diff --git a/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll b/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll index 6a6d819ccf1..ea7983a6202 100644 --- a/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll +++ b/java/ql/src/semmle/code/java/frameworks/JavaxJson.qll @@ -24,6 +24,8 @@ private class FlowSummaries extends SummaryModelCsv { ".json;Json;false;createReader;;;Argument[0];ReturnValue;taint", ".json;Json;false;createValue;;;Argument[0];ReturnValue;taint", ".json;Json;false;createWriter;;;Argument[0];ReturnValue;taint", + ".json;Json;false;decodePointer;;;Argument[0];ReturnValue;taint", + ".json;Json;false;encodePointer;;;Argument[0];ReturnValue;taint", ".json;JsonArray;false;getBoolean;;;Argument[-1];ReturnValue;taint", ".json;JsonArray;false;getBoolean;;;Argument[1];ReturnValue;value", ".json;JsonArray;false;getInt;;;Argument[-1];ReturnValue;taint", diff --git a/java/ql/test/library-tests/frameworks/javax-json/Test.java b/java/ql/test/library-tests/frameworks/javax-json/Test.java index a4366387591..db659ee336c 100644 --- a/java/ql/test/library-tests/frameworks/javax-json/Test.java +++ b/java/ql/test/library-tests/frameworks/javax-json/Test.java @@ -223,6 +223,20 @@ public class Test { out = jakarta.json.Json.createWriter(in); sink(out); // $hasTaintFlow } + { + // "jakarta.json;Json;false;decodePointer;;;Argument[0];ReturnValue;taint" + String out = null; + String in = (String)source(); + out = jakarta.json.Json.decodePointer(in); + sink(out); // $hasTaintFlow + } + { + // "jakarta.json;Json;false;encodePointer;;;Argument[0];ReturnValue;taint" + String out = null; + String in = (String)source(); + out = jakarta.json.Json.encodePointer(in); + sink(out); // $hasTaintFlow + } { // "jakarta.json;JsonArray;false;getBoolean;;;Argument[-1];ReturnValue;taint" boolean out = false; @@ -1934,6 +1948,20 @@ public class Test { out = javax.json.Json.createWriter(in); sink(out); // $hasTaintFlow } + { + // "javax.json;Json;false;decodePointer;;;Argument[0];ReturnValue;taint" + String out = null; + String in = (String)source(); + out = javax.json.Json.decodePointer(in); + sink(out); // $hasTaintFlow + } + { + // "javax.json;Json;false;encodePointer;;;Argument[0];ReturnValue;taint" + String out = null; + String in = (String)source(); + out = javax.json.Json.encodePointer(in); + sink(out); // $hasTaintFlow + } { // "javax.json;JsonArray;false;getBoolean;;;Argument[-1];ReturnValue;taint" boolean out = false;