Skip to content

Commit 0468b3a

Browse files
author
Sebastian Bauersfeld
committed
Java: Track taint through constructor arguments of java.net.URI.
1 parent e07e6c9 commit 0468b3a

3 files changed

Lines changed: 78 additions & 1 deletion

File tree

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,11 @@ private class SummaryModelCsvBase extends SummaryModelCsv {
401401
"java.io;File;false;File;;;Argument[0];Argument[-1];taint;manual",
402402
"java.io;File;false;File;;;Argument[1];Argument[-1];taint;manual",
403403
"java.net;URI;false;URI;(String);;Argument[0];Argument[-1];taint;manual",
404+
"java.net;URI;false;URI;(String,String,String);;Argument[0..2];Argument[-1];taint;manual",
405+
"java.net;URI;false;URI;(String,String,String,int,String,String,String);;Argument[0..2];Argument[-1];taint;manual",
406+
"java.net;URI;false;URI;(String,String,String,int,String,String,String);;Argument[4..6];Argument[-1];taint;manual",
407+
"java.net;URI;false;URI;(String,String,String,String);;Argument[0..3];Argument[-1];taint;manual",
408+
"java.net;URI;false;URI;(String,String,String,String,String);;Argument[0..4];Argument[-1];taint;manual",
404409
"java.net;URL;false;URL;(String);;Argument[0];Argument[-1];taint;manual",
405410
"javax.xml.transform.stream;StreamSource;false;StreamSource;;;Argument[0];Argument[-1];taint;manual",
406411
"javax.xml.transform.sax;SAXSource;false;SAXSource;(InputSource);;Argument[0];Argument[-1];taint;manual",

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,42 @@ edges
99
| Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
1010
| Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
1111
| Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp |
12+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:96:20:96:20 | t : String |
13+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:96:23:96:23 | t : String |
14+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:96:26:96:26 | t : String |
15+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:20:97:20 | t : String |
16+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:23:97:23 | t : String |
17+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:26:97:26 | t : String |
18+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:29:97:29 | t : String |
19+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:20:98:20 | t : String |
20+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:23:98:23 | t : String |
21+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:26:98:26 | t : String |
22+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:29:98:29 | t : String |
23+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:32:98:32 | t : String |
24+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:20:99:20 | t : String |
25+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:23:99:23 | t : String |
26+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:26:99:26 | t : String |
27+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:32:99:32 | t : String |
28+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:35:99:35 | t : String |
29+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:38:99:38 | t : String |
30+
| Test.java:96:20:96:20 | t : String | Test.java:96:12:96:27 | new URI(...) |
31+
| Test.java:96:23:96:23 | t : String | Test.java:96:12:96:27 | new URI(...) |
32+
| Test.java:96:26:96:26 | t : String | Test.java:96:12:96:27 | new URI(...) |
33+
| Test.java:97:20:97:20 | t : String | Test.java:97:12:97:30 | new URI(...) |
34+
| Test.java:97:23:97:23 | t : String | Test.java:97:12:97:30 | new URI(...) |
35+
| Test.java:97:26:97:26 | t : String | Test.java:97:12:97:30 | new URI(...) |
36+
| Test.java:97:29:97:29 | t : String | Test.java:97:12:97:30 | new URI(...) |
37+
| Test.java:98:20:98:20 | t : String | Test.java:98:12:98:33 | new URI(...) |
38+
| Test.java:98:23:98:23 | t : String | Test.java:98:12:98:33 | new URI(...) |
39+
| Test.java:98:26:98:26 | t : String | Test.java:98:12:98:33 | new URI(...) |
40+
| Test.java:98:29:98:29 | t : String | Test.java:98:12:98:33 | new URI(...) |
41+
| Test.java:98:32:98:32 | t : String | Test.java:98:12:98:33 | new URI(...) |
42+
| Test.java:99:20:99:20 | t : String | Test.java:99:12:99:39 | new URI(...) |
43+
| Test.java:99:23:99:23 | t : String | Test.java:99:12:99:39 | new URI(...) |
44+
| Test.java:99:26:99:26 | t : String | Test.java:99:12:99:39 | new URI(...) |
45+
| Test.java:99:32:99:32 | t : String | Test.java:99:12:99:39 | new URI(...) |
46+
| Test.java:99:35:99:35 | t : String | Test.java:99:12:99:39 | new URI(...) |
47+
| Test.java:99:38:99:38 | t : String | Test.java:99:12:99:39 | new URI(...) |
1248
nodes
1349
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
1450
| Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -23,6 +59,29 @@ nodes
2359
| Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
2460
| Test.java:88:17:88:37 | getHostName(...) : String | semmle.label | getHostName(...) : String |
2561
| Test.java:90:26:90:29 | temp | semmle.label | temp |
62+
| Test.java:95:14:95:34 | getHostName(...) : String | semmle.label | getHostName(...) : String |
63+
| Test.java:96:12:96:27 | new URI(...) | semmle.label | new URI(...) |
64+
| Test.java:96:20:96:20 | t : String | semmle.label | t : String |
65+
| Test.java:96:23:96:23 | t : String | semmle.label | t : String |
66+
| Test.java:96:26:96:26 | t : String | semmle.label | t : String |
67+
| Test.java:97:12:97:30 | new URI(...) | semmle.label | new URI(...) |
68+
| Test.java:97:20:97:20 | t : String | semmle.label | t : String |
69+
| Test.java:97:23:97:23 | t : String | semmle.label | t : String |
70+
| Test.java:97:26:97:26 | t : String | semmle.label | t : String |
71+
| Test.java:97:29:97:29 | t : String | semmle.label | t : String |
72+
| Test.java:98:12:98:33 | new URI(...) | semmle.label | new URI(...) |
73+
| Test.java:98:20:98:20 | t : String | semmle.label | t : String |
74+
| Test.java:98:23:98:23 | t : String | semmle.label | t : String |
75+
| Test.java:98:26:98:26 | t : String | semmle.label | t : String |
76+
| Test.java:98:29:98:29 | t : String | semmle.label | t : String |
77+
| Test.java:98:32:98:32 | t : String | semmle.label | t : String |
78+
| Test.java:99:12:99:39 | new URI(...) | semmle.label | new URI(...) |
79+
| Test.java:99:20:99:20 | t : String | semmle.label | t : String |
80+
| Test.java:99:23:99:23 | t : String | semmle.label | t : String |
81+
| Test.java:99:26:99:26 | t : String | semmle.label | t : String |
82+
| Test.java:99:32:99:32 | t : String | semmle.label | t : String |
83+
| Test.java:99:35:99:35 | t : String | semmle.label | t : String |
84+
| Test.java:99:38:99:38 | t : String | semmle.label | t : String |
2685
subpaths
2786
#select
2887
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
@@ -31,3 +90,7 @@ subpaths
3190
| Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
3291
| Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
3392
| Test.java:90:26:90:29 | temp | Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp | $@ flows to here and is used in a path. | Test.java:88:17:88:37 | getHostName(...) | User-provided value |
93+
| Test.java:96:3:96:28 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:96:12:96:27 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
94+
| Test.java:97:3:97:31 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:12:97:30 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
95+
| Test.java:98:3:98:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:12:98:33 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
96+
| Test.java:99:3:99:40 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:39 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
import javax.servlet.ServletException;
77

88
import java.io.*;
9-
import java.net.InetAddress;
9+
import java.net.*;
1010
import java.nio.file.Path;
1111
import java.nio.file.Paths;
1212
import java.nio.file.FileSystems;
@@ -89,4 +89,13 @@ void doGet4(InetAddress address)
8989
// BAD: open a file based on user input, using a MaD-documented API
9090
new LockableFileWriter(temp);
9191
}
92+
93+
void doGet5(InetAddress address)
94+
throws URISyntaxException {
95+
String t = address.getHostName();
96+
new File(new URI(t, t, t));
97+
new File(new URI(t, t, t, t));
98+
new File(new URI(t, t, t, t, t));
99+
new File(new URI(t, t, t, 0, t, t, t));
100+
}
92101
}

0 commit comments

Comments
 (0)