Skip to content

Commit 82d93d0

Browse files
michaelnebelmichaelnebel
committed
Java: Refactor CaptureSummaryModels code to enable re-use in C#.
1 parent ba233ed commit 82d93d0

File tree

5 files changed

+103
-90
lines changed

5 files changed

+103
-90
lines changed

java/ql/src/utils/model-generator/CaptureSummaryModels.ql renamed to java/ql/src/utils/model-generator/CaptureSummaryModels.qll

Lines changed: 3 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,4 @@
1-
/**
2-
* @name Capture summary models.
3-
* @description Finds applicable summary models to be used by other queries.
4-
* @id java/utils/model-generator/summary-models
5-
*/
6-
7-
import java
8-
import semmle.code.java.dataflow.TaintTracking
9-
import semmle.code.java.dataflow.internal.DataFlowImplCommon
10-
import semmle.code.java.dataflow.internal.DataFlowNodes
11-
import semmle.code.java.dataflow.internal.DataFlowPrivate
12-
import semmle.code.java.dataflow.InstanceAccess
13-
import ModelGeneratorUtils
14-
15-
predicate isOwnInstanceAccess(ReturnStmt rtn) { rtn.getResult().(ThisAccess).isOwnInstanceAccess() }
16-
17-
predicate isOwnInstanceAccessNode(ReturnNode node) {
18-
node.asExpr().(ThisAccess).isOwnInstanceAccess()
19-
}
20-
21-
string qualifierString() { result = "Argument[-1]" }
1+
import CaptureSummaryModelsSpecific
222

233
/**
244
* Capture fluent APIs that return `this`.
@@ -32,7 +12,7 @@ string qualifierString() { result = "Argument[-1]" }
3212
* }
3313
* ```
3414
*/
35-
private string captureQualifierFlow(TargetApi api) {
15+
string captureQualifierFlow(TargetApi api) {
3616
exists(ReturnStmt rtn |
3717
rtn.getEnclosingCallable() = api and
3818
isOwnInstanceAccess(rtn)
@@ -92,63 +72,7 @@ class ThroughFlowConfig extends TaintTracking::Configuration {
9272
}
9373
}
9474

95-
/**
96-
* Capture APIs that transfer taint from an input parameter to an output return
97-
* value or parameter.
98-
* Allows a sequence of read steps followed by a sequence of store steps.
99-
*
100-
* Examples:
101-
*
102-
* ```
103-
* public class Foo {
104-
* private String tainted;
105-
*
106-
* public String returnsTainted() {
107-
* return tainted;
108-
* }
109-
*
110-
* public void putsTaintIntoParameter(List<String> foo) {
111-
* foo.add(tainted);
112-
* }
113-
* }
114-
* ```
115-
* Captured Model:
116-
* ```
117-
* p;Foo;true;returnsTainted;;Argument[-1];ReturnValue;taint
118-
* p;Foo;true;putsTaintIntoParameter;(List);Argument[-1];Argument[0];taint
119-
* ```
120-
*
121-
* ```
122-
* public class Foo {
123-
* private String tainted;
124-
* public void doSomething(String input) {
125-
* tainted = input;
126-
* }
127-
* ```
128-
* Captured Model:
129-
* `p;Foo;true;doSomething;(String);Argument[0];Argument[-1];taint`
130-
*
131-
* ```
132-
* public class Foo {
133-
* public String returnData(String tainted) {
134-
* return tainted.substring(0,10)
135-
* }
136-
* }
137-
* ```
138-
* Captured Model:
139-
* `p;Foo;true;returnData;;Argument[0];ReturnValue;taint`
140-
*
141-
* ```
142-
* public class Foo {
143-
* public void addToList(String tainted, List<String> foo) {
144-
* foo.add(tainted);
145-
* }
146-
* }
147-
* ```
148-
* Captured Model:
149-
* `p;Foo;true;addToList;;Argument[0];Argument[1];taint`
150-
*/
151-
private string captureThroughFlow(TargetApi api) {
75+
string captureThroughFlow(TargetApi api) {
15276
exists(
15377
ThroughFlowConfig config, DataFlow::ParameterNode p, ReturnNodeExt returnNodeExt, string input,
15478
string output
@@ -161,12 +85,3 @@ private string captureThroughFlow(TargetApi api) {
16185
result = asTaintModel(api, input, output)
16286
)
16387
}
164-
165-
private string captureFlow(TargetApi api) {
166-
result = captureQualifierFlow(api) or
167-
result = captureThroughFlow(api)
168-
}
169-
170-
from TargetApi api, string flow
171-
where flow = captureFlow(api)
172-
select flow order by flow

‎java/ql/src/utils/model-generator/CaptureSummaryModelsQuery.ql‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/**
2+
* @name Capture summary models.
3+
* @description Finds applicable summary models to be used by other queries.
4+
* @id java/utils/model-generator/summary-models
5+
*/
6+
7+
import CaptureSummaryModels
8+
9+
/**
10+
* Capture fluent APIs that return `this`.
11+
* Example of a fluent API:
12+
* ```
13+
* public class Foo {
14+
* public Foo someAPI() {
15+
* // some side-effect
16+
* return this;
17+
* }
18+
* }
19+
* ```
20+
*
21+
* Capture APIs that transfer taint from an input parameter to an output return
22+
* value or parameter.
23+
* Allows a sequence of read steps followed by a sequence of store steps.
24+
*
25+
* Examples:
26+
*
27+
* ```
28+
* public class Foo {
29+
* private String tainted;
30+
*
31+
* public String returnsTainted() {
32+
* return tainted;
33+
* }
34+
*
35+
* public void putsTaintIntoParameter(List<String> foo) {
36+
* foo.add(tainted);
37+
* }
38+
* }
39+
* ```
40+
* Captured Model:
41+
* ```
42+
* p;Foo;true;returnsTainted;;Argument[-1];ReturnValue;taint
43+
* p;Foo;true;putsTaintIntoParameter;(List);Argument[-1];Argument[0];taint
44+
* ```
45+
*
46+
* ```
47+
* public class Foo {
48+
* private String tainted;
49+
* public void doSomething(String input) {
50+
* tainted = input;
51+
* }
52+
* ```
53+
* Captured Model:
54+
* `p;Foo;true;doSomething;(String);Argument[0];Argument[-1];taint`
55+
*
56+
* ```
57+
* public class Foo {
58+
* public String returnData(String tainted) {
59+
* return tainted.substring(0,10)
60+
* }
61+
* }
62+
* ```
63+
* Captured Model:
64+
* `p;Foo;true;returnData;;Argument[0];ReturnValue;taint`
65+
*
66+
* ```
67+
* public class Foo {
68+
* public void addToList(String tainted, List<String> foo) {
69+
* foo.add(tainted);
70+
* }
71+
* }
72+
* ```
73+
* Captured Model:
74+
* `p;Foo;true;addToList;;Argument[0];Argument[1];taint`
75+
*/
76+
string captureFlow(TargetAPI api) {
77+
result = captureQualifierFlow(api) or
78+
result = captureThroughFlow(api)
79+
}
80+
81+
from TargetAPI api, string flow
82+
where flow = captureFlow(api)
83+
select flow order by flow

‎java/ql/src/utils/model-generator/CaptureSummaryModelsSpecific.qll‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import java
2+
import semmle.code.java.dataflow.TaintTracking
3+
import semmle.code.java.dataflow.internal.DataFlowImplCommon
4+
import semmle.code.java.dataflow.internal.DataFlowNodes
5+
import semmle.code.java.dataflow.internal.DataFlowPrivate
6+
import semmle.code.java.dataflow.InstanceAccess
7+
import ModelGeneratorUtils
8+
9+
predicate isOwnInstanceAccess(ReturnStmt rtn) { rtn.getResult().(ThisAccess).isOwnInstanceAccess() }
10+
11+
predicate isOwnInstanceAccessNode(ReturnNode node) {
12+
node.asExpr().(ThisAccess).isOwnInstanceAccess()
13+
}
14+
15+
string qualifierString() { result = "Argument[-1]" }

‎java/ql/src/utils/model-generator/GenerateFlowModel.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ def asCsvModel(superclass, kind, rows):
132132

133133

134134
if generateSummaries:
135-
summaryRows = runQuery("summary models", "CaptureSummaryModels.ql")
135+
summaryRows = runQuery("summary models", "CaptureSummaryModelsQuery.ql")
136136
summaryCsv = asCsvModel("SummaryModelCsv", "summary", summaryRows)
137137
else:
138138
summaryCsv = ""

‎java/ql/test/utils/model-generator/CaptureSummaryModels.qlref‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
utils/model-generator/CaptureSummaryModels.ql
1+
utils/model-generator/CaptureSummaryModelsQuery.ql

0 commit comments

Comments
 (0)