Skip to content

Commit eddff3d

Browse files
d10cd10c
committed
Java: convert GroovyInjection test to .qlref
1 parent 403e782 commit eddff3d

File tree

10 files changed

+417
-108
lines changed

10 files changed

+417
-108
lines changed

java/ql/test/query-tests/security/CWE-094/GroovyClassLoaderTest.java renamed to java/ql/test/query-tests/security/CWE-094/GroovyInjection/GroovyClassLoaderTest.java

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,42 +14,41 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
1414
throws ServletException, IOException {
1515
// "groovy.lang;GroovyClassLoader;false;parseClass;(GroovyCodeSource);;Argument[0];groovy;manual",
1616
{
17-
String script = request.getParameter("script");
17+
String script = request.getParameter("script"); // $Source
1818
final GroovyClassLoader classLoader = new GroovyClassLoader();
1919
GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
20-
classLoader.parseClass(gcs); // $hasGroovyInjection
20+
classLoader.parseClass(gcs); // $Alert
2121
}
2222
// "groovy.lang;GroovyClassLoader;false;parseClass;(GroovyCodeSource,boolean);;Argument[0];groovy;manual",
2323
{
24-
String script = request.getParameter("script");
24+
String script = request.getParameter("script"); // $Source
2525
final GroovyClassLoader classLoader = new GroovyClassLoader();
2626
GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
27-
classLoader.parseClass(gcs, true); // $hasGroovyInjection
27+
classLoader.parseClass(gcs, true); // $Alert
2828
}
2929
// "groovy.lang;GroovyClassLoader;false;parseClass;(InputStream,String);;Argument[0];groovy;manual",
3030
{
31-
String script = request.getParameter("script");
31+
String script = request.getParameter("script"); // $Source
3232
final GroovyClassLoader classLoader = new GroovyClassLoader();
33-
classLoader.parseClass(new ByteArrayInputStream(script.getBytes()), "test"); // $hasGroovyInjection
33+
classLoader.parseClass(new ByteArrayInputStream(script.getBytes()), "test"); // $Alert
3434
}
3535
// "groovy.lang;GroovyClassLoader;false;parseClass;(Reader,String);;Argument[0];groovy;manual",
3636
{
37-
String script = request.getParameter("script");
37+
String script = request.getParameter("script"); // $Source
3838
final GroovyClassLoader classLoader = new GroovyClassLoader();
39-
classLoader.parseClass(new StringReader(script), "test"); // $hasGroovyInjection
39+
classLoader.parseClass(new StringReader(script), "test"); // $Alert
4040
}
4141
// "groovy.lang;GroovyClassLoader;false;parseClass;(String);;Argument[0];groovy;manual",
4242
{
43-
String script = request.getParameter("script");
43+
String script = request.getParameter("script"); // $Source
4444
final GroovyClassLoader classLoader = new GroovyClassLoader();
45-
classLoader.parseClass(script); // $hasGroovyInjection
45+
classLoader.parseClass(script); // $Alert
4646
}
4747
// "groovy.lang;GroovyClassLoader;false;parseClass;(String,String);;Argument[0];groovy;manual",
4848
{
49-
String script = request.getParameter("script");
49+
String script = request.getParameter("script"); // $Source
5050
final GroovyClassLoader classLoader = new GroovyClassLoader();
51-
classLoader.parseClass(script, "test"); // $hasGroovyInjection
51+
classLoader.parseClass(script, "test"); // $Alert
5252
}
5353
}
5454
}
55-

java/ql/test/query-tests/security/CWE-094/GroovyCompilationUnitTest.java renamed to java/ql/test/query-tests/security/CWE-094/GroovyInjection/GroovyCompilationUnitTest.java

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ public void doGet(HttpServletRequest request, HttpServletResponse response)
1818
// "org.codehaus.groovy.control;CompilationUnit;false;compile;;;Argument[this];groovy;manual"
1919
{
2020
CompilationUnit cu = new CompilationUnit();
21-
cu.addSource("test", request.getParameter("source"));
22-
cu.compile(); // $hasGroovyInjection
21+
cu.addSource("test", request.getParameter("source")); // $Source
22+
cu.compile(); // $Alert
2323
}
2424
{
2525
CompilationUnit cu = new CompilationUnit();
@@ -29,20 +29,20 @@ public void doGet(HttpServletRequest request, HttpServletResponse response)
2929
{
3030
CompilationUnit cu = new CompilationUnit();
3131
cu.addSource("test",
32-
new ByteArrayInputStream(request.getParameter("source").getBytes()));
33-
cu.compile(); // $hasGroovyInjection
32+
new ByteArrayInputStream(request.getParameter("source").getBytes())); // $Source
33+
cu.compile(); // $Alert
3434
}
3535
{
3636
CompilationUnit cu = new CompilationUnit();
37-
cu.addSource(new URL(request.getParameter("source")));
38-
cu.compile(); // $hasGroovyInjection
37+
cu.addSource(new URL(request.getParameter("source"))); // $Source
38+
cu.compile(); // $Alert
3939
}
4040
{
4141
CompilationUnit cu = new CompilationUnit();
4242
SourceUnit su =
43-
new SourceUnit("test", request.getParameter("source"), null, null, null);
43+
new SourceUnit("test", request.getParameter("source"), null, null, null); // $Source
4444
cu.addSource(su);
45-
cu.compile(); // $hasGroovyInjection
45+
cu.compile(); // $Alert
4646
}
4747
{
4848
CompilationUnit cu = new CompilationUnit();
@@ -53,29 +53,29 @@ public void doGet(HttpServletRequest request, HttpServletResponse response)
5353
}
5454
{
5555
CompilationUnit cu = new CompilationUnit();
56-
StringReaderSource rs = new StringReaderSource(request.getParameter("source"), null);
56+
StringReaderSource rs = new StringReaderSource(request.getParameter("source"), null); // $Source
5757
SourceUnit su = new SourceUnit("test", rs, null, null, null);
5858
cu.addSource(su);
59-
cu.compile(); // $hasGroovyInjection
59+
cu.compile(); // $Alert
6060
}
6161
{
6262
CompilationUnit cu = new CompilationUnit();
6363
SourceUnit su =
64-
new SourceUnit(new URL(request.getParameter("source")), null, null, null);
64+
new SourceUnit(new URL(request.getParameter("source")), null, null, null); // $Source
6565
cu.addSource(su);
66-
cu.compile(); // $hasGroovyInjection
66+
cu.compile(); // $Alert
6767
}
6868
{
6969
CompilationUnit cu = new CompilationUnit();
70-
SourceUnit su = SourceUnit.create("test", request.getParameter("source"));
70+
SourceUnit su = SourceUnit.create("test", request.getParameter("source")); // $Source
7171
cu.addSource(su);
72-
cu.compile(); // $hasGroovyInjection
72+
cu.compile(); // $Alert
7373
}
7474
{
7575
CompilationUnit cu = new CompilationUnit();
76-
SourceUnit su = SourceUnit.create("test", request.getParameter("source"), 0);
76+
SourceUnit su = SourceUnit.create("test", request.getParameter("source"), 0); // $Source
7777
cu.addSource(su);
78-
cu.compile(); // $hasGroovyInjection
78+
cu.compile(); // $Alert
7979
}
8080
{
8181
CompilationUnit cu = new CompilationUnit();
@@ -85,8 +85,8 @@ public void doGet(HttpServletRequest request, HttpServletResponse response)
8585
}
8686
{
8787
JavaAwareCompilationUnit cu = new JavaAwareCompilationUnit();
88-
cu.addSource("test", request.getParameter("source"));
89-
cu.compile(); // $hasGroovyInjection
88+
cu.addSource("test", request.getParameter("source")); // $Source
89+
cu.compile(); // $Alert
9090
}
9191
{
9292
JavaStubCompilationUnit cu = new JavaStubCompilationUnit(null, null);

java/ql/test/query-tests/security/CWE-094/GroovyEvalTest.java renamed to java/ql/test/query-tests/security/CWE-094/GroovyInjection/GroovyEvalTest.java

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,30 +11,29 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
1111
throws ServletException, IOException {
1212
// "groovy.util;Eval;false;me;(String);;Argument[0];groovy;manual",
1313
{
14-
String script = request.getParameter("script");
15-
Eval.me(script); // $hasGroovyInjection
14+
String script = request.getParameter("script"); // $Source
15+
Eval.me(script); // $Alert
1616
}
1717
// "groovy.util;Eval;false;me;(String,Object,String);;Argument[2];groovy;manual",
1818
{
19-
String script = request.getParameter("script");
20-
Eval.me("test", "result", script); // $hasGroovyInjection
19+
String script = request.getParameter("script"); // $Source
20+
Eval.me("test", "result", script); // $Alert
2121
}
2222
// "groovy.util;Eval;false;x;(Object,String);;Argument[1];groovy;manual",
2323
{
24-
String script = request.getParameter("script");
25-
Eval.x("result2", script); // $hasGroovyInjection
24+
String script = request.getParameter("script"); // $Source
25+
Eval.x("result2", script); // $Alert
2626

2727
}
2828
// "groovy.util;Eval;false;xy;(Object,Object,String);;Argument[2];groovy;manual",
2929
{
30-
String script = request.getParameter("script");
31-
Eval.xy("result3", "result4", script); // $hasGroovyInjection
30+
String script = request.getParameter("script"); // $Source
31+
Eval.xy("result3", "result4", script); // $Alert
3232
}
3333
// "groovy.util;Eval;false;xyz;(Object,Object,Object,String);;Argument[3];groovy;manual",
3434
{
35-
String script = request.getParameter("script");
36-
Eval.xyz("result3", "result4", "aaa", script); // $hasGroovyInjection
35+
String script = request.getParameter("script"); // $Source
36+
Eval.xyz("result3", "result4", "aaa", script); // $Alert
3737
}
3838
}
3939
}
40-

0 commit comments

Comments
 (0)