hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-23 18:33:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Expand log injection sanitizer guards to non-annotation regex matches

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-02-14 08:24:12 +00:00
parent 60e58f8219
commit 924bb92d91
1 changed files with 28 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
java/ql/lib/semmle/code/java/security/LogInjection.qll
View File

@@ -105,24 +105,35 @@ private predicate logInjectionGuard(Guard g, Expr e, boolean branch) {
or
exists(RegexMatch rm, CompileTimeConstantExpr target |
rm = g and
not rm instanceof Annotation and
target = rm.getRegex() and
e = rm.getString()
e = rm.getASanitizedExpr()
|
// Allow anything except line breaks
(
not target.getStringValue().matches("%[^%]%") and
not target.getStringValue().matches("%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%")
or
target.getStringValue().matches("%[^%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%]%")
) and
branch = true
or
// Disallow line breaks
(
not target.getStringValue().matches("%[^%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%]%") and
// Assuming a regex containing line breaks is correctly matching line breaks in a string
target.getStringValue().matches("%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%")
) and
branch = false
regexPreventsLogInjection(target.getStringValue(), branch)
)
}
/**
* Holds if `regex` matches against a pattern that allows anything except
* line breaks when `branch` is `true`, or a pattern that matches line breaks
* when `branch` is `false`.
*/
bindingset[regex]
private predicate regexPreventsLogInjection(string regex, boolean branch) {
// Allow anything except line breaks
(
not regex.matches("%[^%]%") and
not regex.matches("%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%")
or
regex.matches("%[^%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%]%")
) and
branch = true
or
// Disallow line breaks
(
not regex.matches("%[^%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%]%") and
// Assuming a regex containing line breaks is correctly matching line breaks in a string
regex.matches("%" + ["\n", "\r", "\\n", "\\r", "\\R"] + "%")
) and
branch = false
}