Skip to content

Commit 87e4dec

Browse files
aschackmullaschackmull
authored
Merge pull request #5300 from tamasvajk/feature/external-remote-flow-sources
Java: Convert remote flow sources to use new CSV format
2 parents 25f4b76 + 5480a31 commit 87e4dec

File tree

2 files changed

+81
-119
lines changed

2 files changed

+81
-119
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 81 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,87 @@ private predicate sourceModelCsv(string row) {
9696
// SocketGetInputStreamMethod
9797
"java.net;Socket;false;getInputStream;();;ReturnValue;remote",
9898
// BeanValidationSource
99-
"javax.validation;ConstraintValidator;true;isValid;;;Parameter[0];remote"
99+
"javax.validation;ConstraintValidator;true;isValid;;;Parameter[0];remote",
100+
// SpringMultipartRequestSource
101+
"org.springframework.web.multipart;MultipartRequest;true;getFile;(String);;ReturnValue;remote",
102+
"org.springframework.web.multipart;MultipartRequest;true;getFileMap;();;ReturnValue;remote",
103+
"org.springframework.web.multipart;MultipartRequest;true;getFileNames;();;ReturnValue;remote",
104+
"org.springframework.web.multipart;MultipartRequest;true;getFiles;(String);;ReturnValue;remote",
105+
"org.springframework.web.multipart;MultipartRequest;true;getMultiFileMap;();;ReturnValue;remote",
106+
"org.springframework.web.multipart;MultipartRequest;true;getMultipartContentType;(String);;ReturnValue;remote",
107+
// SpringMultipartFileSource
108+
"org.springframework.web.multipart;MultipartFile;true;getBytes;();;ReturnValue;remote",
109+
"org.springframework.web.multipart;MultipartFile;true;getContentType;();;ReturnValue;remote",
110+
"org.springframework.web.multipart;MultipartFile;true;getInputStream;();;ReturnValue;remote",
111+
"org.springframework.web.multipart;MultipartFile;true;getName;();;ReturnValue;remote",
112+
"org.springframework.web.multipart;MultipartFile;true;getOriginalFilename;();;ReturnValue;remote",
113+
"org.springframework.web.multipart;MultipartFile;true;getResource;();;ReturnValue;remote",
114+
// HttpServletRequest.get*
115+
"javax.servlet.http;HttpServletRequest;false;getHeader;(String);;ReturnValue;remote",
116+
"javax.servlet.http;HttpServletRequest;false;getHeaders;(String);;ReturnValue;remote",
117+
"javax.servlet.http;HttpServletRequest;false;getHeaderNames;();;ReturnValue;remote",
118+
"javax.servlet.http;HttpServletRequest;false;getPathInfo;();;ReturnValue;remote",
119+
"javax.servlet.http;HttpServletRequest;false;getRequestURI;();;ReturnValue;remote",
120+
"javax.servlet.http;HttpServletRequest;false;getRequestURL;();;ReturnValue;remote",
121+
"javax.servlet.http;HttpServletRequest;false;getRemoteUser;();;ReturnValue;remote",
122+
// SpringWebRequestGetMethod
123+
"org.springframework.web.context.request;WebRequest;false;getDescription;;;ReturnValue;remote",
124+
"org.springframework.web.context.request;WebRequest;false;getHeader;;;ReturnValue;remote",
125+
"org.springframework.web.context.request;WebRequest;false;getHeaderNames;;;ReturnValue;remote",
126+
"org.springframework.web.context.request;WebRequest;false;getHeaderValues;;;ReturnValue;remote",
127+
"org.springframework.web.context.request;WebRequest;false;getParameter;;;ReturnValue;remote",
128+
"org.springframework.web.context.request;WebRequest;false;getParameterMap;;;ReturnValue;remote",
129+
"org.springframework.web.context.request;WebRequest;false;getParameterNames;;;ReturnValue;remote",
130+
"org.springframework.web.context.request;WebRequest;false;getParameterValues;;;ReturnValue;remote",
131+
// TODO consider org.springframework.web.context.request.WebRequest.getRemoteUser
132+
// ServletRequestGetBodyMethod
133+
"javax.servlet;ServletRequest;false;getInputStream;();;ReturnValue;remote",
134+
"javax.servlet;ServletRequest;false;getReader;();;ReturnValue;remote",
135+
// CookieGet*
136+
"javax.servlet.http;Cookie;false;getValue;();;ReturnValue;remote",
137+
"javax.servlet.http;Cookie;false;getName;();;ReturnValue;remote",
138+
"javax.servlet.http;Cookie;false;getComment;();;ReturnValue;remote",
139+
// ApacheHttp*
140+
"org.apache.http;HttpMessage;false;getParams;();;ReturnValue;remote",
141+
"org.apache.http;HttpEntity;false;getContent;();;ReturnValue;remote",
142+
// In the setting of Android we assume that XML has been transmitted over
143+
// the network, so may be tainted.
144+
// XmlPullGetMethod
145+
"org.xmlpull.v1;XmlPullParser;false;getName;();;ReturnValue;remote",
146+
"org.xmlpull.v1;XmlPullParser;false;getNamespace;();;ReturnValue;remote",
147+
"org.xmlpull.v1;XmlPullParser;false;getText;();;ReturnValue;remote",
148+
// XmlAttrSetGetMethod
149+
"android.util;AttributeSet;false;getAttributeBooleanValue;;;ReturnValue;remote",
150+
"android.util;AttributeSet;false;getAttributeCount;;;ReturnValue;remote",
151+
"android.util;AttributeSet;false;getAttributeFloatValue;;;ReturnValue;remote",
152+
"android.util;AttributeSet;false;getAttributeIntValue;;;ReturnValue;remote",
153+
"android.util;AttributeSet;false;getAttributeListValue;;;ReturnValue;remote",
154+
"android.util;AttributeSet;false;getAttributeName;;;ReturnValue;remote",
155+
"android.util;AttributeSet;false;getAttributeNameResource;;;ReturnValue;remote",
156+
"android.util;AttributeSet;false;getAttributeNamespace;;;ReturnValue;remote",
157+
"android.util;AttributeSet;false;getAttributeResourceValue;;;ReturnValue;remote",
158+
"android.util;AttributeSet;false;getAttributeUnsignedIntValue;;;ReturnValue;remote",
159+
"android.util;AttributeSet;false;getAttributeValue;;;ReturnValue;remote",
160+
"android.util;AttributeSet;false;getClassAttribute;;;ReturnValue;remote",
161+
"android.util;AttributeSet;false;getIdAttribute;;;ReturnValue;remote",
162+
"android.util;AttributeSet;false;getIdAttributeResourceValue;;;ReturnValue;remote",
163+
"android.util;AttributeSet;false;getPositionDescription;;;ReturnValue;remote",
164+
"android.util;AttributeSet;false;getStyleAttribute;;;ReturnValue;remote",
165+
// The current URL in a browser may be untrusted or uncontrolled.
166+
// WebViewGetUrlMethod
167+
"android.webkit;WebView;false;getUrl;();;ReturnValue;remote",
168+
"android.webkit;WebView;false;getOriginalUrl;();;ReturnValue;remote",
169+
// SpringRestTemplateResponseEntityMethod
170+
"org.springframework.web.client;RestTemplate;false;exchange;;;ReturnValue;remote",
171+
"org.springframework.web.client;RestTemplate;false;getForEntity;;;ReturnValue;remote",
172+
"org.springframework.web.client;RestTemplate;false;postForEntity;;;ReturnValue;remote",
173+
// WebSocketMessageParameterSource
174+
"java.net.http;WebSocket$Listener;true;onText;(WebSocket,CharSequence,boolean);;Parameter[1];remote",
175+
// PlayRequestGetMethod
176+
"play.mvc;Http$RequestHeader;false;queryString;;;ReturnValue;remote",
177+
"play.mvc;Http$RequestHeader;false;getQueryString;;;ReturnValue;remote",
178+
"play.mvc;Http$RequestHeader;false;header;;;ReturnValue;remote",
179+
"play.mvc;Http$RequestHeader;false;getHeader;;;ReturnValue;remote"
100180
]
101181
}
102182

‎java/ql/src/semmle/code/java/dataflow/FlowSources.qll‎

Lines changed: 0 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,6 @@ private class ExternalRemoteFlowSource extends RemoteFlowSource {
3939
override string getSourceType() { result = "external" }
4040
}
4141

42-
private class RemoteTaintedMethodAccessSource extends RemoteFlowSource {
43-
RemoteTaintedMethodAccessSource() {
44-
this.asExpr().(MethodAccess).getMethod() instanceof RemoteTaintedMethod
45-
}
46-
47-
override string getSourceType() { result = "network data source" }
48-
}
49-
5042
private class RmiMethodParameterSource extends RemoteFlowSource {
5143
RmiMethodParameterSource() {
5244
exists(RemoteCallableMethod method |
@@ -115,42 +107,12 @@ private class MessageBodyReaderParameterSource extends RemoteFlowSource {
115107
override string getSourceType() { result = "MessageBodyReader parameter" }
116108
}
117109

118-
private class SpringMultipartRequestSource extends RemoteFlowSource {
119-
SpringMultipartRequestSource() {
120-
exists(MethodAccess ma, Method m |
121-
ma = this.asExpr() and
122-
m = ma.getMethod() and
123-
m.getDeclaringType()
124-
.getASourceSupertype*()
125-
.hasQualifiedName("org.springframework.web.multipart", "MultipartRequest") and
126-
m.getName().matches("get%")
127-
)
128-
}
129-
130-
override string getSourceType() { result = "Spring MultipartRequest getter" }
131-
}
132-
133110
private class PlayParameterSource extends RemoteFlowSource {
134111
PlayParameterSource() { exists(PlayActionMethodQueryParameter p | p = this.asParameter()) }
135112

136113
override string getSourceType() { result = "Play Query Parameters" }
137114
}
138115

139-
private class SpringMultipartFileSource extends RemoteFlowSource {
140-
SpringMultipartFileSource() {
141-
exists(MethodAccess ma, Method m |
142-
ma = this.asExpr() and
143-
m = ma.getMethod() and
144-
m.getDeclaringType()
145-
.getASourceSupertype*()
146-
.hasQualifiedName("org.springframework.web.multipart", "MultipartFile") and
147-
m.getName().matches("get%")
148-
)
149-
}
150-
151-
override string getSourceType() { result = "Spring MultipartFile getter" }
152-
}
153-
154116
private class SpringServletInputParameterSource extends RemoteFlowSource {
155117
SpringServletInputParameterSource() {
156118
this.asParameter() = any(SpringRequestMappingParameter srmp | srmp.isTaintedInput())
@@ -188,30 +150,6 @@ private class ThriftIfaceParameterSource extends RemoteFlowSource {
188150
override string getSourceType() { result = "Thrift Iface parameter" }
189151
}
190152

191-
private class WebSocketMessageParameterSource extends RemoteFlowSource {
192-
WebSocketMessageParameterSource() {
193-
exists(WebsocketOnText t | t.getParameter(1) = this.asParameter())
194-
}
195-
196-
override string getSourceType() { result = "Websocket onText parameter" }
197-
}
198-
199-
private class BeanValidationSource extends RemoteFlowSource {
200-
BeanValidationSource() {
201-
exists(Method m, Parameter v |
202-
this.asParameter() = v and
203-
m.getParameter(0) = v and
204-
m.getDeclaringType()
205-
.getASourceSupertype+()
206-
.hasQualifiedName("javax.validation", "ConstraintValidator") and
207-
m.hasName("isValid") and
208-
m.fromSource()
209-
)
210-
}
211-
212-
override string getSourceType() { result = "BeanValidation source" }
213-
}
214-
215153
/** Class for `tainted` user input. */
216154
abstract class UserInput extends DataFlow::Node { }
217155

@@ -258,62 +196,6 @@ class DatabaseInput extends LocalUserInput {
258196
DatabaseInput() { this.asExpr().(MethodAccess).getMethod() instanceof ResultSetGetStringMethod }
259197
}
260198

261-
private class RemoteTaintedMethod extends Method {
262-
RemoteTaintedMethod() {
263-
this instanceof ServletRequestGetParameterMethod or
264-
this instanceof ServletRequestGetParameterMapMethod or
265-
this instanceof ServletRequestGetParameterNamesMethod or
266-
this instanceof HttpServletRequestGetQueryStringMethod or
267-
this instanceof HttpServletRequestGetHeaderMethod or
268-
this instanceof HttpServletRequestGetPathMethod or
269-
this instanceof HttpServletRequestGetHeadersMethod or
270-
this instanceof HttpServletRequestGetHeaderNamesMethod or
271-
this instanceof HttpServletRequestGetRequestURIMethod or
272-
this instanceof HttpServletRequestGetRequestURLMethod or
273-
this instanceof HttpServletRequestGetRemoteUserMethod or
274-
this instanceof PlayRequestGetMethod or
275-
this instanceof SpringWebRequestGetMethod or
276-
this instanceof SpringRestTemplateResponseEntityMethod or
277-
this instanceof ServletRequestGetBodyMethod or
278-
this instanceof CookieGetValueMethod or
279-
this instanceof CookieGetNameMethod or
280-
this instanceof CookieGetCommentMethod or
281-
this instanceof URLConnectionGetInputStreamMethod or
282-
this instanceof SocketGetInputStreamMethod or
283-
this instanceof ApacheHttpGetParams or
284-
this instanceof ApacheHttpEntityGetContent or
285-
// In the setting of Android we assume that XML has been transmitted over
286-
// the network, so may be tainted.
287-
this instanceof XmlPullGetMethod or
288-
this instanceof XmlAttrSetGetMethod or
289-
// The current URL in a browser may be untrusted or uncontrolled.
290-
this instanceof WebViewGetUrlMethod
291-
}
292-
}
293-
294-
private class PlayRequestGetMethod extends Method {
295-
PlayRequestGetMethod() {
296-
this.getDeclaringType() instanceof PlayMvcHttpRequestHeader and
297-
this.hasName(["queryString", "getQueryString", "header", "getHeader"])
298-
}
299-
}
300-
301-
private class SpringWebRequestGetMethod extends Method {
302-
SpringWebRequestGetMethod() {
303-
exists(SpringWebRequest swr | this = swr.getAMethod() |
304-
this.hasName("getDescription") or
305-
this.hasName("getHeader") or
306-
this.hasName("getHeaderNames") or
307-
this.hasName("getHeaderValues") or
308-
this.hasName("getParameter") or
309-
this.hasName("getParameterMap") or
310-
this.hasName("getParameterNames") or
311-
this.hasName("getParameterValues")
312-
// TODO consider getRemoteUser
313-
)
314-
}
315-
}
316-
317199
/** A method that reads from the environment, such as `System.getProperty` or `System.getenv`. */
318200
class EnvReadMethod extends Method {
319201
EnvReadMethod() {

0 commit comments

Comments
 (0)