hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
Co-authored-by: Chris Smowton <smowton@github.com>
This commit is contained in:
Jonathan Leitschuh
2022-03-07 11:31:32 -05:00
committed by GitHub
parent 523ddb79f3
commit b282c7f1b9
4 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/environment/SystemProperty.qll
View File

@@ -20,7 +20,7 @@ Expr getSystemProperty(string propertyName) {
private MethodAccess getSystemPropertyFromSystem(string propertyName) {
result.(MethodAccessSystemGetProperty).hasCompileTimeConstantGetPropertyName(propertyName)
or
exists(Method m | result.getMethod() = m | m.hasName("lineSeparator")) and
result.getMethod().hasName("lineSeparator") and
propertyName = "line.separator"
}

32
java/ql/lib/semmle/code/java/os/OSCheck.qll
View File

@@ -10,14 +10,14 @@ private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.TaintTracking
/**
* A guard that checks if the current os is Windows.
* A guard that checks if the current OS is Windows.
* When True, the OS is Windows.
* When False, the OS is not Windows.
*/
abstract class IsWindowsGuard extends Guard { }
/**
* A guard that checks if the current OS is any Windows.
* A guard that checks if the current OS is a specific Windows variant.
* When True, the OS is Windows.
* When False, the OS *may* still be Windows.
*/
@@ -31,7 +31,7 @@ abstract class IsSpecificWindowsVariant extends Guard { }
abstract class IsUnixGuard extends Guard { }
/**
* A guard that checks if the current OS is unix or unix-like.
* A guard that checks if the current OS is a specific unix or unix-like variant.
* When True, the OS is unix or unix-like.
* When False, the OS *may* still be unix or unix-like.
*/
@@ -42,7 +42,7 @@ abstract class IsSpecificUnixVariant extends Guard { }
*/
bindingset[osString]
private predicate isOsFromSystemProp(MethodAccess ma, string osString) {
TaintTracking::localExprTaint(getSystemProperty("os.name"), ma.getQualifier()) and // Call from System.getProperty (or equvalent) to some partial match method
TaintTracking::localExprTaint(getSystemProperty("os.name"), ma.getQualifier()) and // Call from System.getProperty (or equivalent) to some partial match method
exists(StringPartialMatchMethod m, CompileTimeConstantExpr matchedStringConstant |
m = ma.getMethod() and
matchedStringConstant.getStringValue().toLowerCase().matches(osString)
@@ -68,24 +68,24 @@ private Guard isOsFromSystemPropertyEqualityCheck(string propertyName, string co
), _)
}
private class IsWindowsFromCharPathSeperator extends IsWindowsGuard {
IsWindowsFromCharPathSeperator() {
private class IsWindowsFromCharPathSeparator extends IsWindowsGuard {
IsWindowsFromCharPathSeparator() {
this = isOsFromSystemPropertyEqualityCheck("path.separator", "\\")
}
}
private class IsWindowsFromCharSeperator extends IsWindowsGuard {
IsWindowsFromCharSeperator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ";") }
private class IsWindowsFromCharSeparator extends IsWindowsGuard {
IsWindowsFromCharSeparator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ";") }
}
private class IsUnixFromCharPathSeperator extends IsUnixGuard {
IsUnixFromCharPathSeperator() {
private class IsUnixFromCharPathSeparator extends IsUnixGuard {
IsUnixFromCharPathSeparator() {
this = isOsFromSystemPropertyEqualityCheck("path.separator", "/")
}
}
private class IsUnixFromCharSeperator extends IsUnixGuard {
IsUnixFromCharSeperator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ":") }
private class IsUnixFromCharSeparator extends IsUnixGuard {
IsUnixFromCharSeparator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ":") }
}
private class IsUnixFromSystemProp extends IsSpecificUnixVariant instanceof MethodAccess {
@@ -138,12 +138,12 @@ private class IsUnixFromPosixFromFileSystem extends IsUnixGuard instanceof Metho
m.hasName("contains")
) and
this.getArgument(0).(CompileTimeConstantExpr).getStringValue() = "posix" and
exists(Method supportedFileAttribtueViewsMethod |
supportedFileAttribtueViewsMethod.hasName("supportedFileAttributeViews") and
supportedFileAttribtueViewsMethod.getDeclaringType() instanceof TypeFileSystem
exists(Method supportedFileAttributeViewsMethod |
supportedFileAttributeViewsMethod.hasName("supportedFileAttributeViews") and
supportedFileAttributeViewsMethod.getDeclaringType() instanceof TypeFileSystem
|
DataFlow::localExprFlow(any(MethodAccess ma |
ma.getMethod() = supportedFileAttribtueViewsMethod
ma.getMethod() = supportedFileAttributeViewsMethod
), super.getQualifier())
)
}

2
java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql
View File

@@ -118,7 +118,7 @@ private class IsWindowsBarrierGuard extends WindowsOsBarrierGuard instanceof IsW
override predicate checks(Expr e, boolean branch) { this.controls(e.getBasicBlock(), branch) }
}
private class IsAnyWindowsBarrierGuard extends WindowsOsBarrierGuard instanceof IsSpecificWindowsVariant {
private class IsSpecificWindowsBarrierGuard extends WindowsOsBarrierGuard instanceof IsSpecificWindowsVariant {
override predicate checks(Expr e, boolean branch) {
branch = true and this.controls(e.getBasicBlock(), branch)
}

4
java/ql/src/change-notes/2022-02-14-os-guards.md
View File

@@ -2,7 +2,7 @@
category: minorAnalysis
---
* Add new guards `IsWindowsGuard`, `IsSpecificWindowsVariant`, `IsUnixGuard`, and `IsSpecificUnixVariant` to detect OS specific guards.
* Add new predicate `getSystemProperty` that gets all expressions that retrieve system properties from a variety of sources (eg. alternative JDK API's, Google Guava, Apache Commons, Apache IO, ect..).
* Add new predicate `getSystemProperty` that gets all expressions that retrieve system properties from a variety of sources (eg. alternative JDK API's, Google Guava, Apache Commons, Apache IO, etc..).
* Update "Local information disclosure in a temporary directory" (`java/local-temp-file-or-directory-information-disclosure`) to remove false-positives when OS is properly used as logical guard.
* Update "Local information disclosure in a temporary directory" (`java/local-temp-file-or-directory-information-disclosure`) to use `getSystemProperty` to use new `getSystemProperty` predicate.
* Update "Local information disclosure in a temporary directory" (`java/local-temp-file-or-directory-information-disclosure`) to use new `getSystemProperty` predicate.