Java: Merge TaintPreservingMethod with TaintTransferringMethod

This commit is contained in:
Joe Farebrother
2020-10-08 17:02:49 +01:00
parent a510f58865
commit 5d487b97da
4 changed files with 11 additions and 19 deletions

View File

@@ -32,31 +32,23 @@ class AdditionalTaintStep extends Unit {
}
/**
* A method that returns tainted data when one of its inputs (an argument or the qualifier) is tainted.
* A method that preserves taint.
*
* Extend this class to add additional taint steps through a method that should
* apply to all taint configurations.
* Extend this class and override at least one of `returnsTaint` or `transfersTaint`
* to add additional taint steps through a method that should apply to all taint configurations.
*/
abstract class TaintPreservingMethod extends Method {
/**
* Holds if this method returns tainted data when `arg` tainted.
* `arg` is a parameter index, or is -1 to indicate the qualifier.
*/
abstract predicate returnsTaint(int arg);
}
predicate returnsTaint(int arg) { none() }
/**
* A method that transfers taint from one of its inputs (an argument or the qualifier) to another.
*
* Extend this class to add additional taint steps through a method that should
* apply to all taint configurations.
*/
abstract class TaintTransferringMethod extends Method {
/**
* Holds if this method writes tainted data to `sink` when `src` is tainted.
* `src` and `sink` are parameter indices, or -1 to indicate the qualifier.
*/
abstract predicate transfersTaint(int src, int sink);
predicate transfersTaint(int src, int sink) { none() }
}
private class StringTaintPreservingMethod extends TaintPreservingMethod {

View File

@@ -296,7 +296,7 @@ private predicate taintPreservingQualifierToArgument(Method m, int arg) {
m.hasName("read") and
arg = 0
or
m.(TaintTransferringMethod).transfersTaint(-1, arg)
m.(TaintPreservingMethod).transfersTaint(-1, arg)
}
/** Access to a method that passes taint from the qualifier. */
@@ -571,7 +571,7 @@ private predicate taintPreservingArgToArg(Method method, int input, int output)
input = 0 and
output = 2
or
method.(TaintTransferringMethod).transfersTaint(input, output)
method.(TaintPreservingMethod).transfersTaint(input, output)
}
/**
@@ -610,7 +610,7 @@ private predicate taintPreservingArgumentToQualifier(Method method, int arg) {
append.getDeclaringType().hasQualifiedName("java.io", "StringWriter")
)
or
method.(TaintTransferringMethod).transfersTaint(arg, -1)
method.(TaintPreservingMethod).transfersTaint(arg, -1)
}
/** A comparison or equality test with a constant. */
@@ -734,7 +734,7 @@ private class TypeFormatter extends Class {
TypeFormatter() { this.hasQualifiedName("java.util", "Formatter") }
}
private class FormatterMethod extends TaintPreservingMethod, TaintTransferringMethod {
private class FormatterMethod extends TaintPreservingMethod {
FormatterMethod() {
getDeclaringType() instanceof TypeFormatter and
hasName(["format", "out", "toString"])

View File

@@ -256,7 +256,7 @@ private class QueryBuilderBuildMethod extends TaintPreservingMethod {
override predicate returnsTaint(int arg) { argument = arg }
}
private class QueryBuilderAppendMethod extends TaintTransferringMethod {
private class QueryBuilderAppendMethod extends TaintPreservingMethod {
QueryBuilderAppendMethod() {
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
// setProjectionMap(Map<String, String> columnMap)

View File

@@ -28,7 +28,7 @@ abstract class JacksonSerializableType extends Type { }
* A method used for serializing objects using Jackson. The final parameter is the object to be
* serialized.
*/
library class JacksonWriteValueMethod extends TaintPreservingMethod, TaintTransferringMethod {
library class JacksonWriteValueMethod extends TaintPreservingMethod {
JacksonWriteValueMethod() {
(
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectWriter") or