include suggestions from review.

This commit is contained in:
Porcupiney Hairs
2020-11-13 00:28:06 +05:30
parent 38de9b6433
commit 2525cfd786
13 changed files with 197 additions and 180 deletions

View File

@@ -27,15 +27,6 @@ class TypeApacheHttpRequestBase extends RefType {
}
}
/*
* Any class which can be used to make an HTTP request using the Apache Http Client library
* Examples include `HttpGet`,`HttpPost` etc.
*/
class TypeApacheHttpRequest extends Class {
TypeApacheHttpRequest() { exists(TypeApacheHttpRequestBase t | this.extendsOrImplements(t)) }
}
/* A class representing the `RequestBuilder` class of the Apache Http Client library */
class TypeApacheHttpRequestBuilder extends Class {
TypeApacheHttpRequestBuilder() {

View File

@@ -171,7 +171,7 @@ class JaxRsResponseBuilder extends Class {
}
/**
* The class `javax.ws.rs.client.Client`
* The class `javax.ws.rs.client.Client`.
*/
class JaxRsClient extends RefType {
JaxRsClient() { this.hasQualifiedName("javax.ws.rs.client", "Client") }

View File

@@ -4,6 +4,7 @@
import semmle.code.java.Type
// import semmle.code.java.dataflow.FlowSources
/** The type `java.net.URLConnection`. */
class TypeUrlConnection extends RefType {
TypeUrlConnection() { hasQualifiedName("java.net", "URLConnection") }
@@ -41,3 +42,88 @@ class SocketGetInputStreamMethod extends Method {
hasNoParameters()
}
}
/** Any expresion or call which returns a new URI. */
abstract class UriCreation extends Top {
/**
* Returns the host of the newly created URI.
* In the case where the host is specified separately, this returns only the host.
* In the case where the uri is parsed from an input string,
* such as in `URI(`http://foo.com/mypath')`,
* this returns the entire argument passed i.e. `http://foo.com/mypath'.
*/
abstract Expr hostArg();
}
/** An URI constructor expression */
class UriConstructor extends ClassInstanceExpr, UriCreation {
UriConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URI" }
override Expr hostArg() {
// URI(String str)
result = this.getArgument(0) and this.getNumArgument() = 1
or
// URI(String scheme, String ssp, String fragment)
// URI(String scheme, String host, String path, String fragment)
// URI(String scheme, String authority, String path, String query, String fragment)
result = this.getArgument(1) and this.getNumArgument() = [3, 4, 5]
or
// URI(String scheme, String userInfo, String host, int port, String path, String query,
// String fragment)
result = this.getArgument(2) and this.getNumArgument() = 7
}
}
class UriCreate extends Call, UriCreation {
UriCreate() {
this.getCallee().getName() = "create" and
this.getCallee().getDeclaringType() instanceof TypeUri
}
override Expr hostArg() { result = this.getArgument(0) }
}
/* An URL constructor expression */
class UrlConstructor extends ClassInstanceExpr {
UrlConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URL" }
Expr hostArg() {
// URL(String spec)
this.getNumArgument() = 1 and result = this.getArgument(0)
or
// URL(String protocol, String host, int port, String file)
// URL(String protocol, String host, int port, String file, URLStreamHandler handler)
this.getNumArgument() = [4, 5] and result = this.getArgument(1)
or
// URL(String protocol, String host, String file)
// but not
// URL(URL context, String spec, URLStreamHandler handler)
(
this.getNumArgument() = 3 and
this.getConstructor().getParameter(2).getType() instanceof TypeString
) and
result = this.getArgument(1)
}
Expr protocolArg() {
// In all cases except where the first parameter is a URL, the argument
// containing the protocol is the first one, otherwise it is the second.
if this.getConstructor().getParameter(0).getType().getName() = "URL"
then result = this.getArgument(1)
else result = this.getArgument(0)
}
}
class UrlOpenStreamMethod extends Method {
UrlOpenStreamMethod() {
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openStream"
}
}
class UrlOpenConnectionMethod extends Method {
UrlOpenConnectionMethod() {
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openConnection"
}
}

View File

@@ -1,7 +1,10 @@
import java
import semmle.code.java.dataflow.FlowSources
/**
* Provides classes for identifying methods called by the Java net Http package.
*/
/** A class representing `HttpRequest.Builder`. */
import java
/** The interface representing `HttpRequest.Builder`. */
class TypeHttpRequestBuilder extends Interface {
TypeHttpRequestBuilder() { hasQualifiedName("java.net.http", "HttpRequest$Builder") }
}
@@ -11,7 +14,7 @@ class TypeHttpRequest extends Interface {
TypeHttpRequest() { hasQualifiedName("java.net.http", "HttpRequest") }
}
/** A class representing `java.net.http.HttpRequest$Builder`'s `uri` method. */
/** The `uri` method on `java.net.http.HttpRequest.Builder`. */
class HttpBuilderUri extends Method {
HttpBuilderUri() {
this.getDeclaringType() instanceof TypeHttpRequestBuilder and

View File

@@ -1,43 +0,0 @@
import java
import semmle.code.java.dataflow.FlowSources
/** Any expresion or call which returns a new URI.*/
abstract class UriCreation extends Top {
/**
* Returns the host of the newly created URI.
* In the case where the host is specified separately, this returns only the host.
* In the case where the uri is parsed from an input string,
* such as in `URI(`http://foo.com/mypath')`,
* this returns the entire argument passed i.e. `http://foo.com/mypath'.
*/
abstract Expr hostArg();
}
/** An URI constructor expression */
class UriConstructor extends ClassInstanceExpr, UriCreation {
UriConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URI" }
override Expr hostArg() {
// URI(String str)
result = this.getArgument(0) and this.getNumArgument() = 1
or
// URI(String scheme, String ssp, String fragment)
// URI(String scheme, String host, String path, String fragment)
// URI(String scheme, String authority, String path, String query, String fragment)
result = this.getArgument(1) and this.getNumArgument() = [3, 4, 5]
or
// URI(String scheme, String userInfo, String host, int port, String path, String query,
// String fragment)
result = this.getArgument(2) and this.getNumArgument() = 7
}
}
class UriCreate extends Call, UriCreation {
UriCreate() {
this.getCallee().getName() = "create" and
this.getCallee().getDeclaringType() instanceof TypeUri
}
override Expr hostArg() { result = this.getArgument(0) }
}

View File

@@ -1,47 +0,0 @@
import java
import semmle.code.java.dataflow.FlowSources
/* Am URL constructor expression */
class UrlConstructor extends ClassInstanceExpr {
UrlConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URL" }
Expr hostArg() {
// URL(String spec)
this.getNumArgument() = 1 and result = this.getArgument(0)
or
// URL(String protocol, String host, int port, String file)
// URL(String protocol, String host, int port, String file, URLStreamHandler handler)
this.getNumArgument() = [4,5] and result = this.getArgument(1)
or
// URL(String protocol, String host, String file)
// but not
// URL(URL context, String spec, URLStreamHandler handler)
(
this.getNumArgument() = 3 and
this.getConstructor().getParameter(2).getType() instanceof TypeString
) and
result = this.getArgument(1)
}
Expr protocolArg() {
// In all cases except where the first parameter is a URL, the argument
// containing the protocol is the first one, otherwise it is the second.
if this.getConstructor().getParameter(0).getType().getName() = "URL"
then result = this.getArgument(1)
else result = this.getArgument(0)
}
}
class UrlOpenStreamMethod extends Method {
UrlOpenStreamMethod() {
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openStream"
}
}
class UrlOpenConnectionMethod extends Method {
UrlOpenConnectionMethod() {
this.getDeclaringType() instanceof TypeUrl and
this.getName() = "openConnection"
}
}

View File

@@ -39,17 +39,3 @@ class SpringResponseEntityBodyBuilder extends Interface {
class SpringHttpHeaders extends Class {
SpringHttpHeaders() { this.hasQualifiedName("org.springframework.http", "HttpHeaders") }
}
/** Models `org.springframework.http.RequestEntity`s instantiation expressions. */
class SpringRequestEntityInstanceExpr extends ClassInstanceExpr {
int numArgs;
SpringRequestEntityInstanceExpr() {
this.getConstructedType() instanceof SpringRequestEntity and
numArgs = this.getNumArgument()
}
Argument getUriArg() {
exists(Argument a | this.getAnArgument() = a and a.getType() instanceof TypeUri | result = a)
}
}

View File

@@ -33,7 +33,10 @@ class SpringWebClient extends Interface {
* which take an URL as an argument.
*/
abstract class SpringRestTemplateUrlMethods extends Method {
/** Gets the argument which corresponds to a URL */
/**
* Gets the argument which corresponds to a URL argument
* passed as a `java.net.URL` object or as a string or the like
*/
abstract Argument getUrlArgument(MethodAccess ma);
}