Merge pull request #4042 from aschackmull/java/xsssink-extensible

Approved by aibaars

Author: codeql-ci

java/ql/src/Security/CWE/CWE-079/XSS.ql

@@ -12,11 +12,10 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking2
 import semmle.code.java.security.XSS
-import DataFlow2::PathGraph
+import DataFlow::PathGraph
 
-class XSSConfig extends TaintTracking2::Configuration {
+class XSSConfig extends TaintTracking::Configuration {
   XSSConfig() { this = "XSSConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -28,7 +27,7 @@ class XSSConfig extends TaintTracking2::Configuration {
   }
 }
 
-from DataFlow2::PathNode source, DataFlow2::PathNode sink, XSSConfig conf
+from DataFlow::PathNode source, DataFlow::PathNode sink, XSSConfig conf
 where conf.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "user-provided value"

java/ql/src/Security/CWE/CWE-079/XSSLocal.ql

@@ -12,19 +12,18 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.TaintTracking2
 import semmle.code.java.security.XSS
-import DataFlow2::PathGraph
+import DataFlow::PathGraph
 
-class XSSLocalConfig extends TaintTracking2::Configuration {
+class XSSLocalConfig extends TaintTracking::Configuration {
   XSSLocalConfig() { this = "XSSLocalConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
 }
 
-from DataFlow2::PathNode source, DataFlow2::PathNode sink, XSSLocalConfig conf
+from DataFlow::PathNode source, DataFlow::PathNode sink, XSSLocalConfig conf
 where conf.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "user-provided value"

java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql

@@ -14,7 +14,7 @@
 
 import java
 import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.TaintTracking2
+import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.XSS
 
 /**
@@ -84,7 +84,7 @@ predicate stackTraceExpr(Expr exception, MethodAccess stackTraceString) {
   )
 }
 
-class StackTraceStringToXssSinkFlowConfig extends TaintTracking2::Configuration {
+class StackTraceStringToXssSinkFlowConfig extends TaintTracking::Configuration {
   StackTraceStringToXssSinkFlowConfig() {
     this = "StackTraceExposure::StackTraceStringToXssSinkFlowConfig"
   }
@@ -124,7 +124,7 @@ class GetMessageFlowSource extends MethodAccess {
   }
 }
 
-class GetMessageFlowSourceToXssSinkFlowConfig extends TaintTracking2::Configuration {
+class GetMessageFlowSourceToXssSinkFlowConfig extends TaintTracking::Configuration {
   GetMessageFlowSourceToXssSinkFlowConfig() {
     this = "StackTraceExposure::GetMessageFlowSourceToXssSinkFlowConfig"
   }

java/ql/src/semmle/code/java/security/XSS.qll

@@ -3,33 +3,36 @@ import semmle.code.java.frameworks.Servlets
 import semmle.code.java.frameworks.android.WebView
 import semmle.code.java.frameworks.spring.SpringController
 import semmle.code.java.frameworks.spring.SpringHttp
-import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.TaintTracking2
 
 /*
  * Definitions for XSS sinks
  */
 
-class XssSink extends DataFlow::ExprNode {
-  XssSink() {
+abstract class XssSink extends DataFlow::Node { }
+
+private class DefaultXssSink extends XssSink {
+  DefaultXssSink() {
     exists(HttpServletResponseSendErrorMethod m, MethodAccess ma |
       ma.getMethod() = m and
-      this.getExpr() = ma.getArgument(1)
+      this.asExpr() = ma.getArgument(1)
     )
     or
     exists(ServletWriterSourceToWritingMethodFlowConfig writer, MethodAccess ma |
       ma.getMethod() instanceof WritingMethod and
       writer.hasFlowToExpr(ma.getQualifier()) and
-      this.getExpr() = ma.getArgument(_)
+      this.asExpr() = ma.getArgument(_)
     )
     or
     exists(Method m |
       m.getDeclaringType() instanceof TypeWebView and
       (
-        m.getAReference().getArgument(0) = this.getExpr() and m.getName() = "loadData"
+        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadData"
         or
-        m.getAReference().getArgument(0) = this.getExpr() and m.getName() = "loadUrl"
+        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadUrl"
         or
-        m.getAReference().getArgument(1) = this.getExpr() and m.getName() = "loadDataWithBaseURL"
+        m.getAReference().getArgument(1) = this.asExpr() and m.getName() = "loadDataWithBaseURL"
       )
     )
     or
@@ -77,7 +80,7 @@ class XssSink extends DataFlow::ExprNode {
   }
 }
 
-class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking::Configuration {
+private class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking2::Configuration {
   ServletWriterSourceToWritingMethodFlowConfig() {
     this = "XSS::ServletWriterSourceToWritingMethodFlowConfig"
   }
@@ -91,7 +94,7 @@ class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking::Config
   }
 }
 
-class WritingMethod extends Method {
+private class WritingMethod extends Method {
   WritingMethod() {
     getDeclaringType().getASupertype*().hasQualifiedName("java.io", _) and
     (