Skip to content

Commit fdc8453

Browse files
atorralbaatorralba
committed
Introduce TaintedPathAdditionalTaintStep
Use separate configurations for tainted path and tainted path local again.
1 parent 95478f1 commit fdc8453

4 files changed

Lines changed: 26 additions & 22 deletions

File tree

‎java/ql/src/Security/CWE/CWE-022/TaintedPath.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ predicate containsDotDotSanitizer(Guard g, Expr e, boolean branch) {
2929
)
3030
}
3131

32-
class TaintedPathConfig extends TaintedPathCommonConfig {
32+
class TaintedPathConfig extends TaintTracking::Configuration {
3333
TaintedPathConfig() { this = "TaintedPathConfig" }
3434

3535
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -48,6 +48,10 @@ class TaintedPathConfig extends TaintedPathCommonConfig {
4848
or
4949
node = DataFlow::BarrierGuard<containsDotDotSanitizer/3>::getABarrierNode()
5050
}
51+
52+
override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
53+
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
54+
}
5155
}
5256

5357
/**

‎java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,19 @@ import java
66
import semmle.code.java.controlflow.Guards
77
import semmle.code.java.security.PathCreation
88
import semmle.code.java.frameworks.Networking
9-
import semmle.code.java.dataflow.TaintTracking
9+
import semmle.code.java.dataflow.DataFlow
1010

11-
abstract class TaintedPathCommonConfig extends TaintTracking::Configuration {
12-
bindingset[this]
13-
TaintedPathCommonConfig() { any() }
11+
/**
12+
* A unit class for adding additional taint steps.
13+
*
14+
* Extend this class to add additional taint steps that should apply to tainted path flow configurations.
15+
*/
16+
class TaintedPathAdditionalTaintStep extends Unit {
17+
abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
18+
}
1419

15-
final override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
20+
private class DefaultTaintedPathAdditionalTaintStep extends TaintedPathAdditionalTaintStep {
21+
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
1622
exists(Argument a |
1723
a = n1.asExpr() and
1824
a.getCall() = n2.asExpr() and

‎java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,18 @@ import semmle.code.java.security.PathCreation
1919
import DataFlow::PathGraph
2020
import TaintedPathCommon
2121

22-
class TaintedPathLocalConfig extends TaintedPathCommonConfig {
22+
class TaintedPathLocalConfig extends TaintTracking::Configuration {
2323
TaintedPathLocalConfig() { this = "TaintedPathLocalConfig" }
2424

2525
override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
2626

2727
override predicate isSink(DataFlow::Node sink) {
2828
sink.asExpr() = any(PathCreation p).getAnInput()
2929
}
30+
31+
override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
32+
any(TaintedPathAdditionalTaintStep s).step(n1, n2)
33+
}
3034
}
3135

3236
from

‎java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,11 @@ edges
99
| Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
1010
| Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
1111
| Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp |
12-
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:26:97:26 | t : String |
13-
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:23:98:23 | t : String |
14-
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:29:99:29 | t : String |
15-
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:32:100:32 | t : String |
16-
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:41:101:41 | t : String |
17-
| Test.java:97:26:97:26 | t : String | Test.java:97:12:97:33 | new URI(...) |
18-
| Test.java:98:23:98:23 | t : String | Test.java:98:12:98:33 | new URI(...) |
19-
| Test.java:99:29:99:29 | t : String | Test.java:99:12:99:33 | new URI(...) |
20-
| Test.java:100:32:100:32 | t : String | Test.java:100:12:100:45 | new URI(...) |
21-
| Test.java:101:41:101:41 | t : String | Test.java:101:12:101:54 | new URI(...) |
12+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:12:97:33 | new URI(...) |
13+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:12:98:33 | new URI(...) |
14+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) |
15+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) |
16+
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) |
2217
nodes
2318
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
2419
| Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -35,15 +30,10 @@ nodes
3530
| Test.java:90:26:90:29 | temp | semmle.label | temp |
3631
| Test.java:95:14:95:34 | getHostName(...) : String | semmle.label | getHostName(...) : String |
3732
| Test.java:97:12:97:33 | new URI(...) | semmle.label | new URI(...) |
38-
| Test.java:97:26:97:26 | t : String | semmle.label | t : String |
3933
| Test.java:98:12:98:33 | new URI(...) | semmle.label | new URI(...) |
40-
| Test.java:98:23:98:23 | t : String | semmle.label | t : String |
4134
| Test.java:99:12:99:33 | new URI(...) | semmle.label | new URI(...) |
42-
| Test.java:99:29:99:29 | t : String | semmle.label | t : String |
4335
| Test.java:100:12:100:45 | new URI(...) | semmle.label | new URI(...) |
44-
| Test.java:100:32:100:32 | t : String | semmle.label | t : String |
4536
| Test.java:101:12:101:54 | new URI(...) | semmle.label | new URI(...) |
46-
| Test.java:101:41:101:41 | t : String | semmle.label | t : String |
4737
subpaths
4838
#select
4939
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |

0 commit comments

Comments
 (0)