hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: remove Format and MessageFormat

Browse Source
This commit is contained in:
Jami Cogswell
2023-03-14 22:40:23 -04:00
parent 702ca19c3c
commit e0c0c973a7
4 changed files with 4 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/lib/ext/java.text.model.yml
View File

@@ -1,12 +1,4 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: summaryModel
data:
- ["java.text", "Format", True, "format", "(Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.text", "MessageFormat", False, "format", "(String,Object[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.text", "MessageFormat", False, "format", "(String,Object[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
- addsTo:
pack: codeql/java-all
extensible: neutralModel

12
java/ql/test/ext/TestModels/Test.java
View File

@@ -7,8 +7,6 @@ import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.text.Format;
import java.text.MessageFormat;
import java.util.EventObject;
import java.util.Locale;
import java.util.ResourceBundle;
@@ -157,16 +155,6 @@ public class Test {
EventObject eventObj = new EventObject(source());
sink(eventObj.getSource()); // $hasValueFlow
// java.text
Format mf1 = new MessageFormat("test");
sink(mf1.format(source())); // $hasTaintFlow
String mf2 = MessageFormat.format((String)source(), null);
sink(mf2); // $hasTaintFlow
String mf3 = MessageFormat.format("test", source());
sink(mf3); // $hasTaintFlow
// java.lang
AssertionError assertErr = new AssertionError(source());
sink((String)assertErr.getMessage()); // $hasValueFlow

2
java/ql/test/ext/TopJdkApis/TopJdkApis.qll
View File

@@ -310,6 +310,8 @@ class TopJdkApi extends SummarizedCallableBase {
* `java.lang.System#getProperty(String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
* `java.lang.System#setProperty(String,String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
* `java.lang.Throwable#printStackTrace()`: should probably not be a general step, but there might be specialised queries that care
* `java.text.Format#format(Object)`: similar issue as `Object.toString`; depends on the object being passed as the argument
* `java.text.MessageFormat#format(String,Object[])`: similar issue as `Object.toString`; depends on the object being passed as the argument
* `java.util.Comparator#comparing(Function)`: lambda flow
* `java.util.function.BiConsumer#accept(Object,Object)`: specialized lambda flow
* `java.util.function.BiFunction#apply(Object,Object)`: specialized lambda flow

2
java/ql/test/ext/TopJdkApis/TopJdkApisTest.expected
View File

@@ -2,6 +2,8 @@
| java.lang.System#getProperty(String) | no manual model |
| java.lang.System#setProperty(String,String) | no manual model |
| java.lang.Throwable#printStackTrace() | no manual model |
| java.text.Format#format(Object) | no manual model |
| java.text.MessageFormat#format(String,Object[]) | no manual model |
| java.util.Comparator#comparing(Function) | no manual model |
| java.util.function.BiConsumer#accept(Object,Object) | no manual model |
| java.util.function.BiFunction#apply(Object,Object) | no manual model |