|
1 | 1 | import java |
2 | 2 | import DataFlow |
3 | 3 | import semmle.code.java.Reflection |
4 | | -import semmle.code.java.dataflow.DataFlow3 |
5 | 4 | import semmle.code.java.dataflow.FlowSources |
6 | | -import semmle.code.java.dataflow.TaintTracking2 |
7 | 5 |
|
8 | 6 | /** |
9 | | - * A call to a Java standard library method which constructs or returns a `Class<T>` from a `String`. |
10 | | - * e.g `Class.forName(...)` or `ClassLoader.loadClass(...)` |
| 7 | + * A call to `java.lang.reflect.Method.invoke`. |
11 | 8 | */ |
12 | | -class ReflectiveClassIdentifierMethodAccessCall extends MethodAccess { |
13 | | - ReflectiveClassIdentifierMethodAccessCall() { |
14 | | - this instanceof ReflectiveClassIdentifierMethodAccess |
15 | | - } |
| 9 | +class MethodInvokeCall extends MethodAccess { |
| 10 | + MethodInvokeCall() { this.getMethod().hasQualifiedName("java.lang.reflect", "Method", "invoke") } |
16 | 11 | } |
17 | 12 |
|
18 | 13 | /** |
19 | | - * Unsafe reflection sink. |
20 | | - * e.g `Constructor.newInstance(...)` or `Method.invoke(...)` or `Class.newInstance()`. |
| 14 | + * Unsafe reflection sink (the qualifier or method arguments to `Constructor.newInstance(...)` or `Method.invoke(...)`) |
21 | 15 | */ |
22 | 16 | class UnsafeReflectionSink extends DataFlow::ExprNode { |
23 | 17 | UnsafeReflectionSink() { |
24 | 18 | exists(MethodAccess ma | |
25 | 19 | ( |
26 | | - ma.getMethod().hasQualifiedName("java.lang.reflect", "Constructor<>", "newInstance") |
27 | | - or |
28 | | - ma.getMethod().hasQualifiedName("java.lang.reflect", "Method", "invoke") |
| 20 | + ma.getMethod().hasQualifiedName("java.lang.reflect", "Constructor<>", "newInstance") or |
| 21 | + ma instanceof MethodInvokeCall |
29 | 22 | ) and |
30 | | - ma.getQualifier() = this.asExpr() and |
31 | | - exists(ReflectionArgsConfig rac | rac.hasFlowToExpr(ma.getAnArgument())) |
| 23 | + this.asExpr() = [ma.getQualifier(), ma.getAnArgument()] |
32 | 24 | ) |
33 | 25 | } |
34 | 26 | } |
35 | 27 |
|
36 | | -/** Taint-tracking configuration tracing flow from remote sources to specifying the initialization parameters to the constructor or method. */ |
37 | | -class ReflectionArgsConfig extends TaintTracking2::Configuration { |
38 | | - ReflectionArgsConfig() { this = "ReflectionArgsConfig" } |
39 | | - |
40 | | - override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } |
41 | | - |
42 | | - override predicate isSink(DataFlow::Node sink) { |
43 | | - exists(NewInstance ni | ni.getAnArgument() = sink.asExpr()) |
44 | | - or |
45 | | - exists(MethodAccess ma | |
46 | | - ma.getMethod().hasQualifiedName("java.lang.reflect", "Method", "invoke") and |
47 | | - ma.getArgument(1) = sink.asExpr() and |
48 | | - exists(ReflectionInvokeObjectConfig rioc | rioc.hasFlowToExpr(ma.getArgument(0))) |
49 | | - ) |
50 | | - } |
| 28 | +/** |
| 29 | + * Holds if `fromNode` to `toNode` is a dataflow step that looks like resolving a class. |
| 30 | + * A method probably resolves a class if it takes a string, returns a Class |
| 31 | + * and its name contains "resolve", "load", etc. |
| 32 | + */ |
| 33 | +predicate looksLikeResolveClassStep(DataFlow::Node fromNode, DataFlow::Node toNode) { |
| 34 | + exists(MethodAccess ma, Method m, int i, Expr arg | |
| 35 | + m = ma.getMethod() and arg = ma.getArgument(i) |
| 36 | + | |
| 37 | + m.getReturnType() instanceof TypeClass and |
| 38 | + m.getName().toLowerCase().regexpMatch("resolve|load|class|type") and |
| 39 | + arg.getType() instanceof TypeString and |
| 40 | + arg = fromNode.asExpr() and |
| 41 | + ma = toNode.asExpr() |
| 42 | + ) |
51 | 43 | } |
52 | 44 |
|
53 | | -/** A data flow configuration tracing flow from the class object associated with the class to specifying the initialization parameters. */ |
54 | | -class ReflectionInvokeObjectConfig extends DataFlow3::Configuration { |
55 | | - ReflectionInvokeObjectConfig() { this = "ReflectionInvokeObjectConfig" } |
56 | | - |
57 | | - override predicate isSource(DataFlow::Node source) { |
58 | | - exists(ReflectiveClassIdentifierMethodAccessCall rma | rma = source.asExpr()) |
59 | | - } |
60 | | - |
61 | | - override predicate isSink(DataFlow::Node sink) { |
62 | | - exists(MethodAccess ma | |
63 | | - ma.getMethod().hasQualifiedName("java.lang.reflect", "Method", "invoke") and |
64 | | - ma.getArgument(0) = sink.asExpr() |
65 | | - ) |
66 | | - } |
67 | | - |
68 | | - override predicate isAdditionalFlowStep(Node pred, Node succ) { |
69 | | - exists(NewInstance ni | |
70 | | - ni.getQualifier() = pred.asExpr() and |
71 | | - ni = succ.asExpr() |
72 | | - ) |
73 | | - or |
74 | | - exists(MethodAccess ma, Method m, int i, Expr arg | |
75 | | - m = ma.getMethod() and arg = ma.getArgument(i) |
76 | | - | |
77 | | - m.getReturnType() instanceof TypeObject and |
78 | | - arg.getType() instanceof TypeClass and |
79 | | - arg = pred.asExpr() and |
80 | | - ma = succ.asExpr() |
81 | | - ) |
82 | | - } |
| 45 | +/** |
| 46 | + * Holds if `fromNode` to `toNode` is a dataflow step that looks like instantiating a class. |
| 47 | + * A method probably instantiates a class if it is external, takes a Class, returns an Object |
| 48 | + * and its name contains "instantiate" or similar terms. |
| 49 | + */ |
| 50 | +predicate looksLikeInstantiateClassStep(DataFlow::Node fromNode, DataFlow::Node toNode) { |
| 51 | + exists(MethodAccess ma, Method m, int i, Expr arg | |
| 52 | + m = ma.getMethod() and arg = ma.getArgument(i) |
| 53 | + | |
| 54 | + m.getReturnType() instanceof TypeObject and |
| 55 | + m.getName() |
| 56 | + .toLowerCase() |
| 57 | + .regexpMatch("instantiate|instance|create|make|getbean|instantiateclass") and |
| 58 | + arg.getType() instanceof TypeClass and |
| 59 | + arg = fromNode.asExpr() and |
| 60 | + ma = toNode.asExpr() |
| 61 | + ) |
83 | 62 | } |
0 commit comments