diff --git a/java/ql/lib/change-notes/2022-12-05-kotlin-path-sanitizer.md b/java/ql/lib/change-notes/2022-12-05-kotlin-path-sanitizer.md new file mode 100644 index 00000000000..ac6d59046a0 --- /dev/null +++ b/java/ql/lib/change-notes/2022-12-05-kotlin-path-sanitizer.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The library `PathSanitizer.qll` has been improved to detect more path validation patterns in Kotlin. diff --git a/java/ql/lib/semmle/code/java/frameworks/kotlin/IO.qll b/java/ql/lib/semmle/code/java/frameworks/kotlin/IO.qll new file mode 100644 index 00000000000..38af34bc690 --- /dev/null +++ b/java/ql/lib/semmle/code/java/frameworks/kotlin/IO.qll @@ -0,0 +1,8 @@ +/** Provides classes and predicates related to `kotlin.io`. */ + +import java + +/** The type `kotlin.io.FilesKt`, where `File` extension methods are declared. */ +class FilesKt extends RefType { + FilesKt() { this.hasQualifiedName("kotlin.io", "FilesKt") } +} diff --git a/java/ql/lib/semmle/code/java/frameworks/kotlin/Text.qll b/java/ql/lib/semmle/code/java/frameworks/kotlin/Text.qll new file mode 100644 index 00000000000..62eafa9565e --- /dev/null +++ b/java/ql/lib/semmle/code/java/frameworks/kotlin/Text.qll @@ -0,0 +1,21 @@ +/** Provides classes and predicates related to `kotlin.text`. */ + +import java + +/** The type `kotlin.text.StringsKt`, where `String` extension methods are declared. */ +class StringsKt extends RefType { + StringsKt() { this.hasQualifiedName("kotlin.text", "StringsKt") } +} + +/** A call to the extension method `String.toRegex` from `kotlin.text`. */ +class KtToRegex extends MethodAccess { + KtToRegex() { + this.getMethod().getDeclaringType() instanceof StringsKt and + this.getMethod().hasName("toRegex") + } + + /** Gets the constant string value being converted to a regex by this call. */ + string getExpressionString() { + result = this.getArgument(0).(CompileTimeConstantExpr).getStringValue() + } +} diff --git a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll index 3b8ab9d6ba5..061ec5dc68c 100644 --- a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll +++ b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll @@ -4,6 +4,8 @@ import java private import semmle.code.java.controlflow.Guards private import semmle.code.java.dataflow.FlowSources private import semmle.code.java.dataflow.SSA +private import semmle.code.java.frameworks.kotlin.IO +private import semmle.code.java.frameworks.kotlin.Text /** A sanitizer that protects against path injection vulnerabilities. */ abstract class PathInjectionSanitizer extends DataFlow::Node { } @@ -50,12 +52,14 @@ private predicate exactPathMatchGuard(Guard g, Expr e, boolean branch) { t instanceof TypeUri or t instanceof TypePath or t instanceof TypeFile or - t.hasQualifiedName("android.net", "Uri") + t.hasQualifiedName("android.net", "Uri") or + t instanceof StringsKt or + t instanceof FilesKt | + e = getVisualQualifier(ma).getUnderlyingExpr() and ma.getMethod().getDeclaringType() = t and ma = g and - ma.getMethod().getName() = ["equals", "equalsIgnoreCase"] and - e = ma.getQualifier() and + getSourceMethod(ma.getMethod()).hasName(["equals", "equalsIgnoreCase"]) and branch = true ) } @@ -86,7 +90,7 @@ private class AllowedPrefixGuard extends PathGuard instanceof MethodAccess { not isDisallowedWord(super.getAnArgument()) } - override Expr getCheckedExpr() { result = super.getQualifier() } + override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() } } /** @@ -153,7 +157,7 @@ private class BlockListGuard extends PathGuard instanceof MethodAccess { isDisallowedWord(super.getAnArgument()) } - override Expr getCheckedExpr() { result = super.getQualifier() } + override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() } } /** @@ -187,15 +191,31 @@ private class BlockListSanitizer extends PathInjectionSanitizer { } } +private class ConstantOrRegex extends Expr { + ConstantOrRegex() { + this instanceof CompileTimeConstantExpr or + this instanceof KtToRegex + } + + string getStringValue() { + result = this.(CompileTimeConstantExpr).getStringValue() or + result = this.(KtToRegex).getExpressionString() + } +} + private predicate isStringPrefixMatch(MethodAccess ma) { - exists(Method m | m = ma.getMethod() and m.getDeclaringType() instanceof TypeString | - m.hasName("startsWith") + exists(Method m, RefType t | + m.getDeclaringType() = t and + (t instanceof TypeString or t instanceof StringsKt) and + m = ma.getMethod() + | + getSourceMethod(m).hasName("startsWith") or - m.hasName("regionMatches") and - ma.getArgument(0).(CompileTimeConstantExpr).getIntValue() = 0 + getSourceMethod(m).hasName("regionMatches") and + getVisualArgument(ma, 0).(CompileTimeConstantExpr).getIntValue() = 0 or m.hasName("matches") and - not ma.getArgument(0).(CompileTimeConstantExpr).getStringValue().matches(".*%") + not getVisualArgument(ma, 0).(ConstantOrRegex).getStringValue().matches(".*%") ) } @@ -205,52 +225,52 @@ private predicate isStringPrefixMatch(MethodAccess ma) { private predicate isStringPartialMatch(MethodAccess ma) { isStringPrefixMatch(ma) or - ma.getMethod().getDeclaringType() instanceof TypeString and - ma.getMethod().hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"]) + exists(RefType t | t = ma.getMethod().getDeclaringType() | + t instanceof TypeString or t instanceof StringsKt + ) and + getSourceMethod(ma.getMethod()) + .hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"]) } /** * Holds if `ma` is a call to a method that checks whether a path starts with a prefix. */ private predicate isPathPrefixMatch(MethodAccess ma) { - exists(RefType t | - t instanceof TypePath - or - t.hasQualifiedName("kotlin.io", "FilesKt") - | - t = ma.getMethod().getDeclaringType() and - ma.getMethod().hasName("startsWith") - ) + exists(RefType t | t = ma.getMethod().getDeclaringType() | + t instanceof TypePath or t instanceof FilesKt + ) and + getSourceMethod(ma.getMethod()).hasName("startsWith") } -private predicate isDisallowedWord(CompileTimeConstantExpr word) { +private predicate isDisallowedWord(ConstantOrRegex word) { word.getStringValue().matches(["/", "\\", "%WEB-INF%", "%/data%"]) } /** A complementary guard that protects against path traversal, by looking for the literal `..`. */ private class PathTraversalGuard extends PathGuard { + Expr checkedExpr; + PathTraversalGuard() { - exists(MethodAccess ma | - ma.getMethod().getDeclaringType() instanceof TypeString and + exists(MethodAccess ma, Method m, RefType t | + m = ma.getMethod() and + t = m.getDeclaringType() and + (t instanceof TypeString or t instanceof StringsKt) and + checkedExpr = getVisualQualifier(ma).getUnderlyingExpr() and ma.getAnArgument().(CompileTimeConstantExpr).getStringValue() = ".." | this = ma and - ma.getMethod().hasName("contains") + getSourceMethod(m).hasName("contains") or exists(EqualityTest eq | this = eq and - ma.getMethod().hasName(["indexOf", "lastIndexOf"]) and + getSourceMethod(m).hasName(["indexOf", "lastIndexOf"]) and eq.getAnOperand() = ma and eq.getAnOperand().(CompileTimeConstantExpr).getIntValue() = -1 ) ) } - override Expr getCheckedExpr() { - exists(MethodAccess ma | ma = this.(EqualityTest).getAnOperand() or ma = this | - result = ma.getQualifier() - ) - } + override Expr getCheckedExpr() { result = checkedExpr } boolean getBranch() { this instanceof MethodAccess and result = false @@ -262,15 +282,46 @@ private class PathTraversalGuard extends PathGuard { /** A complementary sanitizer that protects against path traversal using path normalization. */ private class PathNormalizeSanitizer extends MethodAccess { PathNormalizeSanitizer() { - exists(RefType t | - t instanceof TypePath or - t.hasQualifiedName("kotlin.io", "FilesKt") - | - this.getMethod().getDeclaringType() = t and + exists(RefType t | this.getMethod().getDeclaringType() = t | + (t instanceof TypePath or t instanceof FilesKt) and this.getMethod().hasName("normalize") + or + t instanceof TypeFile and + this.getMethod().hasName(["getCanonicalPath", "getCanonicalFile"]) ) - or - this.getMethod().getDeclaringType() instanceof TypeFile and - this.getMethod().hasName(["getCanonicalPath", "getCanonicalFile"]) } } + +/** + * Gets the qualifier of `ma` as seen in the source code. + * This is a helper predicate to solve discrepancies between + * what `getQualifier` actually gets in Java and Kotlin. + */ +private Expr getVisualQualifier(MethodAccess ma) { + if getSourceMethod(ma.getMethod()) instanceof ExtensionMethod + then result = ma.getArgument(0) + else result = ma.getQualifier() +} + +/** + * Gets the argument of `ma` at position `argPos` as seen in the source code. + * This is a helper predicate to solve discrepancies between + * what `getArgument` actually gets in Java and Kotlin. + */ +bindingset[argPos] +private Argument getVisualArgument(MethodAccess ma, int argPos) { + if getSourceMethod(ma.getMethod()) instanceof ExtensionMethod + then result = ma.getArgument(argPos + 1) + else result = ma.getArgument(argPos) +} + +/** + * Gets the proxied method if `m` is a Kotlin proxy that supplies default parameter values. + * Otherwise, just gets `m`. + */ +private Method getSourceMethod(Method m) { + m = result.getKotlinParameterDefaultsProxy() + or + not exists(Method src | m = src.getKotlinParameterDefaultsProxy()) and + result = m +} diff --git a/java/ql/test/library-tests/pathsanitizer/Test.java b/java/ql/test/library-tests/pathsanitizer/Test.java index 27a15d867ce..61e0f498bd8 100644 --- a/java/ql/test/library-tests/pathsanitizer/Test.java +++ b/java/ql/test/library-tests/pathsanitizer/Test.java @@ -279,7 +279,7 @@ public class Test { } private void blockListGuardValidation(String path) throws Exception { - if (path.contains("..") || !path.startsWith("/data")) + if (path.contains("..") || path.startsWith("/data")) throw new Exception(); } diff --git a/java/ql/test/library-tests/pathsanitizer/TestKt.kt b/java/ql/test/library-tests/pathsanitizer/TestKt.kt new file mode 100644 index 00000000000..d0a11dac0ee --- /dev/null +++ b/java/ql/test/library-tests/pathsanitizer/TestKt.kt @@ -0,0 +1,499 @@ +import java.io.File +import java.net.URI +import java.nio.file.Path +import java.nio.file.Paths +import android.net.Uri + +class TestKt { + fun source(): Any? { + return null + } + + fun sink(o: Any?) {} + + @Throws(Exception::class) + private fun exactPathMatchGuardValidation(path: String?) { + if (!path.equals("/safe/path")) throw Exception() + } + + @Throws(Exception::class) + fun exactPathMatchGuard() { + run { + val source = source() as String? + if (source!!.equals("/safe/path")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as URI? + if (source!!.equals(URI("http://safe/uri"))) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as File? + if (source!!.equals(File("/safe/file"))) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as Uri? + if (source!!.equals(Uri.parse("http://safe/uri"))) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + exactPathMatchGuardValidation(source) + sink(source) // Safe + } + } + + @Throws(Exception::class) + private fun allowListGuardValidation(path: String?) { + if (path!!.contains("..") || !path.startsWith("/safe")) throw Exception() + } + + @Throws(Exception::class) + fun allowListGuard() { + // Prefix check by itself is not enough + run { + val source = source() as String? + if (source!!.startsWith("/safe")) { + sink(source) // $ hasTaintFlow + } else + sink(source) // $ hasTaintFlow + } + // PathTraversalGuard + allowListGuard + run { + val source = source() as String? + if (!source!!.contains("..") && source.startsWith("/safe")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.indexOf("..") == -1 && source.startsWith("/safe")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.lastIndexOf("..") == -1 && source.startsWith("/safe")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + // PathTraversalSanitizer + allowListGuard + run { + val source: File? = source() as File? + val normalized: String = source!!.canonicalPath + if (normalized.startsWith("/safe")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source: File? = source() as File? + val normalized: File = source!!.canonicalFile + if (normalized.startsWith("/safe")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source: File? = source() as File? + val normalized: String = source!!.canonicalFile.toString() + if (normalized.startsWith("/safe")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source = source() as String? + val normalized: Path = Paths.get(source).normalize() + if (normalized.startsWith("/safe")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.startsWith("/safe")) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.regionMatches(0, "/safe", 0, 5)) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.matches("/safe/.*".toRegex())) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + // validation method + run { + val source = source() as String? + allowListGuardValidation(source) + sink(source) // Safe + } + // PathInjectionSanitizer + partial string match is considered unsafe + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.contains("/safe")) { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.regionMatches(1, "/safe", 0, 5)) { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (normalized.matches(".*/safe/.*".toRegex())) { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + } + + @Throws(Exception::class) + private fun dotDotCheckGuardValidation(path: String?) { + if (!path!!.startsWith("/safe") || path.contains("..")) throw Exception() + } + + @Throws(Exception::class) + fun dotDotCheckGuard() { + // dot dot check by itself is not enough + run { + val source = source() as String? + if (!source!!.contains("..")) { + sink(source) // $ hasTaintFlow + } else + sink(source) // $ hasTaintFlow + } + // allowListGuard + dotDotCheckGuard + run { + val source = source() as String? + if (source!!.startsWith("/safe") && !source.contains("..")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.startsWith("/safe") && source.indexOf("..") == -1) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (!source!!.startsWith("/safe") || source.indexOf("..") != -1) + sink(source) // $ hasTaintFlow + else + sink(source) // Safe + } + run { + val source = source() as String? + if (source!!.startsWith("/safe") && source.lastIndexOf("..") == -1) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + // blockListGuard + dotDotCheckGuard + run { + val source = source() as String? + if (!source!!.startsWith("/data") && !source.contains("..")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (!source!!.startsWith("/data") && source.indexOf("..") == -1) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.startsWith("/data") || source.indexOf("..") != -1) + sink(source) // $ hasTaintFlow + else + sink(source) // Safe + } + run { + val source = source() as String? + if (!source!!.startsWith("/data") && source.lastIndexOf("..") == -1) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + // validation method + run { + val source = source() as String? + dotDotCheckGuardValidation(source) + sink(source) // Safe + } + } + + @Throws(Exception::class) + private fun blockListGuardValidation(path: String?) { + if (path!!.contains("..") || path.startsWith("/data")) throw Exception() + } + + @Throws(Exception::class) + fun blockListGuard() { + // Prefix check by itself is not enough + run { + val source = source() as String? + if (!source!!.startsWith("/data")) { + sink(source) // $ hasTaintFlow + } else + sink(source) // $ hasTaintFlow + } + // PathTraversalGuard + blockListGuard + run { + val source = source() as String? + if (!source!!.contains("..") && !source.startsWith("/data")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.indexOf("..") == -1 && !source.startsWith("/data")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + run { + val source = source() as String? + if (source!!.lastIndexOf("..") == -1 && !source.startsWith("/data")) + sink(source) // Safe + else + sink(source) // $ hasTaintFlow + } + // PathTraversalSanitizer + blockListGuard + run { + val source: File? = source() as File? + val normalized: String = source!!.canonicalPath + if (!normalized.startsWith("/data")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source: File? = source() as File? + val normalized: File = source!!.canonicalFile + if (!normalized.startsWith("/data")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source: File? = source() as File? + val normalized: String = source!!.canonicalFile.toString() + if (!normalized.startsWith("/data")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source = source() as String? + val normalized: Path = Paths.get(source).normalize() + if (!normalized.startsWith("/data")) { + sink(source) // Safe + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.startsWith("/data")) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.regionMatches(0, "/data", 0, 5)) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.matches("/data/.*".toRegex())) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + // validation method + run { + val source = source() as String? + blockListGuardValidation(source) + sink(source) // Safe + } + // PathInjectionSanitizer + partial string match with disallowed words + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.contains("/")) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.regionMatches(1, "/", 0, 5)) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.matches("/".toRegex())) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + // PathInjectionSanitizer + partial string match with disallowed prefixes + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.contains("/data")) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.regionMatches(1, "/data", 0, 5)) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + run { + val source = source() as String? + // normalize().toString() gets extracted as Object.toString, stopping taint here + val normalized: String = Paths.get(source).normalize().toString() + if (!normalized.matches(".*/data/.*".toRegex())) { + sink(source) // $ SPURIOUS: hasTaintFlow + sink(normalized) // Safe + } else { + sink(source) // $ hasTaintFlow + sink(normalized) // $ MISSING: hasTaintFlow + } + } + } +} \ No newline at end of file diff --git a/java/ql/test/library-tests/pathsanitizer/options b/java/ql/test/library-tests/pathsanitizer/options index 1e6e9ea2bf1..02ea18b0cac 100644 --- a/java/ql/test/library-tests/pathsanitizer/options +++ b/java/ql/test/library-tests/pathsanitizer/options @@ -1 +1,2 @@ //semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/google-android-9.0.0 +//codeql-extractor-kotlin-options: ${testdir}/../../stubs/google-android-9.0.0