Add tests for StandardSystemProperty

2026-04-30 19:26:02 +02:00 · 2022-03-15 12:37:42 -04:00
parent 451661dd20
commit 09cc8ee09e
5 changed files with 166 additions and 15 deletions
--- a/java/ql/lib/semmle/code/java/environment/SystemProperty.qll
+++ b/java/ql/lib/semmle/code/java/environment/SystemProperty.qll
@@ -170,8 +170,18 @@ private MethodAccess getSystemPropertyFromApacheFileUtils(string propertyName) {
 private MethodAccess getSystemPropertyFromGuava(string propertyName) {
  exists(EnumConstant ec |
    ec.getDeclaringType().hasQualifiedName("com.google.common.base", "StandardSystemProperty") and
-    result.getQualifier() = ec.getAnAccess() and
-    result.getMethod().hasName("value")
+    // Example: `StandardSystemProperty.JAVA_IO_TMPDIR.value()`
+    (
+      localExprFlowPlusInitializers(ec.getAnAccess(), result.getQualifier()) and
+      result.getMethod().hasName("value")
+    )
+    or
+    // Example: `System.getProperty(StandardSystemProperty.JAVA_IO_TMPDIR.key())`
+    exists(MethodAccess keyMa |
+      localExprFlowPlusInitializers(ec.getAnAccess(), keyMa.getQualifier()) and
+      keyMa.getMethod().hasName("key") and
+      localExprFlowPlusInitializers(keyMa, result.(MethodAccessSystemGetProperty).getArgument(0))
+    )
  |
    ec.hasName("JAVA_VERSION") and propertyName = "java.version"
    or
--- a/java/ql/test/library-tests/environment/SystemPropertyAccess.java
+++ b/java/ql/test/library-tests/environment/SystemPropertyAccess.java
@@ -1,6 +1,7 @@
 import java.io.File;
 import java.util.Properties;
 import org.apache.commons.lang3.SystemUtils;
+import com.google.common.base.StandardSystemProperty;

 public class SystemPropertyAccess {
    private static final Properties SYSTEM_PROPERTIES = System.getProperties();
@@ -20,6 +21,10 @@ public class SystemPropertyAccess {
        char separatorChar = File.separatorChar;
        String pathSeparator = File.pathSeparator;
        char pathSeparatorChar = File.pathSeparatorChar;
+        StandardSystemProperty.JAVA_VERSION.value();
+        StandardSystemProperty property = StandardSystemProperty.JAVA_VERSION;
+        property.value();
+        System.getProperty(StandardSystemProperty.JAVA_IO_TMPDIR.key());
    }
    
 }
--- a/java/ql/test/library-tests/environment/SystemPropertyTest.expected
+++ b/java/ql/test/library-tests/environment/SystemPropertyTest.expected
@@ -38,15 +38,20 @@
 | ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:843:5:843:48 | USER_NAME | user.name |
 | ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:861:5:861:52 | USER_TIMEZONE | user.timezone |
 | ../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/SystemUtils.java:1762:47:1762:63 | JAVA_AWT_HEADLESS | java.awt.headless |
-| SystemPropertyAccess.java:9:9:9:37 | getProperty(...) | os.name |
-| SystemPropertyAccess.java:10:9:10:48 | getProperty(...) | os.name |
-| SystemPropertyAccess.java:11:9:11:53 | getProperty(...) | os.name |
-| SystemPropertyAccess.java:12:9:12:52 | get(...) | java.io.tmpdir |
-| SystemPropertyAccess.java:15:9:15:30 | lineSeparator(...) | line.separator |
-| SystemPropertyAccess.java:16:29:16:51 | SystemUtils.AWT_TOOLKIT | awt.toolkit |
-| SystemPropertyAccess.java:17:31:17:55 | SystemUtils.FILE_ENCODING | file.encoding |
-| SystemPropertyAccess.java:18:25:18:50 | SystemUtils.JAVA_IO_TMPDIR | java.io.tmpdir |
-| SystemPropertyAccess.java:19:28:19:41 | File.separator | file.separator |
-| SystemPropertyAccess.java:20:30:20:47 | File.separatorChar | file.separator |
-| SystemPropertyAccess.java:21:32:21:49 | File.pathSeparator | path.separator |
-| SystemPropertyAccess.java:22:34:22:55 | File.pathSeparatorChar | path.separator |
+| SystemPropertyAccess.java:10:9:10:37 | getProperty(...) | os.name |
+| SystemPropertyAccess.java:11:9:11:48 | getProperty(...) | os.name |
+| SystemPropertyAccess.java:12:9:12:53 | getProperty(...) | os.name |
+| SystemPropertyAccess.java:13:9:13:52 | get(...) | java.io.tmpdir |
+| SystemPropertyAccess.java:14:9:14:50 | getProperty(...) | java.home |
+| SystemPropertyAccess.java:15:9:15:46 | get(...) | file.encoding |
+| SystemPropertyAccess.java:16:9:16:30 | lineSeparator(...) | line.separator |
+| SystemPropertyAccess.java:17:29:17:51 | SystemUtils.AWT_TOOLKIT | awt.toolkit |
+| SystemPropertyAccess.java:18:31:18:55 | SystemUtils.FILE_ENCODING | file.encoding |
+| SystemPropertyAccess.java:19:25:19:50 | SystemUtils.JAVA_IO_TMPDIR | java.io.tmpdir |
+| SystemPropertyAccess.java:20:28:20:41 | File.separator | file.separator |
+| SystemPropertyAccess.java:21:30:21:47 | File.separatorChar | file.separator |
+| SystemPropertyAccess.java:22:32:22:49 | File.pathSeparator | path.separator |
+| SystemPropertyAccess.java:23:34:23:55 | File.pathSeparatorChar | path.separator |
+| SystemPropertyAccess.java:24:9:24:51 | value(...) | java.version |
+| SystemPropertyAccess.java:26:9:26:24 | value(...) | java.version |
+| SystemPropertyAccess.java:27:9:27:71 | getProperty(...) | java.io.tmpdir |
--- a/java/ql/test/library-tests/environment/options
+++ b/java/ql/test/library-tests/environment/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/apache-commons-lang3-3.7/
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/apache-commons-lang3-3.7/:${testdir}/../../stubs/guava-30.0/
--- a/java/ql/test/stubs/guava-30.0/com/google/common/base/StandardSystemProperty.java
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/base/StandardSystemProperty.java
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.common.base;
+
+public enum StandardSystemProperty {
+
+  /** Java Runtime Environment version. */
+  JAVA_VERSION("java.version"),
+
+  /** Java Runtime Environment vendor. */
+  JAVA_VENDOR("java.vendor"),
+
+  /** Java vendor URL. */
+  JAVA_VENDOR_URL("java.vendor.url"),
+
+  /** Java installation directory. */
+  JAVA_HOME("java.home"),
+
+  /** Java Virtual Machine specification version. */
+  JAVA_VM_SPECIFICATION_VERSION("java.vm.specification.version"),
+
+  /** Java Virtual Machine specification vendor. */
+  JAVA_VM_SPECIFICATION_VENDOR("java.vm.specification.vendor"),
+
+  /** Java Virtual Machine specification name. */
+  JAVA_VM_SPECIFICATION_NAME("java.vm.specification.name"),
+
+  /** Java Virtual Machine implementation version. */
+  JAVA_VM_VERSION("java.vm.version"),
+
+  /** Java Virtual Machine implementation vendor. */
+  JAVA_VM_VENDOR("java.vm.vendor"),
+
+  /** Java Virtual Machine implementation name. */
+  JAVA_VM_NAME("java.vm.name"),
+
+  /** Java Runtime Environment specification version. */
+  JAVA_SPECIFICATION_VERSION("java.specification.version"),
+
+  /** Java Runtime Environment specification vendor. */
+  JAVA_SPECIFICATION_VENDOR("java.specification.vendor"),
+
+  /** Java Runtime Environment specification name. */
+  JAVA_SPECIFICATION_NAME("java.specification.name"),
+
+  /** Java class format version number. */
+  JAVA_CLASS_VERSION("java.class.version"),
+
+  /** Java class path. */
+  JAVA_CLASS_PATH("java.class.path"),
+
+  /** List of paths to search when loading libraries. */
+  JAVA_LIBRARY_PATH("java.library.path"),
+
+  /** Default temp file path. */
+  JAVA_IO_TMPDIR("java.io.tmpdir"),
+
+  /** Name of JIT compiler to use. */
+  JAVA_COMPILER("java.compiler"),
+
+  /**
+   * Path of extension directory or directories.
+   *
+   * @deprecated This property was <a
+   *     href="https://openjdk.java.net/jeps/220#Removed:-The-extension-mechanism">deprecated</a> in
+   *     Java 8 and removed in Java 9. We do not plan to remove this API from Guava, but if you are
+   *     using it, it is probably not doing what you want.
+   */
+  @Deprecated
+  JAVA_EXT_DIRS("java.ext.dirs"),
+
+  /** Operating system name. */
+  OS_NAME("os.name"),
+
+  /** Operating system architecture. */
+  OS_ARCH("os.arch"),
+
+  /** Operating system version. */
+  OS_VERSION("os.version"),
+
+  /** File separator ("/" on UNIX). */
+  FILE_SEPARATOR("file.separator"),
+
+  /** Path separator (":" on UNIX). */
+  PATH_SEPARATOR("path.separator"),
+
+  /** Line separator ("\n" on UNIX). */
+  LINE_SEPARATOR("line.separator"),
+
+  /** User's account name. */
+  USER_NAME("user.name"),
+
+  /** User's home directory. */
+  USER_HOME("user.home"),
+
+  /** User's current working directory. */
+  USER_DIR("user.dir");
+
+  private final String key;
+
+  StandardSystemProperty(String key) {
+    this.key = key;
+  }
+
+  /** Returns the key used to lookup this system property. */
+  public String key() {
+    return null;
+  }
+
+  public String value() {
+    return null;
+  }
+
+  /** Returns a string representation of this system property. */
+  @Override
+  public String toString() {
+    return null;
+  }
+}