mirror of
https://github.com/github/codeql.git
synced 2026-05-04 05:05:12 +02:00
Merge branch 'github:main' into amammad-python-WebAppsConstatntSecretKeys
This commit is contained in:
amammad
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The `ExecCallable` class in `ExternalProcess.qll` has been deprecated.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added a missing summary model for the method `java.net.URL.toString`.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added automatically-generated dataflow models for `javax.portlet`.
|
||||
6
java/ql/lib/ext/experimental/com.jcraft.jsch.model.yml
Normal file
6
java/ql/lib/ext/experimental/com.jcraft.jsch.model.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: experimentalSinkModel
|
||||
data:
|
||||
- ["com.jcraft.jsch", "ChannelExec", True, "setCommand", "", "", "Argument[0]", "command-injection", "manual", "jsch-os-injection"]
|
||||
190
java/ql/lib/ext/generated/javax.portlet.model.yml
Normal file
190
java/ql/lib/ext/generated/javax.portlet.model.yml
Normal file
@@ -0,0 +1,190 @@
|
||||
# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
|
||||
# Definitions of models for the Java Portlet framework.
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: summaryModel
|
||||
data:
|
||||
- ["javax.portlet.filter", "ActionRequestWrapper", true, "ActionRequestWrapper", "(ActionRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ActionRequestWrapper", true, "setRequest", "(ActionRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ActionResponseWrapper", true, "ActionResponseWrapper", "(ActionResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ActionResponseWrapper", true, "setResponse", "(ActionResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "EventRequestWrapper", true, "EventRequestWrapper", "(EventRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "EventRequestWrapper", true, "setRequest", "(EventRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "EventResponseWrapper", true, "EventResponseWrapper", "(EventResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "EventResponseWrapper", true, "setResponse", "(EventResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletRequestWrapper", true, "PortletRequestWrapper", "(PortletRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletRequestWrapper", true, "getRequest", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletRequestWrapper", true, "setRequest", "(PortletRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletResponseWrapper", true, "PortletResponseWrapper", "(PortletResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletResponseWrapper", true, "getResponse", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "PortletResponseWrapper", true, "setResponse", "(PortletResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "RenderRequestWrapper", true, "RenderRequestWrapper", "(RenderRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "RenderRequestWrapper", true, "setRequest", "(RenderRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "RenderResponseWrapper", true, "RenderResponseWrapper", "(RenderResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "RenderResponseWrapper", true, "setResponse", "(RenderResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ResourceRequestWrapper", true, "ResourceRequestWrapper", "(ResourceRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ResourceRequestWrapper", true, "setRequest", "(ResourceRequest)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ResourceResponseWrapper", true, "ResourceResponseWrapper", "(ResourceResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet.filter", "ResourceResponseWrapper", true, "setResponse", "(ResourceResponse)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "GenericPortlet", true, "getPortletConfig", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "Portlet", true, "init", "(PortletConfig)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletException", true, "PortletException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletException", true, "PortletException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletException", true, "PortletException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletMode", true, "PortletMode", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletMode", true, "toString", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(String,PortletMode)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(String,PortletMode)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(String,Throwable,PortletMode)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(String,Throwable,PortletMode)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(String,Throwable,PortletMode)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "PortletModeException", "(Throwable,PortletMode)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletModeException", true, "getMode", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletSecurityException", true, "PortletSecurityException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletSecurityException", true, "PortletSecurityException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletSecurityException", true, "PortletSecurityException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "PortletSessionUtil", true, "decodeAttributeName", "(String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ReadOnlyException", true, "ReadOnlyException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ReadOnlyException", true, "ReadOnlyException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ReadOnlyException", true, "ReadOnlyException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "UnavailableException", true, "UnavailableException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "UnavailableException", true, "UnavailableException", "(String,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(String,Collection)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(String,Collection)", "", "Argument[1].Element", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(String,Throwable,Collection)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(String,Throwable,Collection)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(String,Throwable,Collection)", "", "Argument[2].Element", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "ValidatorException", "(Throwable,Collection)", "", "Argument[1].Element", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "ValidatorException", true, "getFailedKeys", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowState", true, "WindowState", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowState", true, "toString", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(String,Throwable,WindowState)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(String,Throwable,WindowState)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(String,Throwable,WindowState)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(String,WindowState)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(String,WindowState)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "WindowStateException", "(Throwable,WindowState)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["javax.portlet", "WindowStateException", true, "getState", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"]
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: neutralModel
|
||||
data:
|
||||
- ["javax.portlet", "ActionResponse", "sendRedirect", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ActionResponse", "sendRedirect", "(String,String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getCharacterEncoding", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getContentLength", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getContentType", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getMethod", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getPortletInputStream", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "getReader", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ClientDataRequest", "setCharacterEncoding", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "EventPortlet", "processEvent", "(EventRequest,EventResponse)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "EventRequest", "getEvent", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "EventRequest", "getMethod", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "EventResponse", "setRenderParameters", "(EventRequest)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "GenericPortlet", "init", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "createActionURL", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "createRenderURL", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "createResourceURL", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "flushBuffer", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getBufferSize", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getCacheControl", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getCharacterEncoding", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getContentType", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getLocale", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getPortletOutputStream", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "getWriter", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "isCommitted", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "reset", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "resetBuffer", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "setBufferSize", "(int)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "MimeResponse", "setContentType", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "Portlet", "destroy", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "Portlet", "processAction", "(ActionRequest,ActionResponse)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "Portlet", "render", "(RenderRequest,RenderResponse)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getContainerRuntimeOptions", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getDefaultNamespace", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getInitParameter", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getInitParameterNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getPortletContext", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getPortletName", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getProcessingEventQNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getPublicRenderParameterNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getPublishingEventQNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getResourceBundle", "(Locale)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletConfig", "getSupportedLocales", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletException", "PortletException", "(Throwable)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest$P3PUserInfos", "toString", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getAttribute", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getAttributeNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getAuthType", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getContextPath", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getCookies", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getLocale", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getLocales", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getParameter", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getParameterMap", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getParameterNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getParameterValues", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPortalContext", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPortletMode", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPortletSession", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPortletSession", "(boolean)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPreferences", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPrivateParameterMap", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getProperties", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getProperty", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPropertyNames", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getPublicParameterMap", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getRemoteUser", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getRequestedSessionId", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getResponseContentType", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getResponseContentTypes", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getScheme", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getServerName", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getServerPort", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getUserPrincipal", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getWindowID", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "getWindowState", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "isPortletModeAllowed", "(PortletMode)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "isRequestedSessionIdValid", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "isSecure", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "isUserInRole", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "isWindowStateAllowed", "(WindowState)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "removeAttribute", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletRequest", "setAttribute", "(String,Object)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "addProperty", "(Cookie)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "addProperty", "(String,Element)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "addProperty", "(String,String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "createElement", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "encodeURL", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "getNamespace", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletResponse", "setProperty", "(String,String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletSecurityException", "PortletSecurityException", "(Throwable)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "PortletSessionUtil", "decodeScope", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ReadOnlyException", "ReadOnlyException", "(Throwable)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "RenderRequest", "getETag", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "RenderResponse", "setNextPossiblePortletModes", "(Collection)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "RenderResponse", "setTitle", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceRequest", "getCacheability", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceRequest", "getETag", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceRequest", "getPrivateRenderParameterMap", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceRequest", "getResourceID", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceResponse", "setCharacterEncoding", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceResponse", "setContentLength", "(int)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceResponse", "setLocale", "(Locale)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "ResourceServingPortlet", "serveResource", "(ResourceRequest,ResourceResponse)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "getPortletMode", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "getRenderParameterMap", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "getWindowState", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "removePublicRenderParameter", "(String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setEvent", "(QName,Serializable)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setEvent", "(String,Serializable)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setPortletMode", "(PortletMode)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setRenderParameter", "(String,String)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setRenderParameter", "(String,String[])", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setRenderParameters", "(Map)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "StateAwareResponse", "setWindowState", "(WindowState)", "summary", "df-generated"]
|
||||
- ["javax.portlet", "UnavailableException", "getUnavailableSeconds", "()", "summary", "df-generated"]
|
||||
- ["javax.portlet", "UnavailableException", "isPermanent", "()", "summary", "df-generated"]
|
||||
1695
java/ql/lib/ext/generated/org.apache.commons.lang.model.yml
Normal file
1695
java/ql/lib/ext/generated/org.apache.commons.lang.model.yml
Normal file
File diff suppressed because it is too large
Load Diff
@@ -8,30 +8,30 @@ extensions:
|
||||
- ["java.lang", "ClassLoader", True, "getSystemResource", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
|
||||
- ["java.lang", "ClassLoader", True, "getSystemResourceAsStream", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
|
||||
- ["java.lang", "Module", True, "getResourceAsStream", "(String)", "", "Argument[0]", "path-injection", "ai-manual"]
|
||||
- ["java.lang", "ProcessBuilder", False, "command", "(List)", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["java.lang", "ProcessBuilder", False, "command", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "ProcessBuilder", False, "directory", "(File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "ProcessBuilder", False, "ProcessBuilder", "(List)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "ProcessBuilder", False, "ProcessBuilder", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String[],String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String[],String[],File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String[],String[],File)", "", "Argument[2]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String,String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String,String[],File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "Runtime", True, "exec", "(String,String[],File)", "", "Argument[2]", "command-injection", "ai-manual"]
|
||||
# These are potential vulnerabilities, but not for command-injection. No query for this kind of vulnerability currently exists.
|
||||
# - ["java.lang", "Runtime", False, "load", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", False, "loadLibrary", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# These are modeled in plain CodeQL. TODO: migrate them.
|
||||
# - ["java.lang", "ProcessBuilder", False, "command", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "ProcessBuilder", False, "directory", "(File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "ProcessBuilder", False, "ProcessBuilder", "(List)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "ProcessBuilder", False, "ProcessBuilder", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String,String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String[],String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String,String[],File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String,String[],File)", "", "Argument[2]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String[],String[],File)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String[],String[],File)", "", "Argument[2]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "Runtime", True, "exec", "(String[])", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "String", False, "matches", "(String)", "", "Argument[0]", "regex-use[f-1]", "manual"]
|
||||
- ["java.lang", "String", False, "replaceAll", "(String,String)", "", "Argument[0]", "regex-use[-1]", "manual"]
|
||||
- ["java.lang", "String", False, "replaceFirst", "(String,String)", "", "Argument[0]", "regex-use[-1]", "manual"]
|
||||
- ["java.lang", "String", False, "split", "(String)", "", "Argument[0]", "regex-use[-1]", "manual"]
|
||||
- ["java.lang", "String", False, "split", "(String,int)", "", "Argument[0]", "regex-use[-1]", "manual"]
|
||||
# These are modeled in plain CodeQL. TODO: migrate them.
|
||||
# - ["java.lang", "System", False, "load", "(String)", "", "Argument[0]", "command-injection", "ai-manual"] # This is actually injecting a library.
|
||||
# - ["java.lang", "System", False, "loadLibrary", "(String)", "", "Argument[0]", "command-injection", "ai-manual"] # This is actually injecting a library.
|
||||
# These are potential vulnerabilities, but not for command-injection. No query for this kind of vulnerability currently exists.
|
||||
# - ["java.lang", "System", False, "load", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
# - ["java.lang", "System", False, "loadLibrary", "(String)", "", "Argument[0]", "command-injection", "ai-manual"]
|
||||
- ["java.lang", "System$Logger", True, "log", "(Level,Object)", "", "Argument[1]", "log-injection", "manual"]
|
||||
- ["java.lang", "System$Logger", True, "log", "(Level,ResourceBundle,String,Object[])", "", "Argument[2..3]", "log-injection", "manual"]
|
||||
- ["java.lang", "System$Logger", True, "log", "(Level,ResourceBundle,String,Throwable)", "", "Argument[2]", "log-injection", "manual"]
|
||||
|
||||
@@ -45,7 +45,8 @@ extensions:
|
||||
- ["java.net", "URI", False, "toURL", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
|
||||
- ["java.net", "URL", False, "URL", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
|
||||
- ["java.net", "URL", False, "URL", "(URL,String)", "", "Argument[0]", "Argument[this]", "taint", "ai-manual"]
|
||||
- ["java.net", "URL", False, "URL", "(URL,String)", "", "Argument[1]", "Argument[this]", "taint", "ai-manual"] # @atorralba: review for consistency
|
||||
- ["java.net", "URL", False, "URL", "(URL,String)", "", "Argument[1]", "Argument[this]", "taint", "ai-manual"]
|
||||
- ["java.net", "URL", False, "toExternalForm", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
|
||||
- ["java.net", "URL", False, "toURI", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
|
||||
- ["java.net", "URL", False, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
|
||||
- ["java.net", "URLDecoder", False, "decode", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
|
||||
|
||||
11
java/ql/lib/ext/org.apache.commons.exec.model.yml
Normal file
11
java/ql/lib/ext/org.apache.commons.exec.model.yml
Normal file
@@ -0,0 +1,11 @@
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: sinkModel
|
||||
data:
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "parse", "(String)", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "parse", "(String,Map)", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "addArguments", "(String)", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "addArguments", "(String,boolean)", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "addArguments", "(String[])", "", "Argument[0]", "command-injection", "manual"]
|
||||
- ["org.apache.commons.exec", "CommandLine", True, "addArguments", "(String[],boolean)", "", "Argument[0]", "command-injection", "manual"]
|
||||
@@ -199,18 +199,18 @@ class TypeFile extends Class {
|
||||
|
||||
// --- Standard methods ---
|
||||
/**
|
||||
* Any constructor of class `java.lang.ProcessBuilder`.
|
||||
* DEPRECATED: Any constructor of class `java.lang.ProcessBuilder`.
|
||||
*/
|
||||
class ProcessBuilderConstructor extends Constructor, ExecCallable {
|
||||
deprecated class ProcessBuilderConstructor extends Constructor, ExecCallable {
|
||||
ProcessBuilderConstructor() { this.getDeclaringType() instanceof TypeProcessBuilder }
|
||||
|
||||
override int getAnExecutedArgument() { result = 0 }
|
||||
}
|
||||
|
||||
/**
|
||||
* Any of the methods named `command` on class `java.lang.ProcessBuilder`.
|
||||
* DEPRECATED: Any of the methods named `command` on class `java.lang.ProcessBuilder`.
|
||||
*/
|
||||
class MethodProcessBuilderCommand extends Method, ExecCallable {
|
||||
deprecated class MethodProcessBuilderCommand extends Method, ExecCallable {
|
||||
MethodProcessBuilderCommand() {
|
||||
this.hasName("command") and
|
||||
this.getDeclaringType() instanceof TypeProcessBuilder
|
||||
@@ -220,9 +220,9 @@ class MethodProcessBuilderCommand extends Method, ExecCallable {
|
||||
}
|
||||
|
||||
/**
|
||||
* Any method named `exec` on class `java.lang.Runtime`.
|
||||
* DEPRECATED: Any method named `exec` on class `java.lang.Runtime`.
|
||||
*/
|
||||
class MethodRuntimeExec extends Method, ExecCallable {
|
||||
deprecated class MethodRuntimeExec extends Method, ExecCallable {
|
||||
MethodRuntimeExec() {
|
||||
this.hasName("exec") and
|
||||
this.getDeclaringType() instanceof TypeRuntime
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
/** Definitions related to the Apache Commons Exec library. */
|
||||
|
||||
import semmle.code.java.Type
|
||||
import semmle.code.java.security.ExternalProcess
|
||||
|
||||
/** The class `org.apache.commons.exec.CommandLine`. */
|
||||
private class TypeCommandLine extends Class {
|
||||
TypeCommandLine() { this.hasQualifiedName("org.apache.commons.exec", "CommandLine") }
|
||||
}
|
||||
|
||||
/** The `parse()` method of the class `org.apache.commons.exec.CommandLine`. */
|
||||
private class MethodCommandLineParse extends Method, ExecCallable {
|
||||
MethodCommandLineParse() {
|
||||
this.getDeclaringType() instanceof TypeCommandLine and
|
||||
this.hasName("parse")
|
||||
}
|
||||
|
||||
override int getAnExecutedArgument() { result = 0 }
|
||||
}
|
||||
|
||||
/** The `addArguments()` method of the class `org.apache.commons.exec.CommandLine`. */
|
||||
private class MethodCommandLineAddArguments extends Method, ExecCallable {
|
||||
MethodCommandLineAddArguments() {
|
||||
this.getDeclaringType() instanceof TypeCommandLine and
|
||||
this.hasName("addArguments")
|
||||
}
|
||||
|
||||
override int getAnExecutedArgument() { result = 0 }
|
||||
}
|
||||
@@ -10,8 +10,8 @@
|
||||
import java
|
||||
private import semmle.code.java.dataflow.FlowSources
|
||||
private import semmle.code.java.dataflow.ExternalFlow
|
||||
private import semmle.code.java.security.ExternalProcess
|
||||
private import semmle.code.java.security.CommandArguments
|
||||
private import semmle.code.java.security.ExternalProcess
|
||||
|
||||
/** A sink for command injection vulnerabilities. */
|
||||
abstract class CommandInjectionSink extends DataFlow::Node { }
|
||||
@@ -33,9 +33,7 @@ class CommandInjectionAdditionalTaintStep extends Unit {
|
||||
}
|
||||
|
||||
private class DefaultCommandInjectionSink extends CommandInjectionSink {
|
||||
DefaultCommandInjectionSink() {
|
||||
this.asExpr() instanceof ArgumentToExec or sinkNode(this, "command-injection")
|
||||
}
|
||||
DefaultCommandInjectionSink() { sinkNode(this, "command-injection") }
|
||||
}
|
||||
|
||||
private class DefaultCommandInjectionSanitizer extends CommandInjectionSanitizer {
|
||||
@@ -100,7 +98,7 @@ predicate execIsTainted(
|
||||
RemoteUserInputToArgumentToExecFlow::PathNode sink, Expr execArg
|
||||
) {
|
||||
RemoteUserInputToArgumentToExecFlow::flowPath(source, sink) and
|
||||
sink.getNode().asExpr() = execArg
|
||||
argumentToExec(execArg, sink.getNode())
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -112,7 +110,7 @@ predicate execIsTainted(
|
||||
*/
|
||||
deprecated predicate execTainted(DataFlow::PathNode source, DataFlow::PathNode sink, Expr execArg) {
|
||||
exists(RemoteUserInputToArgumentToExecFlowConfig conf |
|
||||
conf.hasFlowPath(source, sink) and sink.getNode().asExpr() = execArg
|
||||
conf.hasFlowPath(source, sink) and argumentToExec(execArg, sink.getNode())
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -1,16 +1,13 @@
|
||||
/** Definitions related to external processes. */
|
||||
|
||||
import semmle.code.java.Member
|
||||
|
||||
private module Instances {
|
||||
private import semmle.code.java.JDK
|
||||
private import semmle.code.java.frameworks.apache.Exec
|
||||
}
|
||||
private import semmle.code.java.dataflow.DataFlow
|
||||
private import semmle.code.java.security.CommandLineQuery
|
||||
|
||||
/**
|
||||
* A callable that executes a command.
|
||||
* DEPRECATED: A callable that executes a command.
|
||||
*/
|
||||
abstract class ExecCallable extends Callable {
|
||||
abstract deprecated class ExecCallable extends Callable {
|
||||
/**
|
||||
* Gets the index of an argument that will be part of the command that is executed.
|
||||
*/
|
||||
@@ -23,13 +20,19 @@ abstract class ExecCallable extends Callable {
|
||||
* to be executed.
|
||||
*/
|
||||
class ArgumentToExec extends Expr {
|
||||
ArgumentToExec() {
|
||||
exists(Call execCall, ExecCallable execCallable, int i |
|
||||
execCall.getArgument(pragma[only_bind_into](i)) = this and
|
||||
execCallable = execCall.getCallee() and
|
||||
i = execCallable.getAnExecutedArgument()
|
||||
)
|
||||
}
|
||||
ArgumentToExec() { argumentToExec(this, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `e` is an expression used as an argument to a call that executes an external command.
|
||||
* For calls to varargs method calls, this only includes the first argument, which will be the command
|
||||
* to be executed.
|
||||
*/
|
||||
predicate argumentToExec(Expr e, CommandInjectionSink s) {
|
||||
s.asExpr() = e
|
||||
or
|
||||
e.(Argument).isNthVararg(0) and
|
||||
s.(DataFlow::ImplicitVarargsArray).getCall() = e.(Argument).getCall()
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user