mirror of
https://github.com/github/codeql.git
synced 2026-02-28 21:03:50 +01:00
Java: Merge TaintPreservingMethod with TaintTransferringMethod
This commit is contained in:
@@ -32,31 +32,23 @@ class AdditionalTaintStep extends Unit {
|
||||
}
|
||||
|
||||
/**
|
||||
* A method that returns tainted data when one of its inputs (an argument or the qualifier) is tainted.
|
||||
* A method that preserves taint.
|
||||
*
|
||||
* Extend this class to add additional taint steps through a method that should
|
||||
* apply to all taint configurations.
|
||||
* Extend this class and override at least one of `returnsTaint` or `transfersTaint`
|
||||
* to add additional taint steps through a method that should apply to all taint configurations.
|
||||
*/
|
||||
abstract class TaintPreservingMethod extends Method {
|
||||
/**
|
||||
* Holds if this method returns tainted data when `arg` tainted.
|
||||
* `arg` is a parameter index, or is -1 to indicate the qualifier.
|
||||
*/
|
||||
abstract predicate returnsTaint(int arg);
|
||||
}
|
||||
predicate returnsTaint(int arg) { none() }
|
||||
|
||||
/**
|
||||
* A method that transfers taint from one of its inputs (an argument or the qualifier) to another.
|
||||
*
|
||||
* Extend this class to add additional taint steps through a method that should
|
||||
* apply to all taint configurations.
|
||||
*/
|
||||
abstract class TaintTransferringMethod extends Method {
|
||||
/**
|
||||
* Holds if this method writes tainted data to `sink` when `src` is tainted.
|
||||
* `src` and `sink` are parameter indices, or -1 to indicate the qualifier.
|
||||
*/
|
||||
abstract predicate transfersTaint(int src, int sink);
|
||||
predicate transfersTaint(int src, int sink) { none() }
|
||||
}
|
||||
|
||||
private class StringTaintPreservingMethod extends TaintPreservingMethod {
|
||||
|
||||
@@ -296,7 +296,7 @@ private predicate taintPreservingQualifierToArgument(Method m, int arg) {
|
||||
m.hasName("read") and
|
||||
arg = 0
|
||||
or
|
||||
m.(TaintTransferringMethod).transfersTaint(-1, arg)
|
||||
m.(TaintPreservingMethod).transfersTaint(-1, arg)
|
||||
}
|
||||
|
||||
/** Access to a method that passes taint from the qualifier. */
|
||||
@@ -571,7 +571,7 @@ private predicate taintPreservingArgToArg(Method method, int input, int output)
|
||||
input = 0 and
|
||||
output = 2
|
||||
or
|
||||
method.(TaintTransferringMethod).transfersTaint(input, output)
|
||||
method.(TaintPreservingMethod).transfersTaint(input, output)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -610,7 +610,7 @@ private predicate taintPreservingArgumentToQualifier(Method method, int arg) {
|
||||
append.getDeclaringType().hasQualifiedName("java.io", "StringWriter")
|
||||
)
|
||||
or
|
||||
method.(TaintTransferringMethod).transfersTaint(arg, -1)
|
||||
method.(TaintPreservingMethod).transfersTaint(arg, -1)
|
||||
}
|
||||
|
||||
/** A comparison or equality test with a constant. */
|
||||
@@ -734,7 +734,7 @@ private class TypeFormatter extends Class {
|
||||
TypeFormatter() { this.hasQualifiedName("java.util", "Formatter") }
|
||||
}
|
||||
|
||||
private class FormatterMethod extends TaintPreservingMethod, TaintTransferringMethod {
|
||||
private class FormatterMethod extends TaintPreservingMethod {
|
||||
FormatterMethod() {
|
||||
getDeclaringType() instanceof TypeFormatter and
|
||||
hasName(["format", "out", "toString"])
|
||||
|
||||
@@ -256,7 +256,7 @@ private class QueryBuilderBuildMethod extends TaintPreservingMethod {
|
||||
override predicate returnsTaint(int arg) { argument = arg }
|
||||
}
|
||||
|
||||
private class QueryBuilderAppendMethod extends TaintTransferringMethod {
|
||||
private class QueryBuilderAppendMethod extends TaintPreservingMethod {
|
||||
QueryBuilderAppendMethod() {
|
||||
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
|
||||
// setProjectionMap(Map<String, String> columnMap)
|
||||
|
||||
@@ -28,7 +28,7 @@ abstract class JacksonSerializableType extends Type { }
|
||||
* A method used for serializing objects using Jackson. The final parameter is the object to be
|
||||
* serialized.
|
||||
*/
|
||||
library class JacksonWriteValueMethod extends TaintPreservingMethod, TaintTransferringMethod {
|
||||
library class JacksonWriteValueMethod extends TaintPreservingMethod {
|
||||
JacksonWriteValueMethod() {
|
||||
(
|
||||
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectWriter") or
|
||||
|
||||
Reference in New Issue
Block a user