Skip to content

Commit ddcf852

Browse files
KwstubbsKwstubbs
committed
Add taint steps
1 parent 58e4a40 commit ddcf852

File tree

6 files changed

+122
-1
lines changed

6 files changed

+122
-1
lines changed

‎java/ql/lib/change-notes/2024-09-24-multipart.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: minorAnalysis
33
---
4-
* Added more dataflow models of `org.apache.commons.fileupload.FileItem` and `javax.servlet.http.Part`.
4+
* Added more dataflow models of `org.apache.commons.fileupload.FileItem`, `javax/jakarta.servlet.http.Part` and `org.apache.commons.fileupload.util.Streams`.

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/Test.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package com.mycompany.app;
2+
3+
import org.apache.commons.fileupload.util.Streams;
4+
import java.io.InputStream;
5+
import java.io.OutputStream;
6+
import java.io.ByteArrayOutputStream;
7+
8+
// Test case generated by GenerateFlowTestCase.ql
9+
public class Test {
10+
11+
Object source() {
12+
return null;
13+
}
14+
15+
void sink(Object o) {
16+
}
17+
18+
public void test() throws Exception {
19+
20+
{
21+
InputStream in = (InputStream)source();
22+
OutputStream os = new ByteArrayOutputStream(1024);
23+
24+
InputStream in2 = (InputStream)source();
25+
OutputStream os2 = new ByteArrayOutputStream(1024);
26+
27+
byte[] myArray = new byte[1024];
28+
29+
// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean,byte[]);;Argument[0];Argument[1];taint;manual"
30+
long status = Streams.copy(in, os, true, myArray);
31+
sink(os); // $ hasTaintFlow
32+
// "org.apache.commons.fileupload.util;Streams;true;copy;(InputStream,OutputStream,boolean);;Argument[0];Argument[1];taint;manual"
33+
long status2 = Streams.copy(in2, os2, true);
34+
sink(os2); // $ hasTaintFlow
35+
}
36+
37+
}
38+
public void test2() throws Exception {
39+
40+
{
41+
42+
InputStream in = (InputStream)source();
43+
// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
44+
String result = Streams.asString(in);
45+
sink(result); // $ hasTaintFlow
46+
47+
InputStream in1 = (InputStream)source();
48+
// "org.apache.commons.fileupload.util;Streams;true;asString;(InputStream,String);;Argument[0];ReturnValue;taint;manual"
49+
String result1 = Streams.asString(in1, "test");
50+
sink(result1); // $ hasTaintFlow
51+
}
52+
53+
}
54+
55+
}

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-fileupload-1.4

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.expected‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
models
2+
| 1 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream); ; Argument[0]; ReturnValue; taint; manual |
3+
| 2 | Summary: org.apache.commons.fileupload.util; Streams; true; asString; (InputStream,String); ; Argument[0]; ReturnValue; taint; manual |
4+
| 3 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean); ; Argument[0]; Argument[1]; taint; manual |
5+
| 4 | Summary: org.apache.commons.fileupload.util; Streams; true; copy; (InputStream,OutputStream,boolean,byte[]); ; Argument[0]; Argument[1]; taint; manual |
6+
edges
7+
| Test.java:22:30:22:50 | (...)... : InputStream | Test.java:30:31:30:32 | in : InputStream | provenance | |
8+
| Test.java:22:43:22:50 | source(...) : Object | Test.java:22:30:22:50 | (...)... : InputStream | provenance | |
9+
| Test.java:25:22:25:42 | (...)... : InputStream | Test.java:33:32:33:34 | in2 : InputStream | provenance | |
10+
| Test.java:25:35:25:42 | source(...) : Object | Test.java:25:22:25:42 | (...)... : InputStream | provenance | |
11+
| Test.java:30:31:30:32 | in : InputStream | Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | provenance | MaD:4 |
12+
| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | Test.java:31:9:31:10 | os | provenance | |
13+
| Test.java:33:32:33:34 | in2 : InputStream | Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | provenance | MaD:3 |
14+
| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | Test.java:34:9:34:11 | os2 | provenance | |
15+
| Test.java:45:30:45:50 | (...)... : InputStream | Test.java:47:37:47:38 | in : InputStream | provenance | |
16+
| Test.java:45:43:45:50 | source(...) : Object | Test.java:45:30:45:50 | (...)... : InputStream | provenance | |
17+
| Test.java:47:20:47:39 | asString(...) : String | Test.java:48:9:48:14 | result | provenance | |
18+
| Test.java:47:37:47:38 | in : InputStream | Test.java:47:20:47:39 | asString(...) : String | provenance | MaD:1 |
19+
| Test.java:50:31:50:51 | (...)... : InputStream | Test.java:51:47:51:49 | in1 : InputStream | provenance | |
20+
| Test.java:50:44:50:51 | source(...) : Object | Test.java:50:31:50:51 | (...)... : InputStream | provenance | |
21+
| Test.java:51:30:51:58 | asString(...) : String | Test.java:52:18:52:24 | result1 | provenance | |
22+
| Test.java:51:47:51:49 | in1 : InputStream | Test.java:51:30:51:58 | asString(...) : String | provenance | MaD:2 |
23+
nodes
24+
| Test.java:22:30:22:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
25+
| Test.java:22:43:22:50 | source(...) : Object | semmle.label | source(...) : Object |
26+
| Test.java:25:22:25:42 | (...)... : InputStream | semmle.label | (...)... : InputStream |
27+
| Test.java:25:35:25:42 | source(...) : Object | semmle.label | source(...) : Object |
28+
| Test.java:30:31:30:32 | in : InputStream | semmle.label | in : InputStream |
29+
| Test.java:30:35:30:36 | os [post update] : ByteArrayOutputStream | semmle.label | os [post update] : ByteArrayOutputStream |
30+
| Test.java:31:9:31:10 | os | semmle.label | os |
31+
| Test.java:33:32:33:34 | in2 : InputStream | semmle.label | in2 : InputStream |
32+
| Test.java:33:37:33:39 | os2 [post update] : ByteArrayOutputStream | semmle.label | os2 [post update] : ByteArrayOutputStream |
33+
| Test.java:34:9:34:11 | os2 | semmle.label | os2 |
34+
| Test.java:45:30:45:50 | (...)... : InputStream | semmle.label | (...)... : InputStream |
35+
| Test.java:45:43:45:50 | source(...) : Object | semmle.label | source(...) : Object |
36+
| Test.java:47:20:47:39 | asString(...) : String | semmle.label | asString(...) : String |
37+
| Test.java:47:37:47:38 | in : InputStream | semmle.label | in : InputStream |
38+
| Test.java:48:9:48:14 | result | semmle.label | result |
39+
| Test.java:50:31:50:51 | (...)... : InputStream | semmle.label | (...)... : InputStream |
40+
| Test.java:50:44:50:51 | source(...) : Object | semmle.label | source(...) : Object |
41+
| Test.java:51:30:51:58 | asString(...) : String | semmle.label | asString(...) : String |
42+
| Test.java:51:47:51:49 | in1 : InputStream | semmle.label | in1 : InputStream |
43+
| Test.java:52:18:52:24 | result1 | semmle.label | result1 |
44+
subpaths
45+
testFailures

‎java/ql/test/library-tests/frameworks/apache-commons-fileupload-1.4/test.ql‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import java
2+
import TestUtilities.InlineFlowTest
3+
import DefaultFlowTest
4+
import TaintFlow::PathGraph

‎java/ql/test/stubs/apache-commons-fileupload-1.4/org/apache/commons/fileupload/util/Streams.java‎

Lines changed: 16 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)