Merge pull request #11550 from atorralba/atorralba/kotlin/adapt-path-sanitizer

Kotlin: Adapt PathSanitizer

java/ql/lib/change-notes/2022-12-05-kotlin-path-sanitizer.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The library `PathSanitizer.qll` has been improved to detect more path validation patterns in Kotlin.

java/ql/lib/semmle/code/java/frameworks/kotlin/IO.qll

@@ -0,0 +1,8 @@
+/** Provides classes and predicates related to `kotlin.io`. */
+
+import java
+
+/** The type `kotlin.io.FilesKt`, where `File` extension methods are declared. */
+class FilesKt extends RefType {
+  FilesKt() { this.hasQualifiedName("kotlin.io", "FilesKt") }
+}

java/ql/lib/semmle/code/java/frameworks/kotlin/Text.qll

@@ -0,0 +1,21 @@
+/** Provides classes and predicates related to `kotlin.text`. */
+
+import java
+
+/** The type `kotlin.text.StringsKt`, where `String` extension methods are declared. */
+class StringsKt extends RefType {
+  StringsKt() { this.hasQualifiedName("kotlin.text", "StringsKt") }
+}
+
+/** A call to the extension method `String.toRegex` from `kotlin.text`. */
+class KtToRegex extends MethodAccess {
+  KtToRegex() {
+    this.getMethod().getDeclaringType() instanceof StringsKt and
+    this.getMethod().hasName("toRegex")
+  }
+
+  /** Gets the constant string value being converted to a regex by this call. */
+  string getExpressionString() {
+    result = this.getArgument(0).(CompileTimeConstantExpr).getStringValue()
+  }
+}

java/ql/lib/semmle/code/java/security/PathSanitizer.qll

@@ -4,6 +4,8 @@ import java
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.FlowSources
 private import semmle.code.java.dataflow.SSA
+private import semmle.code.java.frameworks.kotlin.IO
+private import semmle.code.java.frameworks.kotlin.Text
 
 /** A sanitizer that protects against path injection vulnerabilities. */
 abstract class PathInjectionSanitizer extends DataFlow::Node { }
@@ -50,12 +52,14 @@ private predicate exactPathMatchGuard(Guard g, Expr e, boolean branch) {
     t instanceof TypeUri or
     t instanceof TypePath or
     t instanceof TypeFile or
-    t.hasQualifiedName("android.net", "Uri")
+    t.hasQualifiedName("android.net", "Uri") or
+    t instanceof StringsKt or
+    t instanceof FilesKt
   |
+    e = getVisualQualifier(ma).getUnderlyingExpr() and
     ma.getMethod().getDeclaringType() = t and
     ma = g and
-    ma.getMethod().getName() = ["equals", "equalsIgnoreCase"] and
-    e = ma.getQualifier() and
+    getSourceMethod(ma.getMethod()).hasName(["equals", "equalsIgnoreCase"]) and
     branch = true
   )
 }
@@ -86,7 +90,7 @@ private class AllowedPrefixGuard extends PathGuard instanceof MethodAccess {
     not isDisallowedWord(super.getAnArgument())
   }
 
-  override Expr getCheckedExpr() { result = super.getQualifier() }
+  override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() }
 }
 
 /**
@@ -153,7 +157,7 @@ private class BlockListGuard extends PathGuard instanceof MethodAccess {
     isDisallowedWord(super.getAnArgument())
   }
 
-  override Expr getCheckedExpr() { result = super.getQualifier() }
+  override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() }
 }
 
 /**
@@ -187,15 +191,31 @@ private class BlockListSanitizer extends PathInjectionSanitizer {
   }
 }
 
+private class ConstantOrRegex extends Expr {
+  ConstantOrRegex() {
+    this instanceof CompileTimeConstantExpr or
+    this instanceof KtToRegex
+  }
+
+  string getStringValue() {
+    result = this.(CompileTimeConstantExpr).getStringValue() or
+    result = this.(KtToRegex).getExpressionString()
+  }
+}
+
 private predicate isStringPrefixMatch(MethodAccess ma) {
-  exists(Method m | m = ma.getMethod() and m.getDeclaringType() instanceof TypeString |
-    m.hasName("startsWith")
+  exists(Method m, RefType t |
+    m.getDeclaringType() = t and
+    (t instanceof TypeString or t instanceof StringsKt) and
+    m = ma.getMethod()
+  |
+    getSourceMethod(m).hasName("startsWith")
     or
-    m.hasName("regionMatches") and
-    ma.getArgument(0).(CompileTimeConstantExpr).getIntValue() = 0
+    getSourceMethod(m).hasName("regionMatches") and
+    getVisualArgument(ma, 0).(CompileTimeConstantExpr).getIntValue() = 0
     or
     m.hasName("matches") and
-    not ma.getArgument(0).(CompileTimeConstantExpr).getStringValue().matches(".*%")
+    not getVisualArgument(ma, 0).(ConstantOrRegex).getStringValue().matches(".*%")
   )
 }
 
@@ -205,52 +225,52 @@ private predicate isStringPrefixMatch(MethodAccess ma) {
 private predicate isStringPartialMatch(MethodAccess ma) {
   isStringPrefixMatch(ma)
   or
-  ma.getMethod().getDeclaringType() instanceof TypeString and
-  ma.getMethod().hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"])
+  exists(RefType t | t = ma.getMethod().getDeclaringType() |
+    t instanceof TypeString or t instanceof StringsKt
+  ) and
+  getSourceMethod(ma.getMethod())
+      .hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"])
 }
 
 /**
  * Holds if `ma` is a call to a method that checks whether a path starts with a prefix.
  */
 private predicate isPathPrefixMatch(MethodAccess ma) {
-  exists(RefType t |
-    t instanceof TypePath
-    or
-    t.hasQualifiedName("kotlin.io", "FilesKt")
-  |
-    t = ma.getMethod().getDeclaringType() and
-    ma.getMethod().hasName("startsWith")
-  )
+  exists(RefType t | t = ma.getMethod().getDeclaringType() |
+    t instanceof TypePath or t instanceof FilesKt
+  ) and
+  getSourceMethod(ma.getMethod()).hasName("startsWith")
 }
 
-private predicate isDisallowedWord(CompileTimeConstantExpr word) {
+private predicate isDisallowedWord(ConstantOrRegex word) {
   word.getStringValue().matches(["/", "\\", "%WEB-INF%", "%/data%"])
 }
 
 /** A complementary guard that protects against path traversal, by looking for the literal `..`. */
 private class PathTraversalGuard extends PathGuard {
+  Expr checkedExpr;
+
   PathTraversalGuard() {
-    exists(MethodAccess ma |
-      ma.getMethod().getDeclaringType() instanceof TypeString and
+    exists(MethodAccess ma, Method m, RefType t |
+      m = ma.getMethod() and
+      t = m.getDeclaringType() and
+      (t instanceof TypeString or t instanceof StringsKt) and
+      checkedExpr = getVisualQualifier(ma).getUnderlyingExpr() and
       ma.getAnArgument().(CompileTimeConstantExpr).getStringValue() = ".."
     |
       this = ma and
-      ma.getMethod().hasName("contains")
+      getSourceMethod(m).hasName("contains")
       or
       exists(EqualityTest eq |
         this = eq and
-        ma.getMethod().hasName(["indexOf", "lastIndexOf"]) and
+        getSourceMethod(m).hasName(["indexOf", "lastIndexOf"]) and
         eq.getAnOperand() = ma and
         eq.getAnOperand().(CompileTimeConstantExpr).getIntValue() = -1
       )
     )
   }
 
-  override Expr getCheckedExpr() {
-    exists(MethodAccess ma | ma = this.(EqualityTest).getAnOperand() or ma = this |
-      result = ma.getQualifier()
-    )
-  }
+  override Expr getCheckedExpr() { result = checkedExpr }
 
   boolean getBranch() {
     this instanceof MethodAccess and result = false
@@ -262,15 +282,46 @@ private class PathTraversalGuard extends PathGuard {
 /** A complementary sanitizer that protects against path traversal using path normalization. */
 private class PathNormalizeSanitizer extends MethodAccess {
   PathNormalizeSanitizer() {
-    exists(RefType t |
-      t instanceof TypePath or
-      t.hasQualifiedName("kotlin.io", "FilesKt")
-    |
-      this.getMethod().getDeclaringType() = t and
+    exists(RefType t | this.getMethod().getDeclaringType() = t |
+      (t instanceof TypePath or t instanceof FilesKt) and
       this.getMethod().hasName("normalize")
+      or
+      t instanceof TypeFile and
+      this.getMethod().hasName(["getCanonicalPath", "getCanonicalFile"])
     )
-    or
-    this.getMethod().getDeclaringType() instanceof TypeFile and
-    this.getMethod().hasName(["getCanonicalPath", "getCanonicalFile"])
   }
 }
+
+/**
+ * Gets the qualifier of `ma` as seen in the source code.
+ * This is a helper predicate to solve discrepancies between
+ * what `getQualifier` actually gets in Java and Kotlin.
+ */
+private Expr getVisualQualifier(MethodAccess ma) {
+  if getSourceMethod(ma.getMethod()) instanceof ExtensionMethod
+  then result = ma.getArgument(0)
+  else result = ma.getQualifier()
+}
+
+/**
+ * Gets the argument of `ma` at position `argPos` as seen in the source code.
+ * This is a helper predicate to solve discrepancies between
+ * what `getArgument` actually gets in Java and Kotlin.
+ */
+bindingset[argPos]
+private Argument getVisualArgument(MethodAccess ma, int argPos) {
+  if getSourceMethod(ma.getMethod()) instanceof ExtensionMethod
+  then result = ma.getArgument(argPos + 1)
+  else result = ma.getArgument(argPos)
+}
+
+/**
+ * Gets the proxied method if `m` is a Kotlin proxy that supplies default parameter values.
+ * Otherwise, just gets `m`.
+ */
+private Method getSourceMethod(Method m) {
+  m = result.getKotlinParameterDefaultsProxy()
+  or
+  not exists(Method src | m = src.getKotlinParameterDefaultsProxy()) and
+  result = m
+}

java/ql/test/library-tests/pathsanitizer/Test.java

@@ -279,7 +279,7 @@ public class Test {
     }
 
     private void blockListGuardValidation(String path) throws Exception {
-        if (path.contains("..") || !path.startsWith("/data"))
+        if (path.contains("..") || path.startsWith("/data"))
             throw new Exception();
     }
 

java/ql/test/library-tests/pathsanitizer/TestKt.kt

@@ -0,0 +1,499 @@
+import java.io.File
+import java.net.URI
+import java.nio.file.Path
+import java.nio.file.Paths
+import android.net.Uri
+
+class TestKt {
+    fun source(): Any? {
+        return null
+    }
+
+    fun sink(o: Any?) {}
+
+    @Throws(Exception::class)
+    private fun exactPathMatchGuardValidation(path: String?) {
+        if (!path.equals("/safe/path")) throw Exception()
+    }
+
+    @Throws(Exception::class)
+    fun exactPathMatchGuard() {
+        run {
+            val source = source() as String?
+            if (source!!.equals("/safe/path"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as URI?
+            if (source!!.equals(URI("http://safe/uri")))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as File?
+            if (source!!.equals(File("/safe/file")))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as Uri?
+            if (source!!.equals(Uri.parse("http://safe/uri")))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            exactPathMatchGuardValidation(source)
+            sink(source) // Safe
+        }
+    }
+
+    @Throws(Exception::class)
+    private fun allowListGuardValidation(path: String?) {
+        if (path!!.contains("..") || !path.startsWith("/safe")) throw Exception()
+    }
+
+    @Throws(Exception::class)
+    fun allowListGuard() {
+        // Prefix check by itself is not enough
+        run {
+            val source = source() as String?
+            if (source!!.startsWith("/safe")) {
+                sink(source) // $ hasTaintFlow
+            } else
+                sink(source) // $ hasTaintFlow
+        }
+        // PathTraversalGuard + allowListGuard
+        run {
+            val source = source() as String?
+            if (!source!!.contains("..") && source.startsWith("/safe"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.indexOf("..") == -1 && source.startsWith("/safe"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.lastIndexOf("..") == -1 && source.startsWith("/safe"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        // PathTraversalSanitizer + allowListGuard
+        run {
+            val source: File? = source() as File?
+            val normalized: String = source!!.canonicalPath
+            if (normalized.startsWith("/safe")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source: File? = source() as File?
+            val normalized: File = source!!.canonicalFile
+            if (normalized.startsWith("/safe")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source: File? = source() as File?
+            val normalized: String = source!!.canonicalFile.toString()
+            if (normalized.startsWith("/safe")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            val normalized: Path = Paths.get(source).normalize()
+            if (normalized.startsWith("/safe")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.startsWith("/safe")) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.regionMatches(0, "/safe", 0, 5)) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.matches("/safe/.*".toRegex())) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        // validation method
+        run {
+            val source = source() as String?
+            allowListGuardValidation(source)
+            sink(source) // Safe
+        }
+        // PathInjectionSanitizer + partial string match is considered unsafe
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.contains("/safe")) {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.regionMatches(1, "/safe", 0, 5)) {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (normalized.matches(".*/safe/.*".toRegex())) {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+    }
+
+    @Throws(Exception::class)
+    private fun dotDotCheckGuardValidation(path: String?) {
+        if (!path!!.startsWith("/safe") || path.contains("..")) throw Exception()
+    }
+
+    @Throws(Exception::class)
+    fun dotDotCheckGuard() {
+        // dot dot check by itself is not enough
+        run {
+            val source = source() as String?
+            if (!source!!.contains("..")) {
+                sink(source) // $ hasTaintFlow
+            } else
+                sink(source) // $ hasTaintFlow
+        }
+        // allowListGuard + dotDotCheckGuard
+        run {
+            val source = source() as String?
+            if (source!!.startsWith("/safe") && !source.contains(".."))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.startsWith("/safe") && source.indexOf("..") == -1)
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (!source!!.startsWith("/safe") || source.indexOf("..") != -1)
+                sink(source) // $ hasTaintFlow
+            else
+                sink(source) // Safe
+        }
+        run {
+            val source = source() as String?
+            if (source!!.startsWith("/safe") && source.lastIndexOf("..") == -1)
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        // blockListGuard + dotDotCheckGuard
+        run {
+            val source = source() as String?
+            if (!source!!.startsWith("/data") && !source.contains(".."))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (!source!!.startsWith("/data") && source.indexOf("..") == -1)
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.startsWith("/data") || source.indexOf("..") != -1)
+                sink(source) // $ hasTaintFlow
+            else
+                sink(source) // Safe
+        }
+        run {
+            val source = source() as String?
+            if (!source!!.startsWith("/data") && source.lastIndexOf("..") == -1)
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        // validation method
+        run {
+            val source = source() as String?
+            dotDotCheckGuardValidation(source)
+            sink(source) // Safe
+        }
+    }
+
+    @Throws(Exception::class)
+    private fun blockListGuardValidation(path: String?) {
+        if (path!!.contains("..") || path.startsWith("/data")) throw Exception()
+    }
+
+    @Throws(Exception::class)
+    fun blockListGuard() {
+        // Prefix check by itself is not enough
+        run {
+            val source = source() as String?
+            if (!source!!.startsWith("/data")) {
+                sink(source) // $ hasTaintFlow
+            } else
+                sink(source) // $ hasTaintFlow
+        }
+        // PathTraversalGuard + blockListGuard
+        run {
+            val source = source() as String?
+            if (!source!!.contains("..") && !source.startsWith("/data"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.indexOf("..") == -1 && !source.startsWith("/data"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        run {
+            val source = source() as String?
+            if (source!!.lastIndexOf("..") == -1 && !source.startsWith("/data"))
+                sink(source) // Safe
+            else
+                sink(source) // $ hasTaintFlow
+        }
+        // PathTraversalSanitizer + blockListGuard
+        run {
+            val source: File? = source() as File?
+            val normalized: String = source!!.canonicalPath
+            if (!normalized.startsWith("/data")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source: File? = source() as File?
+            val normalized: File = source!!.canonicalFile
+            if (!normalized.startsWith("/data")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source: File? = source() as File?
+            val normalized: String = source!!.canonicalFile.toString()
+            if (!normalized.startsWith("/data")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            val normalized: Path = Paths.get(source).normalize()
+            if (!normalized.startsWith("/data")) {
+                sink(source) // Safe
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.startsWith("/data")) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+           // normalize().toString() gets extracted as Object.toString, stopping taint here
+             val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.regionMatches(0, "/data", 0, 5)) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.matches("/data/.*".toRegex())) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        // validation method
+        run {
+            val source = source() as String?
+            blockListGuardValidation(source)
+            sink(source) // Safe
+        }
+        // PathInjectionSanitizer + partial string match with disallowed words
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.contains("/")) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.regionMatches(1, "/", 0, 5)) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.matches("/".toRegex())) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        // PathInjectionSanitizer + partial string match with disallowed prefixes
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.contains("/data")) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.regionMatches(1, "/data", 0, 5)) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+        run {
+            val source = source() as String?
+            // normalize().toString() gets extracted as Object.toString, stopping taint here
+            val normalized: String = Paths.get(source).normalize().toString()
+            if (!normalized.matches(".*/data/.*".toRegex())) {
+                sink(source) // $ SPURIOUS: hasTaintFlow
+                sink(normalized) // Safe
+            } else {
+                sink(source) // $ hasTaintFlow
+                sink(normalized) // $ MISSING: hasTaintFlow
+            }
+        }
+    }
+}

java/ql/test/library-tests/pathsanitizer/options

@@ -1 +1,2 @@
 //semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/google-android-9.0.0
+//codeql-extractor-kotlin-options: ${testdir}/../../stubs/google-android-9.0.0