From 34572ea63940b7df99ef2cd7a3ea2e1424db2d9d Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Mon, 1 May 2023 14:35:30 +0200 Subject: [PATCH] Java: Update existing tests and add a couple of extra configuration tests. --- .../default-parameter-mad-flow/test.ext.yml | 10 ++--- .../experimental/configured-flow/Test.qll | 12 ++++++ .../configured-flow/codeql-pack.yml | 9 ----- .../{test.expected => test-all.expected} | 0 .../threat-models.yml => test-all.ext.yml} | 0 .../experimental/configured-flow/test-all.ql | 16 ++++++++ .../configured-flow/test-remote.expected | 11 +++++ .../configured-flow/test-remote.ext.yml | 7 ++++ .../configured-flow/test-remote.ql | 16 ++++++++ .../configured-flow/test-sql.expected | 19 +++++++++ .../configured-flow/test-sql.ext.yml | 7 ++++ .../experimental/configured-flow/test-sql.ql | 16 ++++++++ .../test/experimental/configured-flow/test.ql | 40 ------------------- .../dataflow/external-models/srcs.ext.yml | 34 ++++++++-------- 14 files changed, 126 insertions(+), 71 deletions(-) create mode 100644 java/ql/test/experimental/configured-flow/Test.qll delete mode 100644 java/ql/test/experimental/configured-flow/codeql-pack.yml rename java/ql/test/experimental/configured-flow/{test.expected => test-all.expected} (100%) rename java/ql/test/experimental/configured-flow/{ext/threat-models.yml => test-all.ext.yml} (100%) create mode 100644 java/ql/test/experimental/configured-flow/test-all.ql create mode 100644 java/ql/test/experimental/configured-flow/test-remote.expected create mode 100644 java/ql/test/experimental/configured-flow/test-remote.ext.yml create mode 100644 java/ql/test/experimental/configured-flow/test-remote.ql create mode 100644 java/ql/test/experimental/configured-flow/test-sql.expected create mode 100644 java/ql/test/experimental/configured-flow/test-sql.ext.yml create mode 100644 java/ql/test/experimental/configured-flow/test-sql.ql delete mode 100644 java/ql/test/experimental/configured-flow/test.ql diff --git a/java/ql/integration-tests/all-platforms/kotlin/default-parameter-mad-flow/test.ext.yml b/java/ql/integration-tests/all-platforms/kotlin/default-parameter-mad-flow/test.ext.yml index 0ffc8f55394..695532246c8 100644 --- a/java/ql/integration-tests/all-platforms/kotlin/default-parameter-mad-flow/test.ext.yml +++ b/java/ql/integration-tests/all-platforms/kotlin/default-parameter-mad-flow/test.ext.yml @@ -27,8 +27,8 @@ extensions: - ["", "SinkClass", True, "memberSink", "(int,int)", "", "Argument[0]", "kotlinMadFlowTest", "manual"] - ["", "SinkClass", True, "extensionMemberSink", "(String,int,int)", "", "Argument[1]", "kotlinMadFlowTest", "manual"] - - addsTo: - pack: codeql/java-all - extensible: supportedThreatModel - data: - - ["kotlinMadFlowTest"] + # - addsTo: + # pack: codeql/java-all + # extensible: supportedThreatModel + # data: + # - ["kotlinMadFlowTest"] diff --git a/java/ql/test/experimental/configured-flow/Test.qll b/java/ql/test/experimental/configured-flow/Test.qll new file mode 100644 index 00000000000..24751f93026 --- /dev/null +++ b/java/ql/test/experimental/configured-flow/Test.qll @@ -0,0 +1,12 @@ +private import java +private import semmle.code.java.dataflow.DataFlow +private import semmle.code.java.dataflow.ExternalFlow +private import semmle.code.java.dataflow.TaintTracking + +private module ThreatModelConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sourceNode(source, _) } + + predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) } +} + +module ThreatModel = TaintTracking::Global; diff --git a/java/ql/test/experimental/configured-flow/codeql-pack.yml b/java/ql/test/experimental/configured-flow/codeql-pack.yml deleted file mode 100644 index 516153eceab..00000000000 --- a/java/ql/test/experimental/configured-flow/codeql-pack.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: test/configured-threat-models -version: 0.0.0 -dependencies: - codeql/java-all: "*" - -dataExtensions: - - ext/*.yml - -extractor: java diff --git a/java/ql/test/experimental/configured-flow/test.expected b/java/ql/test/experimental/configured-flow/test-all.expected similarity index 100% rename from java/ql/test/experimental/configured-flow/test.expected rename to java/ql/test/experimental/configured-flow/test-all.expected diff --git a/java/ql/test/experimental/configured-flow/ext/threat-models.yml b/java/ql/test/experimental/configured-flow/test-all.ext.yml similarity index 100% rename from java/ql/test/experimental/configured-flow/ext/threat-models.yml rename to java/ql/test/experimental/configured-flow/test-all.ext.yml diff --git a/java/ql/test/experimental/configured-flow/test-all.ql b/java/ql/test/experimental/configured-flow/test-all.ql new file mode 100644 index 00000000000..c4ee0e04568 --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-all.ql @@ -0,0 +1,16 @@ +/** + * @name Testing the threat model + * @kind path-problem + * @problem.severity warning + * @precision low + * @id java/threat-model-all + * @tags security + */ + +import Test +import ThreatModel::PathGraph + +from ThreatModel::PathNode source, ThreatModel::PathNode sink +where ThreatModel::flowPath(source, sink) +select sink.getNode(), source, sink, "This is some kind of threat model thingy $@.", + source.getNode(), "Source of that thingy" diff --git a/java/ql/test/experimental/configured-flow/test-remote.expected b/java/ql/test/experimental/configured-flow/test-remote.expected new file mode 100644 index 00000000000..1fbc50d266d --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-remote.expected @@ -0,0 +1,11 @@ +edges +| Test.java:15:15:15:42 | read(...) : Number | Test.java:18:34:18:36 | val | +| Test.java:15:15:15:42 | read(...) : Number | Test.java:21:29:21:68 | ... + ... | +nodes +| Test.java:15:15:15:42 | read(...) : Number | semmle.label | read(...) : Number | +| Test.java:18:34:18:36 | val | semmle.label | val | +| Test.java:21:29:21:68 | ... + ... | semmle.label | ... + ... | +subpaths +#select +| Test.java:18:34:18:36 | val | Test.java:15:15:15:42 | read(...) : Number | Test.java:18:34:18:36 | val | This is some kind of threat model thingy $@. | Test.java:15:15:15:42 | read(...) | Source of that thingy | +| Test.java:21:29:21:68 | ... + ... | Test.java:15:15:15:42 | read(...) : Number | Test.java:21:29:21:68 | ... + ... | This is some kind of threat model thingy $@. | Test.java:15:15:15:42 | read(...) | Source of that thingy | diff --git a/java/ql/test/experimental/configured-flow/test-remote.ext.yml b/java/ql/test/experimental/configured-flow/test-remote.ext.yml new file mode 100644 index 00000000000..64f76d8ac79 --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-remote.ext.yml @@ -0,0 +1,7 @@ +extensions: + + - addsTo: + pack: codeql/java-all + extensible: supportedThreatModel + data: + - ["remote"] diff --git a/java/ql/test/experimental/configured-flow/test-remote.ql b/java/ql/test/experimental/configured-flow/test-remote.ql new file mode 100644 index 00000000000..88711f64815 --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-remote.ql @@ -0,0 +1,16 @@ +/** + * @name Testing the threat model + * @kind path-problem + * @problem.severity warning + * @precision low + * @id java/threat-model-remote + * @tags security + */ + +import Test +import ThreatModel::PathGraph + +from ThreatModel::PathNode source, ThreatModel::PathNode sink +where ThreatModel::flowPath(source, sink) +select sink.getNode(), source, sink, "This is some kind of threat model thingy $@.", + source.getNode(), "Source of that thingy" diff --git a/java/ql/test/experimental/configured-flow/test-sql.expected b/java/ql/test/experimental/configured-flow/test-sql.expected new file mode 100644 index 00000000000..c5e68242c5a --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-sql.expected @@ -0,0 +1,19 @@ +edges +| Test.java:12:20:12:61 | executeQuery(...) : ResultSet | Test.java:24:59:24:60 | rs : ResultSet | +| Test.java:12:20:12:61 | executeQuery(...) : ResultSet | Test.java:26:34:26:35 | rs : ResultSet | +| Test.java:24:59:24:60 | rs : ResultSet | Test.java:24:59:24:78 | getString(...) : String | +| Test.java:24:59:24:78 | getString(...) : String | Test.java:24:29:24:85 | ... + ... | +| Test.java:26:34:26:35 | rs : ResultSet | Test.java:26:34:26:53 | getString(...) : String | +| Test.java:26:34:26:53 | getString(...) : String | Test.java:26:34:26:64 | getBytes(...) | +nodes +| Test.java:12:20:12:61 | executeQuery(...) : ResultSet | semmle.label | executeQuery(...) : ResultSet | +| Test.java:24:29:24:85 | ... + ... | semmle.label | ... + ... | +| Test.java:24:59:24:60 | rs : ResultSet | semmle.label | rs : ResultSet | +| Test.java:24:59:24:78 | getString(...) : String | semmle.label | getString(...) : String | +| Test.java:26:34:26:35 | rs : ResultSet | semmle.label | rs : ResultSet | +| Test.java:26:34:26:53 | getString(...) : String | semmle.label | getString(...) : String | +| Test.java:26:34:26:64 | getBytes(...) | semmle.label | getBytes(...) | +subpaths +#select +| Test.java:24:29:24:85 | ... + ... | Test.java:12:20:12:61 | executeQuery(...) : ResultSet | Test.java:24:29:24:85 | ... + ... | This is some kind of threat model thingy $@. | Test.java:12:20:12:61 | executeQuery(...) | Source of that thingy | +| Test.java:26:34:26:64 | getBytes(...) | Test.java:12:20:12:61 | executeQuery(...) : ResultSet | Test.java:26:34:26:64 | getBytes(...) | This is some kind of threat model thingy $@. | Test.java:12:20:12:61 | executeQuery(...) | Source of that thingy | diff --git a/java/ql/test/experimental/configured-flow/test-sql.ext.yml b/java/ql/test/experimental/configured-flow/test-sql.ext.yml new file mode 100644 index 00000000000..5849ebb063a --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-sql.ext.yml @@ -0,0 +1,7 @@ +extensions: + + - addsTo: + pack: codeql/java-all + extensible: supportedThreatModel + data: + - ["sql"] diff --git a/java/ql/test/experimental/configured-flow/test-sql.ql b/java/ql/test/experimental/configured-flow/test-sql.ql new file mode 100644 index 00000000000..b8968f093e6 --- /dev/null +++ b/java/ql/test/experimental/configured-flow/test-sql.ql @@ -0,0 +1,16 @@ +/** + * @name Testing the threat model + * @kind path-problem + * @problem.severity warning + * @precision low + * @id java/threat-model-sql + * @tags security + */ + +import Test +import ThreatModel::PathGraph + +from ThreatModel::PathNode source, ThreatModel::PathNode sink +where ThreatModel::flowPath(source, sink) +select sink.getNode(), source, sink, "This is some kind of threat model thingy $@.", + source.getNode(), "Source of that thingy" diff --git a/java/ql/test/experimental/configured-flow/test.ql b/java/ql/test/experimental/configured-flow/test.ql deleted file mode 100644 index cfdb114d8f5..00000000000 --- a/java/ql/test/experimental/configured-flow/test.ql +++ /dev/null @@ -1,40 +0,0 @@ -/** - * @name Testing the threat model - * @kind path-problem - * @problem.severity warning - * @precision low - * @id java/threat-model - * @tags security - */ - -import java -import semmle.code.java.dataflow.DataFlow -import semmle.code.java.dataflow.ExternalFlow -import ThreatModel::PathGraph -import semmle.code.java.dataflow.TaintTracking - -private module ThreatModelConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { - sourceNode(source, _) - } - - predicate isSink(DataFlow::Node sink) { - sinkNode(sink, _) - } -} - -module ThreatModel = TaintTracking::Global; - -from ThreatModel::PathNode source, ThreatModel::PathNode sink -where ThreatModel::flowPath(source, sink) -select sink.getNode(), source, sink, "This is some kind of threat model thingy $@.", source.getNode(), - "Source of that thingy" - -// from DataFlow::Node source, DataFlow::Node sink -// where ThreatModel::flow(source, sink) -// select source, sink - - -// from DataFlow::Node node, string kind -// where sourceNode(node, kind) -// select node, kind diff --git a/java/ql/test/library-tests/dataflow/external-models/srcs.ext.yml b/java/ql/test/library-tests/dataflow/external-models/srcs.ext.yml index c9ff7ec31f9..b9b9fb2ec14 100644 --- a/java/ql/test/library-tests/dataflow/external-models/srcs.ext.yml +++ b/java/ql/test/library-tests/dataflow/external-models/srcs.ext.yml @@ -20,20 +20,20 @@ extensions: - ["my.qltest", "A", False, "srcTwoArg", "(String,String)", "", "ReturnValue", "qltest-shortsig", "manual"] - ["my.qltest", "A", False, "srcTwoArg", "(java.lang.String,java.lang.String)", "", "ReturnValue", "qltest-longsig", "manual"] - - addsTo: - pack: codeql/java-all - extensible: supportedThreatModel - data: - - ["standard"] - - ["qltest"] - - ["qltest-alt"] - - ["qltest-w-subtypes"] - - ["qltest-argany"] - - ["qltest-all-overloads"] - - ["qltest-argnum"] - - ["qltest-retval"] - - ["qltest-param"] - - ["qltest-nospec"] - - ["qltest-shortsig"] - - ["qltest-longsig"] - - ["qltest-param-override"] + # - addsTo: + # pack: codeql/java-all + # extensible: supportedThreatModel + # data: + # - ["standard"] + # - ["qltest"] + # - ["qltest-alt"] + # - ["qltest-w-subtypes"] + # - ["qltest-argany"] + # - ["qltest-all-overloads"] + # - ["qltest-argnum"] + # - ["qltest-retval"] + # - ["qltest-param"] + # - ["qltest-nospec"] + # - ["qltest-shortsig"] + # - ["qltest-longsig"] + # - ["qltest-param-override"]