:39:112:56 | redirectUrl : String | SpringUrlRedirect.java:114:37:114:47 | redirectUrl : String | provenance | |
2523
| SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders | SpringUrlRedirect.java:116:37:116:47 | httpHeaders | provenance | |
26-
| SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | SpringUrlRedirect.java:116:37:116:47 | httpHeaders | provenance | |
2724
| SpringUrlRedirect.java:114:37:114:47 | redirectUrl : String | SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders | provenance | MaD:4 |
28-
| SpringUrlRedirect.java:114:37:114:47 | redirectUrl : String | SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | provenance | MaD:5 |
2925
| SpringUrlRedirect.java:120:33:120:50 | redirectUrl : String | SpringUrlRedirect.java:122:37:122:47 | redirectUrl : String | provenance | |
3026
| SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders | SpringUrlRedirect.java:124:49:124:59 | httpHeaders | provenance | |
31-
| SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | SpringUrlRedirect.java:124:49:124:59 | httpHeaders | provenance | |
3227
| SpringUrlRedirect.java:122:37:122:47 | redirectUrl : String | SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders | provenance | MaD:4 |
33-
| SpringUrlRedirect.java:122:37:122:47 | redirectUrl : String | SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | provenance | MaD:5 |
3428
| SpringUrlRedirect.java:128:33:128:50 | redirectUrl : String | SpringUrlRedirect.java:130:44:130:54 | redirectUrl : String | provenance | |
3529
| SpringUrlRedirect.java:130:9:130:19 | httpHeaders : HttpHeaders | SpringUrlRedirect.java:132:49:132:59 | httpHeaders | provenance | |
3630
| SpringUrlRedirect.java:130:33:130:55 | create(...) : URI | SpringUrlRedirect.java:130:9:130:19 | httpHeaders : HttpHeaders | provenance | Config |
@@ -40,7 +34,6 @@ models
4034
| 2 | Summary: java.lang; String; false; format; (String,Object[]); ; Argument[1].ArrayElement; ReturnValue; taint; manual |
4135
| 3 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual |
4236
| 4 | Summary: org.springframework.http; HttpHeaders; true; add; (String,String); ; Argument[0..1]; Argument[this]; taint; manual |
43-
| 5 | Summary: org.springframework.util; MultiValueMap; true; add; ; ; Argument[1]; Argument[this].MapValue.Element; value; manual |
4437
nodes
4538
| SpringUrlRedirect.java:17:30:17:47 | redirectUrl : String | semmle.label | redirectUrl : String |
4639
| SpringUrlRedirect.java:19:19:19:29 | redirectUrl | semmle.label | redirectUrl |
@@ -71,17 +64,14 @@ nodes
7164
| SpringUrlRedirect.java:100:37:100:47 | httpHeaders | semmle.label | httpHeaders |
7265
| SpringUrlRedirect.java:104:39:104:56 | redirectUrl : String | semmle.label | redirectUrl : String |
7366
| SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders | semmle.label | httpHeaders [post update] : HttpHeaders |
74-
| SpringUrlRedirect.java:106:9:106:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | semmle.label | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String |
7567
| SpringUrlRedirect.java:106:37:106:47 | redirectUrl : String | semmle.label | redirectUrl : String |
7668
| SpringUrlRedirect.java:108:68:108:78 | httpHeaders | semmle.label | httpHeaders |
7769
| SpringUrlRedirect.java:112:39:112:56 | redirectUrl : String | semmle.label | redirectUrl : String |
7870
| SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders | semmle.label | httpHeaders [post update] : HttpHeaders |
79-
| SpringUrlRedirect.java:114:9:114:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | semmle.label | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String |
8071
| SpringUrlRedirect.java:114:37:114:47 | redirectUrl : String | semmle.label | redirectUrl : String |
8172
| SpringUrlRedirect.java:116:37:116:47 | httpHeaders | semmle.label | httpHeaders |
8273
| SpringUrlRedirect.java:120:33:120:50 | redirectUrl : String | semmle.label | redirectUrl : String |
8374
| SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders | semmle.label | httpHeaders [post update] : HttpHeaders |
84-
| SpringUrlRedirect.java:122:9:122:19 | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String | semmle.label | httpHeaders [post update] : HttpHeaders [<map.value>, <element>] : String |
8575
| SpringUrlRedirect.java:122:37:122:47 | redirectUrl : String | semmle.label | redirectUrl : String |
8676
| SpringUrlRedirect.java:124:49:124:59 | httpHeaders | semmle.label | httpHeaders |
8777
| SpringUrlRedirect.java:128:33:128:50 | redirectUrl : String | semmle.label | redirectUrl : String |

‎java/ql/test/library-tests/dataflow/capture/inlinetest.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,9 +98,7 @@ edges
9898
| B.java:107:5:107:6 | l2 : ArrayList [<element>, <element>] : String | B.java:107:16:111:6 | ...->... [post update] : new Consumer<List<String>>(...) { ... } [List<String> out1, <element>] : String | provenance | MaD:1 |
9999
| B.java:107:16:107:16 | l : List [<element>] : String | B.java:107:21:107:21 | l : List [<element>] : String | provenance | |
100100
| B.java:107:16:111:6 | ...->... : new Consumer<List<String>>(...) { ... } [String s] : String | B.java:107:16:111:6 | ...->... [post update] : new Consumer<List<String>>(...) { ... } [List<String> out2, <element>] : String | provenance | MaD:1 |
101-
| B.java:107:16:111:6 | ...->... : new Consumer<List<String>>(...) { ... } [String s] : String | B.java:107:16:111:6 | ...->... [post update] : new Consumer<List<String>>(...) { ... } [List<String> out2, <element>] : String | provenance | heuristic-callback |
102101
| B.java:107:16:111:6 | ...->... : new Consumer<List<String>>(...) { ... } [String s] : String | B.java:107:16:111:6 | parameter this : new Consumer<List<String>>(...) { ... } [String s] : String | provenance | MaD:1 |
103-
| B.java:107:16:111:6 | ...->... : new Consumer<List<String>>(...) { ... } [String s] : String | B.java:107:16:111:6 | parameter this : new Consumer<List<String>>(...) { ... } [String s] : String | provenance | heuristic-callback |
104102
| B.java:107:16:111:6 | ...->... [post update] : new Consumer<List<String>>(...) { ... } [List<String> out1, <element>] : String | B.java:107:16:111:6 | List<String> out1 : List [<element>] : String | provenance | |
105103
| B.java:107:16:111:6 | ...->... [post update] : new Consumer<List<String>>(...) { ... } [List<String> out2, <element>] : String | B.java:107:16:111:6 | List<String> out2 : List [<element>] : String | provenance | |
106104
| B.java:107:16:111:6 | List<String> out1 : List [<element>] : String | B.java:112:10:112:13 | out1 : List [<element>] : String | provenance | |
@@ -111,9 +109,7 @@ edges
111109
| B.java:107:21:107:21 | l : List [<element>] : String | B.java:107:31:111:5 | ...->... [post update] : new Consumer<String>(...) { ... } [List<String> out1, <element>] : String | provenance | MaD:1 |
112110
| B.java:107:31:107:31 | x : String | B.java:109:16:109:16 | x : String | provenance | |
113111
| B.java:107:31:111:5 | ...->... : new Consumer<String>(...) { ... } [String s] : String | B.java:107:31:111:5 | ...->... [post update] : new Consumer<String>(...) { ... } [List<String> out2, <element>] : String | provenance | MaD:1 |
114-
| B.java:107:31:111:5 | ...->... : new Consumer<String>(...) { ... } [String s] : String | B.java:107:31:111:5 | ...->... [post update] : new Consumer<String>(...) { ... } [List<String> out2, <element>] : String | provenance | heuristic-callback |
115112
| B.java:107:31:111:5 | ...->... : new Consumer<String>(...) { ... } [String s] : String | B.java:107:31:111:5 | parameter this : new Consumer<String>(...) { ... } [String s] : String | provenance | MaD:1 |
116-
| B.java:107:31:111:5 | ...->... : new Consumer<String>(...) { ... } [String s] : String | B.java:107:31:111:5 | parameter this : new Consumer<String>(...) { ... } [String s] : String | provenance | heuristic-callback |
117113
| B.java:107:31:111:5 | ...->... [post update] : new Consumer<String>(...) { ... } [List<String> out1, <element>] : String | B.java:107:31:111:5 | List<String> out1 : List [<element>] : String | provenance | |
118114
| B.java:107:31:111:5 | ...->... [post update] : new Consumer<String>(...) { ... } [List<String> out2, <element>] : String | B.java:107:31:111:5 | List<String> out2 : List [<element>] : String | provenance | |
119115
| B.java:107:31:111:5 | List<String> out1 : List [<element>] : String | B.java:107:31:111:5 | this : new Consumer<List<String>>(...) { ... } [List<String> out1, <element>] : String | provenance | |

0 commit comments

Comments
 (0)