Skip to content

Commit e2bf9ea

Browse files
atorralbaatorralba
committed
Consider File.exists() et al a path-injection sink
1 parent 6e550d2 commit e2bf9ea

4 files changed

Lines changed: 6 additions & 6 deletions

File tree

‎java/ql/lib/ext/java.io.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ extensions:
55
data:
66
- ["java.io", "File", True, "createNewFile", "()", "", "Argument[this]", "path-injection", "ai-manual"]
77
- ["java.io", "File", True, "createTempFile", "(String,String,File)", "", "Argument[2]", "path-injection", "ai-manual"]
8+
- ["java.io", "File", True, "exists", "()", "", "Argument[this]", "path-injection", "manual"]
89
- ["java.io", "File", True, "renameTo", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
910
- ["java.io", "FileInputStream", True, "FileInputStream", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
1011
- ["java.io", "FileInputStream", True, "FileInputStream", "(FileDescriptor)", "", "Argument[0]", "path-injection", "manual"]
@@ -126,7 +127,6 @@ extensions:
126127
- ["java.io", "DataOutput", "writeLong", "(long)", "summary", "manual"] # taint-numeric
127128
# sink neutrals
128129
- ["java.io", "File", "compareTo", "", "sink", "hq-manual"]
129-
- ["java.io", "File", "exists", "()", "sink", "hq-manual"]
130130
- addsTo:
131131
pack: codeql/java-all
132132
extensible: sourceModel

‎java/ql/lib/ext/java.nio.file.model.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ extensions:
1818
- ["java.nio.file", "Files", False, "delete", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"]
1919
- ["java.nio.file", "Files", False, "deleteIfExists", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"]
2020
- ["java.nio.file", "Files", False, "getFileStore", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"] # the FileStore class is unlikely to be used for later sanitization
21+
- ["java.nio.file", "Files", False, "exists", "(Path,LinkOption[])", "", "Argument[0]", "path-injection", "manual"]
2122
- ["java.nio.file", "Files", False, "lines", "(Path,Charset)", "", "Argument[0]", "path-injection", "ai-manual"]
2223
- ["java.nio.file", "Files", False, "lines", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"]
2324
- ["java.nio.file", "Files", False, "move", "", "", "Argument[1]", "path-injection", "manual"]
@@ -27,6 +28,7 @@ extensions:
2728
- ["java.nio.file", "Files", False, "newBufferedWriter", "", "", "Argument[0]", "path-injection", "manual"]
2829
- ["java.nio.file", "Files", False, "newInputStream", "(Path,OpenOption[])", "", "Argument[0]", "path-injection", "ai-manual"]
2930
- ["java.nio.file", "Files", False, "newOutputStream", "", "", "Argument[0]", "path-injection", "manual"]
31+
- ["java.nio.file", "Files", False, "notExists", "(Path,LinkOption[])", "", "Argument[0]", "path-injection", "manual"]
3032
- ["java.nio.file", "Files", False, "probeContentType", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"] # accesses the file based on user input, but only reads its content type from it
3133
- ["java.nio.file", "Files", False, "readAllBytes", "(Path)", "", "Argument[0]", "path-injection", "ai-manual"]
3234
- ["java.nio.file", "Files", False, "readAllLines", "(Path,Charset)", "", "Argument[0]", "path-injection", "ai-manual"]
@@ -89,7 +91,6 @@ extensions:
8991
# summary neutrals
9092
- ["java.nio.file", "Files", "exists", "(Path,LinkOption[])", "summary", "manual"]
9193
# sink neutrals
92-
- ["java.nio.file", "Files", "exists", "", "sink", "hq-manual"]
9394
- ["java.nio.file", "Files", "getLastModifiedTime", "", "sink", "hq-manual"]
9495
- ["java.nio.file", "Files", "getOwner", "", "sink", "hq-manual"]
9596
- ["java.nio.file", "Files", "getPosixFilePermissions", "", "sink", "hq-manual"]
@@ -101,6 +102,5 @@ extensions:
101102
- ["java.nio.file", "Files", "isSameFile", "", "sink", "hq-manual"]
102103
- ["java.nio.file", "Files", "isSymbolicLink", "", "sink", "hq-manual"]
103104
- ["java.nio.file", "Files", "isWritable", "", "sink", "hq-manual"]
104-
- ["java.nio.file", "Files", "notExists", "", "sink", "hq-manual"]
105105
- ["java.nio.file", "Files", "setLastModifiedTime", "", "sink", "hq-manual"]
106106
- ["java.nio.file", "Files", "size", "", "sink", "hq-manual"]

‎java/ql/test/experimental/query-tests/security/CWE-073/FilePathInjection.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ edges
44
| FilePathInjection.java:87:21:87:34 | getPara(...) : String | FilePathInjection.java:95:47:95:59 | finalFilePath |
55
| FilePathInjection.java:177:50:177:58 | file : File | FilePathInjection.java:182:30:182:33 | file |
66
| FilePathInjection.java:205:17:205:44 | getParameter(...) : String | FilePathInjection.java:209:24:209:31 | filePath : String |
7+
| FilePathInjection.java:209:15:209:32 | new File(...) : File | FilePathInjection.java:210:23:210:26 | file |
78
| FilePathInjection.java:209:15:209:32 | new File(...) : File | FilePathInjection.java:217:19:217:22 | file : File |
89
| FilePathInjection.java:209:24:209:31 | filePath : String | FilePathInjection.java:209:15:209:32 | new File(...) : File |
910
| FilePathInjection.java:217:19:217:22 | file : File | FilePathInjection.java:177:50:177:58 | file : File |
@@ -19,10 +20,12 @@ nodes
1920
| FilePathInjection.java:205:17:205:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2021
| FilePathInjection.java:209:15:209:32 | new File(...) : File | semmle.label | new File(...) : File |
2122
| FilePathInjection.java:209:24:209:31 | filePath : String | semmle.label | filePath : String |
23+
| FilePathInjection.java:210:23:210:26 | file | semmle.label | file |
2224
| FilePathInjection.java:217:19:217:22 | file : File | semmle.label | file : File |
2325
subpaths
2426
#select
2527
| FilePathInjection.java:26:47:26:59 | finalFilePath | FilePathInjection.java:21:21:21:34 | getPara(...) : String | FilePathInjection.java:26:47:26:59 | finalFilePath | External control of file name or path due to $@. | FilePathInjection.java:21:21:21:34 | getPara(...) | user-provided value |
2628
| FilePathInjection.java:72:47:72:59 | finalFilePath | FilePathInjection.java:64:21:64:34 | getPara(...) : String | FilePathInjection.java:72:47:72:59 | finalFilePath | External control of file name or path due to $@. | FilePathInjection.java:64:21:64:34 | getPara(...) | user-provided value |
2729
| FilePathInjection.java:95:47:95:59 | finalFilePath | FilePathInjection.java:87:21:87:34 | getPara(...) : String | FilePathInjection.java:95:47:95:59 | finalFilePath | External control of file name or path due to $@. | FilePathInjection.java:87:21:87:34 | getPara(...) | user-provided value |
2830
| FilePathInjection.java:182:30:182:33 | file | FilePathInjection.java:205:17:205:44 | getParameter(...) : String | FilePathInjection.java:182:30:182:33 | file | External control of file name or path due to $@. | FilePathInjection.java:205:17:205:44 | getParameter(...) | user-provided value |
31+
| FilePathInjection.java:210:23:210:26 | file | FilePathInjection.java:205:17:205:44 | getParameter(...) : String | FilePathInjection.java:210:23:210:26 | file | External control of file name or path due to $@. | FilePathInjection.java:205:17:205:44 | getParameter(...) | user-provided value |

‎java/ql/test/library-tests/neutrals/neutralsinks/Test.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,9 @@ public void test() throws Exception {
1414

1515
// java.io
1616
File file = null;
17-
file.exists(); // $ isNeutralSink
1817
file.compareTo(null); // $ isNeutralSink
1918

2019
// java.nio.file
21-
Files.exists(null, (LinkOption[])null); // $ isNeutralSink
2220
Files.getLastModifiedTime(null, (LinkOption[])null); // $ isNeutralSink
2321
Files.getOwner(null, (LinkOption[])null); // $ isNeutralSink
2422
Files.getPosixFilePermissions(null, (LinkOption[])null); // $ isNeutralSink
@@ -30,7 +28,6 @@ public void test() throws Exception {
3028
Files.isSameFile(null, null); // $ isNeutralSink
3129
Files.isSymbolicLink(null); // $ isNeutralSink
3230
Files.isWritable(null); // $ isNeutralSink
33-
Files.notExists(null, (LinkOption[])null); // $ isNeutralSink
3431
Files.setLastModifiedTime(null, null); // $ isNeutralSink
3532
Files.size(null); // $ isNeutralSink
3633

0 commit comments

Comments
 (0)