hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-28 02:08:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

Further simplification

Browse Source
This commit is contained in:
Tony Torralba
2022-12-07 10:50:23 +01:00
parent ccd465d669
commit 6dcc0cc188
1 changed files with 13 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
java/ql/lib/semmle/code/java/security/PathSanitizer.qll
View File

@@ -86,18 +86,12 @@ private predicate localTaintFlowToPathGuard(Expr e, PathGuard g) {
}
private class AllowedPrefixGuard extends PathGuard instanceof MethodAccess {
Expr checkedExpr;
AllowedPrefixGuard() {
(
isStringPrefixMatch(this, checkedExpr)
or
isPathPrefixMatch(this, checkedExpr)
) and
(isStringPrefixMatch(this) or isPathPrefixMatch(this)) and
not isDisallowedWord(super.getAnArgument())
}
override Expr getCheckedExpr() { result = checkedExpr }
override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() }
}
/**
@@ -159,18 +153,12 @@ private class DotDotCheckSanitizer extends PathInjectionSanitizer {
}
private class BlockListGuard extends PathGuard instanceof MethodAccess {
Expr checkedExpr;
BlockListGuard() {
(
isStringPartialMatch(this, checkedExpr)
or
isPathPrefixMatch(this, checkedExpr)
) and
(isStringPartialMatch(this) or isPathPrefixMatch(this)) and
isDisallowedWord(super.getAnArgument())
}
override Expr getCheckedExpr() { result = checkedExpr }
override Expr getCheckedExpr() { result = getVisualQualifier(this).getUnderlyingExpr() }
}
/**
@@ -216,12 +204,11 @@ private class ConstantOrRegex extends Expr {
}
}
private predicate isStringPrefixMatch(MethodAccess ma, Expr checkedExpr) {
private predicate isStringPrefixMatch(MethodAccess ma) {
exists(Method m, RefType t |
m.getDeclaringType() = t and
(t instanceof TypeString or t instanceof StringsKt) and
m = ma.getMethod() and
checkedExpr = getVisualQualifier(ma).getUnderlyingExpr()
m = ma.getMethod()
|
getSourceMethod(m).hasName("startsWith")
or
@@ -234,28 +221,26 @@ private predicate isStringPrefixMatch(MethodAccess ma, Expr checkedExpr) {
}
/**
* Holds if `ma` is a call to a method that checks a partial string match on `checkedExpr`.
* Holds if `ma` is a call to a method that checks a partial string match.
*/
private predicate isStringPartialMatch(MethodAccess ma, Expr checkedExpr) {
isStringPrefixMatch(ma, checkedExpr)
private predicate isStringPartialMatch(MethodAccess ma) {
isStringPrefixMatch(ma)
or
exists(RefType t | t = ma.getMethod().getDeclaringType() |
t instanceof TypeString or t instanceof StringsKt
) and
getSourceMethod(ma.getMethod())
.hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"]) and
checkedExpr = getVisualQualifier(ma).getUnderlyingExpr()
.hasName(["contains", "matches", "regionMatches", "indexOf", "lastIndexOf"])
}
/**
* Holds if `ma` is a call to a method that checks whether `checkedExpr` starts with a prefix.
* Holds if `ma` is a call to a method that checks whether a path starts with a prefix.
*/
private predicate isPathPrefixMatch(MethodAccess ma, Expr checkedExpr) {
private predicate isPathPrefixMatch(MethodAccess ma) {
exists(RefType t | t = ma.getMethod().getDeclaringType() |
t instanceof TypePath or t instanceof FilesKt
) and
getSourceMethod(ma.getMethod()).hasName("startsWith") and
checkedExpr = getVisualQualifier(ma)
getSourceMethod(ma.getMethod()).hasName("startsWith")
}
private predicate isDisallowedWord(ConstantOrRegex word) {