Skip to content

Commit 7317c29

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Shared: update kind information
1 parent 79f61cc commit 7317c29

File tree

7 files changed

+308
-161
lines changed

7 files changed

+308
-161
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/SharedModelValidation.qll‎

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,38 +7,57 @@
77

88
/** A valid models-as-data sink kind. */
99
class ValidSinkKind extends string {
10+
bindingset[this]
1011
ValidSinkKind() {
1112
this =
1213
[
13-
// shared ALL languages
14-
"request-forgery", "ldap-injection", "sql-injection", "nosql-injection", "log-injection",
15-
"xpath-injection", "html-injection", "js-injection", "url-redirection", "path-injection",
16-
"file-content-store", "hostname-verification", "response-splitting", "information-leak",
17-
"xslt-injection", "template-injection", "fragment-injection", "command-injection",
18-
"unsafe-deserialization", "xxe", "database-store", "format-string",
19-
// .matches("credentials-%"), .matches("regex-use%")"
20-
// shared MOST languages
21-
"code-injection", // .matches("encryption-%"),
22-
// Java only
23-
"jndi-injection", "mvel-injection", "groovy-injection", "ognl-injection", "jexl-injection",
24-
"bean-validation", "intent-redirection", "pending-intents",
25-
// JS only
26-
"mongodb.sink",
27-
// Swift only
28-
"preferences-store", "transmission", "predicate-injection", "webview-fetch",
29-
"tls-protocol-version", "hash-iteration-count" // .matches("%string-%length"), .matches("weak-hash-input-")
14+
// shared
15+
"code-injection", "command-injection", "file-content-store", "html-injection",
16+
"js-injection", "ldap-injection", "log-injection", "path-injection", "request-forgery",
17+
"sql-injection", "url-redirection",
18+
// Java-only currently, but may be shared in the future
19+
"bean-validation", "fragment-injection", "groovy-injection", "hostname-verification",
20+
"information-leak", "intent-redirection", "jexl-injection", "jndi-injection",
21+
"mvel-injection", "ognl-injection", "pending-intents", "response-splitting",
22+
"template-injection", "xpath-injection", "xslt-injection",
23+
// JavaScript-only currently, but may be shared in the future
24+
"mongodb.sink", "nosql-injection", "unsafe-deserialization",
25+
// Swift-only currently, but may be shared in the future
26+
"database-store", "format-string", "hash-iteration-count", "predicate-injection",
27+
"preferences-store", "tls-protocol-version", "transmission", "webview-fetch", "xxe"
3028
]
29+
or
30+
this.matches([
31+
// shared
32+
"encryption-%",
33+
// Java-only currently, but may be shared in the future
34+
"regex-use%",
35+
// JavaScript-only currently, but may be shared in the future
36+
"credentials-%",
37+
// Swift-only currently, but may be shared in the future
38+
"%string-%length", "weak-hash-input-%"
39+
])
3140
}
3241
}
3342

3443
/** A valid models-as-data source kind. */
3544
class ValidSourceKind extends string {
45+
bindingset[this]
3646
ValidSourceKind() {
3747
this =
3848
[
39-
// shared ALL languages
40-
"remote", "local"
49+
// shared
50+
"local", "remote",
51+
// Java
52+
"android-external-storage-dir", "contentprovider",
53+
// C#
54+
"file", "file-write",
55+
// JavaScript
56+
"database-access-result"
4157
]
58+
or
59+
// Swift
60+
this.matches("%string-%length")
4261
}
4362
}
4463

@@ -47,8 +66,10 @@ class ValidSummaryKind extends string {
4766
ValidSummaryKind() {
4867
this =
4968
[
50-
// shared ALL languages
51-
"taint", "value"
69+
// shared
70+
"taint", "value",
71+
// JavaScript
72+
"type"
5273
]
5374
}
5475
}
@@ -58,8 +79,8 @@ class ValidNeutralKind extends string {
5879
ValidNeutralKind() {
5980
this =
6081
[
61-
// shared ALL languages
62-
"summary", "source", "sink"
82+
// Java/C# currently
83+
"sink", "source", "summary"
6384
]
6485
}
6586
}

‎go/ql/lib/semmle/go/dataflow/SharedModelValidation.qll‎

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,38 +7,57 @@
77

88
/** A valid models-as-data sink kind. */
99
class ValidSinkKind extends string {
10+
bindingset[this]
1011
ValidSinkKind() {
1112
this =
1213
[
13-
// shared ALL languages
14-
"request-forgery", "ldap-injection", "sql-injection", "nosql-injection", "log-injection",
15-
"xpath-injection", "html-injection", "js-injection", "url-redirection", "path-injection",
16-
"file-content-store", "hostname-verification", "response-splitting", "information-leak",
17-
"xslt-injection", "template-injection", "fragment-injection", "command-injection",
18-
"unsafe-deserialization", "xxe", "database-store", "format-string",
19-
// .matches("credentials-%"), .matches("regex-use%")"
20-
// shared MOST languages
21-
"code-injection", // .matches("encryption-%"),
22-
// Java only
23-
"jndi-injection", "mvel-injection", "groovy-injection", "ognl-injection", "jexl-injection",
24-
"bean-validation", "intent-redirection", "pending-intents",
25-
// JS only
26-
"mongodb.sink",
27-
// Swift only
28-
"preferences-store", "transmission", "predicate-injection", "webview-fetch",
29-
"tls-protocol-version", "hash-iteration-count" // .matches("%string-%length"), .matches("weak-hash-input-")
14+
// shared
15+
"code-injection", "command-injection", "file-content-store", "html-injection",
16+
"js-injection", "ldap-injection", "log-injection", "path-injection", "request-forgery",
17+
"sql-injection", "url-redirection",
18+
// Java-only currently, but may be shared in the future
19+
"bean-validation", "fragment-injection", "groovy-injection", "hostname-verification",
20+
"information-leak", "intent-redirection", "jexl-injection", "jndi-injection",
21+
"mvel-injection", "ognl-injection", "pending-intents", "response-splitting",
22+
"template-injection", "xpath-injection", "xslt-injection",
23+
// JavaScript-only currently, but may be shared in the future
24+
"mongodb.sink", "nosql-injection", "unsafe-deserialization",
25+
// Swift-only currently, but may be shared in the future
26+
"database-store", "format-string", "hash-iteration-count", "predicate-injection",
27+
"preferences-store", "tls-protocol-version", "transmission", "webview-fetch", "xxe"
3028
]
29+
or
30+
this.matches([
31+
// shared
32+
"encryption-%",
33+
// Java-only currently, but may be shared in the future
34+
"regex-use%",
35+
// JavaScript-only currently, but may be shared in the future
36+
"credentials-%",
37+
// Swift-only currently, but may be shared in the future
38+
"%string-%length", "weak-hash-input-%"
39+
])
3140
}
3241
}
3342

3443
/** A valid models-as-data source kind. */
3544
class ValidSourceKind extends string {
45+
bindingset[this]
3646
ValidSourceKind() {
3747
this =
3848
[
39-
// shared ALL languages
40-
"remote", "local"
49+
// shared
50+
"local", "remote",
51+
// Java
52+
"android-external-storage-dir", "contentprovider",
53+
// C#
54+
"file", "file-write",
55+
// JavaScript
56+
"database-access-result"
4157
]
58+
or
59+
// Swift
60+
this.matches("%string-%length")
4261
}
4362
}
4463

@@ -47,8 +66,10 @@ class ValidSummaryKind extends string {
4766
ValidSummaryKind() {
4867
this =
4968
[
50-
// shared ALL languages
51-
"taint", "value"
69+
// shared
70+
"taint", "value",
71+
// JavaScript
72+
"type"
5273
]
5374
}
5475
}
@@ -58,8 +79,8 @@ class ValidNeutralKind extends string {
5879
ValidNeutralKind() {
5980
this =
6081
[
61-
// shared ALL languages
62-
"summary", "source", "sink"
82+
// Java/C# currently
83+
"sink", "source", "summary"
6384
]
6485
}
6586
}

‎java/ql/lib/semmle/code/java/dataflow/SharedModelValidation.qll‎

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,38 +7,57 @@
77

88
/** A valid models-as-data sink kind. */
99
class ValidSinkKind extends string {
10+
bindingset[this]
1011
ValidSinkKind() {
1112
this =
1213
[
13-
// shared ALL languages
14-
"request-forgery", "ldap-injection", "sql-injection", "nosql-injection", "log-injection",
15-
"xpath-injection", "html-injection", "js-injection", "url-redirection", "path-injection",
16-
"file-content-store", "hostname-verification", "response-splitting", "information-leak",
17-
"xslt-injection", "template-injection", "fragment-injection", "command-injection",
18-
"unsafe-deserialization", "xxe", "database-store", "format-string",
19-
// .matches("credentials-%"), .matches("regex-use%")"
20-
// shared MOST languages
21-
"code-injection", // .matches("encryption-%"),
22-
// Java only
23-
"jndi-injection", "mvel-injection", "groovy-injection", "ognl-injection", "jexl-injection",
24-
"bean-validation", "intent-redirection", "pending-intents",
25-
// JS only
26-
"mongodb.sink",
27-
// Swift only
28-
"preferences-store", "transmission", "predicate-injection", "webview-fetch",
29-
"tls-protocol-version", "hash-iteration-count" // .matches("%string-%length"), .matches("weak-hash-input-")
14+
// shared
15+
"code-injection", "command-injection", "file-content-store", "html-injection",
16+
"js-injection", "ldap-injection", "log-injection", "path-injection", "request-forgery",
17+
"sql-injection", "url-redirection",
18+
// Java-only currently, but may be shared in the future
19+
"bean-validation", "fragment-injection", "groovy-injection", "hostname-verification",
20+
"information-leak", "intent-redirection", "jexl-injection", "jndi-injection",
21+
"mvel-injection", "ognl-injection", "pending-intents", "response-splitting",
22+
"template-injection", "xpath-injection", "xslt-injection",
23+
// JavaScript-only currently, but may be shared in the future
24+
"mongodb.sink", "nosql-injection", "unsafe-deserialization",
25+
// Swift-only currently, but may be shared in the future
26+
"database-store", "format-string", "hash-iteration-count", "predicate-injection",
27+
"preferences-store", "tls-protocol-version", "transmission", "webview-fetch", "xxe"
3028
]
29+
or
30+
this.matches([
31+
// shared
32+
"encryption-%",
33+
// Java-only currently, but may be shared in the future
34+
"regex-use%",
35+
// JavaScript-only currently, but may be shared in the future
36+
"credentials-%",
37+
// Swift-only currently, but may be shared in the future
38+
"%string-%length", "weak-hash-input-%"
39+
])
3140
}
3241
}
3342

3443
/** A valid models-as-data source kind. */
3544
class ValidSourceKind extends string {
45+
bindingset[this]
3646
ValidSourceKind() {
3747
this =
3848
[
39-
// shared ALL languages
40-
"remote", "local"
49+
// shared
50+
"local", "remote",
51+
// Java
52+
"android-external-storage-dir", "contentprovider",
53+
// C#
54+
"file", "file-write",
55+
// JavaScript
56+
"database-access-result"
4157
]
58+
or
59+
// Swift
60+
this.matches("%string-%length")
4261
}
4362
}
4463

@@ -47,8 +66,10 @@ class ValidSummaryKind extends string {
4766
ValidSummaryKind() {
4867
this =
4968
[
50-
// shared ALL languages
51-
"taint", "value"
69+
// shared
70+
"taint", "value",
71+
// JavaScript
72+
"type"
5273
]
5374
}
5475
}
@@ -58,8 +79,8 @@ class ValidNeutralKind extends string {
5879
ValidNeutralKind() {
5980
this =
6081
[
61-
// shared ALL languages
62-
"summary", "source", "sink"
82+
// Java/C# currently
83+
"sink", "source", "summary"
6384
]
6485
}
6586
}

0 commit comments

Comments
 (0)