Skip to content

Model Spring util #5976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smowton merged 25 commits into from
Jun 29, 2021
Merged

Model Spring util #5976

Changes from 1 commit
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
c4e9b1f
Model Spring `util`
May 31, 2021
92ebb63
Model Spring AntPath utils
Jun 24, 2021
739b142
Generate tests for Spring util
Jun 24, 2021
fb0e6bf
Fix tests for Spring util
Jun 24, 2021
60db9e1
Rename springframework-5.2.3 to 5.3.8
Jun 24, 2021
bddc88c
Add stubs for Spring util tests
Jun 24, 2021
4012076
fixup! Model spring `util`
Jun 28, 2021
240058b
fixup! Fix tests for Spring util
Jun 28, 2021
dec0123
Autoformat
smowton Jun 29, 2021
f7a4614
Add missing tests for AntPathMatcher's protected methods; fix models …
smowton Jun 29, 2021
659478c
Remove model for protected class
smowton Jun 29, 2021
5769f47
Add missing CollectionUtils model
smowton Jun 29, 2021
f67e9ae
Drop tests for protected inner classes
smowton Jun 29, 2021
b202110
Drop redundant model that can be inherited from java.util.Iterator
smowton Jun 29, 2021
0441098
Amend models of MultiValueMap.addAll overloads
smowton Jun 29, 2021
3d270bb
Drop models for stringifying functions
smowton Jun 29, 2021
1bd01a5
Update java/ql/test/library-tests/frameworks/spring/util/test.ql
aschackmull Jun 29, 2021
d6c4325
Import SpringUtil from ExternalFlow.qll
smowton Jun 29, 2021
60126b4
Clean up test
smowton Jun 29, 2021
71f6d59
Genericise test util functions
smowton Jun 29, 2021
916c7c5
Remove superfluous (Object) casts
smowton Jun 29, 2021
60179ce
Genericise MultiValueMaps; remove non-longer-needed casts
smowton Jun 29, 2021
9551321
Fix LinkedMultiValueMap models and make tests more realistic
smowton Jun 29, 2021
48d4493
Fix test indentation
smowton Jun 29, 2021
ad8bef5
Update java/ql/src/semmle/code/java/frameworks/spring/SpringUtil.qll
aschackmull Jun 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Model Spring AntPath utils
  • Loading branch information
Sauyon Lee committed Jun 28, 2021
commit 92ebb63b1f778ea65fa4d5e7018c1779c617bf4d
8 changes: 8 additions & 0 deletions java/ql/src/semmle/code/java/frameworks/spring/SpringUtil.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ module SpringUtil {
private class FlowSummaries extends SummaryModelCsv {
Comment thread
aschackmull marked this conversation as resolved.
Outdated
override predicate row(string row) {
row = [
"org.springframework.util;AntPathMatcher;false;combine;;;Argument[0..1];ReturnValue;taint",
"org.springframework.util;AntPathMatcher;false;doMatch;;;Argument[0];MapValue of Argument[2];taint",
Copy link
Copy Markdown
Contributor

@smowton smowton Jun 29, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"org.springframework.util;AntPathMatcher;false;doMatch;;;Argument[0];MapValue of Argument[2];taint",
"org.springframework.util;AntPathMatcher;false;doMatch;;;Argument[1];MapValue of Argument[3];taint",

Also lacks a test (will require extending the abstract class to allow creating a concrete instance)

"org.springframework.util;AntPathMatcher;false;extractPathWithinPattern;;;Argument[1];ReturnValue;taint",
"org.springframework.util;AntPathMatcher;false;extractUriTemplateVariables;;;Argument[1];MapValue of ReturnValue;taint",
// Return values here are arrays, but there's no value in adding `ArrayValue of` for taint, right?
Copy link
Copy Markdown
Contributor

@aschackmull aschackmull Jun 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I'd say there is.

"org.springframework.util;AntPathMatcher;false;tokenizePath;;;Argument[0];ReturnValue;taint",
"org.springframework.util;AntPathMatcher;false;tokenizePattern;;;Argument[0];ReturnValue;taint",
"org.springframework.util.AntPathMatcher;AntPathStringMatcher;false;matchStrings;;;Argument[0];MapValue of Argument[1];taint",
Copy link
Copy Markdown
Contributor

@smowton smowton Jun 29, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"org.springframework.util.AntPathMatcher;AntPathStringMatcher;false;matchStrings;;;Argument[0];MapValue of Argument[1];taint",
"org.springframework.util;AntPathMatcher$AntPathStringMatcher;false;matchStrings;;;Argument[0];MapValue of Argument[1];taint",

Missing test?

Copy link
Copy Markdown
Contributor

@smowton smowton Jun 29, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually turns out the class is protected so dropping this line

"org.springframework.util;AutoPopulatingList;false;AutoPopulatingList;(java.util.List,org.springframework.util.AutoPopulatingList.ElementFactory);;Element of Argument[0];Element of Argument[-1];value",
"org.springframework.util;AutoPopulatingList;false;AutoPopulatingList;(java.util.List,java.lang.Class);;Element of Argument[0];Element of Argument[-1];value",
"org.springframework.util;Base64Utils;false;decode;;;Argument[0];ReturnValue;taint",
Expand Down