Skip to content

Commit 6bb865a

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: make numeric flow models neutral
1 parent 0c7ffb0 commit 6bb865a

File tree

8 files changed

+44
-85
lines changed

8 files changed

+44
-85
lines changed

‎java/ql/lib/ext/java.lang.model.yml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,9 @@ extensions:
4141
- ["java.lang", "IllegalArgumentException", False, "IllegalArgumentException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
4242
- ["java.lang", "IllegalStateException", False, "IllegalStateException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
4343
- ["java.lang", "IndexOutOfBoundsException", False, "IndexOutOfBoundsException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
44-
- ["java.lang", "Integer", False, "intValue", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
45-
- ["java.lang", "Integer", False, "parseInt", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
46-
- ["java.lang", "Integer", False, "toString", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
47-
- ["java.lang", "Integer", False, "valueOf", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
4844
- ["java.lang", "Iterable", True, "forEach", "(Consumer)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
4945
- ["java.lang", "Iterable", True, "iterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
5046
- ["java.lang", "Iterable", True, "spliterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
51-
- ["java.lang", "Long", False, "longValue", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
52-
- ["java.lang", "Long", False, "parseLong", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
53-
- ["java.lang", "Long", False, "toString", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
54-
- ["java.lang", "Math", False, "min", "(int,int)", "", "Argument[0..1]", "ReturnValue", "value", "manual"]
5547
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
5648
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapKey", "ReturnValue.MapKey", "value", "manual"]
5749
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapValue", "ReturnValue.MapValue", "value", "manual"]
@@ -97,8 +89,6 @@ extensions:
9789
- ["java.lang", "String", False, "valueOf", "(char)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
9890
- ["java.lang", "String", False, "valueOf", "(char[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
9991
- ["java.lang", "String", False, "valueOf", "(char[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
100-
- ["java.lang", "String", False, "valueOf", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
101-
- ["java.lang", "String", False, "valueOf", "(long)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
10292
- ["java.lang", "StringBuffer", True, "StringBuffer", "(CharSequence)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
10393
- ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
10494
- ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
@@ -143,3 +133,16 @@ extensions:
143133
- ["java.lang", "System", "nanoTime", "()", "manual"]
144134
- ["java.lang", "Thread", "currentThread", "()", "manual"]
145135
- ["java.lang", "Thread", "sleep", "(long)", "manual"]
136+
137+
# The below APIs have numeric flow and are currently being stored as neutral models.
138+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
139+
- ["java.lang", "Integer", "intValue", "()", "manual"] # taint-numeric
140+
- ["java.lang", "Integer", "parseInt", "(String)", "manual"] # taint-numeric
141+
- ["java.lang", "Integer", "toString", "(int)", "manual"] # taint-numeric
142+
- ["java.lang", "Integer", "valueOf", "(int)", "manual"] # taint-numeric
143+
- ["java.lang", "Long", "longValue", "()", "manual"] # taint-numeric
144+
- ["java.lang", "Long", "parseLong", "(String)", "manual"] # taint-numeric
145+
- ["java.lang", "Long", "toString", "()", "manual"] # taint-numeric
146+
- ["java.lang", "Math", "min", "(int,int)", "manual"] # value-numeric
147+
- ["java.lang", "String", "valueOf", "(int)", "manual"] # taint-numeric
148+
- ["java.lang", "String", "valueOf", "(long)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.math.model.yml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/java-all
4-
extensible: summaryModel
5-
data:
6-
- ["java.math", "BigDecimal", False, "BigDecimal", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
7-
- ["java.math", "BigDecimal", False, "valueOf", "(double)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8-
- ["java.math", "BigDecimal", False, "valueOf", "(long)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
9-
102
- addsTo:
113
pack: codeql/java-all
124
extensible: neutralModel
135
data:
146
- ["java.math", "BigDecimal", "compareTo", "(BigDecimal)", "manual"]
7+
8+
# The below APIs have numeric flow and are currently being stored as neutral models.
9+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
10+
- ["java.math", "BigDecimal", "BigDecimal", "(String)", "manual"] # taint-numeric
11+
- ["java.math", "BigDecimal", "valueOf", "(double)", "manual"] # taint-numeric
12+
- ["java.math", "BigDecimal", "valueOf", "(long)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.sql.model.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,16 @@ extensions:
1919
pack: codeql/java-all
2020
extensible: summaryModel
2121
data:
22-
- ["java.sql", "PreparedStatement", True, "setInt", "(int,int)", "", "Argument[1]", "Argument[-1]", "value", "manual"]
2322
- ["java.sql", "PreparedStatement", True, "setString", "(int,String)", "", "Argument[1]", "Argument[-1]", "value", "manual"]
24-
- ["java.sql", "ResultSet", True, "getInt", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
2523
- ["java.sql", "ResultSet", True, "getString", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
2624

2725
- addsTo:
2826
pack: codeql/java-all
2927
extensible: neutralModel
3028
data:
3129
- ["java.sql", "ResultSet", "next", "()", "manual"]
30+
31+
# The below APIs have numeric flow and are currently being stored as neutral models.
32+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
33+
- ["java.sql", "PreparedStatement", "setInt", "(int,int)", "manual"] # value-numeric
34+
- ["java.sql", "ResultSet", "getInt", "(String)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.util.concurrent.atomic.model.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,14 @@ extensions:
33
pack: codeql/java-all
44
extensible: summaryModel
55
data:
6-
- ["java.util.concurrent.atomic", "AtomicInteger", False, "AtomicInteger", "(int)", "", "Argument[0]", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicInteger.value]", "value", "manual"]
7-
- ["java.util.concurrent.atomic", "AtomicInteger", False, "get", "()", "", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicInteger.value]", "ReturnValue", "value", "manual"]
86
- ["java.util.concurrent.atomic", "AtomicReference", False, "AtomicReference", "(Object)", "", "Argument[0]", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicReference.value]", "value", "manual"]
97
- ["java.util.concurrent.atomic", "AtomicReference", False, "get", "()", "", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicReference.value]", "ReturnValue", "value", "manual"]
8+
9+
- addsTo:
10+
pack: codeql/java-all
11+
extensible: neutralModel
12+
data:
13+
# The below APIs have numeric flow and are currently being stored as neutral models.
14+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
15+
- ["java.util.concurrent.atomic", "AtomicInteger", "AtomicInteger", "(int)", "manual"] # value-numeric
16+
- ["java.util.concurrent.atomic", "AtomicInteger", "get", "()", "manual"] # value-numeric

‎java/ql/lib/ext/java.util.concurrent.model.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ extensions:
1818
- ["java.util.concurrent", "BlockingQueue", True, "put", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
1919
- ["java.util.concurrent", "BlockingQueue", True, "take", "()", "", "Argument[-1].Element", "ReturnValue", "value", "manual"]
2020
- ["java.util.concurrent", "ConcurrentHashMap", True, "elements", "()", "", "Argument[-1].MapValue", "ReturnValue.Element", "value", "manual"]
21-
- ["java.util.concurrent", "CountDownLatch", False, "CountDownLatch", "(int)", "", "Argument[0]", "Argument[-1].SyntheticField[java.util.concurrent.CountDownLatch.count]", "value", "manual"]
22-
- ["java.util.concurrent", "CountDownLatch", False, "getCount", "()", "", "Argument[-1].SyntheticField[java.util.concurrent.CountDownLatch.count]", "ReturnValue", "value", "manual"]
2321
- ["java.util.concurrent", "TransferQueue", True, "transfer", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
2422
- ["java.util.concurrent", "TransferQueue", True, "tryTransfer", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
2523
- ["java.util.concurrent", "TransferQueue", True, "tryTransfer", "(Object,long,TimeUnit)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
@@ -29,3 +27,8 @@ extensions:
2927
extensible: neutralModel
3028
data:
3129
- ["java.util.concurrent", "CountDownLatch", "countDown", "()", "manual"]
30+
31+
# The below APIs have numeric flow and are currently being stored as neutral models.
32+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
33+
- ["java.util.concurrent", "CountDownLatch", "CountDownLatch", "(int)", "manual"] # value-numeric
34+
- ["java.util.concurrent", "CountDownLatch", "getCount", "()", "manual"] # value-numeric

‎java/ql/lib/ext/java.util.model.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -369,8 +369,6 @@ extensions:
369369
- ["java.util", "Collections", "emptyList", "()", "manual"]
370370
- ["java.util", "Collections", "emptyMap", "()", "manual"]
371371
- ["java.util", "Collections", "emptySet", "()", "manual"]
372-
- ["java.util", "Date", "Date", "(long)", "manual"]
373-
- ["java.util", "Date", "getTime", "()", "manual"]
374372
- ["java.util", "Iterator", "hasNext", "()", "manual"]
375373
- ["java.util", "List", "clear", "()", "manual"]
376374
- ["java.util", "List", "contains", "(Object)", "manual"]
@@ -390,3 +388,8 @@ extensions:
390388
- ["java.util", "Set", "size", "()", "manual"]
391389
- ["java.util", "UUID", "randomUUID", "()", "manual"]
392390
- ["java.util", "UUID", "toString", "()", "manual"]
391+
392+
# The below APIs have numeric flow and are currently being stored as neutral models.
393+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
394+
- ["java.util", "Date", "Date", "(long)", "manual"] # taint-numeric
395+
- ["java.util", "Date", "getTime", "()", "manual"] # taint-numeric

‎java/ql/src/Telemetry/ExternalApi.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ class ExternalApi extends Callable {
4747
* Gets information about the external API in the form expected by the CSV modeling framework.
4848
*/
4949
string getApiName() {
50+
this.getName() = "append" and
5051
result =
5152
this.getDeclaringType().getPackage() + "." + this.getDeclaringType().getSourceDeclaration() +
5253
"#" + this.getName() + paramsString(this)

‎java/ql/test/ext/TestModels/Test.java‎

Lines changed: 0 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
import java.sql.PreparedStatement;
77
import java.sql.ResultSet;
88
import java.util.StringJoiner;
9-
import java.util.concurrent.CountDownLatch;
10-
import java.util.concurrent.atomic.AtomicInteger;
119
import java.util.concurrent.atomic.AtomicReference;
1210
import java.util.function.Function;
1311
import java.util.function.Supplier;
@@ -38,20 +36,10 @@ public void test() throws Exception {
3836
Throwable t = new Throwable((Throwable)source());
3937
sink((Throwable)t.getCause()); // $hasValueFlow
4038

41-
Integer x = (Integer)source();
42-
int y = x;
43-
sink(String.valueOf(y)); // $hasTaintFlow
44-
45-
String s1 = (String)source();
46-
sink(Integer.parseInt(s1)); // $hasTaintFlow
47-
4839
String s2 = (String)source();
4940
int i = 0;
5041
sink(s2.charAt(i)); // $hasTaintFlow
5142

52-
String s3 = (String)source();
53-
sink(new BigDecimal(s3)); // $hasTaintFlow
54-
5543
ResultSet rs = (ResultSet)source();
5644
sink(rs.getString("")); // $hasTaintFlow
5745
}
@@ -76,66 +64,19 @@ public void test() throws Exception {
7664
sink((String)e4.getMessage()); // $hasValueFlow
7765
sink((Throwable)e4.getCause()); // $hasValueFlow
7866

79-
Integer i1 = (Integer)source();
80-
sink(i1.intValue()); // $hasTaintFlow
81-
82-
int i2 = (int)source();
83-
sink(Integer.toString(i2)); // $hasTaintFlow
84-
85-
int i3 = (int)source();
86-
sink(Integer.valueOf(i3)); // $hasTaintFlow
87-
88-
Long l1 = (Long)source();
89-
sink(l1.longValue()); // $hasTaintFlow
90-
91-
String s1 = (String)source();
92-
sink(Long.parseLong(s1)); // $hasTaintFlow
93-
94-
Long l2 = (Long)source();
95-
sink(l2.toString()); // $hasTaintFlow
96-
97-
long l3 = (long)source();
98-
sink(String.valueOf(l3)); // $hasTaintFlow
99-
10067
System.setProperty("testKey", (String)source());
10168
sink(System.getProperty("testKey")); // $hasValueFlow
10269

103-
// java.math
104-
long l4 = (long)source();
105-
sink(BigDecimal.valueOf(l4)); // $hasTaintFlow
106-
107-
double d1 = (double)source();
108-
sink(BigDecimal.valueOf(d1)); // $hasTaintFlow
109-
110-
int i4 = (int)source();
111-
int i5 = (int)source();
112-
sink(Math.min(i4, i5)); // $hasValueFlow
113-
sink(Math.min(i4, 42)); // $hasValueFlow
114-
sink(Math.min(42, i5)); // $hasValueFlow
115-
11670
// java.sql
11771
Connection con = DriverManager.getConnection("");
11872
PreparedStatement ps1 = con.prepareStatement("UPDATE EMPLOYEES SET NAME = ? WHERE ID = ?");
11973
ps1.setString(1, (String)source());
12074
sink(ps1); // $hasValueFlow
121-
PreparedStatement ps2 = con.prepareStatement("UPDATE EMPLOYEES SET NAME = ? WHERE ID = ?");
122-
ps2.setInt(2, (int)source());
123-
sink(ps2); // $hasValueFlow
124-
125-
ResultSet rs = (ResultSet)source();
126-
sink(rs.getInt("")); // $hasTaintFlow
12775

12876
// java.util.concurrent.atomic
129-
AtomicInteger ai = new AtomicInteger((int)source());
130-
sink(ai.get()); // $hasValueFlow
131-
13277
AtomicReference ar = new AtomicReference(source());
13378
sink(ar.get()); // $hasValueFlow
13479

135-
// java.util.concurrent
136-
CountDownLatch cdl = new CountDownLatch((int)source());
137-
sink(cdl.getCount()); // $hasValueFlow
138-
13980
// java.util.function
14081
Function<Object, Object> func = a -> a + "";
14182
sink(func.apply(source())); // $hasTaintFlow

0 commit comments

Comments
 (0)