Skip to content

Commit 531bade

Browse files
d10cd10c
committed
Java: convert SpelInjection test to .qlref
1 parent fa65a9b commit 531bade

File tree

6 files changed

+139
-34
lines changed

6 files changed

+139
-34
lines changed

‎java/ql/test/query-tests/security/CWE-094/SpelInjection/SpelInjectionTest.expected

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
#select
2+
| SpelInjectionTest.java:24:5:24:14 | expression | SpelInjectionTest.java:16:22:16:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:24:5:24:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:16:22:16:44 | getInputStream(...) | user-provided value |
3+
| SpelInjectionTest.java:35:5:35:14 | expression | SpelInjectionTest.java:28:22:28:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:35:5:35:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:28:22:28:44 | getInputStream(...) | user-provided value |
4+
| SpelInjectionTest.java:46:5:46:14 | expression | SpelInjectionTest.java:39:22:39:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:46:5:46:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:39:22:39:44 | getInputStream(...) | user-provided value |
5+
| SpelInjectionTest.java:60:5:60:14 | expression | SpelInjectionTest.java:50:22:50:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:60:5:60:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:50:22:50:44 | getInputStream(...) | user-provided value |
6+
| SpelInjectionTest.java:71:5:71:14 | expression | SpelInjectionTest.java:64:22:64:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:71:5:71:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:64:22:64:44 | getInputStream(...) | user-provided value |
7+
| SpelInjectionTest.java:82:5:82:14 | expression | SpelInjectionTest.java:75:22:75:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:82:5:82:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:75:22:75:44 | getInputStream(...) | user-provided value |
8+
| SpelInjectionTest.java:95:5:95:14 | expression | SpelInjectionTest.java:86:22:86:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:95:5:95:14 | expression | SpEL expression depends on a $@. | SpelInjectionTest.java:86:22:86:44 | getInputStream(...) | user-provided value |
9+
edges
10+
| SpelInjectionTest.java:16:22:16:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:19:13:19:14 | in : InputStream | provenance | Src:MaD:1 |
11+
| SpelInjectionTest.java:19:13:19:14 | in : InputStream | SpelInjectionTest.java:19:21:19:25 | bytes [post update] : byte[] | provenance | MaD:2 |
12+
| SpelInjectionTest.java:19:21:19:25 | bytes [post update] : byte[] | SpelInjectionTest.java:20:31:20:35 | bytes : byte[] | provenance | |
13+
| SpelInjectionTest.java:20:20:20:42 | new String(...) : String | SpelInjectionTest.java:23:52:23:56 | input : String | provenance | |
14+
| SpelInjectionTest.java:20:31:20:35 | bytes : byte[] | SpelInjectionTest.java:20:20:20:42 | new String(...) : String | provenance | MaD:3 |
15+
| SpelInjectionTest.java:23:29:23:57 | parseExpression(...) : Expression | SpelInjectionTest.java:24:5:24:14 | expression | provenance | |
16+
| SpelInjectionTest.java:23:52:23:56 | input : String | SpelInjectionTest.java:23:29:23:57 | parseExpression(...) : Expression | provenance | Config |
17+
| SpelInjectionTest.java:28:22:28:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:31:13:31:14 | in : InputStream | provenance | Src:MaD:1 |
18+
| SpelInjectionTest.java:31:13:31:14 | in : InputStream | SpelInjectionTest.java:31:21:31:25 | bytes [post update] : byte[] | provenance | MaD:2 |
19+
| SpelInjectionTest.java:31:21:31:25 | bytes [post update] : byte[] | SpelInjectionTest.java:32:31:32:35 | bytes : byte[] | provenance | |
20+
| SpelInjectionTest.java:32:20:32:42 | new String(...) : String | SpelInjectionTest.java:34:49:34:53 | input : String | provenance | |
21+
| SpelInjectionTest.java:32:31:32:35 | bytes : byte[] | SpelInjectionTest.java:32:20:32:42 | new String(...) : String | provenance | MaD:3 |
22+
| SpelInjectionTest.java:34:33:34:54 | parseRaw(...) : SpelExpression | SpelInjectionTest.java:35:5:35:14 | expression | provenance | |
23+
| SpelInjectionTest.java:34:49:34:53 | input : String | SpelInjectionTest.java:34:33:34:54 | parseRaw(...) : SpelExpression | provenance | Config |
24+
| SpelInjectionTest.java:39:22:39:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:42:13:42:14 | in : InputStream | provenance | Src:MaD:1 |
25+
| SpelInjectionTest.java:42:13:42:14 | in : InputStream | SpelInjectionTest.java:42:21:42:25 | bytes [post update] : byte[] | provenance | MaD:2 |
26+
| SpelInjectionTest.java:42:21:42:25 | bytes [post update] : byte[] | SpelInjectionTest.java:43:31:43:35 | bytes : byte[] | provenance | |
27+
| SpelInjectionTest.java:43:20:43:42 | new String(...) : String | SpelInjectionTest.java:45:72:45:76 | input : String | provenance | |
28+
| SpelInjectionTest.java:43:31:43:35 | bytes : byte[] | SpelInjectionTest.java:43:20:43:42 | new String(...) : String | provenance | MaD:3 |
29+
| SpelInjectionTest.java:45:29:45:77 | parseExpression(...) : Expression | SpelInjectionTest.java:46:5:46:14 | expression | provenance | |
30+
| SpelInjectionTest.java:45:72:45:76 | input : String | SpelInjectionTest.java:45:29:45:77 | parseExpression(...) : Expression | provenance | Config |
31+
| SpelInjectionTest.java:50:22:50:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:53:13:53:14 | in : InputStream | provenance | Src:MaD:1 |
32+
| SpelInjectionTest.java:53:13:53:14 | in : InputStream | SpelInjectionTest.java:53:21:53:25 | bytes [post update] : byte[] | provenance | MaD:2 |
33+
| SpelInjectionTest.java:53:21:53:25 | bytes [post update] : byte[] | SpelInjectionTest.java:54:31:54:35 | bytes : byte[] | provenance | |
34+
| SpelInjectionTest.java:54:20:54:42 | new String(...) : String | SpelInjectionTest.java:56:72:56:76 | input : String | provenance | |
35+
| SpelInjectionTest.java:54:31:54:35 | bytes : byte[] | SpelInjectionTest.java:54:20:54:42 | new String(...) : String | provenance | MaD:3 |
36+
| SpelInjectionTest.java:56:29:56:77 | parseExpression(...) : Expression | SpelInjectionTest.java:60:5:60:14 | expression | provenance | |
37+
| SpelInjectionTest.java:56:72:56:76 | input : String | SpelInjectionTest.java:56:29:56:77 | parseExpression(...) : Expression | provenance | Config |
38+
| SpelInjectionTest.java:64:22:64:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:67:13:67:14 | in : InputStream | provenance | Src:MaD:1 |
39+
| SpelInjectionTest.java:67:13:67:14 | in : InputStream | SpelInjectionTest.java:67:21:67:25 | bytes [post update] : byte[] | provenance | MaD:2 |
40+
| SpelInjectionTest.java:67:21:67:25 | bytes [post update] : byte[] | SpelInjectionTest.java:68:31:68:35 | bytes : byte[] | provenance | |
41+
| SpelInjectionTest.java:68:20:68:42 | new String(...) : String | SpelInjectionTest.java:70:52:70:56 | input : String | provenance | |
42+
| SpelInjectionTest.java:68:31:68:35 | bytes : byte[] | SpelInjectionTest.java:68:20:68:42 | new String(...) : String | provenance | MaD:3 |
43+
| SpelInjectionTest.java:70:29:70:57 | parseExpression(...) : Expression | SpelInjectionTest.java:71:5:71:14 | expression | provenance | |
44+
| SpelInjectionTest.java:70:52:70:56 | input : String | SpelInjectionTest.java:70:29:70:57 | parseExpression(...) : Expression | provenance | Config |
45+
| SpelInjectionTest.java:75:22:75:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:78:13:78:14 | in : InputStream | provenance | Src:MaD:1 |
46+
| SpelInjectionTest.java:78:13:78:14 | in : InputStream | SpelInjectionTest.java:78:21:78:25 | bytes [post update] : byte[] | provenance | MaD:2 |
47+
| SpelInjectionTest.java:78:21:78:25 | bytes [post update] : byte[] | SpelInjectionTest.java:79:31:79:35 | bytes : byte[] | provenance | |
48+
| SpelInjectionTest.java:79:20:79:42 | new String(...) : String | SpelInjectionTest.java:81:52:81:56 | input : String | provenance | |
49+
| SpelInjectionTest.java:79:31:79:35 | bytes : byte[] | SpelInjectionTest.java:79:20:79:42 | new String(...) : String | provenance | MaD:3 |
50+
| SpelInjectionTest.java:81:29:81:57 | parseExpression(...) : Expression | SpelInjectionTest.java:82:5:82:14 | expression | provenance | |
51+
| SpelInjectionTest.java:81:52:81:56 | input : String | SpelInjectionTest.java:81:29:81:57 | parseExpression(...) : Expression | provenance | Config |
52+
| SpelInjectionTest.java:86:22:86:44 | getInputStream(...) : InputStream | SpelInjectionTest.java:89:13:89:14 | in : InputStream | provenance | Src:MaD:1 |
53+
| SpelInjectionTest.java:89:13:89:14 | in : InputStream | SpelInjectionTest.java:89:21:89:25 | bytes [post update] : byte[] | provenance | MaD:2 |
54+
| SpelInjectionTest.java:89:21:89:25 | bytes [post update] : byte[] | SpelInjectionTest.java:90:31:90:35 | bytes : byte[] | provenance | |
55+
| SpelInjectionTest.java:90:20:90:42 | new String(...) : String | SpelInjectionTest.java:92:52:92:56 | input : String | provenance | |
56+
| SpelInjectionTest.java:90:31:90:35 | bytes : byte[] | SpelInjectionTest.java:90:20:90:42 | new String(...) : String | provenance | MaD:3 |
57+
| SpelInjectionTest.java:92:29:92:57 | parseExpression(...) : Expression | SpelInjectionTest.java:95:5:95:14 | expression | provenance | |
58+
| SpelInjectionTest.java:92:52:92:56 | input : String | SpelInjectionTest.java:92:29:92:57 | parseExpression(...) : Expression | provenance | Config |
59+
models
60+
| 1 | Source: java.net; Socket; false; getInputStream; (); ; ReturnValue; remote; manual |
61+
| 2 | Summary: java.io; InputStream; true; read; (byte[]); ; Argument[this]; Argument[0]; taint; manual |
62+
| 3 | Summary: java.lang; String; false; String; ; ; Argument[0]; Argument[this]; taint; manual |
63+
nodes
64+
| SpelInjectionTest.java:16:22:16:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
65+
| SpelInjectionTest.java:19:13:19:14 | in : InputStream | semmle.label | in : InputStream |
66+
| SpelInjectionTest.java:19:21:19:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
67+
| SpelInjectionTest.java:20:20:20:42 | new String(...) : String | semmle.label | new String(...) : String |
68+
| SpelInjectionTest.java:20:31:20:35 | bytes : byte[] | semmle.label | bytes : byte[] |
69+
| SpelInjectionTest.java:23:29:23:57 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
70+
| SpelInjectionTest.java:23:52:23:56 | input : String | semmle.label | input : String |
71+
| SpelInjectionTest.java:24:5:24:14 | expression | semmle.label | expression |
72+
| SpelInjectionTest.java:28:22:28:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
73+
| SpelInjectionTest.java:31:13:31:14 | in : InputStream | semmle.label | in : InputStream |
74+
| SpelInjectionTest.java:31:21:31:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
75+
| SpelInjectionTest.java:32:20:32:42 | new String(...) : String | semmle.label | new String(...) : String |
76+
| SpelInjectionTest.java:32:31:32:35 | bytes : byte[] | semmle.label | bytes : byte[] |
77+
| SpelInjectionTest.java:34:33:34:54 | parseRaw(...) : SpelExpression | semmle.label | parseRaw(...) : SpelExpression |
78+
| SpelInjectionTest.java:34:49:34:53 | input : String | semmle.label | input : String |
79+
| SpelInjectionTest.java:35:5:35:14 | expression | semmle.label | expression |
80+
| SpelInjectionTest.java:39:22:39:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
81+
| SpelInjectionTest.java:42:13:42:14 | in : InputStream | semmle.label | in : InputStream |
82+
| SpelInjectionTest.java:42:21:42:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
83+
| SpelInjectionTest.java:43:20:43:42 | new String(...) : String | semmle.label | new String(...) : String |
84+
| SpelInjectionTest.java:43:31:43:35 | bytes : byte[] | semmle.label | bytes : byte[] |
85+
| SpelInjectionTest.java:45:29:45:77 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
86+
| SpelInjectionTest.java:45:72:45:76 | input : String | semmle.label | input : String |
87+
| SpelInjectionTest.java:46:5:46:14 | expression | semmle.label | expression |
88+
| SpelInjectionTest.java:50:22:50:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
89+
| SpelInjectionTest.java:53:13:53:14 | in : InputStream | semmle.label | in : InputStream |
90+
| SpelInjectionTest.java:53:21:53:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
91+
| SpelInjectionTest.java:54:20:54:42 | new String(...) : String | semmle.label | new String(...) : String |
92+
| SpelInjectionTest.java:54:31:54:35 | bytes : byte[] | semmle.label | bytes : byte[] |
93+
| SpelInjectionTest.java:56:29:56:77 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
94+
| SpelInjectionTest.java:56:72:56:76 | input : String | semmle.label | input : String |
95+
| SpelInjectionTest.java:60:5:60:14 | expression | semmle.label | expression |
96+
| SpelInjectionTest.java:64:22:64:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
97+
| SpelInjectionTest.java:67:13:67:14 | in : InputStream | semmle.label | in : InputStream |
98+
| SpelInjectionTest.java:67:21:67:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
99+
| SpelInjectionTest.java:68:20:68:42 | new String(...) : String | semmle.label | new String(...) : String |
100+
| SpelInjectionTest.java:68:31:68:35 | bytes : byte[] | semmle.label | bytes : byte[] |
101+
| SpelInjectionTest.java:70:29:70:57 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
102+
| SpelInjectionTest.java:70:52:70:56 | input : String | semmle.label | input : String |
103+
| SpelInjectionTest.java:71:5:71:14 | expression | semmle.label | expression |
104+
| SpelInjectionTest.java:75:22:75:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
105+
| SpelInjectionTest.java:78:13:78:14 | in : InputStream | semmle.label | in : InputStream |
106+
| SpelInjectionTest.java:78:21:78:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
107+
| SpelInjectionTest.java:79:20:79:42 | new String(...) : String | semmle.label | new String(...) : String |
108+
| SpelInjectionTest.java:79:31:79:35 | bytes : byte[] | semmle.label | bytes : byte[] |
109+
| SpelInjectionTest.java:81:29:81:57 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
110+
| SpelInjectionTest.java:81:52:81:56 | input : String | semmle.label | input : String |
111+
| SpelInjectionTest.java:82:5:82:14 | expression | semmle.label | expression |
112+
| SpelInjectionTest.java:86:22:86:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
113+
| SpelInjectionTest.java:89:13:89:14 | in : InputStream | semmle.label | in : InputStream |
114+
| SpelInjectionTest.java:89:21:89:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
115+
| SpelInjectionTest.java:90:20:90:42 | new String(...) : String | semmle.label | new String(...) : String |
116+
| SpelInjectionTest.java:90:31:90:35 | bytes : byte[] | semmle.label | bytes : byte[] |
117+
| SpelInjectionTest.java:92:29:92:57 | parseExpression(...) : Expression | semmle.label | parseExpression(...) : Expression |
118+
| SpelInjectionTest.java:92:52:92:56 | input : String | semmle.label | input : String |
119+
| SpelInjectionTest.java:95:5:95:14 | expression | semmle.label | expression |
120+
subpaths

‎java/ql/test/query-tests/security/CWE-094/SpelInjectionTest.java renamed to ‎java/ql/test/query-tests/security/CWE-094/SpelInjection/SpelInjectionTest.java

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,41 +13,41 @@ public class SpelInjectionTest {
1313
private static final ExpressionParser PARSER = new SpelExpressionParser();
1414

1515
public void testGetValue(Socket socket) throws IOException {
16-
InputStream in = socket.getInputStream();
16+
InputStream in = socket.getInputStream(); // $Source
1717

1818
byte[] bytes = new byte[1024];
1919
int n = in.read(bytes);
2020
String input = new String(bytes, 0, n);
2121

2222
ExpressionParser parser = new SpelExpressionParser();
2323
Expression expression = parser.parseExpression(input);
24-
expression.getValue(); // $hasSpelInjection
24+
expression.getValue(); // $Alert
2525
}
2626

2727
public void testGetValueWithParseRaw(Socket socket) throws IOException {
28-
InputStream in = socket.getInputStream();
28+
InputStream in = socket.getInputStream(); // $Source
2929

3030
byte[] bytes = new byte[1024];
3131
int n = in.read(bytes);
3232
String input = new String(bytes, 0, n);
3333
SpelExpressionParser parser = new SpelExpressionParser();
3434
SpelExpression expression = parser.parseRaw(input);
35-
expression.getValue(); // $hasSpelInjection
35+
expression.getValue(); // $Alert
3636
}
3737

3838
public void testGetValueWithChainedCalls(Socket socket) throws IOException {
39-
InputStream in = socket.getInputStream();
39+
InputStream in = socket.getInputStream(); // $Source
4040

4141
byte[] bytes = new byte[1024];
4242
int n = in.read(bytes);
4343
String input = new String(bytes, 0, n);
4444

4545
Expression expression = new SpelExpressionParser().parseExpression(input);
46-
expression.getValue(); // $hasSpelInjection
46+
expression.getValue(); // $Alert
4747
}
4848

4949
public void testSetValueWithRootObject(Socket socket) throws IOException {
50-
InputStream in = socket.getInputStream();
50+
InputStream in = socket.getInputStream(); // $Source
5151

5252
byte[] bytes = new byte[1024];
5353
int n = in.read(bytes);
@@ -57,33 +57,33 @@ public void testSetValueWithRootObject(Socket socket) throws IOException {
5757

5858
Object root = new Object();
5959
Object value = new Object();
60-
expression.setValue(root, value); // $hasSpelInjection
60+
expression.setValue(root, value); // $Alert
6161
}
6262

6363
public void testGetValueWithStaticParser(Socket socket) throws IOException {
64-
InputStream in = socket.getInputStream();
64+
InputStream in = socket.getInputStream(); // $Source
6565

6666
byte[] bytes = new byte[1024];
6767
int n = in.read(bytes);
6868
String input = new String(bytes, 0, n);
6969

7070
Expression expression = PARSER.parseExpression(input);
71-
expression.getValue(); // $hasSpelInjection
71+
expression.getValue(); // $Alert
7272
}
7373

7474
public void testGetValueType(Socket socket) throws IOException {
75-
InputStream in = socket.getInputStream();
75+
InputStream in = socket.getInputStream(); // $Source
7676

7777
byte[] bytes = new byte[1024];
7878
int n = in.read(bytes);
7979
String input = new String(bytes, 0, n);
8080

8181
Expression expression = PARSER.parseExpression(input);
82-
expression.getValueType(); // $hasSpelInjection
82+
expression.getValueType(); // $Alert
8383
}
8484

8585
public void testWithStandardEvaluationContext(Socket socket) throws IOException {
86-
InputStream in = socket.getInputStream();
86+
InputStream in = socket.getInputStream(); // $Source
8787

8888
byte[] bytes = new byte[1024];
8989
int n = in.read(bytes);
@@ -92,7 +92,7 @@ public void testWithStandardEvaluationContext(Socket socket) throws IOException
9292
Expression expression = PARSER.parseExpression(input);
9393

9494
StandardEvaluationContext context = new StandardEvaluationContext();
95-
expression.getValue(context); // $hasSpelInjection
95+
expression.getValue(context); // $Alert
9696
}
9797

9898
public void testWithSimpleEvaluationContext(Socket socket) throws IOException {

‎java/ql/test/query-tests/security/CWE-094/SpelInjection/SpelInjectionTest.qlref

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security/CWE/CWE-094/SpelInjection.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎java/ql/test/query-tests/security/CWE-094/SpelInjection/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/validation-api-2.0.1.Final:${testdir}/../../../../stubs/springframework-5.8.x:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/apache-commons-logging-1.2:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-freemarker-2.3.31:${testdir}/../../../../stubs/jinjava-2.6.0:${testdir}/../../../../stubs/pebble-3.1.5:${testdir}/../../../../stubs/thymeleaf-3.0.14:${testdir}/../../../../stubs/apache-velocity-2.3:${testdir}/../../../..//stubs/google-android-9.0.0

‎java/ql/test/query-tests/security/CWE-094/SpelInjectionTest.expected

Whitespace-only changes.

0 commit comments

Comments
 (0)