Skip to content

Model Spring util #5976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smowton merged 25 commits into from
Jun 29, 2021
Merged

Model Spring util #5976

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
c4e9b1f
Model Spring `util`
May 31, 2021
92ebb63
Model Spring AntPath utils
Jun 24, 2021
739b142
Generate tests for Spring util
Jun 24, 2021
fb0e6bf
Fix tests for Spring util
Jun 24, 2021
60db9e1
Rename springframework-5.2.3 to 5.3.8
Jun 24, 2021
bddc88c
Add stubs for Spring util tests
Jun 24, 2021
4012076
fixup! Model spring `util`
Jun 28, 2021
240058b
fixup! Fix tests for Spring util
Jun 28, 2021
dec0123
Autoformat
smowton Jun 29, 2021
f7a4614
Add missing tests for AntPathMatcher's protected methods; fix models …
smowton Jun 29, 2021
659478c
Remove model for protected class
smowton Jun 29, 2021
5769f47
Add missing CollectionUtils model
smowton Jun 29, 2021
f67e9ae
Drop tests for protected inner classes
smowton Jun 29, 2021
b202110
Drop redundant model that can be inherited from java.util.Iterator
smowton Jun 29, 2021
0441098
Amend models of MultiValueMap.addAll overloads
smowton Jun 29, 2021
3d270bb
Drop models for stringifying functions
smowton Jun 29, 2021
1bd01a5
Update java/ql/test/library-tests/frameworks/spring/util/test.ql
aschackmull Jun 29, 2021
d6c4325
Import SpringUtil from ExternalFlow.qll
smowton Jun 29, 2021
60126b4
Clean up test
smowton Jun 29, 2021
71f6d59
Genericise test util functions
smowton Jun 29, 2021
916c7c5
Remove superfluous (Object) casts
smowton Jun 29, 2021
60179ce
Genericise MultiValueMaps; remove non-longer-needed casts
smowton Jun 29, 2021
9551321
Fix LinkedMultiValueMap models and make tests more realistic
smowton Jun 29, 2021
48d4493
Fix test indentation
smowton Jun 29, 2021
ad8bef5
Update java/ql/src/semmle/code/java/frameworks/spring/SpringUtil.qll
aschackmull Jun 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix tests for Spring util
  • Loading branch information
Sauyon Lee committed Jun 28, 2021
commit fb0e6bfb42175e0769a5464abc0dbc1e4f59377e
6 changes: 3 additions & 3 deletions java/ql/test/library-tests/frameworks/spring/util/Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ public class Test {
Object source() { return null; }
void sink(Object o) { }

public void test() {
public void test() throws Exception {

{
// "org.springframework.util;AntPathMatcher;false;combine;;;Argument[0..1];ReturnValue;taint"
Expand Down Expand Up @@ -97,7 +97,7 @@ public void test() {
// "org.springframework.util;AutoPopulatingList;false;AutoPopulatingList;(java.util.List,org.springframework.util.AutoPopulatingList.ElementFactory);;Element of Argument[0];Element of Argument[-1];value"
AutoPopulatingList out = null;
List in = (List)newWithElement(source());
out = new AutoPopulatingList(in, (AutoPopulatingList<>.ElementFactory)null);
out = new AutoPopulatingList(in, (AutoPopulatingList.ElementFactory)null);
sink(getElement(out)); // $hasValueFlow
}
{
Expand Down Expand Up @@ -1480,4 +1480,4 @@ public void test() {

}

}
}
1 change: 1 addition & 0 deletions java/ql/test/library-tests/frameworks/spring/util/test.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.ExternalFlow
Copy link
Copy Markdown
Contributor

@aschackmull aschackmull Jun 29, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This import looks unused.

Suggested change
import semmle.code.java.dataflow.ExternalFlow

import semmle.code.java.dataflow.TaintTracking
import TestUtilities.InlineExpectationsTest
import semmle.code.java.frameworks.spring.SpringUtil
Copy link
Copy Markdown
Contributor

@aschackmull aschackmull Jun 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove. ExternalFlow needs bidirectional import, so SpringUtil should be imported there instead.

Copy link
Copy Markdown
Contributor Author

@sauyon sauyon Jun 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the moment it seems like the Spring models are not imported by default, which is why I didn't add the import anywhere---I guess the taint flow steps should always be included?

Copy link
Copy Markdown
Contributor

@aschackmull aschackmull Jun 25, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. Otherwise they don't actually accomplish anything - as you'll see in this test if you remove this line.

Copy link
Copy Markdown
Contributor Author

@sauyon sauyon Jun 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, but that's true of all the Spring models, as far as I can tell? I have included this in Spring.qll.


class SummaryModelTest extends SummaryModelCsv {
override predicate row(string row) {
Expand Down