hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Autoformat ExposeRepresentation, revealing likely bug.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2018-10-11 10:14:20 +02:00
parent 236c79b561
commit 6a8a27201e
1 changed files with 32 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
View File

@@ -11,11 +11,13 @@
* modularity
* external/cwe/cwe-485
*/
import java
import semmle.code.java.dataflow.DefUse
predicate relevantType(RefType t) {
t instanceof Array or
t instanceof Array
or
exists(RefType sup | sup = t.getASupertype*().getSourceDeclaration() |
sup.hasQualifiedName("java.util", "Map") or
sup.hasQualifiedName("java.util", "Collection")
@@ -23,12 +25,18 @@ predicate relevantType(RefType t) {
}
predicate modifyMethod(Method m) {
relevantType(m.getDeclaringType()) and (
m.hasName("add") or m.hasName("addAll") or
m.hasName("put") or m.hasName("putAll") or
m.hasName("push") or m.hasName("pop") or
m.hasName("remove") or m.hasName("removeAll") or
m.hasName("clear") or m.hasName("set")
relevantType(m.getDeclaringType()) and
(
m.hasName("add") or
m.hasName("addAll") or
m.hasName("put") or
m.hasName("putAll") or
m.hasName("push") or
m.hasName("pop") or
m.hasName("remove") or
m.hasName("removeAll") or
m.hasName("clear") or
m.hasName("set")
)
}
@@ -47,25 +55,25 @@ predicate returnsArray(Callable c, Field f) {
}
predicate mayWriteToArray(Expr modified) {
writesToArray(modified) or
writesToArray(modified)
or
// x = __y__; x[0] = 1;
exists(AssignExpr e, LocalVariableDecl v | e.getDest() = v.getAnAccess() |
modified = e.getSource() and
mayWriteToArray(v.getAnAccess())
) or
)
or
// int[] x = __y__; x[0] = 1;
exists(LocalVariableDeclExpr e, Variable v | e.getVariable() = v |
modified = e.getInit() and
mayWriteToArray(v.getAnAccess())
) or
)
or
// return __array__; ... method()[1] = 0
exists(ReturnStmt rs | modified = rs.getResult() and relevantType(modified.getType()) |
exists(Callable enclosing, MethodAccess ma |
enclosing = rs.getEnclosingCallable() and ma.getMethod() = enclosing
|
|
mayWriteToArray(ma)
)
)
@@ -73,10 +81,9 @@ predicate mayWriteToArray(Expr modified) {
predicate writesToArray(Expr array) {
relevantType(array.getType()) and
(
exists(Assignment a, ArrayAccess access | a.getDest() = access | access.getArray() = array)) or
exists(MethodAccess ma | ma.getQualifier() = array | modifyMethod(ma.getMethod())
)
(exists(Assignment a, ArrayAccess access | a.getDest() = access | access.getArray() = array))
or
exists(MethodAccess ma | ma.getQualifier() = array | modifyMethod(ma.getMethod()))
}
VarAccess modificationAfter(VarAccess v) {
@@ -85,14 +92,14 @@ VarAccess modificationAfter(VarAccess v) {
}
VarAccess varPassedInto(Callable c, int i) {
exists(Call call | call.getCallee() = c |
call.getArgument(i) = result
)
exists(Call call | call.getCallee() = c | call.getArgument(i) = result)
}
predicate exposesByReturn(Callable c, Field f, Expr why, string whyText) {
returnsArray(c, f) and
exists(MethodAccess ma | ma.getMethod() = c and ma.getCompilationUnit() != c.getCompilationUnit() |
exists(MethodAccess ma |
ma.getMethod() = c and ma.getCompilationUnit() != c.getCompilationUnit()
|
mayWriteToArray(ma) and
why = ma and
whyText = "after this call to " + c.getName()
@@ -113,6 +120,6 @@ from Callable c, Field f, Expr why, string whyText
where
exposesByReturn(c, f, why, whyText) or
exposesByStore(c, f, why, whyText)
select c, c.getName() + " exposes the internal representation stored in field " + f.getName() +
". The value may be modified $@.",
why.getLocation(), whyText
select c,
c.getName() + " exposes the internal representation stored in field " + f.getName() +
". The value may be modified $@.", why.getLocation(), whyText