hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

java.nio.file tests

Browse Source
This commit is contained in:
Tony Torralba
2023-03-14 12:10:36 +01:00
parent 2e7ad99059
commit d54abddab1
6 changed files with 369 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
java/ql/lib/ext/java.nio.file.model.yml
View File

@@ -28,7 +28,6 @@ extensions:
extensible: summaryModel
data:
- ["java.nio.file", "FileSystem", True, "getPath", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "FileSystem", True, "getRootDirectories", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Path", True, "getParent", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Path", True, "normalize", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Path", True, "resolve", "", "", "Argument[-1..0]", "ReturnValue", "taint", "manual"]

124
java/ql/test/library-tests/frameworks/jdk/java.nio.file/Test.java Normal file
View File

@@ -0,0 +1,124 @@
package generatedtest;
import java.io.File;
import java.net.URI;
import java.nio.file.FileSystem;
import java.nio.file.Path;
import java.nio.file.Paths;
// Test case generated by GenerateFlowTestCase.ql
public class Test {
Object source() {
return null;
}
void sink(Object o) {}
public void test() throws Exception {
{
// "java.nio.file;FileSystem;true;getPath;;;Argument[0];ReturnValue;taint;manual"
Path out = null;
String in = (String) source();
FileSystem instance = null;
out = instance.getPath(in, (String[]) null);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;false;toFile;;;Argument[-1];ReturnValue;taint;manual"
File out = null;
Path in = (Path) source();
out = in.toFile();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;getParent;;;Argument[-1];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
out = in.getParent();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
out = in.normalize();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
Path instance = null;
out = instance.resolve(in);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
out = in.resolve((Path) null);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
out = in.resolve((String) null);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;resolve;;;Argument[-1..0];ReturnValue;taint;manual"
Path out = null;
String in = (String) source();
Path instance = null;
out = instance.resolve(in);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;toAbsolutePath;;;Argument[-1];ReturnValue;taint;manual"
Path out = null;
Path in = (Path) source();
out = in.toAbsolutePath();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;toString;;;Argument[-1];ReturnValue;taint;manual"
String out = null;
Path in = (Path) source();
out = in.toString();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Path;true;toUri;;;Argument[-1];ReturnValue;taint;manual"
URI out = null;
Path in = (Path) source();
out = in.toUri();
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;taint;manual"
Path out = null;
String in = (String) source();
out = Paths.get(in, (String[]) null);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;taint;manual"
Path out = null;
URI in = (URI) source();
out = Paths.get(in);
sink(out); // $ hasTaintFlow
}
{
// "java.nio.file;Paths;true;get;;;Argument[1].ArrayElement;ReturnValue;taint;manual"
Path out = null;
String[] in = (String[]) new String[] {(String) source()};
out = Paths.get((String) null, in);
sink(out); // $ hasTaintFlow
}
}
}

0
java/ql/test/library-tests/frameworks/jdk/java.nio.file/test.expected Normal file
View File

2
java/ql/test/library-tests/frameworks/jdk/java.nio.file/test.ql Normal file
View File

@@ -0,0 +1,2 @@
import java
import TestUtilities.InlineFlowTest

232
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
View File

@@ -14,26 +14,78 @@ edges
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) |
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) |
| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:17:61:17:72 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:19:41:19:52 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:21:56:21:67 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:23:46:23:57 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:25:38:25:49 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:27:36:27:47 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:29:31:29:42 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:31:33:31:44 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:33:50:33:61 | source(...) : String |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:35:54:35:65 | source(...) : String |
| mad/Test.java:17:61:17:72 | source(...) : String | mad/Test.java:17:52:17:72 | (...)... |
| mad/Test.java:19:41:19:52 | source(...) : String | mad/Test.java:19:32:19:52 | (...)... |
| mad/Test.java:21:56:21:67 | source(...) : String | mad/Test.java:21:47:21:67 | (...)... |
| mad/Test.java:23:46:23:57 | source(...) : String | mad/Test.java:23:39:23:57 | (...)... |
| mad/Test.java:25:38:25:49 | source(...) : String | mad/Test.java:25:31:25:49 | (...)... |
| mad/Test.java:27:36:27:47 | source(...) : String | mad/Test.java:27:29:27:47 | (...)... |
| mad/Test.java:29:31:29:42 | source(...) : String | mad/Test.java:29:24:29:42 | (...)... |
| mad/Test.java:31:33:31:44 | source(...) : String | mad/Test.java:31:24:31:44 | (...)... |
| mad/Test.java:33:50:33:61 | source(...) : String | mad/Test.java:33:41:33:61 | (...)... |
| mad/Test.java:35:54:35:65 | source(...) : String | mad/Test.java:35:45:35:65 | (...)... |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:24:61:24:68 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:26:41:26:48 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:28:56:28:63 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:30:46:30:53 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:32:38:32:45 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:34:36:34:43 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:36:31:36:38 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:38:33:38:40 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:40:27:40:34 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:41:27:41:34 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:42:34:42:41 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:44:40:44:47 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:45:48:45:55 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:46:47:46:54 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:48:40:48:47 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:50:38:50:45 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:52:33:52:40 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:54:33:54:40 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:56:41:56:48 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:58:42:58:49 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:60:37:60:44 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:62:29:62:36 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:64:37:64:44 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:66:28:66:35 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:68:33:68:40 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:70:40:70:47 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:72:40:72:47 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:73:40:73:47 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:75:38:75:45 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:77:28:77:35 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:78:28:78:35 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:79:28:79:35 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:81:34:81:41 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:82:34:82:41 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:84:50:84:57 | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:86:54:86:61 | source(...) : String |
| mad/Test.java:24:61:24:68 | source(...) : String | mad/Test.java:24:52:24:68 | (...)... |
| mad/Test.java:26:41:26:48 | source(...) : String | mad/Test.java:26:32:26:48 | (...)... |
| mad/Test.java:28:56:28:63 | source(...) : String | mad/Test.java:28:47:28:63 | (...)... |
| mad/Test.java:30:46:30:53 | source(...) : String | mad/Test.java:30:39:30:53 | (...)... |
| mad/Test.java:32:38:32:45 | source(...) : String | mad/Test.java:32:31:32:45 | (...)... |
| mad/Test.java:34:36:34:43 | source(...) : String | mad/Test.java:34:29:34:43 | (...)... |
| mad/Test.java:36:31:36:38 | source(...) : String | mad/Test.java:36:24:36:38 | (...)... |
| mad/Test.java:38:33:38:40 | source(...) : String | mad/Test.java:38:24:38:40 | (...)... |
| mad/Test.java:40:27:40:34 | source(...) : String | mad/Test.java:40:20:40:34 | (...)... |
| mad/Test.java:41:27:41:34 | source(...) : String | mad/Test.java:41:20:41:34 | (...)... |
| mad/Test.java:42:34:42:41 | source(...) : String | mad/Test.java:42:20:42:41 | (...)... |
| mad/Test.java:44:40:44:47 | source(...) : String | mad/Test.java:44:33:44:47 | (...)... |
| mad/Test.java:45:48:45:55 | source(...) : String | mad/Test.java:45:33:45:55 | (...)... |
| mad/Test.java:46:47:46:54 | source(...) : String | mad/Test.java:46:40:46:54 | (...)... |
| mad/Test.java:48:40:48:47 | source(...) : String | mad/Test.java:48:33:48:47 | (...)... |
| mad/Test.java:50:38:50:45 | source(...) : String | mad/Test.java:50:31:50:45 | (...)... |
| mad/Test.java:52:33:52:40 | source(...) : String | mad/Test.java:52:26:52:40 | (...)... |
| mad/Test.java:54:33:54:40 | source(...) : String | mad/Test.java:54:26:54:40 | (...)... |
| mad/Test.java:56:41:56:48 | source(...) : String | mad/Test.java:56:34:56:48 | (...)... |
| mad/Test.java:58:42:58:49 | source(...) : String | mad/Test.java:58:35:58:49 | (...)... |
| mad/Test.java:60:37:60:44 | source(...) : String | mad/Test.java:60:30:60:44 | (...)... |
| mad/Test.java:62:29:62:36 | source(...) : String | mad/Test.java:62:22:62:36 | (...)... |
| mad/Test.java:64:37:64:44 | source(...) : String | mad/Test.java:64:30:64:44 | (...)... |
| mad/Test.java:66:28:66:35 | source(...) : String | mad/Test.java:66:21:66:35 | (...)... |
| mad/Test.java:68:33:68:40 | source(...) : String | mad/Test.java:68:26:68:40 | (...)... |
| mad/Test.java:70:40:70:47 | source(...) : String | mad/Test.java:70:33:70:47 | (...)... |
| mad/Test.java:72:40:72:47 | source(...) : String | mad/Test.java:72:33:72:47 | (...)... |
| mad/Test.java:73:40:73:47 | source(...) : String | mad/Test.java:73:33:73:47 | (...)... |
| mad/Test.java:75:38:75:45 | source(...) : String | mad/Test.java:75:31:75:45 | (...)... |
| mad/Test.java:77:28:77:35 | source(...) : String | mad/Test.java:77:21:77:35 | (...)... |
| mad/Test.java:78:28:78:35 | source(...) : String | mad/Test.java:78:21:78:35 | (...)... |
| mad/Test.java:79:28:79:35 | source(...) : String | mad/Test.java:79:21:79:35 | (...)... |
| mad/Test.java:81:34:81:41 | source(...) : String | mad/Test.java:81:27:81:41 | (...)... |
| mad/Test.java:82:34:82:41 | source(...) : String | mad/Test.java:82:27:82:41 | (...)... |
| mad/Test.java:84:50:84:57 | source(...) : String | mad/Test.java:84:41:84:57 | (...)... |
| mad/Test.java:86:54:86:61 | source(...) : String | mad/Test.java:86:45:86:61 | (...)... |
nodes
| Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
| Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -54,27 +106,79 @@ nodes
| Test.java:99:12:99:33 | new URI(...) | semmle.label | new URI(...) |
| Test.java:100:12:100:45 | new URI(...) | semmle.label | new URI(...) |
| Test.java:101:12:101:54 | new URI(...) | semmle.label | new URI(...) |
| mad/Test.java:12:16:12:36 | getHostName(...) : String | semmle.label | getHostName(...) : String |
| mad/Test.java:17:52:17:72 | (...)... | semmle.label | (...)... |
| mad/Test.java:17:61:17:72 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:19:32:19:52 | (...)... | semmle.label | (...)... |
| mad/Test.java:19:41:19:52 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:21:47:21:67 | (...)... | semmle.label | (...)... |
| mad/Test.java:21:56:21:67 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:23:39:23:57 | (...)... | semmle.label | (...)... |
| mad/Test.java:23:46:23:57 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:25:31:25:49 | (...)... | semmle.label | (...)... |
| mad/Test.java:25:38:25:49 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:27:29:27:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:27:36:27:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:29:24:29:42 | (...)... | semmle.label | (...)... |
| mad/Test.java:29:31:29:42 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:31:24:31:44 | (...)... | semmle.label | (...)... |
| mad/Test.java:31:33:31:44 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:33:41:33:61 | (...)... | semmle.label | (...)... |
| mad/Test.java:33:50:33:61 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:35:45:35:65 | (...)... | semmle.label | (...)... |
| mad/Test.java:35:54:35:65 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:19:16:19:36 | getHostName(...) : String | semmle.label | getHostName(...) : String |
| mad/Test.java:24:52:24:68 | (...)... | semmle.label | (...)... |
| mad/Test.java:24:61:24:68 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:26:32:26:48 | (...)... | semmle.label | (...)... |
| mad/Test.java:26:41:26:48 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:28:47:28:63 | (...)... | semmle.label | (...)... |
| mad/Test.java:28:56:28:63 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:30:39:30:53 | (...)... | semmle.label | (...)... |
| mad/Test.java:30:46:30:53 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:32:31:32:45 | (...)... | semmle.label | (...)... |
| mad/Test.java:32:38:32:45 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:34:29:34:43 | (...)... | semmle.label | (...)... |
| mad/Test.java:34:36:34:43 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:36:24:36:38 | (...)... | semmle.label | (...)... |
| mad/Test.java:36:31:36:38 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:38:24:38:40 | (...)... | semmle.label | (...)... |
| mad/Test.java:38:33:38:40 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:40:20:40:34 | (...)... | semmle.label | (...)... |
| mad/Test.java:40:27:40:34 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:41:20:41:34 | (...)... | semmle.label | (...)... |
| mad/Test.java:41:27:41:34 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:42:20:42:41 | (...)... | semmle.label | (...)... |
| mad/Test.java:42:34:42:41 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:44:33:44:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:44:40:44:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:45:33:45:55 | (...)... | semmle.label | (...)... |
| mad/Test.java:45:48:45:55 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:46:40:46:54 | (...)... | semmle.label | (...)... |
| mad/Test.java:46:47:46:54 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:48:33:48:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:48:40:48:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:50:31:50:45 | (...)... | semmle.label | (...)... |
| mad/Test.java:50:38:50:45 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:52:26:52:40 | (...)... | semmle.label | (...)... |
| mad/Test.java:52:33:52:40 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:54:26:54:40 | (...)... | semmle.label | (...)... |
| mad/Test.java:54:33:54:40 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:56:34:56:48 | (...)... | semmle.label | (...)... |
| mad/Test.java:56:41:56:48 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:58:35:58:49 | (...)... | semmle.label | (...)... |
| mad/Test.java:58:42:58:49 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:60:30:60:44 | (...)... | semmle.label | (...)... |
| mad/Test.java:60:37:60:44 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:62:22:62:36 | (...)... | semmle.label | (...)... |
| mad/Test.java:62:29:62:36 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:64:30:64:44 | (...)... | semmle.label | (...)... |
| mad/Test.java:64:37:64:44 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:66:21:66:35 | (...)... | semmle.label | (...)... |
| mad/Test.java:66:28:66:35 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:68:26:68:40 | (...)... | semmle.label | (...)... |
| mad/Test.java:68:33:68:40 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:70:33:70:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:70:40:70:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:72:33:72:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:72:40:72:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:73:33:73:47 | (...)... | semmle.label | (...)... |
| mad/Test.java:73:40:73:47 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:75:31:75:45 | (...)... | semmle.label | (...)... |
| mad/Test.java:75:38:75:45 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:77:21:77:35 | (...)... | semmle.label | (...)... |
| mad/Test.java:77:28:77:35 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:78:21:78:35 | (...)... | semmle.label | (...)... |
| mad/Test.java:78:28:78:35 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:79:21:79:35 | (...)... | semmle.label | (...)... |
| mad/Test.java:79:28:79:35 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:81:27:81:41 | (...)... | semmle.label | (...)... |
| mad/Test.java:81:34:81:41 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:82:27:82:41 | (...)... | semmle.label | (...)... |
| mad/Test.java:82:34:82:41 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:84:41:84:57 | (...)... | semmle.label | (...)... |
| mad/Test.java:84:50:84:57 | source(...) : String | semmle.label | source(...) : String |
| mad/Test.java:86:45:86:61 | (...)... | semmle.label | (...)... |
| mad/Test.java:86:54:86:61 | source(...) : String | semmle.label | source(...) : String |
subpaths
#select
| Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | This path depends on a $@. | Test.java:19:18:19:38 | getHostName(...) | user-provided value |
@@ -88,13 +192,39 @@ subpaths
| Test.java:99:3:99:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
| Test.java:100:3:100:46 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
| Test.java:101:3:101:55 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value |
| mad/Test.java:17:52:17:72 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:17:52:17:72 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:19:32:19:52 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:19:32:19:52 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:21:47:21:67 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:21:47:21:67 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:23:39:23:57 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:23:39:23:57 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:25:31:25:49 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:25:31:25:49 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:27:29:27:47 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:27:29:27:47 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:29:24:29:42 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:29:24:29:42 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:31:9:31:45 | new FileReader(...) | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:31:24:31:44 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:33:41:33:61 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:33:41:33:61 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:35:45:35:65 | (...)... | mad/Test.java:12:16:12:36 | getHostName(...) : String | mad/Test.java:35:45:35:65 | (...)... | This path depends on a $@. | mad/Test.java:12:16:12:36 | getHostName(...) | user-provided value |
| mad/Test.java:24:52:24:68 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:24:52:24:68 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:26:32:26:48 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:26:32:26:48 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:28:47:28:63 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:28:47:28:63 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:30:39:30:53 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:30:39:30:53 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:32:31:32:45 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:32:31:32:45 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:34:29:34:43 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:34:29:34:43 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:36:24:36:38 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:36:24:36:38 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:38:9:38:41 | new FileReader(...) | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:38:24:38:40 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:40:20:40:34 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:40:20:40:34 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:41:20:41:34 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:41:20:41:34 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:42:20:42:41 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:42:20:42:41 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:44:33:44:47 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:44:33:44:47 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:45:33:45:55 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:45:33:45:55 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:46:40:46:54 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:46:40:46:54 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:48:33:48:47 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:48:33:48:47 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:50:31:50:45 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:50:31:50:45 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:52:26:52:40 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:52:26:52:40 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:54:26:54:40 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:54:26:54:40 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:56:34:56:48 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:56:34:56:48 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:58:35:58:49 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:58:35:58:49 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:60:30:60:44 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:60:30:60:44 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:62:22:62:36 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:62:22:62:36 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:64:30:64:44 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:64:30:64:44 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:66:21:66:35 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:66:21:66:35 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:68:26:68:40 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:68:26:68:40 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:70:33:70:47 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:70:33:70:47 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:72:33:72:47 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:72:33:72:47 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:73:33:73:47 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:73:33:73:47 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:75:31:75:45 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:75:31:75:45 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:77:21:77:35 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:77:21:77:35 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:78:21:78:35 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:78:21:78:35 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:79:21:79:35 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:79:21:79:35 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:81:27:81:41 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:81:27:81:41 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:82:27:82:41 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:82:27:82:41 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:84:41:84:57 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:84:41:84:57 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |
| mad/Test.java:86:45:86:61 | (...)... | mad/Test.java:19:16:19:36 | getHostName(...) : String | mad/Test.java:86:45:86:61 | (...)... | This path depends on a $@. | mad/Test.java:19:16:19:36 | getHostName(...) | user-provided value |

73
java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java
View File

@@ -2,36 +2,87 @@ import java.io.File;
import java.io.FileInputStream;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.InetAddress;
import java.net.URL;
import java.nio.charset.Charset;
import java.nio.file.Files;
import java.nio.file.Path;
import org.codehaus.cargo.container.installer.ZipURLInstaller;
public class Test {
public Object source(InetAddress address) {
private InetAddress address;
public Object source() {
return address.getHostName();
}
void test() throws IOException {
// "java.lang;Module;true;getResourceAsStream;(String);;Argument[0];read-file;ai-generated"
getClass().getModule().getResourceAsStream((String) source(null));
getClass().getModule().getResourceAsStream((String) source());
// "java.lang;Class;false;getResource;(String);;Argument[0];read-file;ai-generated"
getClass().getResource((String) source(null));
getClass().getResource((String) source());
// "java.lang;ClassLoader;true;getSystemResourceAsStream;(String);;Argument[0];read-file;ai-generated"
ClassLoader.getSystemResourceAsStream((String) source(null));
ClassLoader.getSystemResourceAsStream((String) source());
// "java.io;File;true;createTempFile;(String,String,File);;Argument[2];create-file;ai-generated"
File.createTempFile(";", ";", (File) source(null));
File.createTempFile(";", ";", (File) source());
// "java.io;File;true;renameTo;(File);;Argument[0];create-file;ai-generated"
new File("").renameTo((File) source(null));
new File("").renameTo((File) source());
// "java.io;FileInputStream;true;FileInputStream;(File);;Argument[0];read-file;ai-generated"
new FileInputStream((File) source(null));
new FileInputStream((File) source());
// "java.io;FileReader;true;FileReader;(File);;Argument[0];read-file;ai-generated"
new FileReader((File) source(null));
new FileReader((File) source());
// "java.io;FileReader;true;FileReader;(String);;Argument[0];read-file;ai-generated"
new FileReader((String) source(null));
new FileReader((String) source());
// "java.nio.file;Files;false;copy;;;Argument[0];read-file;manual"
Files.copy((Path) source(), (Path) null);
Files.copy((Path) source(), (OutputStream) null);
Files.copy((InputStream) source(), null);
// "java.nio.file;Files;false;copy;;;Argument[1];create-file;manual"
Files.copy((Path) null, (Path) source());
Files.copy((Path) null, (OutputStream) source());
Files.copy((InputStream) null, (Path) source());
// "java.nio.file;Files;false;createDirectories;;;Argument[0];create-file;manual"
Files.createDirectories((Path) source());
// "java.nio.file;Files;false;createDirectory;;;Argument[0];create-file;manual"
Files.createDirectory((Path) source());
// "java.nio.file;Files;false;createFile;;;Argument[0];create-file;manual"
Files.createFile((Path) source());
// "java.nio.file;Files;false;createLink;;;Argument[0];create-file;manual"
Files.createLink((Path) source(), null);
// "java.nio.file;Files;false;createSymbolicLink;;;Argument[0];create-file;manual"
Files.createSymbolicLink((Path) source(), null);
// "java.nio.file;Files;false;createTempDirectory;(Path,String,FileAttribute[]);;Argument[0];create-file;manual"
Files.createTempDirectory((Path) source(), null);
// "java.nio.file;Files;false;createTempFile;(Path,String,String,FileAttribute[]);;Argument[0];create-file;manual"
Files.createTempFile((Path) source(), null, null);
// "java.nio.file;Files;false;delete;(Path);;Argument[0];delete-file;ai-generated"
Files.delete((Path) source());
// "java.nio.file;Files;false;deleteIfExists;(Path);;Argument[0];delete-file;ai-generated"
Files.deleteIfExists((Path) source());
// "java.nio.file;Files;false;lines;(Path,Charset);;Argument[0];read-file;ai-generated"
Files.lines((Path) source(), null);
// "java.nio.file;Files;false;move;;;Argument[1];create-file;manual"
Files.move(null, (Path) source());
// "java.nio.file;Files;false;newBufferedReader;(Path,Charset);;Argument[0];read-file;ai-generated"
Files.newBufferedReader((Path) source(), null);
// "java.nio.file;Files;false;newBufferedWriter;;;Argument[0];create-file;manual"
Files.newBufferedWriter((Path) source());
Files.newBufferedWriter((Path) source(), (Charset) null);
// "java.nio.file;Files;false;newOutputStream;;;Argument[0];create-file;manual"
Files.newOutputStream((Path) source());
// "java.nio.file;Files;false;write;;;Argument[0];create-file;manual"
Files.write((Path) source(), (byte[]) null);
Files.write((Path) source(), (Iterable<CharSequence>) null);
Files.write((Path) source(), (Iterable<CharSequence>) null, (Charset) null);
// "java.nio.file;Files;false;writeString;;;Argument[0];create-file;manual"
Files.writeString((Path) source(), (CharSequence) null);
Files.writeString((Path) source(), (CharSequence) null, (Charset) null);
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[1];create-file;ai-generated"
new ZipURLInstaller((URL) null, (String) source(null), "");
new ZipURLInstaller((URL) null, (String) source(), "");
// "org.codehaus.cargo.container.installer;ZipURLInstaller;true;ZipURLInstaller;(URL,String,String);;Argument[2];create-file;ai-generated"
new ZipURLInstaller((URL) null, "", (String) source(null));
new ZipURLInstaller((URL) null, "", (String) source());
}
}