hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 19:55:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream-public/main' into yo-h/java16

Browse Source
This commit is contained in:
yo-h
2021-04-06 13:16:02 -04:00
parent 0200aedc2e 9a41c80626
commit cc63563a88
1037 changed files with 29383 additions and 18202 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.expected Normal file
View File

@@ -0,0 +1,5 @@
| InsecureLdapEndpoint.java:19:9:19:92 | setProperty(...) | LDAPS configuration allows insecure endpoint identification |
| InsecureLdapEndpoint.java:50:9:50:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |
| InsecureLdapEndpoint.java:68:9:68:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |
| InsecureLdapEndpoint.java:84:9:84:94 | setProperty(...) | LDAPS configuration allows insecure endpoint identification |
| InsecureLdapEndpoint.java:102:9:102:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |

106
java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.java Normal file
View File

@@ -0,0 +1,106 @@
import java.util.Hashtable;
import java.util.Properties;
import javax.naming.Context;
public class InsecureLdapEndpoint {
private static String PROP_DISABLE_LDAP_ENDPOINT_IDENTIFICATION = "com.sun.jndi.ldap.object.disableEndpointIdentification";
// BAD - Test configuration with disabled LDAPS endpoint check using `System.setProperty()`.
public Hashtable<String, String> createConnectionEnv() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
// Disable SSL endpoint check
System.setProperty("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
return env;
}
// GOOD - Test configuration without disabling LDAPS endpoint check.
public Hashtable<String, String> createConnectionEnv2() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
return env;
}
// BAD - Test configuration with disabled LDAPS endpoint check using `System.setProperties()`.
public Hashtable<String, String> createConnectionEnv3() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
// Disable SSL endpoint check
Properties properties = new Properties();
properties.setProperty("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
System.setProperties(properties);
return env;
}
// BAD - Test configuration with disabled LDAPS endpoint check using `HashTable.put()`.
public Hashtable<String, String> createConnectionEnv4() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
// Disable SSL endpoint check
Properties properties = new Properties();
properties.put("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
System.setProperties(properties);
return env;
}
// BAD - Test configuration with disabled LDAPS endpoint check using the `TRUE` boolean field.
public Hashtable<String, String> createConnectionEnv5() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
// Disable SSL endpoint check
System.setProperty(PROP_DISABLE_LDAP_ENDPOINT_IDENTIFICATION, Boolean.TRUE.toString());
return env;
}
// BAD - Test configuration with disabled LDAPS endpoint check using a boolean value.
public Hashtable<String, String> createConnectionEnv6() {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "secpassword");
// Disable SSL endpoint check
Properties properties = new Properties();
properties.put("com.sun.jndi.ldap.object.disableEndpointIdentification", true);
System.setProperties(properties);
return env;
}
}

1
java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql

7
java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.expected Normal file
View File

@@ -0,0 +1,7 @@
edges
| UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | UnvalidatedCors.java:27:67:27:69 | url |
nodes
| UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | semmle.label | getHeader(...) : String |
| UnvalidatedCors.java:27:67:27:69 | url | semmle.label | url |
#select
| UnvalidatedCors.java:27:67:27:69 | url | UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | UnvalidatedCors.java:27:67:27:69 | url | CORS header is being set using user controlled value $@. | UnvalidatedCors.java:21:22:21:48 | getHeader(...) | user-provided value |

37
java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.java Normal file
View File

@@ -0,0 +1,37 @@
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.StringUtils;
public class UnvalidatedCors implements Filter {
public void init(FilterConfig filterConfig) throws ServletException {}
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
String url = request.getHeader("Origin");
if (!StringUtils.isEmpty(url)) {
String val = response.getHeader("Access-Control-Allow-Origin");
if (StringUtils.isEmpty(val)) {
response.addHeader("Access-Control-Allow-Origin", url);
response.addHeader("Access-Control-Allow-Credentials", "true");
}
}
chain.doFilter(req, res);
}
public void destroy() {}
}

1
java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-346/UnvalidatedCors.ql

1
java/ql/test/experimental/query-tests/security/CWE-346/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/apache-commons-lang3-3.7

79
java/ql/test/experimental/query-tests/security/CWE-502/SpringExporterUnsafeDeserialization.java Normal file
View File

@@ -0,0 +1,79 @@
import org.springframework.boot.SpringBootConfiguration;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter;
import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
@Configuration
public class SpringExporterUnsafeDeserialization {
@Bean(name = "/unsafeHttpInvokerServiceExporter")
HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
exporter.setService(new AccountServiceImpl());
exporter.setServiceInterface(AccountService.class);
return exporter;
}
@Bean(name = "/unsafeCustomeRemoteInvocationSerializingExporter")
RemoteInvocationSerializingExporter unsafeCustomeRemoteInvocationSerializingExporter() {
return new CustomeRemoteInvocationSerializingExporter();
}
HttpInvokerServiceExporter notABean() {
HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
exporter.setService(new AccountServiceImpl());
exporter.setServiceInterface(AccountService.class);
return exporter;
}
}
@SpringBootApplication
class SpringBootTestApplication {
@Bean(name = "/unsafeHttpInvokerServiceExporter")
HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
exporter.setService(new AccountServiceImpl());
exporter.setServiceInterface(AccountService.class);
return exporter;
}
}
@SpringBootConfiguration
class SpringBootTestConfiguration {
@Bean(name = "/unsafeHttpInvokerServiceExporter")
HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
exporter.setService(new AccountServiceImpl());
exporter.setServiceInterface(AccountService.class);
return exporter;
}
}
class CustomeRemoteInvocationSerializingExporter extends RemoteInvocationSerializingExporter {}
class NotAConfiguration {
@Bean(name = "/notAnEndpoint")
HttpInvokerServiceExporter notAnEndpoint() {
HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
exporter.setService(new AccountServiceImpl());
exporter.setServiceInterface(AccountService.class);
return exporter;
}
}
class AccountServiceImpl implements AccountService {
@Override
public String echo(String data) {
return data;
}
}
interface AccountService {
String echo(String data);
}

4
java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.expected Normal file
View File

@@ -0,0 +1,4 @@
| SpringExporterUnsafeDeserialization.java:12:32:12:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |
| SpringExporterUnsafeDeserialization.java:20:41:20:88 | unsafeCustomeRemoteInvocationSerializingExporter | Unsafe deserialization in a Spring exporter bean '/unsafeCustomeRemoteInvocationSerializingExporter' |
| SpringExporterUnsafeDeserialization.java:36:32:36:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |
| SpringExporterUnsafeDeserialization.java:48:32:48:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |

1
java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.ql

2
java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.expected Normal file
View File

@@ -0,0 +1,2 @@
| beans.xml:10:5:13:12 | /unsafeBooking | Unsafe deserialization in a Spring exporter bean '/unsafeBooking' |
| beans.xml:15:5:18:12 | org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean 'org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter' |

1
java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.ql

19
java/ql/test/experimental/query-tests/security/CWE-502/beans.xml Normal file
View File

@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
<bean id="anotherBookingService" class="com.gypsyengineer.server.CabBookingServiceImpl"/>
<bean name="/unsafeBooking" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
<property name="service" ref="anotherBookingService"/>
<property name="serviceInterface" value="com.gypsyengineer.api.CabBookingService"/>
</bean>
<bean class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
<property name="service" ref="anotherBookingService"/>
<property name="serviceInterface" value="com.gypsyengineer.api.CabBookingService"/>
</bean>
</beans>

1
java/ql/test/experimental/query-tests/security/CWE-502/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3

43
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected Normal file
View File

@@ -0,0 +1,43 @@
edges
| XQueryInjection.java:45:23:45:50 | getParameter(...) : String | XQueryInjection.java:51:35:51:38 | xqpe |
| XQueryInjection.java:59:23:59:50 | getParameter(...) : String | XQueryInjection.java:65:53:65:57 | query |
| XQueryInjection.java:73:32:73:59 | nameStr : String | XQueryInjection.java:79:35:79:38 | xqpe |
| XQueryInjection.java:86:33:86:60 | nameStr : String | XQueryInjection.java:92:53:92:57 | query |
| XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:104:35:104:38 | xqpe |
| XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:116:53:116:56 | name |
| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:129:35:129:38 | xqpe |
| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:142:53:142:54 | br |
| XQueryInjection.java:150:23:150:50 | getParameter(...) : String | XQueryInjection.java:155:29:155:32 | name |
| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:159:29:159:30 | br |
nodes
| XQueryInjection.java:45:23:45:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| XQueryInjection.java:51:35:51:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:59:23:59:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| XQueryInjection.java:65:53:65:57 | query | semmle.label | query |
| XQueryInjection.java:73:32:73:59 | nameStr : String | semmle.label | nameStr : String |
| XQueryInjection.java:79:35:79:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:86:33:86:60 | nameStr : String | semmle.label | nameStr : String |
| XQueryInjection.java:92:53:92:57 | query | semmle.label | query |
| XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
| XQueryInjection.java:104:35:104:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
| XQueryInjection.java:116:53:116:56 | name | semmle.label | name |
| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
| XQueryInjection.java:129:35:129:38 | xqpe | semmle.label | xqpe |
| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
| XQueryInjection.java:142:53:142:54 | br | semmle.label | br |
| XQueryInjection.java:150:23:150:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| XQueryInjection.java:155:29:155:32 | name | semmle.label | name |
| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
| XQueryInjection.java:159:29:159:30 | br | semmle.label | br |
#select
| XQueryInjection.java:51:35:51:38 | xqpe | XQueryInjection.java:45:23:45:50 | getParameter(...) : String | XQueryInjection.java:51:35:51:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:45:23:45:50 | getParameter(...) | this user input |
| XQueryInjection.java:65:53:65:57 | query | XQueryInjection.java:59:23:59:50 | getParameter(...) : String | XQueryInjection.java:65:53:65:57 | query | XQuery query might include code from $@. | XQueryInjection.java:59:23:59:50 | getParameter(...) | this user input |
| XQueryInjection.java:79:35:79:38 | xqpe | XQueryInjection.java:73:32:73:59 | nameStr : String | XQueryInjection.java:79:35:79:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:73:32:73:59 | nameStr | this user input |
| XQueryInjection.java:92:53:92:57 | query | XQueryInjection.java:86:33:86:60 | nameStr : String | XQueryInjection.java:92:53:92:57 | query | XQuery query might include code from $@. | XQueryInjection.java:86:33:86:60 | nameStr | this user input |
| XQueryInjection.java:104:35:104:38 | xqpe | XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:104:35:104:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:100:28:100:51 | getInputStream(...) | this user input |
| XQueryInjection.java:116:53:116:56 | name | XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:116:53:116:56 | name | XQuery query might include code from $@. | XQueryInjection.java:112:28:112:51 | getInputStream(...) | this user input |
| XQueryInjection.java:129:35:129:38 | xqpe | XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:129:35:129:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:124:28:124:51 | getInputStream(...) | this user input |
| XQueryInjection.java:142:53:142:54 | br | XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:142:53:142:54 | br | XQuery query might include code from $@. | XQueryInjection.java:137:28:137:51 | getInputStream(...) | this user input |
| XQueryInjection.java:155:29:155:32 | name | XQueryInjection.java:150:23:150:50 | getParameter(...) : String | XQueryInjection.java:155:29:155:32 | name | XQuery query might include code from $@. | XQueryInjection.java:150:23:150:50 | getParameter(...) | this user input |
| XQueryInjection.java:159:29:159:30 | br | XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:159:29:159:30 | br | XQuery query might include code from $@. | XQueryInjection.java:157:26:157:49 | getInputStream(...) | this user input |

195
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.java Normal file
View File

@@ -0,0 +1,195 @@
package com.vuln.v2.controller;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import javax.servlet.http.HttpServletRequest;
import javax.xml.namespace.QName;
import javax.xml.xquery.XQConnection;
import javax.xml.xquery.XQDataSource;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQExpression;
import javax.xml.xquery.XQItemType;
import javax.xml.xquery.XQPreparedExpression;
import javax.xml.xquery.XQResultSequence;
import net.sf.saxon.xqj.SaxonXQDataSource;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
@Controller
public class XQueryInjection {
public static void main(String[] args) throws Exception {
XQDataSource xqds = new SaxonXQDataSource();
XQConnection conn;
try {
String name = "admin";
String query = "declare variable $name as xs:string external;"
+ " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
expr.bindString(new QName("name"), name,
conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
XQResultSequence result = expr.executeQuery(query);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
} catch (XQException e) {
e.printStackTrace();
}
}
@RequestMapping
public void testRequestbad(HttpServletRequest request) throws Exception {
String name = request.getParameter("name");
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name
+ "'] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
XQResultSequence result = xqpe.executeQuery();
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testRequestbad1(HttpServletRequest request) throws Exception {
String name = request.getParameter("name");
XQDataSource xqds = new SaxonXQDataSource();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name
+ "'] return $user/password";
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
XQResultSequence result = expr.executeQuery(query);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testStringtbad(@RequestParam String nameStr) throws XQException {
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + nameStr
+ "'] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
XQResultSequence result = xqpe.executeQuery();
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testStringtbad1(@RequestParam String nameStr) throws XQException {
XQDataSource xqds = new SaxonXQDataSource();
String query = "for $user in doc(\"users.xml\")/Users/User[name='" + nameStr
+ "'] return $user/password";
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
XQResultSequence result = expr.executeQuery(query);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testInputStreambad(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
XQPreparedExpression xqpe = conn.prepareExpression(name);
XQResultSequence result = xqpe.executeQuery();
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testInputStreambad1(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
XQDataSource xqds = new SaxonXQDataSource();
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
XQResultSequence result = expr.executeQuery(name);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testReaderbad(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(name));
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
XQPreparedExpression xqpe = conn.prepareExpression(br);
XQResultSequence result = xqpe.executeQuery();
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testReaderbad1(HttpServletRequest request) throws Exception {
InputStream name = request.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(name));
XQDataSource xqds = new SaxonXQDataSource();
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
XQResultSequence result = expr.executeQuery(br);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void testExecuteCommandbad(HttpServletRequest request) throws Exception {
String name = request.getParameter("name");
XQDataSource xqds = new SaxonXQDataSource();
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
//bad code
expr.executeCommand(name);
//bad code
InputStream is = request.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(is));
expr.executeCommand(br);
expr.close();
}
@RequestMapping
public void good(HttpServletRequest request) throws XQException {
String name = request.getParameter("name");
XQDataSource ds = new SaxonXQDataSource();
XQConnection conn = ds.getConnection();
String query = "declare variable $name as xs:string external;"
+ " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
XQPreparedExpression xqpe = conn.prepareExpression(query);
xqpe.bindString(new QName("name"), name,
conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
XQResultSequence result = xqpe.executeQuery();
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
@RequestMapping
public void good1(HttpServletRequest request) throws XQException {
String name = request.getParameter("name");
String query = "declare variable $name as xs:string external;"
+ " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
XQDataSource xqds = new SaxonXQDataSource();
XQConnection conn = xqds.getConnection();
XQExpression expr = conn.createExpression();
expr.bindString(new QName("name"), name,
conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
XQResultSequence result = expr.executeQuery(query);
while (result.next()) {
System.out.println(result.getItemAsString(null));
}
}
}

1
java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-652/XQueryInjection.ql

1
java/ql/test/experimental/query-tests/security/CWE-652/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/saxon-xqj-9.x/:${testdir}/../../../../stubs/springframework-5.2.3/

11
java/ql/test/experimental/query-tests/security/CWE-759/HASH.java Normal file
View File

@@ -0,0 +1,11 @@
import java.security.NoSuchAlgorithmException;
public interface HASH {
void init() throws NoSuchAlgorithmException;
int getBlockSize();
void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException;
byte[] digest() throws NoSuchAlgorithmException;
}

19
java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.expected Normal file
View File

@@ -0,0 +1,19 @@
edges
| HashWithoutSalt.java:10:36:10:43 | password : String | HashWithoutSalt.java:10:36:10:54 | getBytes(...) |
| HashWithoutSalt.java:25:13:25:20 | password : String | HashWithoutSalt.java:25:13:25:31 | getBytes(...) |
| HashWithoutSalt.java:93:22:93:29 | password : String | HashWithoutSalt.java:94:17:94:25 | passBytes |
| HashWithoutSalt.java:111:22:111:29 | password : String | HashWithoutSalt.java:112:18:112:26 | passBytes |
nodes
| HashWithoutSalt.java:10:36:10:43 | password : String | semmle.label | password : String |
| HashWithoutSalt.java:10:36:10:54 | getBytes(...) | semmle.label | getBytes(...) |
| HashWithoutSalt.java:25:13:25:20 | password : String | semmle.label | password : String |
| HashWithoutSalt.java:25:13:25:31 | getBytes(...) | semmle.label | getBytes(...) |
| HashWithoutSalt.java:93:22:93:29 | password : String | semmle.label | password : String |
| HashWithoutSalt.java:94:17:94:25 | passBytes | semmle.label | passBytes |
| HashWithoutSalt.java:111:22:111:29 | password : String | semmle.label | password : String |
| HashWithoutSalt.java:112:18:112:26 | passBytes | semmle.label | passBytes |
#select
| HashWithoutSalt.java:10:36:10:54 | getBytes(...) | HashWithoutSalt.java:10:36:10:43 | password : String | HashWithoutSalt.java:10:36:10:54 | getBytes(...) | $@ is hashed without a salt. | HashWithoutSalt.java:10:36:10:43 | password : String | The password |
| HashWithoutSalt.java:25:13:25:31 | getBytes(...) | HashWithoutSalt.java:25:13:25:20 | password : String | HashWithoutSalt.java:25:13:25:31 | getBytes(...) | $@ is hashed without a salt. | HashWithoutSalt.java:25:13:25:20 | password : String | The password |
| HashWithoutSalt.java:94:17:94:25 | passBytes | HashWithoutSalt.java:93:22:93:29 | password : String | HashWithoutSalt.java:94:17:94:25 | passBytes | $@ is hashed without a salt. | HashWithoutSalt.java:93:22:93:29 | password : String | The password |
| HashWithoutSalt.java:112:18:112:26 | passBytes | HashWithoutSalt.java:111:22:111:29 | password : String | HashWithoutSalt.java:112:18:112:26 | passBytes | $@ is hashed without a salt. | HashWithoutSalt.java:111:22:111:29 | password : String | The password |

147
java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.java Normal file
View File

@@ -0,0 +1,147 @@
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Base64;
public class HashWithoutSalt {
// BAD - Hash without a salt.
public String getSHA256Hash(String password) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] messageDigest = md.digest(password.getBytes());
return Base64.getEncoder().encodeToString(messageDigest);
}
// GOOD - Hash with a salt.
public String getSHA256Hash(String password, byte[] salt) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(salt);
byte[] messageDigest = md.digest(password.getBytes());
return Base64.getEncoder().encodeToString(messageDigest);
}
// BAD - Hash without a salt.
public String getSHA256Hash2(String password) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(password.getBytes());
byte[] messageDigest = md.digest();
return Base64.getEncoder().encodeToString(messageDigest);
}
// GOOD - Hash with a salt.
public String getSHA256Hash2(String password, byte[] salt) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(salt);
md.update(password.getBytes());
byte[] messageDigest = md.digest();
return Base64.getEncoder().encodeToString(messageDigest);
}
// GOOD - Hash with a salt concatenated with the password.
public String getSHA256Hash3(String password, byte[] salt) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] passBytes = password.getBytes();
byte[] allBytes = new byte[passBytes.length + salt.length];
System.arraycopy(passBytes, 0, allBytes, 0, passBytes.length);
System.arraycopy(salt, 0, allBytes, passBytes.length, salt.length);
byte[] messageDigest = md.digest(allBytes);
byte[] cipherBytes = new byte[32 + salt.length]; // SHA-256 is 32 bytes long
System.arraycopy(messageDigest, 0, cipherBytes, 0, 32);
System.arraycopy(salt, 0, cipherBytes, 32, salt.length);
return Base64.getEncoder().encodeToString(cipherBytes);
}
// GOOD - Hash with a given salt stored somewhere else.
public String getSHA256Hash(String password, String salt) throws NoSuchAlgorithmException {
MessageDigest alg = MessageDigest.getInstance("SHA-256");
String payload = password+":"+salt;
return Base64.getEncoder().encodeToString(alg.digest(payload.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
}
// GOOD - Hash with a given salt stored somewhere else.
public String getSHA256Hash2(String password, String salt, boolean useSalt) throws NoSuchAlgorithmException {
MessageDigest alg = MessageDigest.getInstance("SHA-256");
String payload = useSalt?password+":"+salt:password;
return Base64.getEncoder().encodeToString(alg.digest(payload.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
}
// GOOD - Hash with a salt for a variable named passwordHash, whose value is a hash used as an input for a hashing function.
public String getSHA256Hash3(String passwordHash) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] messageDigest = md.digest(passwordHash.getBytes());
return Base64.getEncoder().encodeToString(messageDigest);
}
public void update(SHA256 sha256, byte[] foo, int start, int len) throws NoSuchAlgorithmException {
sha256.update(foo, start, len);
}
// GOOD - Invoking a wrapper implementation through qualifier with a salt.
public String getWrapperSHA256Hash(String password) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
SHA256 sha256 = new SHA256();
byte[] salt = getSalt();
byte[] passBytes = password.getBytes();
sha256.update(passBytes, 0, passBytes.length);
sha256.update(salt, 0, salt.length);
return Base64.getEncoder().encodeToString(sha256.digest());
}
// BAD - Invoking a wrapper implementation through qualifier without a salt.
public String getWrapperSHA256Hash2(String password) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
SHA256 sha256 = new SHA256();
byte[] passBytes = password.getBytes();
sha256.update(passBytes, 0, passBytes.length);
return Base64.getEncoder().encodeToString(sha256.digest());
}
// GOOD - Invoking a wrapper implementation through qualifier and argument with a salt.
public String getWrapperSHA256Hash3(String password) throws NoSuchAlgorithmException {
SHA256 sha256 = new SHA256();
byte[] salt = getSalt();
byte[] passBytes = password.getBytes();
sha256.update(passBytes, 0, passBytes.length);
update(sha256, salt, 0, salt.length);
return Base64.getEncoder().encodeToString(sha256.digest());
}
// BAD - Invoking a wrapper implementation through argument without a salt.
public String getWrapperSHA256Hash4(String password) throws NoSuchAlgorithmException {
SHA256 sha256 = new SHA256();
byte[] passBytes = password.getBytes();
update(sha256, passBytes, 0, passBytes.length);
return Base64.getEncoder().encodeToString(sha256.digest());
}
// GOOD - Invoking a wrapper implementation through argument with a salt.
public String getWrapperSHA256Hash5(String password) throws NoSuchAlgorithmException {
SHA256 sha256 = new SHA256();
byte[] salt = getSalt();
byte[] passBytes = password.getBytes();
update(sha256, passBytes, 0, passBytes.length);
update(sha256, salt, 0, salt.length);
return Base64.getEncoder().encodeToString(sha256.digest());
}
// BAD - Invoke a wrapper implementation with a salt, which is not detected with an interface type variable.
public String getSHA512Hash8(byte[] passphrase) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
Class c = Class.forName("SHA512");
HASH sha512 = (HASH) (c.newInstance());
byte[] tmp = new byte[4];
byte[] key = new byte[32 * 2];
for (int i = 0; i < 2; i++) {
sha512.init();
tmp[3] = (byte) i;
sha512.update(passphrase, 0, passphrase.length);
System.arraycopy(sha512.digest(), 0, key, i * 32, 32);
}
return Base64.getEncoder().encodeToString(key);
}
public static byte[] getSalt() throws NoSuchAlgorithmException {
SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
byte[] salt = new byte[16];
sr.nextBytes(salt);
return salt;
}
}

1
java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE/CWE-759/HashWithoutSalt.ql

21
java/ql/test/experimental/query-tests/security/CWE-759/SHA256.java Normal file
View File

@@ -0,0 +1,21 @@
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class SHA256 implements HASH {
MessageDigest md;
public int getBlockSize() {return 32;}
public void init() throws NoSuchAlgorithmException {
try { md = MessageDigest.getInstance("SHA-256"); }
catch (Exception e){
System.err.println(e);
}
}
public void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException {
md.update(foo, start, len);
}
public byte[] digest() throws NoSuchAlgorithmException {
return md.digest();
}
}

21
java/ql/test/experimental/query-tests/security/CWE-759/SHA512.java Normal file
View File

@@ -0,0 +1,21 @@
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class SHA512 implements HASH {
MessageDigest md;
public int getBlockSize() {return 32;}
public void init() throws NoSuchAlgorithmException {
try { md = MessageDigest.getInstance("SHA-512"); }
catch (Exception e){
System.err.println(e);
}
}
public void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException {
md.update(foo, start, len);
}
public byte[] digest() throws NoSuchAlgorithmException {
return md.digest();
}
}

63
java/ql/test/library-tests/dataflow/lambda/Executor.java Normal file
View File

@@ -0,0 +1,63 @@
import java.lang.Runtime;
import java.util.function.Function;
public class Executor {
private static final Processor<String> processor = new Processor<String>();
private static String source() { return "taint"; }
public static void main(String[] args) {
exec1(source());
exec2(source());
exec3(source());
exec4(source());
exec5(source());
}
private static void exec1(String command){
command = process(s->s.toUpperCase(),command);
exec(command);
}
private static void exec2(String command){
command = process(s->"Taint stops here.",command);
exec(command);
}
private static void exec3(String command){
command = processor.process(s->s.toUpperCase(),command);
exec(command);
}
private static void exec4(String command){
command = processor.process(s->"Taint stops here.",command);
exec_b(command);
}
private static void exec5(String command){
command = processor.process(s->s.toUpperCase(),command);
exec_b(command);
}
public static String process(Function<String, String> fun, String command){
return processor.process(fun, command);
}
private static void exec(String command){
command = process(s->s.trim(),command);
try {
Runtime.getRuntime().exec(command);
}
catch(Exception e) {}
}
private static void exec_b(String command){
command = processor.process(s->s.trim(),command);
try {
Runtime.getRuntime().exec(command);
}
catch(Exception e) {}
}
}

9
java/ql/test/library-tests/dataflow/lambda/Processor.java Normal file
View File

@@ -0,0 +1,9 @@
import java.util.function.Function;
public class Processor<T> {
public <R> R process(Function<T,R> function, T arg) {
return function.apply(arg);
}
}

30
java/ql/test/library-tests/dataflow/lambda/StringProcessor.java Normal file
View File

@@ -0,0 +1,30 @@
import java.util.function.Function;
public class StringProcessor {
private static final Processor<String> processor = new Processor<String>();
public static void main(String[] args) {
String command = args[0];
lambdaExec(command);
}
public static void lambdaExec(String command){
processor.process(s->exec(s), command);
}
public static String lambdaUnrelated(String command){
return processor.process(s->s+"not related to anything", command);
}
public static String exec(String command){
try {
command = processor.process(s->s.trim(), command);
Runtime.getRuntime().exec(command);
return "Executed: "+command;
} catch(Exception e) {
return null;
}
}
}

8
java/ql/test/library-tests/dataflow/lambda/flow.expected Normal file
View File

@@ -0,0 +1,8 @@
| Executor.java:11:15:11:22 | source(...) | Executor.java:50:39:50:45 | command |
| Executor.java:11:15:11:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
| Executor.java:12:15:12:22 | source(...) | Executor.java:50:39:50:45 | command |
| Executor.java:12:15:12:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
| Executor.java:13:15:13:22 | source(...) | Executor.java:50:39:50:45 | command |
| Executor.java:13:15:13:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
| Executor.java:15:15:15:22 | source(...) | Executor.java:58:39:58:45 | command |
| StringProcessor.java:8:26:8:29 | args | StringProcessor.java:23:39:23:45 | command |

24
java/ql/test/library-tests/dataflow/lambda/flow.ql Normal file
View File

@@ -0,0 +1,24 @@
import java
import semmle.code.java.dataflow.TaintTracking
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest lambda" }
override predicate isSource(DataFlow::Node src) {
src.asExpr().(VarAccess).getVariable().hasName("args")
or
src.asExpr().(MethodAccess).getMethod().hasName("source")
}
override predicate isSink(DataFlow::Node sink) {
sink.asExpr().(Argument).getCall() =
any(MethodAccess ma |
ma.getMethod().hasName("exec") and
ma.getQualifier().(MethodAccess).getMethod().hasName("getRuntime")
)
}
}
from DataFlow::Node src, DataFlow::Node sink, Conf c
where c.hasFlow(src, sink)
select src, sink

75
java/ql/test/library-tests/frameworks/apache-commons-lang3/ArrayUtilsTest.java Normal file
View File

@@ -0,0 +1,75 @@
import org.apache.commons.lang3.ArrayUtils;
import java.io.StringReader;
import java.nio.CharBuffer;
import java.util.ArrayList;
import java.util.List;
import java.util.Locale;
class ArrayUtilsTest {
String taint() { return "tainted"; }
private static class IntSource {
static int taint() { return 0; }
}
void sink(Object o) {}
void test() throws Exception {
// All methods of this class copy the input array, so the incoming array should not be assigned taint.
String[] alreadyTainted = new String[] { taint() };
String[] clean = new String[] { "Untainted" };
sink(ArrayUtils.add(clean, 0, taint())); // $hasTaintFlow
sink(ArrayUtils.add(alreadyTainted, 0, "clean")); // $hasTaintFlow
sink(ArrayUtils.add(clean, IntSource.taint(), "clean")); // Index argument does not contribute taint
sink(ArrayUtils.add(clean, taint())); // $hasTaintFlow
sink(ArrayUtils.add(alreadyTainted, "clean")); // $hasTaintFlow
sink(ArrayUtils.addAll(clean, "clean", taint())); // $hasTaintFlow
sink(ArrayUtils.addAll(clean, taint(), "clean")); // $hasTaintFlow
sink(ArrayUtils.addAll(alreadyTainted, "clean", "also clean")); // $hasTaintFlow
sink(ArrayUtils.addFirst(clean, taint())); // $hasTaintFlow
sink(ArrayUtils.addFirst(alreadyTainted, "clean")); // $hasTaintFlow
sink(ArrayUtils.clone(alreadyTainted)); // $hasTaintFlow
sink(ArrayUtils.get(alreadyTainted, 0)); // $hasTaintFlow
sink(ArrayUtils.get(clean, IntSource.taint())); // Index argument does not contribute taint
sink(ArrayUtils.get(alreadyTainted, 0, "default value")); // $hasTaintFlow
sink(ArrayUtils.get(clean, IntSource.taint(), "default value")); // Index argument does not contribute taint
sink(ArrayUtils.get(clean, 0, taint())); // $hasTaintFlow
sink(ArrayUtils.insert(IntSource.taint(), clean, "value1", "value2")); // Index argument does not contribute taint
sink(ArrayUtils.insert(0, alreadyTainted, "value1", "value2")); // $hasTaintFlow
sink(ArrayUtils.insert(0, clean, taint(), "value2")); // $hasTaintFlow
sink(ArrayUtils.insert(0, clean, "value1", taint())); // $hasTaintFlow
sink(ArrayUtils.nullToEmpty(alreadyTainted)); // $hasTaintFlow
sink(ArrayUtils.nullToEmpty(alreadyTainted, String[].class)); // $hasTaintFlow
sink(ArrayUtils.remove(alreadyTainted, 0)); // $hasTaintFlow
sink(ArrayUtils.remove(clean, IntSource.taint())); // Index argument does not contribute taint
sink(ArrayUtils.removeAll(alreadyTainted, 0, 1)); // $hasTaintFlow
sink(ArrayUtils.removeAll(clean, IntSource.taint(), 1)); // Index argument does not contribute taint
sink(ArrayUtils.removeAll(clean, 0, IntSource.taint())); // Index argument does not contribute taint
sink(ArrayUtils.removeAllOccurences(clean, taint())); // Removed argument does not contribute taint
sink(ArrayUtils.removeAllOccurences(alreadyTainted, "value to remove")); // $hasTaintFlow
sink(ArrayUtils.removeAllOccurrences(clean, taint())); // Removed argument does not contribute taint
sink(ArrayUtils.removeAllOccurrences(alreadyTainted, "value to remove")); // $hasTaintFlow
sink(ArrayUtils.removeElement(clean, taint())); // Removed argument does not contribute taint
sink(ArrayUtils.removeElement(alreadyTainted, "value to remove")); // $hasTaintFlow
sink(ArrayUtils.removeElements(alreadyTainted, 0, 1)); // $hasTaintFlow
sink(ArrayUtils.removeElements(clean, IntSource.taint(), 1)); // Index argument does not contribute taint
sink(ArrayUtils.removeElements(clean, 0, IntSource.taint())); // Index argument does not contribute taint
sink(ArrayUtils.subarray(alreadyTainted, 0, 0)); // $hasTaintFlow
sink(ArrayUtils.subarray(clean, IntSource.taint(), IntSource.taint())); // Index arguments do not contribute taint
sink(ArrayUtils.toArray("clean", taint())); // $hasTaintFlow
sink(ArrayUtils.toArray(taint(), "clean")); // $hasTaintFlow
sink(ArrayUtils.toMap(alreadyTainted).get("key")); // $hasTaintFlow
// Check that none of the above had an effect on `clean`:
sink(clean);
int[] taintedInts = new int[] { IntSource.taint() };
Integer[] taintedBoxedInts = ArrayUtils.toObject(taintedInts);
sink(taintedBoxedInts); // $hasTaintFlow
sink(ArrayUtils.toPrimitive(taintedBoxedInts)); // $hasTaintFlow
sink(ArrayUtils.toPrimitive(new Integer[] {}, IntSource.taint())); // $hasTaintFlow
}
}

41
java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java Normal file
View File

@@ -0,0 +1,41 @@
import org.apache.commons.lang3.ObjectUtils;
public class ObjectUtilsTest {
String taint() { return "tainted"; }
private static class IntSource {
static int taint() { return 0; }
}
void sink(Object o) {}
void test() throws Exception {
sink(ObjectUtils.clone(taint())); // $hasValueFlow
sink(ObjectUtils.cloneIfPossible(taint())); // $hasValueFlow
sink(ObjectUtils.CONST(taint())); // $hasValueFlow
sink(ObjectUtils.CONST_SHORT(IntSource.taint())); // $hasValueFlow
sink(ObjectUtils.CONST_BYTE(IntSource.taint())); // $hasValueFlow
sink(ObjectUtils.defaultIfNull(taint(), null)); // $hasValueFlow
sink(ObjectUtils.defaultIfNull(null, taint())); // $hasValueFlow
sink(ObjectUtils.firstNonNull(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.firstNonNull(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.firstNonNull(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.getIfNull(taint(), null)); // $hasValueFlow
sink(ObjectUtils.max(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.max(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.max(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.median(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.median((String)null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.median((String)null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.min(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.min(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.min(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.mode(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.mode(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.mode(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
sink(ObjectUtils.requireNonEmpty(taint(), "message")); // $hasValueFlow
sink(ObjectUtils.requireNonEmpty("not null", taint())); // GOOD (message doesn't propagate to the return)
sink(ObjectUtils.toString(taint(), "default string")); // GOOD (first argument is stringified)
sink(ObjectUtils.toString(null, taint())); // $hasValueFlow
}
}

28
java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.ql
View File

@@ -2,8 +2,20 @@ import java
import semmle.code.java.dataflow.TaintTracking
import TestUtilities.InlineExpectationsTest
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest:frameworks:apache-commons-lang3" }
class TaintFlowConf extends TaintTracking::Configuration {
TaintFlowConf() { this = "qltest:frameworks:apache-commons-lang3-taint-flow" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("taint")
}
override predicate isSink(DataFlow::Node n) {
exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
}
}
class ValueFlowConf extends DataFlow::Configuration {
ValueFlowConf() { this = "qltest:frameworks:apache-commons-lang3-value-flow" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("taint")
@@ -17,11 +29,19 @@ class Conf extends TaintTracking::Configuration {
class HasFlowTest extends InlineExpectationsTest {
HasFlowTest() { this = "HasFlowTest" }
override string getARelevantTag() { result = "hasTaintFlow" }
override string getARelevantTag() { result = ["hasTaintFlow", "hasValueFlow"] }
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasTaintFlow" and
exists(DataFlow::Node src, DataFlow::Node sink, Conf conf | conf.hasFlow(src, sink) |
exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf | conf.hasFlow(src, sink) |
not any(ValueFlowConf vconf).hasFlow(src, sink) and
sink.getLocation() = location and
element = sink.toString() and
value = ""
)
or
tag = "hasValueFlow" and
exists(DataFlow::Node src, DataFlow::Node sink, ValueFlowConf conf | conf.hasFlow(src, sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""

11
java/ql/test/library-tests/frameworks/guava/TestStrings.java → java/ql/test/library-tests/frameworks/guava/TestBase.java
View File

@@ -1,12 +1,9 @@
import com.google.common.base.Strings;
import com.google.common.base.Splitter;
import com.google.common.base.Joiner;
package com.google.common.base;
import java.util.Map;
import java.util.HashMap;
class TestStrings {
class TestBase {
String taint() { return "tainted"; }
void sink(Object o) {}
@@ -59,4 +56,8 @@ class TestStrings {
m.put("k2", x);
sink(safeJoiner.withKeyValueSeparator("=").join(m)); // $numTaintFlow=1
}
void test4() {
sink(Preconditions.checkNotNull(taint())); // $numTaintFlow=1
}
}

4
java/ql/test/library-tests/literals/literalBoolean.expected
View File

@@ -1 +1,3 @@
| literals/Literals.java:11:22:11:25 | true |
| literals/Literals.java:11:22:11:25 | true | true | true |
| literals/Literals.java:16:3:16:6 | true | true | true |
| literals/Literals.java:17:3:17:7 | false | false | false |

2
java/ql/test/library-tests/literals/literalBoolean.ql
View File

@@ -2,4 +2,4 @@ import semmle.code.java.Expr
from BooleanLiteral lit
where lit.getCompilationUnit().fromSource()
select lit
select lit, lit.getValue(), lit.getBooleanValue()

11
java/ql/test/library-tests/literals/literalChar.expected
View File

@@ -1 +1,10 @@
| literals/Literals.java:12:22:12:24 | 'x' |
| literals/Literals.java:12:22:12:24 | 'x' | x |
| literals/Literals.java:21:3:21:5 | 'a' | a |
| literals/Literals.java:22:3:22:10 | '\\u0061' | a |
| literals/Literals.java:23:3:23:10 | '\\u0000' | \u0000 |
| literals/Literals.java:24:3:24:6 | '\\0' | \u0000 |
| literals/Literals.java:25:3:25:6 | '\\n' | \n |
| literals/Literals.java:26:3:26:6 | '\\0' | \u0000 |
| literals/Literals.java:27:3:27:6 | '\\\\' | \\ |
| literals/Literals.java:28:3:28:6 | '\\'' | ' |
| literals/Literals.java:29:3:29:8 | '\\123' | S |

2
java/ql/test/library-tests/literals/literalChar.ql
View File

@@ -1,4 +1,4 @@
import semmle.code.java.Expr
from CharacterLiteral lit
select lit
select lit, lit.getValue()

17
java/ql/test/library-tests/literals/literalDouble.expected
View File

@@ -1 +1,16 @@
| literals/Literals.java:10:22:10:27 | 456.0D |
| literals/Literals.java:10:22:10:27 | 456.0D | 456.0 | 456.0 |
| literals/Literals.java:33:3:33:5 | 0.0 | 0.0 | 0.0 |
| literals/Literals.java:34:3:34:4 | 0d | 0.0 | 0.0 |
| literals/Literals.java:35:3:35:5 | .0d | 0.0 | 0.0 |
| literals/Literals.java:36:3:36:4 | .0 | 0.0 | 0.0 |
| literals/Literals.java:37:4:37:6 | 0.d | 0.0 | 0.0 |
| literals/Literals.java:38:4:38:6 | 0.d | 0.0 | 0.0 |
| literals/Literals.java:39:3:39:22 | 1.234567890123456789 | 1.2345678901234567 | 1.2345678901234567 |
| literals/Literals.java:40:3:40:24 | 1.55555555555555555555 | 1.5555555555555556 | 1.5555555555555556 |
| literals/Literals.java:42:3:42:5 | 1e1 | 10.0 | 10.0 |
| literals/Literals.java:43:3:43:24 | 1.7976931348623157E308 | 1.7976931348623157E308 | 1.7976931348623157E308 |
| literals/Literals.java:44:4:44:25 | 1.7976931348623157E308 | 1.7976931348623157E308 | 1.7976931348623157E308 |
| literals/Literals.java:45:3:45:28 | 0x1.f_ffff_ffff_ffffP+1023 | 1.7976931348623157E308 | 1.7976931348623157E308 |
| literals/Literals.java:46:3:46:10 | 4.9e-324 | 4.9E-324 | 4.9E-324 |
| literals/Literals.java:47:3:47:28 | 0x0.0_0000_0000_0001P-1022 | 4.9E-324 | 4.9E-324 |
| literals/Literals.java:48:3:48:13 | 0x1.0P-1074 | 4.9E-324 | 4.9E-324 |

2
java/ql/test/library-tests/literals/literalDouble.ql
View File

@@ -1,4 +1,4 @@
import semmle.code.java.Expr
from DoubleLiteral lit
select lit
select lit, lit.getValue(), lit.getDoubleValue()

17
java/ql/test/library-tests/literals/literalFloat.expected
View File

@@ -1 +1,16 @@
| literals/Literals.java:9:22:9:27 | 123.0F |
| literals/Literals.java:9:22:9:27 | 123.0F | 123.0 | 123.0 |
| literals/Literals.java:52:3:52:6 | 0.0f | 0.0 | 0.0 |
| literals/Literals.java:53:3:53:4 | 0f | 0.0 | 0.0 |
| literals/Literals.java:54:3:54:5 | .0f | 0.0 | 0.0 |
| literals/Literals.java:55:4:55:6 | 0.f | 0.0 | 0.0 |
| literals/Literals.java:56:4:56:6 | 0.f | 0.0 | 0.0 |
| literals/Literals.java:57:3:57:10 | 1_0_0.0f | 100.0 | 100.0 |
| literals/Literals.java:58:3:58:23 | 1.234567890123456789f | 1.2345679 | 1.2345679 |
| literals/Literals.java:59:3:59:25 | 1.55555555555555555555f | 1.5555556 | 1.5555556 |
| literals/Literals.java:61:3:61:6 | 1e1f | 10.0 | 10.0 |
| literals/Literals.java:62:3:62:15 | 3.4028235e38f | 3.4028235E38 | 3.4028235E38 |
| literals/Literals.java:63:4:63:16 | 3.4028235e38f | 3.4028235E38 | 3.4028235E38 |
| literals/Literals.java:64:3:64:18 | 0x1.fffffeP+127f | 3.4028235E38 | 3.4028235E38 |
| literals/Literals.java:65:3:65:10 | 1.4e-45f | 1.4E-45 | 1.4E-45 |
| literals/Literals.java:66:3:66:18 | 0x0.000002P-126f | 1.4E-45 | 1.4E-45 |
| literals/Literals.java:67:3:67:13 | 0x1.0P-149f | 1.4E-45 | 1.4E-45 |

2
java/ql/test/library-tests/literals/literalFloat.ql
View File

@@ -1,4 +1,4 @@
import semmle.code.java.Expr
from FloatingPointLiteral lit
select lit
select lit, lit.getValue(), lit.getFloatValue()

28
java/ql/test/library-tests/literals/literalInteger.expected
View File

@@ -1,8 +1,20 @@
| literals/Literals.java:7:22:7:24 | 123 |
| literals/Literals.java:14:16:14:26 | -2147483648 |
| literals/Literals.java:16:21:16:30 | 2147483647 |
| literals/Literals.java:18:20:18:29 | 0x80000000 |
| literals/Literals.java:20:10:20:11 | 23 |
| literals/Literals.java:20:15:20:16 | 19 |
| literals/Literals.java:21:10:21:11 | 23 |
| literals/Literals.java:21:15:21:16 | 19 |
| literals/Literals.java:7:22:7:24 | 123 | 123 | 123 |
| literals/Literals.java:71:3:71:3 | 0 | 0 | 0 |
| literals/Literals.java:72:3:72:5 | 0_0 | 0 | 0 |
| literals/Literals.java:73:3:73:7 | 0___0 | 0 | 0 |
| literals/Literals.java:74:3:74:6 | 0_12 | 10 | 10 |
| literals/Literals.java:75:3:75:7 | 0X012 | 18 | 18 |
| literals/Literals.java:76:3:76:10 | 0xaBcDeF | 11259375 | 11259375 |
| literals/Literals.java:77:3:77:6 | 0B11 | 3 | 3 |
| literals/Literals.java:78:3:78:12 | 0x80000000 | -2147483648 | -2147483648 |
| literals/Literals.java:79:3:79:12 | 2147483647 | 2147483647 | 2147483647 |
| literals/Literals.java:80:3:80:13 | -2147483648 | -2147483648 | -2147483648 |
| literals/Literals.java:82:3:82:13 | 0x7fff_ffff | 2147483647 | 2147483647 |
| literals/Literals.java:83:3:83:16 | 0177_7777_7777 | 2147483647 | 2147483647 |
| literals/Literals.java:84:3:84:43 | 0b0111_1111_1111_1111_1111_1111_1111_1111 | 2147483647 | 2147483647 |
| literals/Literals.java:85:3:85:13 | 0x8000_0000 | -2147483648 | -2147483648 |
| literals/Literals.java:86:3:86:16 | 0200_0000_0000 | -2147483648 | -2147483648 |
| literals/Literals.java:87:3:87:43 | 0b1000_0000_0000_0000_0000_0000_0000_0000 | -2147483648 | -2147483648 |
| literals/Literals.java:88:3:88:13 | 0xffff_ffff | -1 | -1 |
| literals/Literals.java:89:3:89:16 | 0377_7777_7777 | -1 | -1 |
| literals/Literals.java:90:3:90:43 | 0b1111_1111_1111_1111_1111_1111_1111_1111 | -1 | -1 |

2
java/ql/test/library-tests/literals/literalInteger.ql
View File

@@ -1,4 +1,4 @@
import semmle.code.java.Expr
from IntegerLiteral lit
select lit
select lit, lit.getValue(), lit.getIntValue()

24
java/ql/test/library-tests/literals/literalLong.expected
View File

@@ -1,4 +1,20 @@
| literals/Literals.java:8:22:8:25 | 456L |
| literals/Literals.java:15:18:15:38 | -9223372036854775808l |
| literals/Literals.java:17:23:17:42 | 9223372036854775807l |
| literals/Literals.java:19:22:19:40 | 0x8000000000000000L |
| literals/Literals.java:8:22:8:25 | 456L | 456 |
| literals/Literals.java:94:3:94:4 | 0l | 0 |
| literals/Literals.java:95:3:95:4 | 0L | 0 |
| literals/Literals.java:96:3:96:6 | 0_0L | 0 |
| literals/Literals.java:97:3:97:8 | 0___0L | 0 |
| literals/Literals.java:98:3:98:7 | 0_12L | 10 |
| literals/Literals.java:99:3:99:8 | 0X012L | 18 |
| literals/Literals.java:100:3:100:11 | 0xaBcDeFL | 11259375 |
| literals/Literals.java:101:3:101:7 | 0B11L | 3 |
| literals/Literals.java:102:3:102:22 | 9223372036854775807L | 9223372036854775807 |
| literals/Literals.java:103:3:103:23 | -9223372036854775808L | -9223372036854775808 |
| literals/Literals.java:105:3:105:24 | 0x7fff_ffff_ffff_ffffL | 9223372036854775807 |
| literals/Literals.java:106:3:106:30 | 07_7777_7777_7777_7777_7777L | 9223372036854775807 |
| literals/Literals.java:107:3:107:84 | 0b0111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L | 9223372036854775807 |
| literals/Literals.java:108:3:108:24 | 0x8000_0000_0000_0000L | -9223372036854775808 |
| literals/Literals.java:109:3:109:31 | 010_0000_0000_0000_0000_0000L | -9223372036854775808 |
| literals/Literals.java:110:3:110:84 | 0b1000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000L | -9223372036854775808 |
| literals/Literals.java:111:3:111:24 | 0xffff_ffff_ffff_ffffL | -1 |
| literals/Literals.java:112:3:112:31 | 017_7777_7777_7777_7777_7777L | -1 |
| literals/Literals.java:113:3:113:84 | 0b1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L | -1 |

2
java/ql/test/library-tests/literals/literalLong.ql
View File

@@ -1,4 +1,4 @@
import semmle.code.java.Expr
from LongLiteral lit
select lit
select lit, lit.getValue()

26
java/ql/test/library-tests/literals/literalString.expected
View File

@@ -1,6 +1,20 @@
| literals/Literals.java:6:22:6:37 | "literal string" |
| literals/Literals.java:22:22:22:38 | "hello" + "world" |
| literals/Literals.java:23:24:23:47 | "hello" + ", " + "world" |
| literals/Literals.java:24:23:24:52 | "hello" + ", " + "world" + "!" |
| literals/Literals.java:25:22:25:36 | "hello,\\tworld" |
| literals/Literals.java:26:30:26:48 | "hello,\\u0009world" |
| literals/Literals.java:6:22:6:37 | "literal string" | literal string | literal string |
| literals/Literals.java:117:3:117:19 | "hello" + "world" | helloworld | helloworld |
| literals/Literals.java:118:3:118:17 | "hello,\\tworld" | hello,\tworld | hello,\tworld |
| literals/Literals.java:119:3:119:21 | "hello,\\u0009world" | hello,\tworld | hello,\tworld |
| literals/Literals.java:120:3:120:10 | "\\u0061" | a | a |
| literals/Literals.java:121:3:121:6 | "\\0" | \u0000 | \u0000 |
| literals/Literals.java:122:3:122:9 | "\\0000" | \u00000 | \u00000 |
| literals/Literals.java:123:3:123:6 | "\\"" | " | " |
| literals/Literals.java:124:3:124:6 | "\\'" | ' | ' |
| literals/Literals.java:125:3:125:6 | "\\n" | \n | \n |
| literals/Literals.java:126:3:126:6 | "\\\\" | \\ | \\ |
| literals/Literals.java:127:3:127:13 | "test \\123" | test S | test S |
| literals/Literals.java:128:3:128:9 | "\\1234" | S4 | S4 |
| literals/Literals.java:129:3:129:13 | "\\u0061567" | a567 | a567 |
| literals/Literals.java:130:3:130:13 | "\\u1234567" | \u1234567 | \u1234567 |
| literals/Literals.java:131:3:131:18 | "\\uaBcDeF\\u0aB1" | \uabcdeF\u0ab1 | \uabcdeF\u0ab1 |
| literals/Literals.java:132:3:132:16 | "\\uD800\\uDC00" | \ud800\udc00 | \ud800\udc00 |
| literals/Literals.java:134:3:134:10 | "\\uD800" | ? | ? |
| literals/Literals.java:135:3:135:10 | "\\uDC00" | ? | ? |
| literals/Literals.java:136:3:136:31 | "hello\\uD800hello\\uDC00world" | hello?hello?world | hello?hello?world |

2
java/ql/test/library-tests/literals/literalString.ql
View File

@@ -2,4 +2,4 @@ import semmle.code.java.Expr
from StringLiteral lit
where lit.getFile().(CompilationUnit).fromSource()
select lit
select lit, lit.getValue(), lit.getRepresentedString()

137
java/ql/test/library-tests/literals/literals/Literals.java
View File

@@ -11,17 +11,128 @@ public class Literals {
System.out.println(true);
System.out.println('x');
}
int min_int = -2147483648;
long min_long = -9223372036854775808l;
int neg_max_int = -2147483647;
long neg_max_long = -9223372036854775807l;
int alt_min_int = 0x80000000;
long alt_min_long = 0x8000000000000000L;
int i = 23 + 19;
int j = 23 +19;
String twostrings = "hello" + "world";
String threestrings = "hello" + ", " + "world";
String fourstrings = "hello" + ", " + "world" + "!";
String escape_seq = "hello,\tworld";
String unicode_escape_seq = "hello,\u0009world";
boolean[] booleans = {
true,
false
};
char[] chars = {
'a',
'\u0061', // 'a'
'\u0000',
'\0',
'\n',
'\0',
'\\',
'\'',
'\123' // octal escape sequence for 'S'
};
double[] doubles = {
0.0,
0d,
.0d,
.0,
-0.d,
+0.d,
1.234567890123456789,
1.55555555555555555555,
// From the JLS
1e1,
1.7976931348623157E308,
-1.7976931348623157E308,
0x1.f_ffff_ffff_ffffP+1023,
4.9e-324,
0x0.0_0000_0000_0001P-1022,
0x1.0P-1074
};
float[] floats = {
0.0f,
0f,
.0f,
-0.f,
+0.f,
1_0_0.0f,
1.234567890123456789f,
1.55555555555555555555f,
// From the JLS
1e1f,
3.4028235e38f,
-3.4028235e38f,
0x1.fffffeP+127f,
1.4e-45f,
0x0.000002P-126f,
0x1.0P-149f
};
int[] ints = {
0,
0_0,
0___0,
0_12, // octal
0X012, // hex
0xaBcDeF, // hex
0B11, // binary
0x80000000,
2147483647,
-2147483648,
// From the JLS
0x7fff_ffff,
0177_7777_7777, // octal
0b0111_1111_1111_1111_1111_1111_1111_1111, // binary
0x8000_0000,
0200_0000_0000,
0b1000_0000_0000_0000_0000_0000_0000_0000,
0xffff_ffff,
0377_7777_7777,
0b1111_1111_1111_1111_1111_1111_1111_1111
};
long[] longs = {
0l,
0L,
0_0L,
0___0L,
0_12L, // octal
0X012L, // hex
0xaBcDeFL, // hex
0B11L, // binary
9223372036854775807L,
-9223372036854775808L,
// From the JLS
0x7fff_ffff_ffff_ffffL,
07_7777_7777_7777_7777_7777L, // octal
0b0111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L, // binary
0x8000_0000_0000_0000L,
010_0000_0000_0000_0000_0000L,
0b1000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000L,
0xffff_ffff_ffff_ffffL,
017_7777_7777_7777_7777_7777L,
0b1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L
};
String[] strings = {
"hello" + "world", // two separate literals
"hello,\tworld",
"hello,\u0009world",
"\u0061", // 'a'
"\0",
"\0000",
"\"",
"\'",
"\n",
"\\",
"test \123", // octal escape sequence for 'S'
"\1234", // octal escape followed by '4'
"\u0061567", // escape sequence for 'a' followed by "567"
"\u1234567", // '\u1234' followed by "567"
"\uaBcDeF\u0aB1", // '\uABCD' followed by "eF" followed by '\u0AB1'
"\uD800\uDC00", // surrogate pair
// Unpaired surrogates
"\uD800",
"\uDC00",
"hello\uD800hello\uDC00world"
};
}

6
java/ql/test/query-tests/BadAbsOfRandom/BadAbsOfRandom.expected Normal file
View File

@@ -0,0 +1,6 @@
| Test.java:10:5:10:25 | abs(...) | Incorrect computation of abs of signed integral random value. |
| Test.java:11:5:11:26 | abs(...) | Incorrect computation of abs of signed integral random value. |
| Test.java:14:5:14:35 | abs(...) | Incorrect computation of abs of signed integral random value. |
| Test.java:15:5:15:36 | abs(...) | Incorrect computation of abs of signed integral random value. |
| Test.java:20:5:20:27 | abs(...) | Incorrect computation of abs of signed integral random value. |
| Test.java:21:5:21:28 | abs(...) | Incorrect computation of abs of signed integral random value. |

1
java/ql/test/query-tests/BadAbsOfRandom/BadAbsOfRandom.qlref Normal file
View File

@@ -0,0 +1 @@
Likely Bugs/Arithmetic/BadAbsOfRandom.ql

29
java/ql/test/query-tests/BadAbsOfRandom/Test.java Normal file
View File

@@ -0,0 +1,29 @@
import java.util.Random;
import java.util.concurrent.ThreadLocalRandom;
import org.apache.commons.lang3.RandomUtils;
public class Test {
public static void test() {
Random r = new Random();
Math.abs(r.nextInt());
Math.abs(r.nextLong());
Math.abs(r.nextInt(100)); // GOOD: random value already has a restricted range
Math.abs(RandomUtils.nextInt());
Math.abs(RandomUtils.nextLong());
Math.abs(RandomUtils.nextInt(1, 10)); // GOOD: random value already has a restricted range
Math.abs(RandomUtils.nextLong(1, 10)); // GOOD: random value already has a restricted range
ThreadLocalRandom tlr = ThreadLocalRandom.current();
Math.abs(tlr.nextInt());
Math.abs(tlr.nextLong());
Math.abs(tlr.nextInt(10)); // GOOD: random value already has a restricted range
Math.abs(tlr.nextLong(10)); // GOOD: random value already has a restricted range
Math.abs(tlr.nextInt(1, 10)); // GOOD: random value already has a restricted range
Math.abs(tlr.nextLong(1, 10)); // GOOD: random value already has a restricted range
}
}

1
java/ql/test/query-tests/BadAbsOfRandom/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/apache-commons-lang3-3.7

1
java/ql/test/query-tests/RandomUsedOnce/RandomUsedOnce.expected Normal file
View File

@@ -0,0 +1 @@
| Test.java:7:5:7:28 | nextInt(...) | Random object created and used only once. |

1
java/ql/test/query-tests/RandomUsedOnce/RandomUsedOnce.qlref Normal file
View File

@@ -0,0 +1 @@
Likely Bugs/Arithmetic/RandomUsedOnce.ql

11
java/ql/test/query-tests/RandomUsedOnce/Test.java Normal file
View File

@@ -0,0 +1,11 @@
import java.util.Random;
public class Test {
public static void test() {
(new Random()).nextInt();
}
}

10
java/ql/test/query-tests/RangeAnalysis/A.java
View File

@@ -1,3 +1,6 @@
import java.util.Random;
import org.apache.commons.lang3.RandomUtils;
public class A {
private static final int[] arr1 = new int[] { 1, 2, 3, 4, 5, 6, 7, 8 };
private final int[] arr2;
@@ -194,4 +197,11 @@ public class A {
}
}
}
static int m16() {
return A.arr1[(new Random()).nextInt(arr1.length + 1)] + // BAD: random int may be out of range
A.arr1[(new Random()).nextInt(arr1.length)] + // GOOD: random int must be in range
A.arr1[RandomUtils.nextInt(0, arr1.length + 1)] + // BAD: random int may be out of range
A.arr1[RandomUtils.nextInt(0, arr1.length)]; // GOOD: random int must be in range
}
}

30
java/ql/test/query-tests/RangeAnalysis/ArrayIndexOutOfBounds.expected
View File

@@ -1,14 +1,16 @@
| A.java:16:14:16:17 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:23:21:23:28 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:42:14:42:22 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:46:14:46:22 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:55:14:55:19 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:64:14:64:19 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:86:12:86:16 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:97:18:97:31 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 8. |
| A.java:110:14:110:21 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:111:14:111:21 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 1. |
| A.java:122:16:122:23 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 3. |
| A.java:134:16:134:23 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:182:9:182:13 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:192:9:192:13 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:19:14:19:17 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:26:21:26:28 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:45:14:45:22 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:49:14:49:22 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:58:14:58:19 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:67:14:67:19 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:89:12:89:16 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:100:18:100:31 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 8. |
| A.java:113:14:113:21 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:114:14:114:21 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 1. |
| A.java:125:16:125:23 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length + 3. |
| A.java:137:16:137:23 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:185:9:185:13 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:195:9:195:13 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:202:12:202:58 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |
| A.java:204:7:204:53 | ...[...] | This array access might be out of bounds, as the index might be equal to the array length. |

1
java/ql/test/query-tests/RangeAnalysis/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/apache-commons-lang3-3.7

8
java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayConstructionCodeSpecified.expected
View File

@@ -1,7 +1,7 @@
edges
| Test.java:86:16:86:16 | 0 : Number | Test.java:88:27:88:30 | size |
| Test.java:105:16:105:16 | 0 : Number | Test.java:107:27:107:30 | size |
nodes
| Test.java:86:16:86:16 | 0 : Number | semmle.label | 0 : Number |
| Test.java:88:27:88:30 | size | semmle.label | size |
| Test.java:105:16:105:16 | 0 : Number | semmle.label | 0 : Number |
| Test.java:107:27:107:30 | size | semmle.label | size |
#select
| Test.java:91:30:91:30 | 0 | Test.java:86:16:86:16 | 0 : Number | Test.java:88:27:88:30 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:88:19:88:31 | new int[] | array | Test.java:86:16:86:16 | 0 | literal value 0 |
| Test.java:110:30:110:30 | 0 | Test.java:105:16:105:16 | 0 : Number | Test.java:107:27:107:30 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:107:19:107:31 | new int[] | array | Test.java:105:16:105:16 | 0 | literal value 0 |

14
java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayConstructionLocal.expected
View File

@@ -1,10 +1,10 @@
edges
| Test.java:57:27:57:60 | getProperty(...) : String | Test.java:61:31:61:34 | size |
| Test.java:57:27:57:60 | getProperty(...) : String | Test.java:67:34:67:37 | size |
| Test.java:76:27:76:60 | getProperty(...) : String | Test.java:80:31:80:34 | size |
| Test.java:76:27:76:60 | getProperty(...) : String | Test.java:86:34:86:37 | size |
nodes
| Test.java:57:27:57:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
| Test.java:61:31:61:34 | size | semmle.label | size |
| Test.java:67:34:67:37 | size | semmle.label | size |
| Test.java:76:27:76:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
| Test.java:80:31:80:34 | size | semmle.label | size |
| Test.java:86:34:86:37 | size | semmle.label | size |
#select
| Test.java:64:34:64:34 | 0 | Test.java:57:27:57:60 | getProperty(...) : String | Test.java:61:31:61:34 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:61:23:61:35 | new int[] | array | Test.java:57:27:57:60 | getProperty(...) | User-provided value |
| Test.java:70:37:70:37 | 0 | Test.java:57:27:57:60 | getProperty(...) : String | Test.java:67:34:67:37 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:67:26:67:38 | new int[] | array | Test.java:57:27:57:60 | getProperty(...) | User-provided value |
| Test.java:83:34:83:34 | 0 | Test.java:76:27:76:60 | getProperty(...) : String | Test.java:80:31:80:34 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:80:23:80:35 | new int[] | array | Test.java:76:27:76:60 | getProperty(...) | User-provided value |
| Test.java:89:37:89:37 | 0 | Test.java:76:27:76:60 | getProperty(...) : String | Test.java:86:34:86:37 | size | The $@ is accessed here, but the array is initialized using $@ which may be zero. | Test.java:86:26:86:38 | new int[] | array | Test.java:76:27:76:60 | getProperty(...) | User-provided value |

42
java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayIndexCodeSpecified.expected
View File

@@ -1,19 +1,29 @@
edges
| Test.java:40:17:40:48 | nextInt(...) : Number | Test.java:43:30:43:34 | index |
| Test.java:40:17:40:48 | nextInt(...) : Number | Test.java:47:32:47:36 | index |
| Test.java:40:17:40:48 | nextInt(...) : Number | Test.java:51:39:51:43 | index |
| Test.java:93:17:93:17 | 0 : Number | Test.java:96:32:96:36 | index |
| ../../../../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/RandomUtils.java:34:14:34:14 | 0 : Number | Test.java:59:17:59:42 | nextInt(...) : Number |
| Test.java:41:17:41:48 | nextInt(...) : Number | Test.java:44:30:44:34 | index |
| Test.java:41:17:41:48 | nextInt(...) : Number | Test.java:48:32:48:36 | index |
| Test.java:41:17:41:48 | nextInt(...) : Number | Test.java:52:39:52:43 | index |
| Test.java:59:17:59:42 | nextInt(...) : Number | Test.java:62:30:62:34 | index |
| Test.java:59:17:59:42 | nextInt(...) : Number | Test.java:66:32:66:36 | index |
| Test.java:59:17:59:42 | nextInt(...) : Number | Test.java:70:39:70:43 | index |
| Test.java:112:17:112:17 | 0 : Number | Test.java:115:32:115:36 | index |
nodes
| Test.java:40:17:40:48 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:43:30:43:34 | index | semmle.label | index |
| Test.java:47:32:47:36 | index | semmle.label | index |
| Test.java:51:39:51:43 | index | semmle.label | index |
| Test.java:64:34:64:34 | 0 | semmle.label | 0 |
| Test.java:70:37:70:37 | 0 | semmle.label | 0 |
| Test.java:77:39:77:39 | 0 | semmle.label | 0 |
| Test.java:91:30:91:30 | 0 | semmle.label | 0 |
| Test.java:93:17:93:17 | 0 : Number | semmle.label | 0 : Number |
| Test.java:96:32:96:36 | index | semmle.label | index |
| Test.java:102:30:102:30 | 0 | semmle.label | 0 |
| ../../../../../stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/RandomUtils.java:34:14:34:14 | 0 : Number | semmle.label | 0 : Number |
| Test.java:41:17:41:48 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:44:30:44:34 | index | semmle.label | index |
| Test.java:48:32:48:36 | index | semmle.label | index |
| Test.java:52:39:52:43 | index | semmle.label | index |
| Test.java:59:17:59:42 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:62:30:62:34 | index | semmle.label | index |
| Test.java:66:32:66:36 | index | semmle.label | index |
| Test.java:70:39:70:43 | index | semmle.label | index |
| Test.java:83:34:83:34 | 0 | semmle.label | 0 |
| Test.java:89:37:89:37 | 0 | semmle.label | 0 |
| Test.java:96:39:96:39 | 0 | semmle.label | 0 |
| Test.java:110:30:110:30 | 0 | semmle.label | 0 |
| Test.java:112:17:112:17 | 0 : Number | semmle.label | 0 : Number |
| Test.java:115:32:115:36 | index | semmle.label | index |
| Test.java:121:30:121:30 | 0 | semmle.label | 0 |
#select
| Test.java:43:30:43:34 | index | Test.java:40:17:40:48 | nextInt(...) : Number | Test.java:43:30:43:34 | index | $@ flows to the index used in this array access, and may cause the operation to throw an ArrayIndexOutOfBoundsException. | Test.java:40:17:40:48 | nextInt(...) | Random value |
| Test.java:44:30:44:34 | index | Test.java:41:17:41:48 | nextInt(...) : Number | Test.java:44:30:44:34 | index | $@ flows to the index used in this array access, and may cause the operation to throw an ArrayIndexOutOfBoundsException. | Test.java:41:17:41:48 | nextInt(...) | Random value |
| Test.java:62:30:62:34 | index | Test.java:59:17:59:42 | nextInt(...) : Number | Test.java:62:30:62:34 | index | $@ flows to the index used in this array access, and may cause the operation to throw an ArrayIndexOutOfBoundsException. | Test.java:59:17:59:42 | nextInt(...) | Random value |

8
java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayIndexLocal.expected
View File

@@ -1,7 +1,7 @@
edges
| Test.java:13:27:13:60 | getProperty(...) : String | Test.java:18:34:18:38 | index |
| Test.java:14:27:14:60 | getProperty(...) : String | Test.java:19:34:19:38 | index |
nodes
| Test.java:13:27:13:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
| Test.java:18:34:18:38 | index | semmle.label | index |
| Test.java:14:27:14:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
| Test.java:19:34:19:38 | index | semmle.label | index |
#select
| Test.java:18:34:18:38 | index | Test.java:13:27:13:60 | getProperty(...) : String | Test.java:18:34:18:38 | index | $@ flows to here and is used as an index causing an ArrayIndexOutOfBoundsException. | Test.java:13:27:13:60 | getProperty(...) | User-provided value |
| Test.java:19:34:19:38 | index | Test.java:14:27:14:60 | getProperty(...) : String | Test.java:19:34:19:38 | index | $@ flows to here and is used as an index causing an ArrayIndexOutOfBoundsException. | Test.java:14:27:14:60 | getProperty(...) | User-provided value |

21
java/ql/test/query-tests/security/CWE-129/semmle/tests/Test.java
View File

@@ -5,6 +5,7 @@
package test.cwe129.cwe.examples;
import java.security.SecureRandom;
import org.apache.commons.lang3.RandomUtils;
class Test {
public static void basic() {
@@ -52,6 +53,24 @@ class Test {
}
}
public static void apacheRandom() {
int array[] = { 0, 1, 2, 3, 4 };
int index = RandomUtils.nextInt(0, 10);
// BAD Accessing array without conditional check
System.out.println(array[index]);
if (index < array.length) {
// GOOD Accessing array under conditions
System.out.println(array[index]);
}
// GOOD, the array access is protected by short-circuiting
if (index < array.length && array[index] > 0) {
}
}
public static void construction() {
String userProperty = System.getProperty("userProperty");
@@ -101,4 +120,4 @@ class Test {
// GOOD array size is guaranteed to be larger than zero
System.out.println(array[0]);
}
}
}

1
java/ql/test/query-tests/security/CWE-129/semmle/tests/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-commons-lang3-3.7

21
java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticUncontrolled.expected
View File

@@ -1,10 +1,17 @@
edges
| Test.java:205:14:205:57 | nextInt(...) : Number | Test.java:209:17:209:20 | data |
| Test.java:205:14:205:57 | nextInt(...) : Number | Test.java:240:37:240:40 | data |
| Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:210:17:210:20 | data |
| Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:241:37:241:40 | data |
| Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:249:17:249:21 | data2 |
| Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:280:37:280:41 | data2 |
nodes
| Test.java:205:14:205:57 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:209:17:209:20 | data | semmle.label | data |
| Test.java:240:37:240:40 | data | semmle.label | data |
| Test.java:206:14:206:57 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:210:17:210:20 | data | semmle.label | data |
| Test.java:241:37:241:40 | data | semmle.label | data |
| Test.java:245:15:245:35 | nextInt(...) : Number | semmle.label | nextInt(...) : Number |
| Test.java:249:17:249:21 | data2 | semmle.label | data2 |
| Test.java:280:37:280:41 | data2 | semmle.label | data2 |
#select
| Test.java:209:17:209:24 | ... + ... | Test.java:205:14:205:57 | nextInt(...) : Number | Test.java:209:17:209:20 | data | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:205:14:205:57 | nextInt(...) | Uncontrolled value |
| Test.java:240:37:240:46 | ... + ... | Test.java:205:14:205:57 | nextInt(...) : Number | Test.java:240:37:240:40 | data | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:205:14:205:57 | nextInt(...) | Uncontrolled value |
| Test.java:210:17:210:24 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:210:17:210:20 | data | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | Uncontrolled value |
| Test.java:241:37:241:46 | ... + ... | Test.java:206:14:206:57 | nextInt(...) : Number | Test.java:241:37:241:40 | data | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:206:14:206:57 | nextInt(...) | Uncontrolled value |
| Test.java:249:17:249:25 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:249:17:249:21 | data2 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | Uncontrolled value |
| Test.java:280:37:280:47 | ... + ... | Test.java:245:15:245:35 | nextInt(...) : Number | Test.java:280:37:280:41 | data2 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | Test.java:245:15:245:35 | nextInt(...) | Uncontrolled value |

56
java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticWithExtremeValues.expected
View File

@@ -1,31 +1,31 @@
edges
| Test.java:92:8:92:24 | Integer.MAX_VALUE : Number | Test.java:95:8:95:8 | i |
| Test.java:108:13:108:26 | Long.MIN_VALUE : Number | Test.java:110:13:110:13 | i |
| Test.java:137:9:137:25 | Integer.MAX_VALUE : Number | Test.java:138:14:138:14 | i |
| Test.java:143:12:143:28 | Integer.MAX_VALUE : Number | Test.java:146:14:146:14 | i |
| Test.java:184:13:184:26 | Byte.MAX_VALUE : Number | Test.java:187:39:187:39 | b |
| Test.java:191:14:191:28 | Short.MAX_VALUE : Number | Test.java:194:41:194:41 | s |
| Test.java:198:12:198:28 | Integer.MAX_VALUE : Number | Test.java:201:37:201:37 | i |
| Test.java:93:8:93:24 | Integer.MAX_VALUE : Number | Test.java:96:8:96:8 | i |
| Test.java:109:13:109:26 | Long.MIN_VALUE : Number | Test.java:111:13:111:13 | i |
| Test.java:138:9:138:25 | Integer.MAX_VALUE : Number | Test.java:139:14:139:14 | i |
| Test.java:144:12:144:28 | Integer.MAX_VALUE : Number | Test.java:147:14:147:14 | i |
| Test.java:185:13:185:26 | Byte.MAX_VALUE : Number | Test.java:188:39:188:39 | b |
| Test.java:192:14:192:28 | Short.MAX_VALUE : Number | Test.java:195:41:195:41 | s |
| Test.java:199:12:199:28 | Integer.MAX_VALUE : Number | Test.java:202:37:202:37 | i |
nodes
| Test.java:92:8:92:24 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:95:8:95:8 | i | semmle.label | i |
| Test.java:108:13:108:26 | Long.MIN_VALUE : Number | semmle.label | Long.MIN_VALUE : Number |
| Test.java:110:13:110:13 | i | semmle.label | i |
| Test.java:137:9:137:25 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:138:14:138:14 | i | semmle.label | i |
| Test.java:143:12:143:28 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:146:14:146:14 | i | semmle.label | i |
| Test.java:184:13:184:26 | Byte.MAX_VALUE : Number | semmle.label | Byte.MAX_VALUE : Number |
| Test.java:187:39:187:39 | b | semmle.label | b |
| Test.java:191:14:191:28 | Short.MAX_VALUE : Number | semmle.label | Short.MAX_VALUE : Number |
| Test.java:194:41:194:41 | s | semmle.label | s |
| Test.java:198:12:198:28 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:201:37:201:37 | i | semmle.label | i |
| Test.java:93:8:93:24 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:96:8:96:8 | i | semmle.label | i |
| Test.java:109:13:109:26 | Long.MIN_VALUE : Number | semmle.label | Long.MIN_VALUE : Number |
| Test.java:111:13:111:13 | i | semmle.label | i |
| Test.java:138:9:138:25 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:139:14:139:14 | i | semmle.label | i |
| Test.java:144:12:144:28 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:147:14:147:14 | i | semmle.label | i |
| Test.java:185:13:185:26 | Byte.MAX_VALUE : Number | semmle.label | Byte.MAX_VALUE : Number |
| Test.java:188:39:188:39 | b | semmle.label | b |
| Test.java:192:14:192:28 | Short.MAX_VALUE : Number | semmle.label | Short.MAX_VALUE : Number |
| Test.java:195:41:195:41 | s | semmle.label | s |
| Test.java:199:12:199:28 | Integer.MAX_VALUE : Number | semmle.label | Integer.MAX_VALUE : Number |
| Test.java:202:37:202:37 | i | semmle.label | i |
#select
| Test.java:95:8:95:12 | ... + ... | Test.java:92:8:92:24 | Integer.MAX_VALUE : Number | Test.java:95:8:95:8 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:92:8:92:24 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:110:13:110:17 | ... - ... | Test.java:108:13:108:26 | Long.MIN_VALUE : Number | Test.java:110:13:110:13 | i | Variable i is assigned an extreme value $@, and may cause an underflow. | Test.java:108:13:108:26 | Long.MIN_VALUE | MIN_VALUE |
| Test.java:138:14:138:18 | ... + ... | Test.java:137:9:137:25 | Integer.MAX_VALUE : Number | Test.java:138:14:138:14 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:137:9:137:25 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:146:14:146:18 | ... + ... | Test.java:143:12:143:28 | Integer.MAX_VALUE : Number | Test.java:146:14:146:14 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:143:12:143:28 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:187:39:187:43 | ... + ... | Test.java:184:13:184:26 | Byte.MAX_VALUE : Number | Test.java:187:39:187:39 | b | Variable b is assigned an extreme value $@, and may cause an overflow. | Test.java:184:13:184:26 | Byte.MAX_VALUE | MAX_VALUE |
| Test.java:194:41:194:45 | ... + ... | Test.java:191:14:191:28 | Short.MAX_VALUE : Number | Test.java:194:41:194:41 | s | Variable s is assigned an extreme value $@, and may cause an overflow. | Test.java:191:14:191:28 | Short.MAX_VALUE | MAX_VALUE |
| Test.java:201:37:201:42 | ... + ... | Test.java:198:12:198:28 | Integer.MAX_VALUE : Number | Test.java:201:37:201:37 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:198:12:198:28 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:96:8:96:12 | ... + ... | Test.java:93:8:93:24 | Integer.MAX_VALUE : Number | Test.java:96:8:96:8 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:93:8:93:24 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:111:13:111:17 | ... - ... | Test.java:109:13:109:26 | Long.MIN_VALUE : Number | Test.java:111:13:111:13 | i | Variable i is assigned an extreme value $@, and may cause an underflow. | Test.java:109:13:109:26 | Long.MIN_VALUE | MIN_VALUE |
| Test.java:139:14:139:18 | ... + ... | Test.java:138:9:138:25 | Integer.MAX_VALUE : Number | Test.java:139:14:139:14 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:138:9:138:25 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:147:14:147:18 | ... + ... | Test.java:144:12:144:28 | Integer.MAX_VALUE : Number | Test.java:147:14:147:14 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:144:12:144:28 | Integer.MAX_VALUE | MAX_VALUE |
| Test.java:188:39:188:43 | ... + ... | Test.java:185:13:185:26 | Byte.MAX_VALUE : Number | Test.java:188:39:188:39 | b | Variable b is assigned an extreme value $@, and may cause an overflow. | Test.java:185:13:185:26 | Byte.MAX_VALUE | MAX_VALUE |
| Test.java:195:41:195:45 | ... + ... | Test.java:192:14:192:28 | Short.MAX_VALUE : Number | Test.java:195:41:195:41 | s | Variable s is assigned an extreme value $@, and may cause an overflow. | Test.java:192:14:192:28 | Short.MAX_VALUE | MAX_VALUE |
| Test.java:202:37:202:42 | ... + ... | Test.java:199:12:199:28 | Integer.MAX_VALUE : Number | Test.java:202:37:202:37 | i | Variable i is assigned an extreme value $@, and may cause an overflow. | Test.java:199:12:199:28 | Integer.MAX_VALUE | MAX_VALUE |

4
java/ql/test/query-tests/security/CWE-190/semmle/tests/InformationLoss.expected
View File

@@ -1,2 +1,2 @@
| Test.java:67:5:67:25 | ...+=... | Implicit cast of source type long to narrower destination type int. |
| Test.java:86:4:86:9 | ...+=... | Implicit cast of source type long to narrower destination type int. |
| Test.java:68:5:68:25 | ...+=... | Implicit cast of source type long to narrower destination type int. |
| Test.java:87:4:87:9 | ...+=... | Implicit cast of source type long to narrower destination type int. |

6
java/ql/test/query-tests/security/CWE-190/semmle/tests/IntMultToLong.expected
View File

@@ -1,3 +1,3 @@
| Test.java:20:23:20:48 | ... * ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:20:23:20:48 | ... * ... | int multiplication |
| Test.java:27:23:27:52 | ... + ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:27:23:27:48 | ... * ... | int multiplication |
| Test.java:34:23:34:63 | ...?...:... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:34:30:34:55 | ... * ... | int multiplication |
| Test.java:21:23:21:48 | ... * ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:21:23:21:48 | ... * ... | int multiplication |
| Test.java:28:23:28:52 | ... + ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:28:23:28:48 | ... * ... | int multiplication |
| Test.java:35:23:35:63 | ...?...:... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:35:30:35:55 | ... * ... | int multiplication |

40
java/ql/test/query-tests/security/CWE-190/semmle/tests/Test.java
View File

@@ -7,6 +7,7 @@ import java.io.InputStreamReader;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.HashMap;
import org.apache.commons.lang3.RandomUtils;
class Test {
public static void main(String[] args) {
@@ -239,6 +240,45 @@ class Test {
// subsequently cast to narrower type int
int widenedThenNarrowed = (int) (data + 10L);
}
// ArithmeticUncontrolled using Apache RandomUtils
int data2 = RandomUtils.nextInt();
{
// BAD: may overflow if data is large
int output = data2 + 1;
}
{
// GOOD: guarded
if (data2 < Integer.MAX_VALUE) {
int output = data2 + 1;
}
}
{
// guard against underflow
if (data2 > Integer.MIN_VALUE) {
int stillLarge = data2 - 1;
// FALSE NEGATIVE: stillLarge could still be very large, even
// after
// it has had arithmetic done on it
int output = stillLarge + 100;
}
}
{
// GOOD: uncontrolled int value is widened to type long, thus
// avoiding overflow
// (see binary numeric promotions in JLS 5.6.2)
long widened = data2 + 10L;
}
{
// BAD: uncontrolled int value is widened to type long, but
// subsequently cast to narrower type int
int widenedThenNarrowed = (int) (data2 + 10L);
}
}
public static long getLargeNumber() {

1
java/ql/test/query-tests/security/CWE-190/semmle/tests/options Normal file
View File

@@ -0,0 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/apache-commons-lang3-3.7

1383
java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/ArrayUtils.java Normal file
View File

File diff suppressed because it is too large Load Diff

221
java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/ObjectUtils.java Normal file
View File

@@ -0,0 +1,221 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.commons.lang3;
import java.io.IOException;
import java.io.Serializable;
import java.lang.reflect.Array;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.Map;
import java.util.Objects;
import java.util.TreeSet;
import java.util.function.Supplier;
import org.apache.commons.lang3.text.StrBuilder;
@SuppressWarnings("deprecation") // deprecated class StrBuilder is imported
// because it is part of the signature of deprecated methods
public class ObjectUtils {
public static class Null implements Serializable {
}
public static final Null NULL = new Null();
public static boolean allNotNull(final Object... values) {
return false;
}
public static boolean allNull(final Object... values) {
return false;
}
public static boolean anyNotNull(final Object... values) {
return false;
}
public static boolean anyNull(final Object... values) {
return false;
}
public static <T> T clone(final T obj) {
return null;
}
public static <T> T cloneIfPossible(final T obj) {
return null;
}
public static <T extends Comparable<? super T>> int compare(final T c1, final T c2) {
return 0;
}
public static <T extends Comparable<? super T>> int compare(final T c1, final T c2, final boolean nullGreater) {
return 0;
}
public static boolean CONST(final boolean v) {
return false;
}
public static byte CONST(final byte v) {
return 0;
}
public static char CONST(final char v) {
return '\0';
}
public static double CONST(final double v) {
return 0;
}
public static float CONST(final float v) {
return 0;
}
public static int CONST(final int v) {
return 0;
}
public static long CONST(final long v) {
return 0;
}
public static short CONST(final short v) {
return 0;
}
public static <T> T CONST(final T v) {
return null;
}
public static byte CONST_BYTE(final int v) {
return 0;
}
public static short CONST_SHORT(final int v) {
return 0;
}
public static <T> T defaultIfNull(final T object, final T defaultValue) {
return null;
}
public static boolean equals(final Object object1, final Object object2) {
return false;
}
public static <T> T firstNonNull(final T... values) {
return null;
}
public static <T> T getFirstNonNull(final Supplier<T>... suppliers) {
return null;
}
public static <T> T getIfNull(final T object, final Supplier<T> defaultSupplier) {
return null;
}
public static int hashCode(final Object obj) {
return 0;
}
public static int hashCodeMulti(final Object... objects) {
return 0;
}
public static void identityToString(final Appendable appendable, final Object object) throws IOException {
}
public static String identityToString(final Object object) {
return null;
}
public static void identityToString(final StrBuilder builder, final Object object) {
}
public static void identityToString(final StringBuffer buffer, final Object object) {
}
public static void identityToString(final StringBuilder builder, final Object object) {
}
public static boolean isEmpty(final Object object) {
return false;
}
public static boolean isNotEmpty(final Object object) {
return false;
}
public static <T extends Comparable<? super T>> T max(final T... values) {
return null;
}
public static <T> T median(final Comparator<T> comparator, final T... items) {
return null;
}
public static <T extends Comparable<? super T>> T median(final T... items) {
return null;
}
public static <T extends Comparable<? super T>> T min(final T... values) {
return null;
}
public static <T> T mode(final T... items) {
return null;
}
public static boolean notEqual(final Object object1, final Object object2) {
return false;
}
public static <T> T requireNonEmpty(final T obj) {
return null;
}
public static <T> T requireNonEmpty(final T obj, final String message) {
return null;
}
public static String toString(final Object obj) {
return null;
}
public static String toString(final Object obj, final String nullStr) {
return null;
}
public static String toString(final Object obj, final Supplier<String> supplier) {
return null;
}
public static void wait(final Object obj, final Duration duration) throws InterruptedException {
}
public ObjectUtils() {
}
}

65
java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/RandomUtils.java Normal file
View File

@@ -0,0 +1,65 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.commons.lang3;
import java.util.Random;
public class RandomUtils {
public RandomUtils() {
}
public static boolean nextBoolean() {
return false;
}
public static byte[] nextBytes(final int count) {
return null;
}
public static int nextInt(final int startInclusive, final int endExclusive) {
return 0;
}
public static int nextInt() {
return 0;
}
public static long nextLong(final long startInclusive, final long endExclusive) {
return 0;
}
public static long nextLong() {
return 0;
}
public static double nextDouble(final double startInclusive, final double endExclusive) {
return 0;
}
public static double nextDouble() {
return 0;
}
public static float nextFloat(final float startInclusive, final float endExclusive) {
return 0;
}
public static float nextFloat() {
return 0;
}
}

2
java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
View File

@@ -960,4 +960,4 @@ public class StringUtils {
public StringUtils() {
}
}
}

381
java/ql/test/stubs/guava-30.0/com/google/common/base/Preconditions.java Normal file
View File

@@ -0,0 +1,381 @@
/*
* Copyright (C) 2007 The Guava Authors
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
* in compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License
* is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
* or implied. See the License for the specific language governing permissions and limitations under
* the License.
*/
package com.google.common.base;
import org.checkerframework.checker.nullness.qual.NonNull;
import org.checkerframework.checker.nullness.qual.Nullable;
public final class Preconditions {
public static void checkArgument(boolean expression) {
}
public static void checkArgument(boolean expression, @Nullable Object errorMessage) {
}
public static void checkArgument(
boolean expression,
@Nullable String errorMessageTemplate,
@Nullable Object @Nullable ... errorMessageArgs) {
}
public static void checkArgument(boolean b, @Nullable String errorMessageTemplate, char p1) {
}
public static void checkArgument(boolean b, @Nullable String errorMessageTemplate, int p1) {
}
public static void checkArgument(boolean b, @Nullable String errorMessageTemplate, long p1) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, char p1, char p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, char p1, int p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, char p1, long p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, char p1, @Nullable Object p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, int p1, char p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, int p1, int p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, int p1, long p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, int p1, @Nullable Object p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, long p1, char p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, long p1, int p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, long p1, long p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, long p1, @Nullable Object p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, char p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, int p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, long p2) {
}
public static void checkArgument(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, @Nullable Object p2) {
}
public static void checkArgument(
boolean b,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3) {
}
public static void checkArgument(
boolean b,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3,
@Nullable Object p4) {
}
public static void checkState(boolean expression) {
}
public static void checkState(boolean expression, @Nullable Object errorMessage) {
}
public static void checkState(
boolean expression,
@Nullable String errorMessageTemplate,
@Nullable Object @Nullable ... errorMessageArgs) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, char p1) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, int p1) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, long p1) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, char p1, char p2) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, char p1, int p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, char p1, long p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, char p1, @Nullable Object p2) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, int p1, char p2) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, int p1, int p2) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, int p1, long p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, int p1, @Nullable Object p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, long p1, char p2) {
}
public static void checkState(boolean b, @Nullable String errorMessageTemplate, long p1, int p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, long p1, long p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, long p1, @Nullable Object p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, char p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, int p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, long p2) {
}
public static void checkState(
boolean b, @Nullable String errorMessageTemplate, @Nullable Object p1, @Nullable Object p2) {
}
public static void checkState(
boolean b,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3) {
}
public static void checkState(
boolean b,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3,
@Nullable Object p4) {
}
public static <T extends @NonNull Object> T checkNotNull(T reference) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T reference, @Nullable Object errorMessage) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T reference,
@Nullable String errorMessageTemplate,
@Nullable Object @Nullable ... errorMessageArgs) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, char p1) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, int p1) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, long p1) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, @Nullable Object p1) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, char p1, char p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, char p1, int p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, char p1, long p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, char p1, @Nullable Object p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, int p1, char p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, int p1, int p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, int p1, long p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, int p1, @Nullable Object p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, long p1, char p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, long p1, int p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, long p1, long p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, long p1, @Nullable Object p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, @Nullable Object p1, char p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, @Nullable Object p1, int p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, @Nullable Object p1, long p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj, @Nullable String errorMessageTemplate, @Nullable Object p1, @Nullable Object p2) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3) {
return null;
}
public static <T extends @NonNull Object> T checkNotNull(
T obj,
@Nullable String errorMessageTemplate,
@Nullable Object p1,
@Nullable Object p2,
@Nullable Object p3,
@Nullable Object p4) {
return null;
}
public static int checkElementIndex(int index, int size) {
return 0;
}
public static int checkElementIndex(int index, int size, @Nullable String desc) {
return 0;
}
public static int checkPositionIndex(int index, int size) {
return 0;
}
public static int checkPositionIndex(int index, int size, @Nullable String desc) {
return 0;
}
public static void checkPositionIndexes(int start, int end, int size) {
}
}

6
java/ql/test/stubs/guava-30.0/org/checkerframework/checker/nullness/qual/NonNull.java Normal file
View File

@@ -0,0 +1,6 @@
package org.checkerframework.checker.nullness.qual;
import java.lang.annotation.Target;
import java.lang.annotation.ElementType;
@Target({ElementType.TYPE_USE, ElementType.TYPE_PARAMETER})
public @interface NonNull {}

4
java/ql/test/stubs/guava-30.0/org/checkerframework/checker/nullness/qual/Nullable.java
View File

@@ -1,2 +1,6 @@
package org.checkerframework.checker.nullness.qual;
import java.lang.annotation.Target;
import java.lang.annotation.ElementType;
@Target({ElementType.TYPE_USE, ElementType.TYPE_PARAMETER})
public @interface Nullable {}

21
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQConnection.java Normal file
View File

@@ -0,0 +1,21 @@
package javax.xml.xquery;
import java.io.InputStream;
import java.io.Reader;
public interface XQConnection extends XQDataFactory {
XQExpression createExpression() throws XQException;
XQPreparedExpression prepareExpression(String var1) throws XQException;
XQPreparedExpression prepareExpression(String var1, XQStaticContext var2) throws XQException;
XQPreparedExpression prepareExpression(Reader var1) throws XQException;
XQPreparedExpression prepareExpression(Reader var1, XQStaticContext var2) throws XQException;
XQPreparedExpression prepareExpression(InputStream var1) throws XQException;
XQPreparedExpression prepareExpression(InputStream var1, XQStaticContext var2) throws XQException;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataFactory.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQDataFactory {
XQItemType createAtomicType(int var1) throws XQException;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataSource.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQDataSource {
XQConnection getConnection() throws XQException;
}

7
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDynamicContext.java Normal file
View File

@@ -0,0 +1,7 @@
package javax.xml.xquery;
import javax.xml.namespace.QName;
public interface XQDynamicContext {
void bindString(QName var1, String var2, XQItemType var3) throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQException.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public class XQException extends Exception {}

25
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQExpression.java Normal file
View File

@@ -0,0 +1,25 @@
package javax.xml.xquery;
import java.io.InputStream;
import java.io.Reader;
public interface XQExpression extends XQDynamicContext {
void cancel() throws XQException;
boolean isClosed();
void close() throws XQException;
void executeCommand(String var1) throws XQException;
void executeCommand(Reader var1) throws XQException;
XQResultSequence executeQuery(String var1) throws XQException;
XQResultSequence executeQuery(Reader var1) throws XQException;
XQResultSequence executeQuery(InputStream var1) throws XQException;
XQStaticContext getStaticContext() throws XQException;
}

7
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemAccessor.java Normal file
View File

@@ -0,0 +1,7 @@
package javax.xml.xquery;
import java.util.Properties;
public interface XQItemAccessor {
String getItemAsString(Properties var1) throws XQException;
}

68
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemType.java Normal file
View File

@@ -0,0 +1,68 @@
package javax.xml.xquery;
public interface XQItemType extends XQSequenceType {
int XQITEMKIND_ATOMIC = 1;
int XQITEMKIND_ATTRIBUTE = 2;
int XQITEMKIND_COMMENT = 3;
int XQITEMKIND_DOCUMENT = 4;
int XQITEMKIND_DOCUMENT_ELEMENT = 5;
int XQITEMKIND_DOCUMENT_SCHEMA_ELEMENT = 6;
int XQITEMKIND_ELEMENT = 7;
int XQITEMKIND_ITEM = 8;
int XQITEMKIND_NODE = 9;
int XQITEMKIND_PI = 10;
int XQITEMKIND_TEXT = 11;
int XQITEMKIND_SCHEMA_ELEMENT = 12;
int XQITEMKIND_SCHEMA_ATTRIBUTE = 13;
int XQBASETYPE_UNTYPED = 1;
int XQBASETYPE_ANYTYPE = 2;
int XQBASETYPE_ANYSIMPLETYPE = 3;
int XQBASETYPE_ANYATOMICTYPE = 4;
int XQBASETYPE_UNTYPEDATOMIC = 5;
int XQBASETYPE_DAYTIMEDURATION = 6;
int XQBASETYPE_YEARMONTHDURATION = 7;
int XQBASETYPE_ANYURI = 8;
int XQBASETYPE_BASE64BINARY = 9;
int XQBASETYPE_BOOLEAN = 10;
int XQBASETYPE_DATE = 11;
int XQBASETYPE_INT = 12;
int XQBASETYPE_INTEGER = 13;
int XQBASETYPE_SHORT = 14;
int XQBASETYPE_LONG = 15;
int XQBASETYPE_DATETIME = 16;
int XQBASETYPE_DECIMAL = 17;
int XQBASETYPE_DOUBLE = 18;
int XQBASETYPE_DURATION = 19;
int XQBASETYPE_FLOAT = 20;
int XQBASETYPE_GDAY = 21;
int XQBASETYPE_GMONTH = 22;
int XQBASETYPE_GMONTHDAY = 23;
int XQBASETYPE_GYEAR = 24;
int XQBASETYPE_GYEARMONTH = 25;
int XQBASETYPE_HEXBINARY = 26;
int XQBASETYPE_NOTATION = 27;
int XQBASETYPE_QNAME = 28;
int XQBASETYPE_STRING = 29;
int XQBASETYPE_TIME = 30;
int XQBASETYPE_BYTE = 31;
int XQBASETYPE_NONPOSITIVE_INTEGER = 32;
int XQBASETYPE_NONNEGATIVE_INTEGER = 33;
int XQBASETYPE_NEGATIVE_INTEGER = 34;
int XQBASETYPE_POSITIVE_INTEGER = 35;
int XQBASETYPE_UNSIGNED_LONG = 36;
int XQBASETYPE_UNSIGNED_INT = 37;
int XQBASETYPE_UNSIGNED_SHORT = 38;
int XQBASETYPE_UNSIGNED_BYTE = 39;
int XQBASETYPE_NORMALIZED_STRING = 40;
int XQBASETYPE_TOKEN = 41;
int XQBASETYPE_LANGUAGE = 42;
int XQBASETYPE_NAME = 43;
int XQBASETYPE_NCNAME = 44;
int XQBASETYPE_NMTOKEN = 45;
int XQBASETYPE_ID = 46;
int XQBASETYPE_IDREF = 47;
int XQBASETYPE_ENTITY = 48;
int XQBASETYPE_IDREFS = 49;
int XQBASETYPE_ENTITIES = 50;
int XQBASETYPE_NMTOKENS = 51;
}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQPreparedExpression.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQPreparedExpression extends XQDynamicContext {
XQResultSequence executeQuery() throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQResultSequence.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQResultSequence extends XQSequence {}

5
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequence.java Normal file
View File

@@ -0,0 +1,5 @@
package javax.xml.xquery;
public interface XQSequence extends XQItemAccessor {
boolean next() throws XQException;
}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequenceType.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQSequenceType {}

3
java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQStaticContext.java Normal file
View File

@@ -0,0 +1,3 @@
package javax.xml.xquery;
public interface XQStaticContext {}

6
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/Configuration.java Normal file
View File

@@ -0,0 +1,6 @@
package net.sf.saxon;
import java.io.Serializable;
public class Configuration implements Serializable, SourceResolver {}

3
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/SourceResolver.java Normal file
View File

@@ -0,0 +1,3 @@
package net.sf.saxon;
public interface SourceResolver {}

3
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/Closable.java Normal file
View File

@@ -0,0 +1,3 @@
package net.sf.saxon.xqj;
public abstract class Closable {}

46
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQConnection.java Normal file
View File

@@ -0,0 +1,46 @@
package net.sf.saxon.xqj;
import java.io.Reader;
import net.sf.saxon.Configuration;
import javax.xml.xquery.XQConnection;
import javax.xml.xquery.XQPreparedExpression;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQExpression;
import javax.xml.xquery.XQStaticContext;
import java.io.InputStream;
public class SaxonXQConnection extends SaxonXQDataFactory implements XQConnection {
private SaxonXQStaticContext staticContext;
SaxonXQConnection(SaxonXQDataSource dataSource) {
}
public XQExpression createExpression() throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(InputStream xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(InputStream xquery, XQStaticContext properties) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(Reader xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(Reader xquery, XQStaticContext properties){
return null;
}
public XQPreparedExpression prepareExpression(String xquery) throws XQException {
return null;
}
public XQPreparedExpression prepareExpression(String xquery, XQStaticContext properties) throws XQException {
return null;
}
}

11
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataFactory.java Normal file
View File

@@ -0,0 +1,11 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQDataFactory;
import javax.xml.xquery.XQItemType;
public abstract class SaxonXQDataFactory extends Closable implements XQDataFactory {
public XQItemType createAtomicType(int baseType) throws XQException {
return null;
}
}

12
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataSource.java Normal file
View File

@@ -0,0 +1,12 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQDataSource;
import javax.xml.xquery.XQException;
import javax.xml.xquery.XQConnection;
public class SaxonXQDataSource implements XQDataSource {
public XQConnection getConnection() throws XQException {
return new SaxonXQConnection(this);
}
}

5
java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQStaticContext.java Normal file
View File

@@ -0,0 +1,5 @@
package net.sf.saxon.xqj;
import javax.xml.xquery.XQStaticContext;
public class SaxonXQStaticContext implements XQStaticContext {}

11
java/ql/test/stubs/servlet-api-2.4/javax/servlet/Filter.java Normal file
View File

@@ -0,0 +1,11 @@
package javax.servlet;
import java.io.IOException;
public interface Filter {
default public void init(FilterConfig filterConfig) throws ServletException {}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain)
throws IOException, ServletException;
default public void destroy() {}
}

7
java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterChain.java Normal file
View File

@@ -0,0 +1,7 @@
package javax.servlet;
import java.io.IOException;
public interface FilterChain {
public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException;
}

10
java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterConfig.java Normal file
View File

@@ -0,0 +1,10 @@
package javax.servlet;
import java.util.Enumeration;
public interface FilterConfig {
public String getFilterName();
public ServletContext getServletContext();
public String getInitParameter(String name);
public Enumeration<String> getInitParameterNames();
}

Some files were not shown because too many files have changed in this diff Show More