Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
cd073a2
Java: Add Guard Classes for checking OS
JLLeitschuh Feb 14, 2022
39828fd
Apply OS guard checks to TempDirLocalInformationDisclosure
JLLeitschuh Feb 14, 2022
3cdfc00
Cleanup from review feedback
JLLeitschuh Feb 15, 2022
4951344
Update java/ql/lib/semmle/code/java/os/OSCheck.qll
JLLeitschuh Feb 23, 2022
9f5022e
Review fixup and add test for apache SystemUtils
JLLeitschuh Feb 23, 2022
fd63107
Update OS Check from Review Feedback
JLLeitschuh Mar 1, 2022
5913c9a
Refactor OS Guard Checks
JLLeitschuh Mar 1, 2022
dad9a02
Update TempDirInfoDisclosure with new OS Guards
JLLeitschuh Mar 1, 2022
82d3cd8
Improve system property lookup
JLLeitschuh Mar 2, 2022
3c53a05
Add OS Checks based upon separator or path separator
JLLeitschuh Mar 2, 2022
a7adbb7
Refactor more system property access logic
JLLeitschuh Mar 3, 2022
85de9f3
Fix naming of OSCheck method
JLLeitschuh Mar 3, 2022
fea5006
Fix duplicated comment
JLLeitschuh Mar 3, 2022
103c770
Apply suggestions from code review
JLLeitschuh Mar 3, 2022
31527a6
Refactor OS Checks & SystemProperty logic from review feedback
JLLeitschuh Mar 3, 2022
7ab193d
Add System.getProperties().getProperty support
JLLeitschuh Mar 4, 2022
5243fe3
Apply suggestions from code review
JLLeitschuh Mar 4, 2022
523ddb7
Cleanup after code review feedback
JLLeitschuh Mar 4, 2022
b282c7f
Apply suggestions from code review
JLLeitschuh Mar 7, 2022
5b651f2
Fix insufficient tests and add documentation
JLLeitschuh Mar 7, 2022
a21992a
Minor refactoring to improve tests and documentation
JLLeitschuh Mar 7, 2022
2a6c4e9
Add localFlowPlusInitializers
JLLeitschuh Mar 9, 2022
ecb8911
Apply suggestions from code review
JLLeitschuh Mar 10, 2022
1c98642
Remove SystemProperty from FlowSources
JLLeitschuh Mar 10, 2022
50ff2c2
Code cleanup from code review
JLLeitschuh Mar 11, 2022
451661d
Improve guard class names
smowton Mar 15, 2022
09cc8ee
Add tests for StandardSystemProperty
JLLeitschuh Mar 15, 2022
b11340c
Change note tense and detail level
smowton Mar 16, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Code cleanup from code review
  • Loading branch information
JLLeitschuh committed Mar 11, 2022
commit 50ff2c2c68aea31f70a4d7019ffcc2788d9c2632
4 changes: 4 additions & 0 deletions java/ql/lib/semmle/code/java/environment/SystemProperty.qll
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
/**
* Provides classes and predicates for working with java system properties.
*/

import java
private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.frameworks.Properties
Expand Down
9 changes: 9 additions & 0 deletions java/ql/lib/semmle/code/java/frameworks/Properties.qll
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,14 @@
import semmle.code.java.Type
private import semmle.code.java.dataflow.FlowSteps

/**
* The `java.util.Properties` class.
*/
class TypeProperty extends Class {
TypeProperty() { hasQualifiedName("java.util", "Properties") }
}

/** The `getProperty` method of the class `java.util.Properties`. */
class PropertiesGetPropertyMethod extends ValuePreservingMethod {
PropertiesGetPropertyMethod() {
getDeclaringType() instanceof TypeProperty and
Expand All @@ -15,20 +19,25 @@ class PropertiesGetPropertyMethod extends ValuePreservingMethod {
override predicate returnsValue(int arg) { arg = 1 }
}

/** The `get` method of the class `java.util.Properties`. */
class PropertiesGetMethod extends Method {
PropertiesGetMethod() {
getDeclaringType() instanceof TypeProperty and
hasName("get")
}
}

/** The `setProperty` method of the class `java.util.Properties`. */
class PropertiesSetPropertyMethod extends Method {
PropertiesSetPropertyMethod() {
getDeclaringType() instanceof TypeProperty and
hasName("setProperty")
}
}

/**
* The methods of the class `java.util.Properties` that write the contents to an output.
*/
class PropertiesStoreMethod extends Method {
PropertiesStoreMethod() {
getDeclaringType() instanceof TypeProperty and
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -177,9 +177,7 @@ private class TempDirSystemGetPropertyDirectlyToMkdirConfig extends TaintTrackin
}

override predicate isSource(DataFlow::Node node) {
exists(
ExprSystemGetPropertyTempDirTainted propertyGetExpr, DataFlow::Node callSite
|
exists(ExprSystemGetPropertyTempDirTainted propertyGetExpr, DataFlow::Node callSite |
DataFlow::localFlow(DataFlow::exprNode(propertyGetExpr), callSite)
|
isFileConstructorArgument(callSite.asExpr(), node.asExpr(), 1)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ import default
import semmle.code.java.os.OSCheck

from IsSpecificUnixVariant isAnyUnix
select isAnyUnix
select isAnyUnix
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ import default
import semmle.code.java.os.OSCheck

from IsSpecificWindowsVariant isAnyWindows
select isAnyWindows
select isAnyWindows
2 changes: 1 addition & 1 deletion java/ql/test/library-tests/os/unix-test.ql
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ import default
import semmle.code.java.os.OSCheck

from IsUnixGuard isUnix
select isUnix
select isUnix
2 changes: 1 addition & 1 deletion java/ql/test/library-tests/os/windows-test.ql
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ import default
import semmle.code.java.os.OSCheck

from IsWindowsGuard isWindows
select isWindows
select isWindows