hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add unit tests

Browse Source
This commit is contained in:
Joe Farebrother
2021-02-10 17:28:49 +00:00
parent da6e9492a0
commit 5bba7f6df7
14 changed files with 576 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
java/ql/test/library-tests/frameworks/apache-http/A.java Normal file
View File

@@ -0,0 +1,41 @@
import org.apache.http.*;
import org.apache.http.protocol.*;
import org.apache.http.util.*;
import org.apache.http.entity.*;
class A {
static Object taint() { return null; }
static void sink(Object o) { }
class Test1 implements HttpRequestHandler {
public void handle(HttpRequest req, HttpResponse res, HttpContext ctx) {
A.sink(req.getRequestLine());
A.sink(req.getRequestLine().getUri());
A.sink(req.getRequestLine().getMethod());
A.sink(req.getAllHeaders());
HeaderIterator it = req.headerIterator();
A.sink(it.next());
A.sink(it.nextHeader());
Header h = req.getHeaders("abc")[3];
A.sink(h.getName());
A.sink(h.getValue());
HeaderElement el = h.getElements()[0];
A.sink(el.getName());
A.sink(el.getValue());
A.sink(el.getParameters());
A.sink(el.getParameterByName("abc").getValue());
A.sink(el.getParameter(0).getName());
HttpEntity ent = ((HttpEntityEnclosingRequest)req).getEntity();
A.sink(ent.getContent());
A.sink(ent.getContentEncoding());
A.sink(ent.getContentType());
A.sink(EntityUtils.toString(ent));
A.sink(EntityUtils.toByteArray(ent));
A.sink(EntityUtils.getContentCharSet(ent));
A.sink(EntityUtils.getContentMimeType(ent));
res.setEntity(new StringEntity("<a href='" + req.getRequestLine().getUri() + "'>a</a>"));
EntityUtils.updateEntity(res, new ByteArrayEntity(EntityUtils.toByteArray(ent)));
}
}
}

23
java/ql/test/library-tests/frameworks/apache-http/flow.expected Normal file
View File

@@ -0,0 +1,23 @@
| A.java:12:28:12:42 | req | A.java:13:20:13:39 | getRequestLine(...) |
| A.java:12:28:12:42 | req | A.java:14:20:14:48 | getUri(...) |
| A.java:12:28:12:42 | req | A.java:15:20:15:51 | getMethod(...) |
| A.java:12:28:12:42 | req | A.java:16:20:16:38 | getAllHeaders(...) |
| A.java:12:28:12:42 | req | A.java:18:20:18:28 | next(...) |
| A.java:12:28:12:42 | req | A.java:19:20:19:34 | nextHeader(...) |
| A.java:12:28:12:42 | req | A.java:21:20:21:30 | getName(...) |
| A.java:12:28:12:42 | req | A.java:22:20:22:31 | getValue(...) |
| A.java:12:28:12:42 | req | A.java:24:20:24:31 | getName(...) |
| A.java:12:28:12:42 | req | A.java:25:20:25:32 | getValue(...) |
| A.java:12:28:12:42 | req | A.java:26:20:26:37 | getParameters(...) |
| A.java:12:28:12:42 | req | A.java:27:20:27:58 | getValue(...) |
| A.java:12:28:12:42 | req | A.java:28:20:28:47 | getName(...) |
| A.java:12:28:12:42 | req | A.java:30:20:30:35 | getContent(...) |
| A.java:12:28:12:42 | req | A.java:31:20:31:43 | getContentEncoding(...) |
| A.java:12:28:12:42 | req | A.java:32:20:32:39 | getContentType(...) |
| A.java:12:28:12:42 | req | A.java:33:20:33:44 | toString(...) |
| A.java:12:28:12:42 | req | A.java:34:20:34:47 | toByteArray(...) |
| A.java:12:28:12:42 | req | A.java:35:20:35:53 | getContentCharSet(...) |
| A.java:12:28:12:42 | req | A.java:36:20:36:54 | getContentMimeType(...) |
| A.java:12:28:12:42 | req | A.java:37:27:37:99 | new StringEntity(...) |
| A.java:12:28:12:42 | req | A.java:38:43:38:91 | new ByteArrayEntity(...) |
| A.java:30:20:30:35 | getContent(...) | A.java:30:20:30:35 | getContent(...) |

24
java/ql/test/library-tests/frameworks/apache-http/flow.ql Normal file
View File

@@ -0,0 +1,24 @@
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.XSS
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest:frameworks:apache-http" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("taint")
or
n instanceof RemoteFlowSource
}
override predicate isSink(DataFlow::Node n) {
exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
or
n instanceof XssSink
}
}
from DataFlow::Node src, DataFlow::Node sink, Conf conf
where conf.hasFlow(src, sink)
select src, sink

1
java/ql/test/library-tests/frameworks/apache-http/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-http-4.4.13

37
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/Header.java
View File

@@ -1,8 +1,4 @@
/*
* $HeadURL: http://svn.apache.org/repos/asf/httpcomponents/httpcore/trunk/module-main/src/main/java/org/apache/http/Header.java $
* $Revision: 569636 $
* $Date: 2007-08-25 00:34:47 -0700 (Sat, 25 Aug 2007) $
*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
@@ -33,38 +29,25 @@ package org.apache.http;
/**
* Represents an HTTP header field.
*
* <p>
* The HTTP header fields follow the same generic format as that given in
* Section 3.1 of RFC 822. Each header field consists of a name followed by a
* colon (":") and the field value. Field names are case-insensitive. The field
* value MAY be preceded by any amount of LWS, though a single SP is preferred.
*
* <pre>
* <p>The HTTP header fields follow the same generic format as
* that given in Section 3.1 of RFC 822. Each header field consists
* of a name followed by a colon (":") and the field value. Field names
* are case-insensitive. The field value MAY be preceded by any amount
* of LWS, though a single SP is preferred.
*
*<pre>
* message-header = field-name ":" [ field-value ]
* field-name = token
* field-value = *( field-content | LWS )
* field-content = &lt;the OCTETs making up the field-value
* and consisting of either *TEXT or combinations
* of token, separators, and quoted-string&gt;
* </pre>
*
* @author <a href="mailto:remm@apache.org">Remy Maucherat</a>
* @author <a href="mailto:oleg at ural.ru">Oleg Kalnichevski</a>
* @version $Revision: 569636 $
*</pre>
*
* @deprecated Please use {@link java.net.URL#openConnection} instead. Please
* visit <a href=
* "http://android-developers.blogspot.com/2011/09/androids-http-clients.html">this
* webpage</a> for further details.
* @since 4.0
*/
@Deprecated
public interface Header {
String getName();
String getValue();
public interface Header extends NameValuePair {
HeaderElement[] getElements() throws ParseException;
}

55
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/HttpResponse.java Normal file
View File

@@ -0,0 +1,55 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http;
import java.util.Locale;
public interface HttpResponse extends HttpMessage {
// StatusLine getStatusLine();
// void setStatusLine(StatusLine statusline);
// void setStatusLine(ProtocolVersion ver, int code);
// void setStatusLine(ProtocolVersion ver, int code, String reason);
void setStatusCode(int code)
throws IllegalStateException;
void setReasonPhrase(String reason)
throws IllegalStateException;
HttpEntity getEntity();
void setEntity(HttpEntity entity);
Locale getLocale();
void setLocale(Locale loc);
}

74
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/AbstractHttpEntity.java Normal file
View File

@@ -0,0 +1,74 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.entity;
import java.io.IOException;
import org.apache.http.HttpEntity;
import org.apache.http.Header;
public abstract class AbstractHttpEntity implements HttpEntity {
@Override
public Header getContentType() {
return null;
}
@Override
public Header getContentEncoding() {
return null;
}
@Override
public boolean isChunked() {
return false;
}
public void setContentType(final Header contentType) {
}
public void setContentType(final String ctString) {
}
public void setContentEncoding(final Header contentEncoding) {
}
public void setContentEncoding(final String ceString) {
}
public void setChunked(final boolean b) {
}
@Override
public void consumeContent() throws IOException {
}
@Override
public String toString() {
return null;
}
}

78
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/ByteArrayEntity.java Normal file
View File

@@ -0,0 +1,78 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.entity;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
public class ByteArrayEntity extends AbstractHttpEntity implements Cloneable {
public ByteArrayEntity(final byte[] b, final ContentType contentType) {
}
public ByteArrayEntity(final byte[] b, final int off, final int len, final ContentType contentType) {
}
public ByteArrayEntity(final byte[] b) {
}
public ByteArrayEntity(final byte[] b, final int off, final int len) {
}
@Override
public boolean isRepeatable() {
return false;
}
@Override
public long getContentLength() {
return 0;
}
@Override
public InputStream getContent() {
return null;
}
@Override
public void writeTo(final OutputStream outStream) throws IOException {
}
@Override
public boolean isStreaming() {
return false;
}
@Override
public Object clone() throws CloneNotSupportedException {
return null;
}
}

35
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/ContentType.java Normal file
View File

@@ -0,0 +1,35 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.entity;
import java.io.Serializable;
public final class ContentType implements Serializable {
}

87
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/entity/StringEntity.java Normal file
View File

@@ -0,0 +1,87 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.entity;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.UnsupportedEncodingException;
import java.nio.charset.Charset;
import java.nio.charset.UnsupportedCharsetException;
public class StringEntity extends AbstractHttpEntity implements Cloneable {
public StringEntity(final String string, final ContentType contentType) throws UnsupportedCharsetException {
}
public StringEntity(
final String string, final String mimeType, final String charset) throws UnsupportedEncodingException {
}
public StringEntity(final String string, final String charset)
throws UnsupportedCharsetException {
}
public StringEntity(final String string, final Charset charset) {
}
public StringEntity(final String string)
throws UnsupportedEncodingException {
}
@Override
public boolean isRepeatable() {
return false;
}
@Override
public long getContentLength() {
return 0;
}
@Override
public InputStream getContent() throws IOException {
return null;
}
@Override
public void writeTo(final OutputStream outStream) throws IOException {
}
@Override
public boolean isStreaming() {
return false;
}
@Override
public Object clone() throws CloneNotSupportedException {
return null;
}
}

37
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/protocol/HttpContext.java Normal file
View File

@@ -0,0 +1,37 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.protocol;
public interface HttpContext {
Object getAttribute(String id);
void setAttribute(String id, Object obj);
Object removeAttribute(String id);
}

38
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/protocol/HttpRequestHandler.java Normal file
View File

@@ -0,0 +1,38 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.protocol;
import java.io.IOException;
import org.apache.http.HttpRequest;
import org.apache.http.HttpResponse;
public interface HttpRequestHandler {
void handle(HttpRequest request, HttpResponse response, HttpContext context)
throws IOException;
}

72
java/ql/test/stubs/apache-http-4.4.13/org/apache/http/util/EntityUtils.java Normal file
View File

@@ -0,0 +1,72 @@
/*
* ====================================================================
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*
*/
package org.apache.http.util;
import java.io.IOException;
import java.nio.charset.Charset;
import org.apache.http.*;
public final class EntityUtils {
public static void consumeQuietly(final HttpEntity entity) {
}
public static void consume(final HttpEntity entity) throws IOException {
}
public static void updateEntity(
final HttpResponse response, final HttpEntity entity) throws IOException {
}
public static byte[] toByteArray(final HttpEntity entity) throws IOException {
return null;
}
public static String getContentCharSet(final HttpEntity entity) {
return null;
}
public static String getContentMimeType(final HttpEntity entity) {
return null;
}
public static String toString(
final HttpEntity entity, final Charset defaultCharset) throws IOException {
return null;
}
public static String toString(
final HttpEntity entity, final String defaultCharset) throws IOException {
return null;
}
public static String toString(final HttpEntity entity) throws IOException, ParseException {
return null;
}
}