Skip to content

Commit 11f527e

Browse files
author
Sebastian Bauersfeld
committed
Fix up query tests.
1 parent 354a7fd commit 11f527e

File tree

4 files changed

+22
-2
lines changed

4 files changed

+22
-2
lines changed

‎java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,15 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
2727
override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
2828

2929
override predicate isSanitizer(DataFlow::Node node) {
30-
node.getType() instanceof PrimitiveType or
30+
node.getType() instanceof PrimitiveType
31+
or
3132
node.getType() instanceof BoxedType
33+
or
34+
exists(MethodAccess ma |
35+
ma.getMethod().hasQualifiedName("java.lang", "String", "replaceAll") and
36+
ma.getArgument(0).(StringLiteral).getValue().matches("%[^%") and
37+
node.asExpr() = ma
38+
)
3239
}
3340
}
3441

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,5 +64,7 @@
6464
| Test.java:213:21:213:24 | main | 5 | Test.java:218:14:218:17 | args |
6565
| Validation.java:6:21:6:35 | checkIdentifier | 1 | Validation.java:7:23:7:24 | id |
6666
| Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:14 | id |
67+
| Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:24 | charAt(...) |
68+
| Validation.java:6:21:6:35 | checkIdentifier | 3 | Validation.java:9:28:9:28 | c |
6769
| Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:32:10:58 | ... + ... |
6870
| Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:57:10:58 | id |

‎java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,25 @@
11
edges
2+
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
3+
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String |
24
| UrlRedirect.java:36:58:36:89 | getParameter(...) : String | UrlRedirect.java:36:25:36:89 | ... + ... |
5+
| UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:14 | input : String |
6+
| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String |
37
nodes
48
| UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) |
9+
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) |
10+
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
511
| UrlRedirect.java:36:25:36:89 | ... + ... | semmle.label | ... + ... |
612
| UrlRedirect.java:36:58:36:89 | getParameter(...) : String | semmle.label | getParameter(...) : String |
713
| UrlRedirect.java:39:34:39:63 | getParameter(...) | semmle.label | getParameter(...) |
814
| UrlRedirect.java:42:43:42:72 | getParameter(...) | semmle.label | getParameter(...) |
15+
| UrlRedirect.java:45:28:45:39 | input : String | semmle.label | input : String |
16+
| UrlRedirect.java:46:10:46:14 | input : String | semmle.label | input : String |
17+
| UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | semmle.label | replaceAll(...) : String |
918
subpaths
19+
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
1020
#select
1121
| UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value |
22+
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value |
1223
| UrlRedirect.java:36:25:36:89 | ... + ... | UrlRedirect.java:36:58:36:89 | getParameter(...) : String | UrlRedirect.java:36:25:36:89 | ... + ... | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:36:58:36:89 | getParameter(...) | user-provided value |
1324
| UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:39:34:39:63 | getParameter(...) | user-provided value |
1425
| UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:42:43:42:72 | getParameter(...) | user-provided value |

‎java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
2727
response.sendRedirect(VALID_REDIRECT);
2828
}
2929

30-
// FALSE NEGATIVE: the user attempts to clean the string, but this will fail
30+
// BAD: the user attempts to clean the string, but this will fail
3131
// if the argument is "hthttp://tp://malicious.com"
3232
response.sendRedirect(weakCleanup(request.getParameter("target")));
3333

0 commit comments

Comments
 (0)