hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5487 from joefarebrother/sql-sinks

Browse Source 
Java: Convert SQL sinks to CSV format
This commit is contained in:
Anders Schack-Mulligen
2021-07-02 10:51:09 +02:00
committed by GitHub
parent 61ee193dc0 1e82c607ef
commit 80124df78e
14 changed files with 428 additions and 726 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
java/ql/test/library-tests/frameworks/android/taint-database/FlowSteps.java
View File

@@ -27,155 +27,160 @@ public class FlowSteps {
}
public static String[] appendSelectionArgs() {
String[] originalValues = taint();
String[] newValues = taint();
String[] originalValues = {taint()}; // $ MISSING: taintReachesReturn
String[] newValues = {taint()}; // $ MISSING: taintReachesReturn
return DatabaseUtils.appendSelectionArgs(originalValues, newValues);
}
public static String concatenateWhere() {
String a = taint();
String b = taint();
String a = taint(); // $taintReachesReturn
String b = taint(); // $taintReachesReturn
return DatabaseUtils.concatenateWhere(a, b);
}
public static String buildQueryString(MySQLiteQueryBuilder target) {
target = taint();
boolean distinct = taint();
String tables = taint();
String[] columns = taint();
String where = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
boolean distinct = taint();
String tables = taint(); // $taintReachesReturn
String[] columns = {taint()}; // $ MISSING: taintReachesReturn
String where = taint(); // $taintReachesReturn
String groupBy = taint(); // $taintReachesReturn
String having = taint(); // $taintReachesReturn
String orderBy = taint(); // $taintReachesReturn
String limit = taint(); // $taintReachesReturn
return SQLiteQueryBuilder.buildQueryString(distinct, tables, columns, where, groupBy, having, orderBy, limit);
}
public static String buildQuery(MySQLiteQueryBuilder target) {
target = taint();
String[] projectionIn = taint();
String selection = taint();
String groupBy = taint();
String having = taint();
String sortOrder = taint();
String limit = taint();
target = taint(); // $taintReachesReturn
String[] projectionIn = {taint()};// $ MISSING: taintReachesReturn
String selection = taint(); // $taintReachesReturn
String groupBy = taint(); // $taintReachesReturn
String having = taint(); // $taintReachesReturn
String sortOrder = taint(); // $taintReachesReturn
String limit = taint(); // $taintReachesReturn
return target.buildQuery(projectionIn, selection, groupBy, having, sortOrder, limit);
}
public static String buildQuery2(MySQLiteQueryBuilder target) {
target = taint();
String[] projectionIn = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String sortOrder = taint();
String limit = taint();
target = taint(); // $taintReachesReturn
String[] projectionIn = {taint()}; // $ MISSING: taintReachesReturn
String selection = taint(); // $taintReachesReturn
String[] selectionArgs = {taint()}; // $ MISSING: taintReachesReturn
String groupBy = taint(); // $taintReachesReturn
String having = taint(); // $taintReachesReturn
String sortOrder = taint(); // $taintReachesReturn
String limit = taint(); // $taintReachesReturn
return target.buildQuery(projectionIn, selection, selectionArgs, groupBy, having, sortOrder, limit);
}
public static String buildUnionQuery(MySQLiteQueryBuilder target) {
target = taint();
String[] subQueries = taint();
String sortOrder = taint();
String limit = taint();
target = taint(); // $taintReachesReturn
String[] subQueries = {taint()}; // $ MISSING: taintReachesReturn
String sortOrder = taint(); // $taintReachesReturn
String limit = taint(); // $taintReachesReturn
return target.buildUnionQuery(subQueries, sortOrder, limit);
}
public static String buildUnionSubQuery2(MySQLiteQueryBuilder target) {
target = taint();
String typeDiscriminatorColumn = taint();
String[] unionColumns = taint();
Set<String> columnsPresentInTable = taint();
target = taint(); // $taintReachesReturn
String typeDiscriminatorColumn = taint(); // $taintReachesReturn
String[] unionColumns = {taint()}; // $ MISSING: taintReachesReturn
Set<String> columnsPresentInTable = taint(); // $taintReachesReturn
int computedColumnsOffset = taint();
String typeDiscriminatorValue = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String typeDiscriminatorValue = taint(); // $taintReachesReturn
String selection = taint(); // $taintReachesReturn
String[] selectionArgs = {taint()}; // $ MISSING: taintReachesReturn
String groupBy = taint(); // $taintReachesReturn
String having = taint(); // $taintReachesReturn
return target.buildUnionSubQuery(typeDiscriminatorColumn, unionColumns, columnsPresentInTable,
computedColumnsOffset, typeDiscriminatorValue, selection, selectionArgs, groupBy, having);
}
public static void buildUnionSubQuery3(MySQLiteQueryBuilder target) {
target = taint();
String typeDiscriminatorColumn = taint();
String[] unionColumns = taint();
Set<String> columnsPresentInTable = taint();
public static String buildUnionSubQuery3(MySQLiteQueryBuilder target) {
target = taint(); // $taintReachesReturn
String typeDiscriminatorColumn = taint(); // $taintReachesReturn
String[] unionColumns = {taint()}; // $ MISSING: taintReachesReturn
Set<String> columnsPresentInTable = taint(); // $taintReachesReturn
int computedColumnsOffset = taint();
String typeDiscriminatorValue = taint();
String selection = taint();
String groupBy = taint();
String having = taint();
target.buildUnionSubQuery(typeDiscriminatorColumn, unionColumns, columnsPresentInTable, computedColumnsOffset,
String typeDiscriminatorValue = taint(); // $taintReachesReturn
String selection = taint(); // $taintReachesReturn
String groupBy = taint(); // $taintReachesReturn
String having = taint(); // $taintReachesReturn
return target.buildUnionSubQuery(typeDiscriminatorColumn, unionColumns, columnsPresentInTable, computedColumnsOffset,
typeDiscriminatorValue, selection, groupBy, having);
}
public static Cursor query(MyContentResolver target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
Uri uri = taint(); // $taintReachesReturn
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
CancellationSignal cancellationSignal = taint();
return target.query(uri, projection, selection, selectionArgs, sortOrder, cancellationSignal);
}
public static Cursor query(MyContentProvider target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
Uri uri = taint(); // $taintReachesReturn
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
CancellationSignal cancellationSignal = taint();
return target.query(uri, projection, selection, selectionArgs, sortOrder, cancellationSignal);
}
public static Cursor query2(MyContentResolver target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
Uri uri = taint(); // $taintReachesReturn
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
return target.query(uri, projection, selection, selectionArgs, sortOrder);
}
public static Cursor query2(MyContentProvider target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
Uri uri = taint(); // $taintReachesReturn
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
return target.query(uri, projection, selection, selectionArgs, sortOrder);
}
public static void appendColumns() {
StringBuilder s = taint();
String[] columns = taint();
public static StringBuilder appendColumns() {
StringBuilder s = taint(); // $taintReachesReturn
String[] columns = {taint()}; // $ MISSING: taintReachesReturn
SQLiteQueryBuilder.appendColumns(s, columns);
return s;
}
public static void setProjectionMap(MySQLiteQueryBuilder target) {
target = taint();
Map<String, String> columnMap = taint();
public static SQLiteQueryBuilder setProjectionMap(MySQLiteQueryBuilder target) {
target = taint(); // $taintReachesReturn
Map<String, String> columnMap = taint(); // $taintReachesReturn
target.setProjectionMap(columnMap);
return target;
}
public static void setTables(MySQLiteQueryBuilder target) {
target = taint();
String inTables = taint();
public static SQLiteQueryBuilder setTables(MySQLiteQueryBuilder target) {
target = taint(); // $taintReachesReturn
String inTables = taint(); // $taintReachesReturn
target.setTables(inTables);
return target;
}
public static void appendWhere(MySQLiteQueryBuilder target) {
target = taint();
CharSequence inWhere = taint();
public static SQLiteQueryBuilder appendWhere(MySQLiteQueryBuilder target) {
target = taint(); // $taintReachesReturn
CharSequence inWhere = taint(); // $taintReachesReturn
target.appendWhere(inWhere);
return target;
}
public static void appendWhereStandalone(MySQLiteQueryBuilder target) {
target = taint();
CharSequence inWhere = taint();
public static SQLiteQueryBuilder appendWhereStandalone(MySQLiteQueryBuilder target) {
target = taint(); // $taintReachesReturn
CharSequence inWhere = taint(); // $taintReachesReturn
target.appendWhereStandalone(inWhere);
return target;
}
}

264
java/ql/test/library-tests/frameworks/android/taint-database/Sinks.java
View File

@@ -25,58 +25,58 @@ public class Sinks {
}
public static void compileStatement(SQLiteDatabase target) {
String sql = taint();
String sql = taint(); // $taintReachesSink
target.compileStatement(sql);
}
public static void delete1(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.delete(db, selection, selectionArgs);
}
public static void delete(SQLiteDatabase target) {
String table = taint();
String whereClause = taint();
String[] whereArgs = taint();
String table = taint(); // $taintReachesSink
String whereClause = taint(); // $taintReachesSink
String[] whereArgs = {taint()};
target.delete(table, whereClause, whereArgs);
}
public static void delete(MyContentResolver target) {
Uri uri = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.delete(uri, selection, selectionArgs);
}
public static void delete(MyContentProvider target) {
Uri uri = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.delete(uri, selection, selectionArgs);
}
public static void execPerConnectionSQL(SQLiteDatabase target) {
String sql = taint();
Object[] bindArgs = taint();
String sql = taint(); // $taintReachesSink
Object[] bindArgs = {taint()};
target.execPerConnectionSQL(sql, bindArgs);
}
public static void execSQL(SQLiteDatabase target) {
String sql = taint();
String sql = taint(); // $taintReachesSink
target.execSQL(sql);
}
public static void execSQL2(SQLiteDatabase target) {
String sql = taint();
Object[] bindArgs = taint();
String sql = taint(); // $taintReachesSink
Object[] bindArgs = {taint()};
target.execSQL(sql, bindArgs);
}
public static void insert(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
ContentValues values = taint();
target.insert(db, values);
@@ -84,108 +84,108 @@ public class Sinks {
public static void query(SQLiteDatabase target) {
boolean distinct = taint();
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
target.query(distinct, table, columns, selection, selectionArgs, groupBy, having, orderBy, limit);
}
public static void query2(SQLiteDatabase target) {
boolean distinct = taint();
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
CancellationSignal cancellationSignal = taint();
target.query(distinct, table, columns, selection, selectionArgs, groupBy, having, orderBy, limit,
cancellationSignal);
}
public static void query3(SQLiteDatabase target) {
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
target.query(table, columns, selection, selectionArgs, groupBy, having, orderBy);
}
public static void query4(SQLiteDatabase target) {
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
target.query(table, columns, selection, selectionArgs, groupBy, having, orderBy, limit);
}
public static void query(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
String[] projectionIn = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String sortOrder = taint();
String[] projectionIn = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String sortOrder = taint(); // $taintReachesSink
target.query(db, projectionIn, selection, selectionArgs, groupBy, having, sortOrder);
}
public static void query2(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
String[] projectionIn = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String sortOrder = taint();
String limit = taint();
String[] projectionIn = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String sortOrder = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
target.query(db, projectionIn, selection, selectionArgs, groupBy, having, sortOrder, limit);
}
public static void query3(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
String[] projectionIn = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String sortOrder = taint();
String limit = taint();
String[] projectionIn = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String sortOrder = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
CancellationSignal cancellationSignal = taint();
target.query(db, projectionIn, selection, selectionArgs, groupBy, having, sortOrder, limit, cancellationSignal);
}
public static void query3(MyContentProvider target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
target.query(uri, projection, selection, selectionArgs, sortOrder);
}
public static void query(MyContentProvider target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
CancellationSignal cancellationSignal = taint();
target.query(uri, projection, selection, selectionArgs, sortOrder, cancellationSignal);
@@ -193,18 +193,18 @@ public class Sinks {
public static void query3(MyContentResolver target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
target.query(uri, projection, selection, selectionArgs, sortOrder);
}
public static void query(MyContentResolver target) {
Uri uri = taint();
String[] projection = taint();
String selection = taint();
String[] selectionArgs = taint();
String[] projection = {taint()};
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String sortOrder = taint();
CancellationSignal cancellationSignal = taint();
target.query(uri, projection, selection, selectionArgs, sortOrder, cancellationSignal);
@@ -213,14 +213,14 @@ public class Sinks {
public static void queryWithFactory(SQLiteDatabase target) {
SQLiteDatabase.CursorFactory cursorFactory = taint();
boolean distinct = taint();
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
target.queryWithFactory(cursorFactory, distinct, table, columns, selection, selectionArgs, groupBy, having,
orderBy, limit);
}
@@ -228,103 +228,103 @@ public class Sinks {
public static void queryWithFactory2(SQLiteDatabase target) {
SQLiteDatabase.CursorFactory cursorFactory = taint();
boolean distinct = taint();
String table = taint();
String[] columns = taint();
String selection = taint();
String[] selectionArgs = taint();
String groupBy = taint();
String having = taint();
String orderBy = taint();
String limit = taint();
String table = taint(); // $taintReachesSink
String[] columns = {taint()}; // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String groupBy = taint(); // $taintReachesSink
String having = taint(); // $taintReachesSink
String orderBy = taint(); // $taintReachesSink
String limit = taint(); // $taintReachesSink
CancellationSignal cancellationSignal = taint();
target.queryWithFactory(cursorFactory, distinct, table, columns, selection, selectionArgs, groupBy, having,
orderBy, limit, cancellationSignal);
}
public static void rawQuery(SQLiteDatabase target) {
String sql = taint();
String[] selectionArgs = taint();
String sql = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.rawQuery(sql, selectionArgs);
}
public static void rawQuery2(SQLiteDatabase target) {
String sql = taint();
String[] selectionArgs = taint();
String sql = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
CancellationSignal cancellationSignal = taint();
target.rawQuery(sql, selectionArgs, cancellationSignal);
}
public static void rawQueryWithFactory(SQLiteDatabase target) {
SQLiteDatabase.CursorFactory cursorFactory = taint();
String sql = taint();
String[] selectionArgs = taint();
String sql = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String editTable = taint();
target.rawQueryWithFactory(cursorFactory, sql, selectionArgs, editTable);
}
public static void rawQueryWithFactory2(SQLiteDatabase target) {
SQLiteDatabase.CursorFactory cursorFactory = taint();
String sql = taint();
String[] selectionArgs = taint();
String sql = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
String editTable = taint();
CancellationSignal cancellationSignal = taint();
target.rawQueryWithFactory(cursorFactory, sql, selectionArgs, editTable, cancellationSignal);
}
public static void update(MySQLiteQueryBuilder target) {
target = taint();;
target = taint(); // $taintReachesSink
SQLiteDatabase db = taint();
ContentValues values = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.update(db, values, selection, selectionArgs);
}
public static void update(SQLiteDatabase target) {
String table = taint();
String table = taint(); // $taintReachesSink
ContentValues values = taint();
String whereClause = taint();
String[] whereArgs = taint();
String whereClause = taint(); // $taintReachesSink
String[] whereArgs = {taint()};
target.update(table, values, whereClause, whereArgs);
}
public static void update(MyContentResolver target) {
Uri uri = taint();
ContentValues values = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.update(uri, values, selection, selectionArgs);
}
public static void update(MyContentProvider target) {
Uri uri = taint();
ContentValues values = taint();
String selection = taint();
String[] selectionArgs = taint();
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
target.update(uri, values, selection, selectionArgs);
}
public static void updateWithOnConflict(SQLiteDatabase target) {
String table = taint();
String table = taint(); // $taintReachesSink
ContentValues values = taint();
String whereClause = taint();
String[] whereArgs = taint();
String whereClause = taint(); // $taintReachesSink
String[] whereArgs = {taint()};
int conflictAlgorithm = taint();
target.updateWithOnConflict(table, values, whereClause, whereArgs, conflictAlgorithm);
}
public static void queryNumEntries() {
SQLiteDatabase db = taint();
String table = taint();
String selection = taint();
String table = taint(); // $taintReachesSink
String selection = taint(); // $taintReachesSink
DatabaseUtils.queryNumEntries(db, table, selection);
}
public static void queryNumEntries2() {
SQLiteDatabase db = taint();
String table = taint();
String selection = taint();
String[] selectionArgs = taint();
String table = taint(); // $taintReachesSink
String selection = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
DatabaseUtils.queryNumEntries(db, table, selection, selectionArgs);
}
@@ -332,28 +332,28 @@ public class Sinks {
Context context = taint();
String dbName = taint();
int dbVersion = taint();
String sqlStatements = taint();
String sqlStatements = taint(); // $taintReachesSink
DatabaseUtils.createDbFromSqlStatements(context, dbName, dbVersion, sqlStatements);
}
public static void blobFileDescriptorForQuery() {
SQLiteDatabase db = taint();
String query = taint();
String[] selectionArgs = taint();
String query = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
DatabaseUtils.blobFileDescriptorForQuery(db, query, selectionArgs);
}
public static void longForQuery() {
SQLiteDatabase db = taint();
String query = taint();
String[] selectionArgs = taint();
String query = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
DatabaseUtils.longForQuery(db, query, selectionArgs);
}
public static void stringForQuery() {
SQLiteDatabase db = taint();
String query = taint();
String[] selectionArgs = taint();
String query = taint(); // $taintReachesSink
String[] selectionArgs = {taint()};
DatabaseUtils.stringForQuery(db, query, selectionArgs);
}
}

56
java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.expected
View File

@@ -1,56 +0,0 @@
| FlowSteps.java:32:44:32:57 | originalValues | FlowSteps.java:32:10:32:69 | appendSelectionArgs(...) |
| FlowSteps.java:32:60:32:68 | newValues | FlowSteps.java:32:10:32:69 | appendSelectionArgs(...) |
| FlowSteps.java:38:41:38:41 | a | FlowSteps.java:38:10:38:45 | concatenateWhere(...) |
| FlowSteps.java:38:44:38:44 | b | FlowSteps.java:38:10:38:45 | concatenateWhere(...) |
| FlowSteps.java:51:56:51:61 | tables | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:64:51:70 | columns | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:73:51:77 | where | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:80:51:86 | groupBy | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:89:51:94 | having | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:97:51:103 | orderBy | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:51:106:51:110 | limit | FlowSteps.java:51:10:51:111 | buildQueryString(...) |
| FlowSteps.java:62:10:62:15 | target | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:28:62:39 | projectionIn | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:42:62:50 | selection | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:53:62:59 | groupBy | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:62:62:67 | having | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:70:62:78 | sortOrder | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:62:81:62:85 | limit | FlowSteps.java:62:10:62:86 | buildQuery(...) |
| FlowSteps.java:74:10:74:15 | target | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:28:74:39 | projectionIn | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:42:74:50 | selection | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:53:74:65 | selectionArgs | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:68:74:74 | groupBy | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:77:74:82 | having | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:85:74:93 | sortOrder | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:74:96:74:100 | limit | FlowSteps.java:74:10:74:101 | buildQuery(...) |
| FlowSteps.java:82:10:82:15 | target | FlowSteps.java:82:10:82:61 | buildUnionQuery(...) |
| FlowSteps.java:82:33:82:42 | subQueries | FlowSteps.java:82:10:82:61 | buildUnionQuery(...) |
| FlowSteps.java:82:45:82:53 | sortOrder | FlowSteps.java:82:10:82:61 | buildUnionQuery(...) |
| FlowSteps.java:82:56:82:60 | limit | FlowSteps.java:82:10:82:61 | buildUnionQuery(...) |
| FlowSteps.java:96:10:96:15 | target | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:96:36:96:58 | typeDiscriminatorColumn | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:96:61:96:72 | unionColumns | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:96:75:96:95 | columnsPresentInTable | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:97:28:97:49 | typeDiscriminatorValue | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:97:52:97:60 | selection | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:97:63:97:75 | selectionArgs | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:97:78:97:84 | groupBy | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:97:87:97:92 | having | FlowSteps.java:96:10:97:93 | buildUnionSubQuery(...) |
| FlowSteps.java:110:3:110:8 | target | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:110:29:110:51 | typeDiscriminatorColumn | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:110:54:110:65 | unionColumns | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:110:68:110:88 | columnsPresentInTable | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:111:5:111:26 | typeDiscriminatorValue | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:111:29:111:37 | selection | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:111:40:111:46 | groupBy | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:111:49:111:54 | having | FlowSteps.java:110:3:111:55 | buildUnionSubQuery(...) |
| FlowSteps.java:121:23:121:25 | uri | FlowSteps.java:121:10:121:95 | query(...) |
| FlowSteps.java:131:23:131:25 | uri | FlowSteps.java:131:10:131:95 | query(...) |
| FlowSteps.java:140:23:140:25 | uri | FlowSteps.java:140:10:140:75 | query(...) |
| FlowSteps.java:149:23:149:25 | uri | FlowSteps.java:149:10:149:75 | query(...) |
| FlowSteps.java:155:39:155:45 | columns | FlowSteps.java:155:36:155:36 | s [post update] |
| FlowSteps.java:161:27:161:35 | columnMap | FlowSteps.java:161:3:161:8 | target [post update] |
| FlowSteps.java:167:20:167:27 | inTables | FlowSteps.java:167:3:167:8 | target [post update] |
| FlowSteps.java:173:22:173:28 | inWhere | FlowSteps.java:173:3:173:8 | target [post update] |
| FlowSteps.java:179:32:179:38 | inWhere | FlowSteps.java:179:3:179:8 | target [post update] |

27
java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql
View File

@@ -2,21 +2,30 @@ import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.QueryInjection
import TestUtilities.InlineExpectationsTest
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest:dataflow:android::flow" }
override predicate isSource(DataFlow::Node source) {
exists(VarAccess va, MethodAccess ma |
source.asExpr() = va and
va.getVariable().getAnAssignedValue() = ma and
ma.getMethod().hasName("taint")
)
source.asExpr().(MethodAccess).getMethod().hasName("taint")
}
override predicate isSink(DataFlow::Node sink) { not isSource(sink) }
override predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(ReturnStmt r).getResult() }
}
from DataFlow::Node source, DataFlow::Node sink, Conf config
where config.hasFlow(source, sink) and sink.getLocation().getFile().getBaseName() = "FlowSteps.java"
select source, sink
class FlowStepTest extends InlineExpectationsTest {
FlowStepTest() { this = "FlowStepTest" }
override string getARelevantTag() { result = "taintReachesReturn" }
override predicate hasActualResult(Location l, string element, string tag, string value) {
tag = "taintReachesReturn" and
value = "" and
exists(Conf conf, DataFlow::Node source, DataFlow::Node sink |
conf.hasFlow(source, sink) and
l = source.getLocation() and
element = source.toString()
)
}
}

88
java/ql/test/library-tests/frameworks/android/taint-database/sinks.expected
View File

@@ -1,88 +0,0 @@
| Sinks.java:29:27:29:29 | sql |
| Sinks.java:37:3:37:8 | target |
| Sinks.java:37:21:37:29 | selection |
| Sinks.java:44:24:44:34 | whereClause |
| Sinks.java:51:22:51:30 | selection |
| Sinks.java:58:22:58:30 | selection |
| Sinks.java:64:31:64:33 | sql |
| Sinks.java:69:18:69:20 | sql |
| Sinks.java:75:18:75:20 | sql |
| Sinks.java:82:3:82:8 | target |
| Sinks.java:95:26:95:30 | table |
| Sinks.java:95:33:95:39 | columns |
| Sinks.java:95:42:95:50 | selection |
| Sinks.java:95:68:95:74 | groupBy |
| Sinks.java:95:77:95:82 | having |
| Sinks.java:95:85:95:91 | orderBy |
| Sinks.java:95:94:95:98 | limit |
| Sinks.java:109:26:109:30 | table |
| Sinks.java:109:33:109:39 | columns |
| Sinks.java:109:42:109:50 | selection |
| Sinks.java:109:68:109:74 | groupBy |
| Sinks.java:109:77:109:82 | having |
| Sinks.java:109:85:109:91 | orderBy |
| Sinks.java:109:94:109:98 | limit |
| Sinks.java:121:16:121:20 | table |
| Sinks.java:121:23:121:29 | columns |
| Sinks.java:121:32:121:40 | selection |
| Sinks.java:121:58:121:64 | groupBy |
| Sinks.java:121:67:121:72 | having |
| Sinks.java:121:75:121:81 | orderBy |
| Sinks.java:133:16:133:20 | table |
| Sinks.java:133:23:133:29 | columns |
| Sinks.java:133:32:133:40 | selection |
| Sinks.java:133:58:133:64 | groupBy |
| Sinks.java:133:67:133:72 | having |
| Sinks.java:133:75:133:81 | orderBy |
| Sinks.java:133:84:133:88 | limit |
| Sinks.java:145:3:145:8 | target |
| Sinks.java:145:34:145:42 | selection |
| Sinks.java:145:60:145:66 | groupBy |
| Sinks.java:145:69:145:74 | having |
| Sinks.java:145:77:145:85 | sortOrder |
| Sinks.java:158:3:158:8 | target |
| Sinks.java:158:34:158:42 | selection |
| Sinks.java:158:60:158:66 | groupBy |
| Sinks.java:158:69:158:74 | having |
| Sinks.java:158:77:158:85 | sortOrder |
| Sinks.java:158:88:158:92 | limit |
| Sinks.java:172:3:172:8 | target |
| Sinks.java:172:34:172:42 | selection |
| Sinks.java:172:60:172:66 | groupBy |
| Sinks.java:172:69:172:74 | having |
| Sinks.java:172:77:172:85 | sortOrder |
| Sinks.java:172:88:172:92 | limit |
| Sinks.java:181:33:181:41 | selection |
| Sinks.java:191:33:191:41 | selection |
| Sinks.java:200:33:200:41 | selection |
| Sinks.java:210:33:210:41 | selection |
| Sinks.java:224:52:224:56 | table |
| Sinks.java:224:59:224:65 | columns |
| Sinks.java:224:68:224:76 | selection |
| Sinks.java:224:94:224:100 | groupBy |
| Sinks.java:224:103:224:108 | having |
| Sinks.java:225:5:225:11 | orderBy |
| Sinks.java:225:14:225:18 | limit |
| Sinks.java:240:52:240:56 | table |
| Sinks.java:240:59:240:65 | columns |
| Sinks.java:240:68:240:76 | selection |
| Sinks.java:240:94:240:100 | groupBy |
| Sinks.java:240:103:240:108 | having |
| Sinks.java:241:5:241:11 | orderBy |
| Sinks.java:241:14:241:18 | limit |
| Sinks.java:247:19:247:21 | sql |
| Sinks.java:254:19:254:21 | sql |
| Sinks.java:262:45:262:47 | sql |
| Sinks.java:271:45:271:47 | sql |
| Sinks.java:280:3:280:8 | target |
| Sinks.java:280:29:280:37 | selection |
| Sinks.java:288:32:288:42 | whereClause |
| Sinks.java:296:30:296:38 | selection |
| Sinks.java:304:30:304:38 | selection |
| Sinks.java:313:46:313:56 | whereClause |
| Sinks.java:320:44:320:52 | selection |
| Sinks.java:328:44:328:52 | selection |
| Sinks.java:336:71:336:83 | sqlStatements |
| Sinks.java:343:48:343:52 | query |
| Sinks.java:350:34:350:38 | query |
| Sinks.java:357:36:357:40 | query |

32
java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql
View File

@@ -1,5 +1,31 @@
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.QueryInjection
import TestUtilities.InlineExpectationsTest
from QueryInjectionSink sink
where sink.getLocation().getFile().getBaseName() = "Sinks.java"
select sink
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest:dataflow:android::flow" }
override predicate isSource(DataFlow::Node source) {
source.asExpr().(MethodAccess).getMethod().hasName("taint")
}
override predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }
}
class SinkTest extends InlineExpectationsTest {
SinkTest() { this = "SinkTest" }
override string getARelevantTag() { result = "taintReachesSink" }
override predicate hasActualResult(Location l, string element, string tag, string value) {
tag = "taintReachesSink" and
value = "" and
exists(Conf conf, DataFlow::Node source, DataFlow::Node sink |
conf.hasFlow(source, sink) and
l = source.getLocation() and
element = source.toString()
)
}
}