hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Update Log4J models with provenance information.

Browse Source
This commit is contained in:
Michael Nebel
2022-06-13 16:30:25 +02:00
parent 733fc16902
commit b6ccaf14f6
1 changed files with 125 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

237
java/ql/src/experimental/Security/CWE/CWE-020/Log4jJndiInjection.ql
View File

@@ -27,124 +27,137 @@ private class Log4jLoggingSinkModels extends SinkModelCsv {
"org.apache.logging.log4j;Logger;true;" +
["debug", "error", "fatal", "info", "trace", "warn"] +
[
";(CharSequence);;Argument[0];log4j", ";(CharSequence,Throwable);;Argument[0];log4j",
";(Marker,CharSequence);;Argument[1];log4j",
";(Marker,CharSequence,Throwable);;Argument[1];log4j",
";(Marker,Message);;Argument[1];log4j", ";(Marker,MessageSupplier);;Argument[1];log4j",
";(Marker,MessageSupplier);;Argument[1];log4j",
";(Marker,MessageSupplier,Throwable);;Argument[1];log4j",
";(Marker,Object);;Argument[1];log4j", ";(Marker,Object,Throwable);;Argument[1];log4j",
";(Marker,String);;Argument[1];log4j",
";(Marker,String,Object[]);;Argument[1..2];log4j",
";(Marker,String,Object);;Argument[1..2];log4j",
";(Marker,String,Object,Object);;Argument[1..3];log4j",
";(Marker,String,Object,Object,Object);;Argument[1..4];log4j",
";(Marker,String,Object,Object,Object,Object);;Argument[1..5];log4j",
";(Marker,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j",
";(Marker,String,Supplier);;Argument[1..2];log4j",
";(Marker,String,Throwable);;Argument[1];log4j",
";(Marker,Supplier);;Argument[1];log4j",
";(Marker,Supplier,Throwable);;Argument[1];log4j",
";(MessageSupplier);;Argument[0];log4j",
";(MessageSupplier,Throwable);;Argument[0];log4j", ";(Message);;Argument[0];log4j",
";(Message,Throwable);;Argument[0];log4j", ";(Object);;Argument[0];log4j",
";(Object,Throwable);;Argument[0];log4j", ";(String);;Argument[0];log4j",
";(String,Object[]);;Argument[0..1];log4j", ";(String,Object);;Argument[0..1];log4j",
";(String,Object,Object);;Argument[0..2];log4j",
";(String,Object,Object,Object);;Argument[0..3];log4j",
";(String,Object,Object,Object,Object);;Argument[0..4];log4j",
";(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j",
";(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j",
";(String,Supplier);;Argument[0..1];log4j", ";(String,Throwable);;Argument[0];log4j",
";(Supplier);;Argument[0];log4j", ";(Supplier,Throwable);;Argument[0];log4j"
";(CharSequence);;Argument[0];log4j;manual",
";(CharSequence,Throwable);;Argument[0];log4j;manual",
";(Marker,CharSequence);;Argument[1];log4j;manual",
";(Marker,CharSequence,Throwable);;Argument[1];log4j;manual",
";(Marker,Message);;Argument[1];log4j;manual",
";(Marker,MessageSupplier);;Argument[1];log4j;manual",
";(Marker,MessageSupplier);;Argument[1];log4j;manual",
";(Marker,MessageSupplier,Throwable);;Argument[1];log4j;manual",
";(Marker,Object);;Argument[1];log4j;manual",
";(Marker,Object,Throwable);;Argument[1];log4j;manual",
";(Marker,String);;Argument[1];log4j;manual",
";(Marker,String,Object[]);;Argument[1..2];log4j;manual",
";(Marker,String,Object);;Argument[1..2];log4j;manual",
";(Marker,String,Object,Object);;Argument[1..3];log4j;manual",
";(Marker,String,Object,Object,Object);;Argument[1..4];log4j;manual",
";(Marker,String,Object,Object,Object,Object);;Argument[1..5];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j;manual",
";(Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j;manual",
";(Marker,String,Supplier);;Argument[1..2];log4j;manual",
";(Marker,String,Throwable);;Argument[1];log4j;manual",
";(Marker,Supplier);;Argument[1];log4j;manual",
";(Marker,Supplier,Throwable);;Argument[1];log4j;manual",
";(MessageSupplier);;Argument[0];log4j;manual",
";(MessageSupplier,Throwable);;Argument[0];log4j;manual",
";(Message);;Argument[0];log4j;manual",
";(Message,Throwable);;Argument[0];log4j;manual", ";(Object);;Argument[0];log4j;manual",
";(Object,Throwable);;Argument[0];log4j;manual", ";(String);;Argument[0];log4j;manual",
";(String,Object[]);;Argument[0..1];log4j;manual",
";(String,Object);;Argument[0..1];log4j;manual",
";(String,Object,Object);;Argument[0..2];log4j;manual",
";(String,Object,Object,Object);;Argument[0..3];log4j;manual",
";(String,Object,Object,Object,Object);;Argument[0..4];log4j;manual",
";(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j;manual",
";(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j;manual",
";(String,Supplier);;Argument[0..1];log4j;manual",
";(String,Throwable);;Argument[0];log4j;manual",
";(Supplier);;Argument[0];log4j;manual",
";(Supplier,Throwable);;Argument[0];log4j;manual"
],
"org.apache.logging.log4j;Logger;true;log" +
[
";(Level,CharSequence);;Argument[1];log4j",
";(Level,CharSequence,Throwable);;Argument[1];log4j",
";(Level,Marker,CharSequence);;Argument[2];log4j",
";(Level,Marker,CharSequence,Throwable);;Argument[2];log4j",
";(Level,Marker,Message);;Argument[2];log4j",
";(Level,Marker,MessageSupplier);;Argument[2];log4j",
";(Level,Marker,MessageSupplier);;Argument[2];log4j",
";(Level,Marker,MessageSupplier,Throwable);;Argument[2];log4j",
";(Level,Marker,Object);;Argument[2];log4j",
";(Level,Marker,Object,Throwable);;Argument[2];log4j",
";(Level,Marker,String);;Argument[2];log4j",
";(Level,Marker,String,Object[]);;Argument[2..3];log4j",
";(Level,Marker,String,Object);;Argument[2..3];log4j",
";(Level,Marker,String,Object,Object);;Argument[2..4];log4j",
";(Level,Marker,String,Object,Object,Object);;Argument[2..5];log4j",
";(Level,Marker,String,Object,Object,Object,Object);;Argument[2..6];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object);;Argument[2..7];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object);;Argument[2..8];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[2..9];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..10];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..11];log4j",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..12];log4j",
";(Level,Marker,String,Supplier);;Argument[2..3];log4j",
";(Level,Marker,String,Throwable);;Argument[2];log4j",
";(Level,Marker,Supplier);;Argument[2];log4j",
";(Level,Marker,Supplier,Throwable);;Argument[2];log4j",
";(Level,Message);;Argument[1];log4j", ";(Level,MessageSupplier);;Argument[1];log4j",
";(Level,MessageSupplier,Throwable);;Argument[1];log4j",
";(Level,Message);;Argument[1];log4j", ";(Level,Message,Throwable);;Argument[1];log4j",
";(Level,Object);;Argument[1];log4j", ";(Level,Object);;Argument[1];log4j",
";(Level,String);;Argument[1];log4j", ";(Level,Object,Throwable);;Argument[1];log4j",
";(Level,String);;Argument[1];log4j", ";(Level,String,Object[]);;Argument[1..2];log4j",
";(Level,String,Object);;Argument[1..2];log4j",
";(Level,String,Object,Object);;Argument[1..3];log4j",
";(Level,String,Object,Object,Object);;Argument[1..4];log4j",
";(Level,String,Object,Object,Object,Object);;Argument[1..5];log4j",
";(Level,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j",
";(Level,String,Supplier);;Argument[1..2];log4j",
";(Level,String,Throwable);;Argument[1];log4j", ";(Level,Supplier);;Argument[1];log4j",
";(Level,Supplier,Throwable);;Argument[1];log4j"
], "org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];log4j",
"org.apache.logging.log4j;Logger;true;logMessage;(Level,Marker,String,StackTraceElement,Message,Throwable);;Argument[4];log4j",
"org.apache.logging.log4j;Logger;true;printf;(Level,Marker,String,Object[]);;Argument[2..3];log4j",
"org.apache.logging.log4j;Logger;true;printf;(Level,String,Object[]);;Argument[1..2];log4j",
";(Level,CharSequence);;Argument[1];log4j;manual",
";(Level,CharSequence,Throwable);;Argument[1];log4j;manual",
";(Level,Marker,CharSequence);;Argument[2];log4j;manual",
";(Level,Marker,CharSequence,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Message);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier);;Argument[2];log4j;manual",
";(Level,Marker,MessageSupplier,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Object);;Argument[2];log4j;manual",
";(Level,Marker,Object,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,String);;Argument[2];log4j;manual",
";(Level,Marker,String,Object[]);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Object);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Object,Object);;Argument[2..4];log4j;manual",
";(Level,Marker,String,Object,Object,Object);;Argument[2..5];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object);;Argument[2..6];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object);;Argument[2..7];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object);;Argument[2..8];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object);;Argument[2..9];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..10];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..11];log4j;manual",
";(Level,Marker,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[2..12];log4j;manual",
";(Level,Marker,String,Supplier);;Argument[2..3];log4j;manual",
";(Level,Marker,String,Throwable);;Argument[2];log4j;manual",
";(Level,Marker,Supplier);;Argument[2];log4j;manual",
";(Level,Marker,Supplier,Throwable);;Argument[2];log4j;manual",
";(Level,Message);;Argument[1];log4j;manual",
";(Level,MessageSupplier);;Argument[1];log4j;manual",
";(Level,MessageSupplier,Throwable);;Argument[1];log4j;manual",
";(Level,Message);;Argument[1];log4j;manual",
";(Level,Message,Throwable);;Argument[1];log4j;manual",
";(Level,Object);;Argument[1];log4j;manual",
";(Level,Object);;Argument[1];log4j;manual",
";(Level,String);;Argument[1];log4j;manual",
";(Level,Object,Throwable);;Argument[1];log4j;manual",
";(Level,String);;Argument[1];log4j;manual",
";(Level,String,Object[]);;Argument[1..2];log4j;manual",
";(Level,String,Object);;Argument[1..2];log4j;manual",
";(Level,String,Object,Object);;Argument[1..3];log4j;manual",
";(Level,String,Object,Object,Object);;Argument[1..4];log4j;manual",
";(Level,String,Object,Object,Object,Object);;Argument[1..5];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object);;Argument[1..6];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object);;Argument[1..7];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object);;Argument[1..8];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..9];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..10];log4j;manual",
";(Level,String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[1..11];log4j;manual",
";(Level,String,Supplier);;Argument[1..2];log4j;manual",
";(Level,String,Throwable);;Argument[1];log4j;manual",
";(Level,Supplier);;Argument[1];log4j;manual",
";(Level,Supplier,Throwable);;Argument[1];log4j;manual"
], "org.apache.logging.log4j;Logger;true;entry;(Object[]);;Argument[0];log4j;manual",
"org.apache.logging.log4j;Logger;true;logMessage;(Level,Marker,String,StackTraceElement,Message,Throwable);;Argument[4];log4j;manual",
"org.apache.logging.log4j;Logger;true;printf;(Level,Marker,String,Object[]);;Argument[2..3];log4j;manual",
"org.apache.logging.log4j;Logger;true;printf;(Level,String,Object[]);;Argument[1..2];log4j;manual",
// org.apache.logging.log4j.LogBuilder
"org.apache.logging.log4j;LogBuilder;true;log;(CharSequence);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Message);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Object);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object[]);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object);;Argument[0..2];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object);;Argument[0..3];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object);;Argument[0..4];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Supplier[]);;Argument[0..1];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(Supplier);;Argument[0];log4j",
"org.apache.logging.log4j;LogBuilder;true;log;(CharSequence);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Message);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Object);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String);;Argument[0];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object[]);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object);;Argument[0..2];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object);;Argument[0..3];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object);;Argument[0..4];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object);;Argument[0..5];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object);;Argument[0..6];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object);;Argument[0..7];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..8];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..9];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);;Argument[0..10];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(String,Supplier[]);;Argument[0..1];log4j;manual",
"org.apache.logging.log4j;LogBuilder;true;log;(Supplier);;Argument[0];log4j;manual",
// org.apache.logging.log4j.ThreadContext
"org.apache.logging.log4j;ThreadContext;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;ThreadContext;false;putIfNull;;;Argument[1];log4j",
"org.apache.logging.log4j;ThreadContext;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;ThreadContext;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;ThreadContext;false;putIfNull;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;ThreadContext;false;putAll;;;Argument[0];log4j;manual",
// org.apache.logging.log4j.CloseableThreadContext
"org.apache.logging.log4j;CloseableThreadContext;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;CloseableThreadContext;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;put;;;Argument[1];log4j",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;putAll;;;Argument[0];log4j",
"org.apache.logging.log4j;CloseableThreadContext;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext;false;putAll;;;Argument[0];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;put;;;Argument[1];log4j;manual",
"org.apache.logging.log4j;CloseableThreadContext$Instance;false;putAll;;;Argument[0];log4j;manual",
]
}
}