hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9025 from michaelnebel/csharp/generatedrefactor

Browse Source 
C#: Provenance column in Models as Data CSV format.
This commit is contained in:
Michael Nebel
2022-06-22 10:34:31 +02:00
committed by GitHub
parent 2b892bc000 b4cb1e58d3
commit 24ba5cc06e
190 changed files with 44588 additions and 44474 deletions
Download Patch File Download Diff File Expand all files Collapse all files

245
java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql
View File

@@ -27,124 +27,137 @@ private class Log4jLoggingSinkModels extends SinkModelCsv {
"org.apache.logging.log4j;Logger;true;" +
["debug", "error", "fatal", "info", "trace", "warn"] +
[
";(CharSequence);;Argument[0];log4j", ";(CharSequence,Throwable);;Argument[0];log4j",
";(Marker,CharSequence);;Argument[1];log4j",
";(Marker,CharSequence,Throwable);;Argument[1];log4j",
";(Marker,Message);;Argument[1];log4j", ";(Marker,MessageSupplier);;Argument[1];log4j",
";(Marker,MessageSupplier);;Argument[1];log4j",
";(Marker,MessageSupplier,Throwable);;Argument[1];log4j",
";(Marker,Object);;Argument[1];log4j", ";(Marker,Object,Throwable);;Argument[1];log4j",
";(Marker,String);;Argument[1];log4j",
";(Marker,String,Object[]);;Argument[1..2];log4j",
";(Marker,String,Object);;Argument[1..2];log4j",
";(Marker,String,Object,Object);;Argument[1..3];log4j",
";(Marker,String,Object,Object,Object);;Argument[1..4];log4j",
";(Marker,String,Object,Object,Object,Object);;Argument[1..5];log4j",
";(Marker,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j",
";(Marker,String,Supplier);;Argument[1..2];log4j",
";(Marker,String,Throwable);;Argument[1];log4j",
";(Marker,Supplier);;Argument[1];log4j",
";(Marker,Supplier,Throwable);;Argument[1];log4j",
";(MessageSupplier);;Argument[0];log4j",
";(MessageSupplier,Throwable);;Argument[0];log4j", ";(Message);;Argument[0];log4j",
";(Message,Throwable);;Argument[0];log4j", ";(Object);;Argument[0];log4j",
";(Object,Throwable);;Argument[0];log4j", ";(String);;Argument[0];log4j",
";(String,Object[]);;Argument[0..1];log4j", ";(String,Object);;Argument[0..1];log4j",
";(String,Object,Object);;Argument[0..2];log4j",
";(String,Object,Object,Object);;Argument[0..3];log4j",
";(String,Object,Object,Object,Object);;Argument[0..4];log4j",
";(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j",
";(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j",
";(String,Supplier);;Argument[0..1];log4j", ";(String,Throwable);;Argument[0];log4j",
";(Supplier);;Argument[0];log4j", ";(Supplier,Throwable);;Argument[0];log4j"
";(CharSequence);;Argument[0];log4j;manual",
";(CharSequence,Throwable);;Argument[0];log4j;manual",
";(Marker,CharSequence);;Argument[1];log4j;manual",
";(Marker,CharSequence,Throwable);;Argument[1];log4j;manual",
";(Marker,Message);;Argument[1];log4j;manual",
";(Marker,MessageSupplier);;Argument[1];log4j;manual",
";(Marker,MessageSupplier);;Argument[1];log4j;manual",
";(Marker,MessageSupplier,Throwable);;Argument[1];log4j;manual",
";(Marker,Object);;Argument[1];log4j;manual",
";(Marker,Object,Throwable);;Argument[1];log4j;manual",
";(Marker,String);;Argument[1];log4j;manual",
";(Marker,String,Object[]);;Argument[1..2];log4j;manual",
";(Marker,String,Object);;Argument[1..2];log4j;manual",
";(Marker,String,Object,Object);;Argument[1..3];log4j;manual",
";(Marker,String,Object,Object,Object);;Argument[1..4];log4j;manual",
";(Marker,String,Object,Object,Object,Object);;Argument[1..5];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j;manual",
";(Marker,String,Supplier);;Argument[1..2];log4j;manual",
";(Marker,String,Throwable);;Argument[1];log4j;manual",
";(Marker,Supplier);;Argument[1];log4j;manual",
";(Marker,Supplier,Throwable);;Argument[1];log4j;manual",
";(MessageSupplier);;Argument[0];log4j;manual",
";(MessageSupplier,Throwable);;Argument[0];log4j;manual",
";(Message);;Argument[0];log4j;manual",
";(Message,Throwable);;Argument[0];log4j;manual", ";(Object);;Argument[0];log4j;manual",
";(Object,Throwable);;Argument[0];log4j;manual", ";(String);;Argument[0];log4j;manual",
";(String,Object[]);;Argument[0..1];log4j;manual",
";(String,Object);;Argument[0..1];log4j;manual",
";(String,Object,Object);;Argument[0..2];log4j;manual",
";(String,Object,Object,Object);;Argument[0..3];log4j;manual",
";(String,Object,Object,Object,Object);;Argument[0..4];log4j;manual",
";(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j;manual",
";(String,Supplier);;Argument[0..1];log4j;manual",
";(String,Throwable);;Argument[0];log4j;manual",
";(Supplier);;Argument[0];log4j;manual",
";(Supplier,Throwable);;Argument[0];log4j;manual"
],
"org.apache.logging.log4j;Logger;true;log" +
[
";(Level,CharSequence);;Argument[1];log4j",
";(Level,CharSequence,Throwable);;Argument[1];log4j",
";(Level,Marker,CharSequence);;Argument[2];log4j",
";(Level,Marker,CharSequence,Throwable);;Argument[2];log4j",
";(Level,Marker,Message);;Argument[2];log4j",
";(Level,Marker,MessageSupplier);;Argument[2];log4j",
";(Level,Marker,MessageSupplier);;Argument[2];log4j",
";(Level,Marker,MessageSupplier,Throwable);;Argument[2];log4j",
";(Level,Marker,Object);;Argument[2];log4j",
";(Level,Marker,Object,Throwable);;Argument[2];log4j",
";(Level,Marker,String);;Argument[2];log4j",
";(Level,Marker,String,Object[]);;Argument[2..3];log4j",
";(Level,Marker,String,Object);;Argument[2..3];log4j",
";(Level,Marker,String,Object,Object);;Argument[2..4];log4j",
";(Level,Marker,String,Object,Object,Object);;Argument[2..5];log4j",
";(Level,Marker,String,Object,Object,Object,Object);;Argument[2..6];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object);;Argument[2..7];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object);;Argument[2..8];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[2..9];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..10];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..11];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..12];log4j",
";(Level,Marker,String,Supplier);;Argument[2..3];log4j",
";(Level,Marker,String,Throwable);;Argument[2];log4j",
";(Level,Marker,Supplier);;Argument[2];log4j",
";(Level,Marker,Supplier,Throwable);;Argument[2];log4j",
";(Level,Message);;Argument[1];log4j", ";(Level,MessageSupplier);;Argument[1];log4j",
";(Level,MessageSupplier,Throwable);;Argument[1];log4j",
";(Level,Message);;Argument[1];log4j", ";(Level,Message,Throwable);;Argument[1];log4j",
";(Level,Object);;Argument[1];log4j", ";(Level,Object);;Argument[1];log4j",
";(Level,String);;Argument[1];log4j", ";(Level,Object,Throwable);;Argument[1];log4j",
";(Level,String);;Argument[1];log4j", ";(Level,String,Object[]);;Argument[1..2];log4j",
";(Level,String,Object);;Argument[1..2];log4j",
";(Level,String,Object,Object);;Argument[1..3];log4j",
";(Level,String,Object,Object,Object);;Argument[1..4];log4j",
";(Level,String,Object,Object,Object,Object);;Argument[1..5];log4j",
";(Level,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j",
";(Level,String,Supplier);;Argument[1..2];log4j",
";(Level,String,Throwable);;Argument[1];log4j", ";(Level,Supplier);;Argument[1];log4j",
";(Level,Supplier,Throwable);;Argument[1];log4j"
], "org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];log4j",
"org.apache.logging.log4j;Logger;true;logMessage;(Level,Marker,String,StackTraceElement,Message,Throwable);;Argument[4];log4j",
"org.apache.logging.log4j;Logger;true;printf;(Level,Marker,String,Object[]);;Argument[2..3];log4j",
"org.apache.logging.log4j;Logger;true;printf;(Level,String,Object[]);;Argument[1..2];log4j",
";(Level,CharSequence);;Argument[1];log4j;manual",
";(Level,CharSequence,Throwable);;Argument[1];log4j;manual",
";(Level,Marker,CharSequence);;Argument[2];log4j;manual",
";(Level,Marker,CharSequence,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Message);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Object);;Argument[2];log4j;manual",
";(Level,Marker,Object,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,String);;Argument[2];log4j;manual",
";(Level,Marker,String,Object[]);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Object);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Object,Object);;Argument[2..4];log4j;manual",
";(Level,Marker,String,Object,Object,Object);;Argument[2..5];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object);;Argument[2..6];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object);;Argument[2..7];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object);;Argument[2..8];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[2..9];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..10];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..11];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..12];log4j;manual",
";(Level,Marker,String,Supplier);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Supplier);;Argument[2];log4j;manual",
";(Level,Marker,Supplier,Throwable);;Argument[2];log4j;manual",
";(Level,Message);;Argument[1];log4j;manual",
";(Level,MessageSupplier);;Argument[1];log4j;manual",
";(Level,MessageSupplier,Throwable);;Argument[1];log4j;manual",
";(Level,Message);;Argument[1];log4j;manual",
";(Level,Message,Throwable);;Argument[1];log4j;manual",
";(Level,Object);;Argument[1];log4j;manual",
";(Level,Object);;Argument[1];log4j;manual",
";(Level,String);;Argument[1];log4j;manual",
";(Level,Object,Throwable);;Argument[1];log4j;manual",
";(Level,String);;Argument[1];log4j;manual",
";(Level,String,Object[]);;Argument[1..2];log4j;manual",
";(Level,String,Object);;Argument[1..2];log4j;manual",
";(Level,String,Object,Object);;Argument[1..3];log4j;manual",
";(Level,String,Object,Object,Object);;Argument[1..4];log4j;manual",
";(Level,String,Object,Object,Object,Object);;Argument[1..5];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j;manual",
";(Level,String,Supplier);;Argument[1..2];log4j;manual",
";(Level,String,Throwable);;Argument[1];log4j;manual",
";(Level,Supplier);;Argument[1];log4j;manual",
";(Level,Supplier,Throwable);;Argument[1];log4j;manual"
], "org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];log4j;manual",
"org.apache.logging.log4j;Logger;true;logMessage;(Level,Marker,String,StackTraceElement,Message,Throwable);;Argument[4];log4j;manual",
"org.apache.logging.log4j;Logger;true;printf;(Level,Marker,String,Object[]);;Argument[2..3];log4j;manual",
"org.apache.logging.log4j;Logger;true;printf;(Level,String,Object[]);;Argument[1..2];log4j;manual",
// org.apache.logging.log4j.LogBuilder
"org.apache.logging.log4j;LogBuilder;true;log;(CharSequence);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Message);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Object);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object[]);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object);;Argument[0..2];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object);;Argument[0..3];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object);;Argument[0..4];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Supplier[]);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Supplier);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(CharSequence);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Message);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Object);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object[]);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object);;Argument[0..2];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object);;Argument[0..3];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object);;Argument[0..4];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Supplier[]);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Supplier);;Argument[0];log4j;manual",
// org.apache.logging.log4j.ThreadContext
"org.apache.logging.log4j;ThreadContext;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;ThreadContext;false;putIfNull;;;Argument[1];log4j",
"org.apache.logging.log4j;ThreadContext;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;ThreadContext;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;ThreadContext;false;putIfNull;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;ThreadContext;false;putAll;;;Argument[0];log4j;manual",
// org.apache.logging.log4j.CloseableThreadContext
"org.apache.logging.log4j;CloseableThreadContext;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;CloseableThreadContext;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;CloseableThreadContext;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext;false;putAll;;;Argument[0];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;putAll;;;Argument[0];log4j;manual",
]
}
}
@@ -153,10 +166,10 @@ class Log4jInjectionSummaries extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"org.apache.logging.log4j.message;MapMessage;true;with;;;Argument[1];Argument[-1];taint",
"org.apache.logging.log4j.message;MapMessage;true;with;;;Argument[-1];ReturnValue;value",
"org.apache.logging.log4j.message;MapMessage;true;put;;;Argument[1];Argument[-1];taint",
"org.apache.logging.log4j.message;MapMessage;true;putAll;;;Argument[0].MapValue;Argument[-1];taint",
"org.apache.logging.log4j.message;MapMessage;true;with;;;Argument[1];Argument[-1];taint;manual",
"org.apache.logging.log4j.message;MapMessage;true;with;;;Argument[-1];ReturnValue;value;manual",
"org.apache.logging.log4j.message;MapMessage;true;put;;;Argument[1];Argument[-1];taint;manual",
"org.apache.logging.log4j.message;MapMessage;true;putAll;;;Argument[0].MapValue;Argument[-1];taint;manual",
]
}
}

12
java/ql/src/experimental/Security/CWE/CWE-073/JFinalController.qll
View File

@@ -68,17 +68,17 @@ private class JFinalControllerSource extends SourceModelCsv {
row =
[
"com.jfinal.core;Controller;true;getCookie" + ["", "Object", "Objects", "ToInt", "ToLong"] +
";;;ReturnValue;remote",
"com.jfinal.core;Controller;true;getFile" + ["", "s"] + ";;;ReturnValue;remote",
"com.jfinal.core;Controller;true;getHeader;;;ReturnValue;remote",
"com.jfinal.core;Controller;true;getKv;;;ReturnValue;remote",
";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getFile" + ["", "s"] + ";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getHeader;;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getKv;;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;getPara" +
[
"", "Map", "ToBoolean", "ToDate", "ToInt", "ToLong", "Values", "ValuesToInt",
"ValuesToLong"
] + ";;;ReturnValue;remote",
] + ";;;ReturnValue;remote;manual",
"com.jfinal.core;Controller;true;get" + ["", "Int", "Long", "Boolean", "Date"] +
";;;ReturnValue;remote"
";;;ReturnValue;remote;manual"
]
}
}

4
java/ql/src/experimental/Security/CWE/CWE-200/AndroidWebResourceResponse.qll
View File

@@ -74,8 +74,8 @@ private class LoadUrlSummaries extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.io;FileInputStream;true;FileInputStream;;;Argument[0];Argument[-1];taint",
"android.webkit;WebResourceRequest;false;getUrl;;;Argument[-1];ReturnValue;taint"
"java.io;FileInputStream;true;FileInputStream;;;Argument[0];Argument[-1];taint;manual",
"android.webkit;WebResourceRequest;false;getUrl;;;Argument[-1];ReturnValue;taint;manual"
]
}
}

6
java/ql/src/experimental/Security/CWE/CWE-321/HardcodedJwtKey.qll
View File

@@ -131,15 +131,15 @@ private class VerificationFlowStep extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"com.auth0.jwt.interfaces;Verification;true;build;;;Argument[-1];ReturnValue;taint",
"com.auth0.jwt.interfaces;Verification;true;build;;;Argument[-1];ReturnValue;taint;manual",
"com.auth0.jwt.interfaces;Verification;true;" +
["acceptLeeway", "acceptExpiresAt", "acceptNotBefore", "acceptIssuedAt", "ignoreIssuedAt"]
+ ";;;Argument[-1];ReturnValue;value",
+ ";;;Argument[-1];ReturnValue;value;manual",
"com.auth0.jwt.interfaces;Verification;true;with" +
[
"Issuer", "Subject", "Audience", "AnyOfAudience", "ClaimPresence", "Claim",
"ArrayClaim", "JWTId"
] + ";;;Argument[-1];ReturnValue;value"
] + ";;;Argument[-1];ReturnValue;value;manual"
]
}
}

8
java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qll
View File

@@ -10,8 +10,8 @@ private class MathCompDataModel extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.lang;Math;false;min;;;Argument[0..1];ReturnValue;value",
"java.lang;Math;false;max;;;Argument[0..1];ReturnValue;value"
"java.lang;Math;false;min;;;Argument[0..1];ReturnValue;value;manual",
"java.lang;Math;false;max;;;Argument[0..1];ReturnValue;value;manual"
]
}
}
@@ -21,8 +21,8 @@ private class PauseThreadDataModel extends SinkModelCsv {
override predicate row(string row) {
row =
[
"java.lang;Thread;true;sleep;;;Argument[0];thread-pause",
"java.util.concurrent;TimeUnit;true;sleep;;;Argument[0];thread-pause"
"java.lang;Thread;true;sleep;;;Argument[0];thread-pause;manual",
"java.util.concurrent;TimeUnit;true;sleep;;;Argument[0];thread-pause;manual"
]
}
}

18
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qll
View File

@@ -154,8 +154,8 @@ private class ServletGetPathSource extends SourceModelCsv {
override predicate row(string row) {
row =
[
"javax.servlet.http;HttpServletRequest;true;getServletPath;;;ReturnValue;remote",
"jakarta.servlet.http;HttpServletRequest;true;getServletPath;;;ReturnValue;remote"
"javax.servlet.http;HttpServletRequest;true;getServletPath;;;ReturnValue;remote;manual",
"jakarta.servlet.http;HttpServletRequest;true;getServletPath;;;ReturnValue;remote;manual"
]
}
}
@@ -165,13 +165,13 @@ private class FilePathFlowStep extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.nio.file;Paths;true;get;;;Argument[0..1];ReturnValue;taint",
"java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint",
"java.nio.file;Path;true;toString;;;Argument[-1];ReturnValue;taint",
"io.undertow.server.handlers.resource;Resource;true;getFile;;;Argument[-1];ReturnValue;taint",
"io.undertow.server.handlers.resource;Resource;true;getFilePath;;;Argument[-1];ReturnValue;taint",
"io.undertow.server.handlers.resource;Resource;true;getPath;;;Argument[-1];ReturnValue;taint"
"java.nio.file;Paths;true;get;;;Argument[0..1];ReturnValue;taint;manual",
"java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint;manual",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint;manual",
"java.nio.file;Path;true;toString;;;Argument[-1];ReturnValue;taint;manual",
"io.undertow.server.handlers.resource;Resource;true;getFile;;;Argument[-1];ReturnValue;taint;manual",
"io.undertow.server.handlers.resource;Resource;true;getFilePath;;;Argument[-1];ReturnValue;taint;manual",
"io.undertow.server.handlers.resource;Resource;true;getPath;;;Argument[-1];ReturnValue;taint;manual"
]
}
}

4
java/ql/src/experimental/semmle/code/java/PathSanitizer.qll
View File

@@ -196,8 +196,8 @@ private class PathDataModel extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;taint",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint"
"java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;taint;manual",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint;manual"
]
}
}

4
java/ql/src/utils/flowtestcasegenerator/FlowTestCase.qll
View File

@@ -64,8 +64,8 @@ private newtype TTestCase =
string inputSpec, string outputSpec
|
any(TargetSummaryModelCsv tsmc).row(row) and
summaryModel(namespace, type, subtypes, name, signature, ext, inputSpec, outputSpec, kind,
false, row) and
summaryModel(namespace, type, subtypes, name, signature, ext, inputSpec, outputSpec, kind, _,
row) and
callable = interpretElement(namespace, type, subtypes, name, signature, ext) and
Private::External::interpretSpec(inputSpec, input) and
Private::External::interpretSpec(outputSpec, output)

4
java/ql/src/utils/flowtestcasegenerator/FlowTestCaseSupportMethods.qll
View File

@@ -165,7 +165,7 @@ private class DefaultGetMethod extends GetMethod {
override string getCsvModel() {
result =
"generatedtest;Test;false;" + this.getName() + ";(Object);;" +
getComponentSpec(SummaryComponent::content(c)) + "Argument[0].;ReturnValue;value"
getComponentSpec(SummaryComponent::content(c)) + "Argument[0].;ReturnValue;value;manual"
}
}
@@ -361,7 +361,7 @@ private class DefaultGenMethod extends GenMethod {
override string getCsvModel() {
result =
"generatedtest;Test;false;" + this.getName() + ";(Object);;Argument[0];" +
getComponentSpec(SummaryComponent::content(c)) + "ReturnValue.;value"
getComponentSpec(SummaryComponent::content(c)) + "ReturnValue.;value;manual"
}
}

13
java/ql/src/utils/model-generator/internal/CaptureModels.qll
View File

@@ -44,7 +44,8 @@ private string asSummaryModel(TargetApi api, string input, string output, string
result =
asPartialModel(api) + input + ";" //
+ output + ";" //
+ "generated:" + kind
+ kind + ";" //
+ "generated"
}
/**
@@ -68,7 +69,10 @@ private string asTaintModel(TargetApi api, string input, string output) {
*/
bindingset[input, kind]
private string asSinkModel(TargetApi api, string input, string kind) {
result = asPartialModel(api) + input + ";" + "generated:" + kind
result =
asPartialModel(api) + input + ";" //
+ kind + ";" //
+ "generated"
}
/**
@@ -76,7 +80,10 @@ private string asSinkModel(TargetApi api, string input, string kind) {
*/
bindingset[output, kind]
private string asSourceModel(TargetApi api, string output, string kind) {
result = asPartialModel(api) + output + ";" + "generated:" + kind
result =
asPartialModel(api) + output + ";" //
+ kind + ";" //
+ "generated"
}
/**