hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: fix 'matches' false branch

Browse Source
This commit is contained in:
Jami Cogswell
2025-03-17 18:48:44 -04:00
parent 49d37c517d
commit 0d2e9ae469
2 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
java/ql/lib/semmle/code/java/security/PathSanitizer.qll
View File

@@ -497,9 +497,9 @@ private predicate isMatchesCall(StringMatchesCall matchesCall, Expr checkedExpr,
target.getStringValue() = targetValue and
checkedExpr = matchesCall.getQualifier()
|
targetValue.matches(["[%]*", "[%]+", "[%]{%}"]) and
(
// Allow anything except `.`, '/', '\'
targetValue.matches(["[%]*", "[%]+", "[%]{%}"]) and
(
// Note: we do not account for when '.', '/', '\' are inside a character range
not targetValue.matches("[%" + [".", "/", "\\\\\\\\"] + "%]%") and
@@ -512,9 +512,10 @@ private predicate isMatchesCall(StringMatchesCall matchesCall, Expr checkedExpr,
branch = true
or
// Disallow `.`, '/', '\'
targetValue.matches("[%.%]%") and
targetValue.matches("[%/%]%") and
targetValue.matches("[%\\\\\\\\%]%") and
targetValue.matches([".*[%].*", ".+[%].+"]) and
targetValue.matches("%[%.%]%") and
targetValue.matches("%[%/%]%") and
targetValue.matches("%[%\\\\\\\\%]%") and
not targetValue.matches("%[^%]%") and
branch = false
)

21
java/ql/test/library-tests/pathsanitizer/Test.java
View File

@@ -684,16 +684,33 @@ public class Test {
// branch = false
{
String source = (String) source();
if (source.matches(".*[\\./\\\\].*")) {
sink(source); // $ hasTaintFlow
} else {
sink(source); // Safe
}
}
{
String source = (String) source();
if (source.matches(".+[\\./\\\\].+")) {
sink(source); // $ hasTaintFlow
} else {
sink(source); // Safe
}
}
{
String source = (String) source();
// does not match whole string
if (source.matches("[\\./\\\\]+")) {
sink(source); // $ hasTaintFlow
} else {
sink(source); // $ Safe
sink(source); // $ hasTaintFlow
}
}
{
String source = (String) source();
// not a complete sanitizer since it doesn't protect against absolute path injection
if (source.matches("[\\.]+")) {
if (source.matches(".+[\\.].+")) {
sink(source); // $ hasTaintFlow
} else {
sink(source); // $ hasTaintFlow