Skip to content

Commit 92fd8c4

Browse files
joefarebrotherjoefarebrother
committed
Java: Move new definitions to new file
1 parent 60a7666 commit 92fd8c4

File tree

5 files changed

+59
-53
lines changed

5 files changed

+59
-53
lines changed

‎java/ql/src/semmle/code/java/dataflow/FlowSteps.qll‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Provides classes representing various flow steps for taint tracking.
3+
*/
4+
5+
import java
6+
7+
/**
8+
* A method that returns tainted data when one of its inputs (an argument or the qualifier) are tainted.
9+
*
10+
* Extend this class to add additional taint steps through a method that should
11+
* apply to all taint configurations.
12+
*/
13+
abstract class TaintPreservingMethod extends Method {
14+
/**
15+
* Holds if this method returns tainted data when `arg` tainted.
16+
* `arg` is a parameter index, or is -1 to indicate the qualifier.
17+
*/
18+
abstract predicate returnsTaint(int arg);
19+
}
20+
21+
/**
22+
* A method that transfers taint from one of its inputs (an argument or the qualifier) to another.
23+
*
24+
* Extend this class to add additional taint steps through a method that should
25+
* apply to all taint configurations.
26+
*/
27+
abstract class TaintTransferringMethod extends Method {
28+
/**
29+
* Holds if this method writes tainted data to `sink` when `src` is tainted.
30+
* `src` and `sink` are parameter indices, or -1 to indicate the qualifier.
31+
*/
32+
abstract predicate transfersTaint(int src, int sink);
33+
}
34+
35+
private class StringTaintPreservingMethod extends TaintPreservingMethod {
36+
StringTaintPreservingMethod() {
37+
getDeclaringType() instanceof TypeString and
38+
hasName(["concat", "copyValueOf", "endsWith", "format", "formatted", "getBytes", "indent",
39+
"intern", "join", "repeat", "split", "strip", "stripIndent", "stripLeading",
40+
"stripTrailing", "substring", "toCharArray", "toLowerCase", "toString", "toUpperCase",
41+
"trim"])
42+
}
43+
44+
override predicate returnsTaint(int arg) {
45+
arg = -1
46+
or
47+
this.hasName(["concat", "copyValueOf"]) and arg = 0
48+
or
49+
this.hasName(["format", "formatted", "join"]) and arg = [0 .. getNumberOfParameters()]
50+
}
51+
}

java/ql/src/semmle/code/java/dataflow/TaintTrackingFrameworks.qll renamed to java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingFrameworks.qll

File renamed without changes.

‎java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 2 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ private import semmle.code.java.security.SecurityTests
77
private import semmle.code.java.security.Validation
88
private import semmle.code.java.Maps
99
private import semmle.code.java.dataflow.internal.ContainerFlow
10-
private import semmle.code.java.dataflow.TaintTrackingFrameworks
10+
private import semmle.code.java.dataflow.FlowSteps
11+
private import semmle.code.java.dataflow.internal.TaintTrackingFrameworks
1112

1213
/**
1314
* Holds if taint can flow from `src` to `sink` in zero or more
@@ -72,52 +73,6 @@ predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
7273
any(AdditionalTaintStep a).step(src, sink)
7374
}
7475

75-
/**
76-
* A method that returns tainted data when one of its inputs (an argument or the qualifier) are tainted.
77-
*
78-
* Extend this class to add additional taint steps through a method that should
79-
* apply to all taint configurations.
80-
*/
81-
abstract class TaintPreservingMethod extends Method {
82-
/**
83-
* Holds if this method returns tainted data when `arg` tainted.
84-
* `arg` is a parameter index, or is -1 to indicate the qualifier.
85-
*/
86-
abstract predicate returnsTaint(int arg);
87-
}
88-
89-
/**
90-
* A method that transfers taint from one of its inputs (an argument or the qualifier) to another.
91-
*
92-
* Extend this class to add additional taint steps through a method that should
93-
* apply to all taint configurations.
94-
*/
95-
abstract class TaintTransferringMethod extends Method {
96-
/**
97-
* Holds if this method writes tainted data to `sink` when `src` is tainted.
98-
* `src` and `sink` are parameter indices, or -1 to indicate the qualifier.
99-
*/
100-
abstract predicate transfersTaint(int src, int sink);
101-
}
102-
103-
private class StringTaintPreservingMethod extends TaintPreservingMethod {
104-
StringTaintPreservingMethod() {
105-
getDeclaringType() instanceof TypeString and
106-
hasName(["concat", "copyValueOf", "endsWith", "format", "formatted", "getBytes", "indent",
107-
"intern", "join", "repeat", "split", "strip", "stripIndent", "stripLeading",
108-
"stripTrailing", "substring", "toCharArray", "toLowerCase", "toString", "toUpperCase",
109-
"trim"])
110-
}
111-
112-
override predicate returnsTaint(int arg) {
113-
arg = -1
114-
or
115-
this.hasName(["concat", "copyValueOf"]) and arg = 0
116-
or
117-
this.hasName(["format", "formatted", "join"]) and arg = [0 .. getNumberOfParameters()]
118-
}
119-
}
120-
12176
/**
12277
* Holds if `node` should be a sanitizer in all global taint flow configurations
12378
* but not in local taint.

‎java/ql/src/semmle/code/java/frameworks/android/SQLite.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import java
22
import Android
3-
private import semmle.code.java.dataflow.TaintTracking::TaintTracking as TT
3+
import semmle.code.java.dataflow.FlowSteps
44

55
/**
66
* The class `android.database.sqlite.SQLiteDatabase`.
@@ -228,7 +228,7 @@ private class ContentProviderUpdateMethod extends SQLiteRunner {
228228
override int sqlIndex() { result = 2 }
229229
}
230230

231-
private class QueryBuilderBuildMethod extends TT::TaintPreservingMethod {
231+
private class QueryBuilderBuildMethod extends TaintPreservingMethod {
232232
QueryBuilderBuildMethod() {
233233
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
234234
// buildQuery(String[] projectionIn, String selection, String groupBy, String having, String sortOrder, String limit)
@@ -255,7 +255,7 @@ private class QueryBuilderBuildMethod extends TT::TaintPreservingMethod {
255255
}
256256
}
257257

258-
private class QueryBuilderAppendMethod extends TT::TaintTransferringMethod {
258+
private class QueryBuilderAppendMethod extends TaintTransferringMethod {
259259
QueryBuilderAppendMethod() {
260260
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
261261
// setProjectionMap(Map<String, String> columnMap)
@@ -273,7 +273,7 @@ private class QueryBuilderAppendMethod extends TT::TaintTransferringMethod {
273273
}
274274
}
275275

276-
private class UnsafeAppendUtilMethod extends TT::TaintPreservingMethod {
276+
private class UnsafeAppendUtilMethod extends TaintPreservingMethod {
277277
UnsafeAppendUtilMethod() {
278278
this.getDeclaringType() instanceof TypeDatabaseUtils and
279279
// String[] appendSelectionArgs(String[] originalValues, String[] newValues)

‎java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import semmle.code.java.Serializability
88
import semmle.code.java.Reflection
99
import semmle.code.java.dataflow.DataFlow
1010
import semmle.code.java.dataflow.DataFlow5
11-
private import semmle.code.java.dataflow.TaintTracking::TaintTracking as TT
11+
import semmle.code.java.dataflow.FlowSteps
1212

1313
/**
1414
* A `@com.fasterxml.jackson.annotation.JsonIgnore` annoation.
@@ -28,7 +28,7 @@ abstract class JacksonSerializableType extends Type { }
2828
* A method used for serializing objects using Jackson. The final parameter is the object to be
2929
* serialized.
3030
*/
31-
library class JacksonWriteValueMethod extends TT::TaintPreservingMethod, TT::TaintTransferringMethod {
31+
library class JacksonWriteValueMethod extends TaintPreservingMethod, TaintTransferringMethod {
3232
JacksonWriteValueMethod() {
3333
(
3434
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectWriter") or

0 commit comments

Comments
 (0)