hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6216 from smowton/smowton/admin/serializability-dataflow

Browse Source 
Create a dataflow instance specifically for the Serializability library
This commit is contained in:
Anders Schack-Mulligen
2021-08-03 13:03:49 +02:00
committed by GitHub
parent ee51e1593f 36379146c5
commit ad86641e22
5 changed files with 4487 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/identical-files.json
View File

@@ -6,6 +6,7 @@
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",

19
java/ql/src/semmle/code/java/dataflow/internal/DataFlowForSerializability.qll Normal file
View File

@@ -0,0 +1,19 @@
/**
* Provides classes for performing local (intra-procedural) and
* global (inter-procedural) data flow analyses (for internal use only).
*
* This copy of the library is exclusively for use by `Serializability.qll` and
* related libraries. Configurations computed using this instance of the library
* are in scope whenever `java.qll` is imported, and are used to compute among
* other things `AdditionalTaintStep`.
*/
import java
/**
* Provides classes for performing local (intra-procedural) and
* global (inter-procedural) data flow analyses (for internal use only).
*/
module DataFlowForSerializability {
import semmle.code.java.dataflow.internal.DataFlowImplForSerializability
}

4463
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll Normal file
View File

File diff suppressed because it is too large Load Diff

4
java/ql/src/semmle/code/java/frameworks/google/GoogleHttpClientApi.qll
View File

@@ -1,7 +1,7 @@
import java
import semmle.code.java.Serializability
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.DataFlow5
private import semmle.code.java.dataflow.internal.DataFlowForSerializability
/** The method `parseAs` in `com.google.api.client.http.HttpResponse`. */
private class ParseAsMethod extends Method {
@@ -11,7 +11,7 @@ private class ParseAsMethod extends Method {
}
}
private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configuration {
private class TypeLiteralToParseAsFlowConfiguration extends DataFlowForSerializability::Configuration {
TypeLiteralToParseAsFlowConfiguration() {
this = "GoogleHttpClientApi::TypeLiteralToParseAsFlowConfiguration"
}

4
java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll
View File

@@ -7,7 +7,7 @@ import java
import semmle.code.java.Serializability
import semmle.code.java.Reflection
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.DataFlow5
private import semmle.code.java.dataflow.internal.DataFlowForSerializability
import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.ExternalFlow
@@ -85,7 +85,7 @@ private class FieldReferencedJacksonSerializableType extends JacksonSerializable
/** A type whose values may be deserialized by the Jackson JSON framework. */
abstract class JacksonDeserializableType extends Type { }
private class TypeLiteralToJacksonDatabindFlowConfiguration extends DataFlow5::Configuration {
private class TypeLiteralToJacksonDatabindFlowConfiguration extends DataFlowForSerializability::Configuration {
TypeLiteralToJacksonDatabindFlowConfiguration() {
this = "TypeLiteralToJacksonDatabindFlowConfiguration"
}