hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Support CharSequence#subSequence

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-08-16 15:23:03 +02:00
parent b7e608abc9
commit 3928ffd30d
3 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/src/semmle/code/java/frameworks/Strings.qll
View File

@@ -48,7 +48,8 @@ private class StringSummaryCsv extends SummaryModelCsv {
"java.lang;AbstractStringBuilder;true;toString;;;Argument[-1];ReturnValue;taint",
"java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint",
"java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint",
"java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint"
"java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint",
"java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint"
]
}
}

13
java/ql/test/library-tests/dataflow/taint/CharSeq.java Normal file
View File

@@ -0,0 +1,13 @@
public class CharSeq {
public static String taint() { return "tainted"; }
public static void sink(Object o) { }
void test1() {
CharSequence seq = taint().subSequence(0,1);
sink(seq);
CharSequence seqFromSeq = seq.subSequence(0, 1);
sink(seqFromSeq);
}
}

2
java/ql/test/library-tests/dataflow/taint/test.expected
View File

@@ -37,6 +37,8 @@
| B.java:15:21:15:27 | taint(...) | B.java:143:10:143:44 | toURL(...) |
| B.java:15:21:15:27 | taint(...) | B.java:146:10:146:37 | toPath(...) |
| B.java:15:21:15:27 | taint(...) | B.java:149:10:149:46 | toFile(...) |
| CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:8:12:8:14 | seq |
| CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:11:12:11:21 | seqFromSeq |
| MethodFlow.java:7:22:7:28 | taint(...) | MethodFlow.java:8:10:8:16 | tainted |
| MethodFlow.java:9:31:9:37 | taint(...) | MethodFlow.java:10:10:10:17 | tainted2 |
| MethodFlow.java:11:35:11:41 | taint(...) | MethodFlow.java:12:10:12:17 | tainted3 |