Merge pull request #4358 from joefarebrother/format-taint

Java: Add taint steps through string formatting methods

java/ql/test/library-tests/dataflow/taint-format/A.java

@@ -0,0 +1,45 @@
+import java.util.Formatter;
+import java.lang.StringBuilder;
+import java.lang.System;
+import java.io.Console;
+
+class A {
+    public static String taint() { return "tainted"; }
+
+    public static void test1() {
+        String bad = taint();
+        String good = "hi";
+
+        bad.formatted(good);
+        good.formatted("a", bad, "b", good);
+        String.format("%s%s", bad, good);
+        String.format("%s", good);
+    }
+
+    public static void test2() {
+        String bad = taint();
+        Formatter f = new Formatter();
+
+        f.toString();
+        f.format("%s", bad);
+        f.toString();
+    }
+
+    public static void test3() {
+        String bad = taint();
+        StringBuilder sb = new StringBuilder();
+        Formatter f = new Formatter(sb);
+
+        sb.toString(); // false positive
+        f.format("%s", bad);
+        sb.toString();
+    }
+
+    public static void test4() {
+        String bad = taint();
+        Console c = System.console();
+
+        c.format(bad);
+        c.readLine("Enter something: %s", bad);
+    }
+}

java/ql/test/library-tests/dataflow/taint-format/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args --enable-preview -source 14 -target 14

java/ql/test/library-tests/dataflow/taint-format/test.expected

@@ -0,0 +1,28 @@
+| A.java:10:22:10:28 | taint(...) | A.java:10:22:10:28 | taint(...) |
+| A.java:10:22:10:28 | taint(...) | A.java:13:9:13:11 | bad |
+| A.java:10:22:10:28 | taint(...) | A.java:13:9:13:27 | formatted(...) |
+| A.java:10:22:10:28 | taint(...) | A.java:14:9:14:43 | formatted(...) |
+| A.java:10:22:10:28 | taint(...) | A.java:14:9:14:43 | new ..[] { .. } |
+| A.java:10:22:10:28 | taint(...) | A.java:14:29:14:31 | bad |
+| A.java:10:22:10:28 | taint(...) | A.java:15:9:15:40 | format(...) |
+| A.java:10:22:10:28 | taint(...) | A.java:15:9:15:40 | new ..[] { .. } |
+| A.java:10:22:10:28 | taint(...) | A.java:15:31:15:33 | bad |
+| A.java:20:22:20:28 | taint(...) | A.java:20:22:20:28 | taint(...) |
+| A.java:20:22:20:28 | taint(...) | A.java:24:9:24:9 | f [post update] |
+| A.java:20:22:20:28 | taint(...) | A.java:24:9:24:27 | format(...) |
+| A.java:20:22:20:28 | taint(...) | A.java:24:9:24:27 | new ..[] { .. } |
+| A.java:20:22:20:28 | taint(...) | A.java:24:24:24:26 | bad |
+| A.java:20:22:20:28 | taint(...) | A.java:25:9:25:9 | f |
+| A.java:29:22:29:28 | taint(...) | A.java:29:22:29:28 | taint(...) |
+| A.java:29:22:29:28 | taint(...) | A.java:33:9:33:10 | sb |
+| A.java:29:22:29:28 | taint(...) | A.java:33:9:33:21 | toString(...) |
+| A.java:29:22:29:28 | taint(...) | A.java:34:9:34:9 | f [post update] |
+| A.java:29:22:29:28 | taint(...) | A.java:34:9:34:27 | format(...) |
+| A.java:29:22:29:28 | taint(...) | A.java:34:9:34:27 | new ..[] { .. } |
+| A.java:29:22:29:28 | taint(...) | A.java:34:24:34:26 | bad |
+| A.java:29:22:29:28 | taint(...) | A.java:35:9:35:10 | sb |
+| A.java:29:22:29:28 | taint(...) | A.java:35:9:35:21 | toString(...) |
+| A.java:39:22:39:28 | taint(...) | A.java:39:22:39:28 | taint(...) |
+| A.java:39:22:39:28 | taint(...) | A.java:42:18:42:20 | bad |
+| A.java:39:22:39:28 | taint(...) | A.java:43:9:43:46 | new ..[] { .. } |
+| A.java:39:22:39:28 | taint(...) | A.java:43:43:43:45 | bad |

java/ql/test/library-tests/dataflow/taint-format/test.ql

@@ -0,0 +1,16 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+class Conf extends TaintTracking::Configuration {
+  Conf() { this = "qltest:dataflow:format" }
+
+  override predicate isSource(DataFlow::Node n) {
+    n.asExpr().(MethodAccess).getMethod().hasName("taint")
+  }
+
+  override predicate isSink(DataFlow::Node n) { any() }
+}
+
+from DataFlow::Node src, DataFlow::Node sink, Conf conf
+where conf.hasFlow(src, sink)
+select src, sink