Skip to content

Commit b0031a0

Browse files
luchua-bcluchua-bc
committed
Add local input test case and update qldoc
1 parent c74eac4 commit b0031a0

File tree

4 files changed

+52
-30
lines changed

4 files changed

+52
-30
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-400/LocalThreadResourceAbuse.expected

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
edges
2+
| ThreadResourceAbuse.java:37:25:37:73 | getInitParameter(...) : String | ThreadResourceAbuse.java:40:28:40:36 | delayTime : Number |
3+
| ThreadResourceAbuse.java:40:4:40:37 | new UncheckedSyncAction(...) [waitTime] : Number | ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number |
4+
| ThreadResourceAbuse.java:40:28:40:36 | delayTime : Number | ThreadResourceAbuse.java:40:4:40:37 | new UncheckedSyncAction(...) [waitTime] : Number |
5+
| ThreadResourceAbuse.java:40:28:40:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number |
6+
| ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number |
7+
| ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number | ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number |
8+
| ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number |
9+
| ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | waitTime |
10+
nodes
11+
| ThreadResourceAbuse.java:37:25:37:73 | getInitParameter(...) : String | semmle.label | getInitParameter(...) : String |
12+
| ThreadResourceAbuse.java:40:4:40:37 | new UncheckedSyncAction(...) [waitTime] : Number | semmle.label | new UncheckedSyncAction(...) [waitTime] : Number |
13+
| ThreadResourceAbuse.java:40:28:40:36 | delayTime : Number | semmle.label | delayTime : Number |
14+
| ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | semmle.label | waitTime : Number |
15+
| ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number | semmle.label | this [post update] [waitTime] : Number |
16+
| ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number | semmle.label | waitTime : Number |
17+
| ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | semmle.label | parameter this [waitTime] : Number |
18+
| ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | semmle.label | this <.field> [waitTime] : Number |
19+
| ThreadResourceAbuse.java:74:18:74:25 | waitTime | semmle.label | waitTime |
20+
subpaths
21+
| ThreadResourceAbuse.java:40:28:40:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number | ThreadResourceAbuse.java:40:4:40:37 | new UncheckedSyncAction(...) [waitTime] : Number |
22+
#select
23+
| ThreadResourceAbuse.java:74:18:74:25 | waitTime | ThreadResourceAbuse.java:37:25:37:73 | getInitParameter(...) : String | ThreadResourceAbuse.java:74:18:74:25 | waitTime | Possible uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:37:25:37:73 | getInitParameter(...) | local user-provided value |

‎java/ql/test/experimental/query-tests/security/CWE-400/LocalThreadResourceAbuse.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-400/LocalThreadResourceAbuse.ql

‎java/ql/test/experimental/query-tests/security/CWE-400/ThreadResourceAbuse.expected

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
edges
22
| ThreadResourceAbuse.java:18:25:18:57 | getParameter(...) : String | ThreadResourceAbuse.java:21:28:21:36 | delayTime : Number |
3-
| ThreadResourceAbuse.java:21:4:21:37 | new UncheckedSyncAction(...) [waitTime] : Number | ThreadResourceAbuse.java:72:15:72:17 | parameter this [waitTime] : Number |
3+
| ThreadResourceAbuse.java:21:4:21:37 | new UncheckedSyncAction(...) [waitTime] : Number | ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number |
44
| ThreadResourceAbuse.java:21:28:21:36 | delayTime : Number | ThreadResourceAbuse.java:21:4:21:37 | new UncheckedSyncAction(...) [waitTime] : Number |
55
| ThreadResourceAbuse.java:21:28:21:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number |
66
| ThreadResourceAbuse.java:29:82:29:114 | getParameter(...) : String | ThreadResourceAbuse.java:30:28:30:36 | delayTime : Number |
7-
| ThreadResourceAbuse.java:30:4:30:37 | new UncheckedSyncAction(...) [waitTime] : Number | ThreadResourceAbuse.java:72:15:72:17 | parameter this [waitTime] : Number |
7+
| ThreadResourceAbuse.java:30:4:30:37 | new UncheckedSyncAction(...) [waitTime] : Number | ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number |
88
| ThreadResourceAbuse.java:30:28:30:36 | delayTime : Number | ThreadResourceAbuse.java:30:4:30:37 | new UncheckedSyncAction(...) [waitTime] : Number |
99
| ThreadResourceAbuse.java:30:28:30:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number |
1010
| ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number |
1111
| ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number | ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number |
12-
| ThreadResourceAbuse.java:72:15:72:17 | parameter this [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number |
12+
| ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number |
1313
| ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | ThreadResourceAbuse.java:74:18:74:25 | waitTime |
1414
| ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | ThreadResourceAbuse.java:144:34:144:42 | delayTime |
15-
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:177:17:177:26 | retryAfter |
16-
| ThreadResourceAbuse.java:208:28:208:56 | getParameter(...) : String | ThreadResourceAbuse.java:211:49:211:59 | uploadDelay : Number |
17-
| ThreadResourceAbuse.java:211:30:211:87 | new UploadListener(...) [slowUploads] : Number | UploadListener.java:28:14:28:19 | parameter this [slowUploads] : Number |
18-
| ThreadResourceAbuse.java:211:49:211:59 | uploadDelay : Number | ThreadResourceAbuse.java:211:30:211:87 | new UploadListener(...) [slowUploads] : Number |
19-
| ThreadResourceAbuse.java:211:49:211:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number |
15+
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:176:17:176:26 | retryAfter |
16+
| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number |
17+
| ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | UploadListener.java:28:14:28:19 | parameter this [slowUploads] : Number |
18+
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number |
19+
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number |
2020
| UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | UploadListener.java:16:17:16:33 | sleepMilliseconds : Number |
2121
| UploadListener.java:16:17:16:33 | sleepMilliseconds : Number | UploadListener.java:16:3:16:13 | this <.field> [post update] [slowUploads] : Number |
2222
| UploadListener.java:28:14:28:19 | parameter this [slowUploads] : Number | UploadListener.java:29:3:29:11 | this <.field> [slowUploads] : Number |
@@ -36,16 +36,16 @@ nodes
3636
| ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | semmle.label | waitTime : Number |
3737
| ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number | semmle.label | this [post update] [waitTime] : Number |
3838
| ThreadResourceAbuse.java:67:20:67:27 | waitTime : Number | semmle.label | waitTime : Number |
39-
| ThreadResourceAbuse.java:72:15:72:17 | parameter this [waitTime] : Number | semmle.label | parameter this [waitTime] : Number |
39+
| ThreadResourceAbuse.java:71:15:71:17 | parameter this [waitTime] : Number | semmle.label | parameter this [waitTime] : Number |
4040
| ThreadResourceAbuse.java:74:18:74:25 | this <.field> [waitTime] : Number | semmle.label | this <.field> [waitTime] : Number |
4141
| ThreadResourceAbuse.java:74:18:74:25 | waitTime | semmle.label | waitTime |
4242
| ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | semmle.label | getValue(...) : String |
4343
| ThreadResourceAbuse.java:144:34:144:42 | delayTime | semmle.label | delayTime |
4444
| ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
45-
| ThreadResourceAbuse.java:177:17:177:26 | retryAfter | semmle.label | retryAfter |
46-
| ThreadResourceAbuse.java:208:28:208:56 | getParameter(...) : String | semmle.label | getParameter(...) : String |
47-
| ThreadResourceAbuse.java:211:30:211:87 | new UploadListener(...) [slowUploads] : Number | semmle.label | new UploadListener(...) [slowUploads] : Number |
48-
| ThreadResourceAbuse.java:211:49:211:59 | uploadDelay : Number | semmle.label | uploadDelay : Number |
45+
| ThreadResourceAbuse.java:176:17:176:26 | retryAfter | semmle.label | retryAfter |
46+
| ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | semmle.label | getParameter(...) : String |
47+
| ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number | semmle.label | new UploadListener(...) [slowUploads] : Number |
48+
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | semmle.label | uploadDelay : Number |
4949
| UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | semmle.label | sleepMilliseconds : Number |
5050
| UploadListener.java:16:3:16:13 | this <.field> [post update] [slowUploads] : Number | semmle.label | this <.field> [post update] [slowUploads] : Number |
5151
| UploadListener.java:16:17:16:33 | sleepMilliseconds : Number | semmle.label | sleepMilliseconds : Number |
@@ -59,10 +59,10 @@ nodes
5959
subpaths
6060
| ThreadResourceAbuse.java:21:28:21:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number | ThreadResourceAbuse.java:21:4:21:37 | new UncheckedSyncAction(...) [waitTime] : Number |
6161
| ThreadResourceAbuse.java:30:28:30:36 | delayTime : Number | ThreadResourceAbuse.java:66:30:66:41 | waitTime : Number | ThreadResourceAbuse.java:67:4:67:7 | this [post update] [waitTime] : Number | ThreadResourceAbuse.java:30:4:30:37 | new UncheckedSyncAction(...) [waitTime] : Number |
62-
| ThreadResourceAbuse.java:211:49:211:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | UploadListener.java:16:3:16:13 | this <.field> [post update] [slowUploads] : Number | ThreadResourceAbuse.java:211:30:211:87 | new UploadListener(...) [slowUploads] : Number |
62+
| ThreadResourceAbuse.java:209:49:209:59 | uploadDelay : Number | UploadListener.java:15:24:15:44 | sleepMilliseconds : Number | UploadListener.java:16:3:16:13 | this <.field> [post update] [slowUploads] : Number | ThreadResourceAbuse.java:209:30:209:87 | new UploadListener(...) [slowUploads] : Number |
6363
#select
6464
| ThreadResourceAbuse.java:74:18:74:25 | waitTime | ThreadResourceAbuse.java:18:25:18:57 | getParameter(...) : String | ThreadResourceAbuse.java:74:18:74:25 | waitTime | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:18:25:18:57 | getParameter(...) | user-provided value |
6565
| ThreadResourceAbuse.java:74:18:74:25 | waitTime | ThreadResourceAbuse.java:29:82:29:114 | getParameter(...) : String | ThreadResourceAbuse.java:74:18:74:25 | waitTime | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:29:82:29:114 | getParameter(...) | user-provided value |
6666
| ThreadResourceAbuse.java:144:34:144:42 | delayTime | ThreadResourceAbuse.java:141:27:141:43 | getValue(...) : String | ThreadResourceAbuse.java:144:34:144:42 | delayTime | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:141:27:141:43 | getValue(...) | user-provided value |
67-
| ThreadResourceAbuse.java:177:17:177:26 | retryAfter | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:177:17:177:26 | retryAfter | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) | user-provided value |
68-
| UploadListener.java:35:18:35:28 | slowUploads | ThreadResourceAbuse.java:208:28:208:56 | getParameter(...) : String | UploadListener.java:35:18:35:28 | slowUploads | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:208:28:208:56 | getParameter(...) | user-provided value |
67+
| ThreadResourceAbuse.java:176:17:176:26 | retryAfter | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) : String | ThreadResourceAbuse.java:176:17:176:26 | retryAfter | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:172:19:172:50 | getHeader(...) | user-provided value |
68+
| UploadListener.java:35:18:35:28 | slowUploads | ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) : String | UploadListener.java:35:18:35:28 | slowUploads | Vulnerability of uncontrolled resource consumption due to $@. | ThreadResourceAbuse.java:206:28:206:56 | getParameter(...) | user-provided value |

‎java/ql/test/experimental/query-tests/security/CWE-400/ThreadResourceAbuse.java

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ public class ThreadResourceAbuse extends HttpServlet {
1414
static final int MAX_RETRY_AFTER = 10*1000;
1515

1616
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
17-
// Get thread pause time from request parameter
17+
// BAD: Get thread pause time from request parameter without validation
1818
String delayTimeStr = request.getParameter("DelayTime");
1919
try {
2020
int delayTime = Integer.valueOf(delayTimeStr);
@@ -24,7 +24,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) t
2424
}
2525

2626
protected void doGet2(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
27-
// Get thread pause time from request parameter
27+
// BAD: Get thread pause time from request parameter without validation
2828
try {
2929
int delayTime = request.getParameter("nodelay") != null ? 0 : Integer.valueOf(request.getParameter("DelayTime"));
3030
new UncheckedSyncAction(delayTime).start();
@@ -33,7 +33,7 @@ protected void doGet2(HttpServletRequest request, HttpServletResponse response)
3333
}
3434

3535
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
36-
// Get thread pause time from init container parameter (not detected because LocalUserInput tends to add a lot of FP)
36+
// BAD: Get thread pause time from context init parameter without validation
3737
String delayTimeStr = getServletContext().getInitParameter("DelayTime");
3838
try {
3939
int delayTime = Integer.valueOf(delayTimeStr);
@@ -43,7 +43,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
4343
}
4444

4545
protected void doPut(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
46-
// Get thread pause time from request cookie
46+
// GOOD: Get thread pause time from request cookie with validation
4747
Cookie[] cookies = request.getCookies();
4848

4949
for ( int i=0; i<cookies.length; i++) {
@@ -68,8 +68,8 @@ public UncheckedSyncAction(int waitTime) {
6868
}
6969

7070
@Override
71-
// BAD: no boundary check on wait time
7271
public void run() {
72+
// BAD: no boundary check on wait time
7373
try {
7474
Thread.sleep(waitTime);
7575
// Do other updates
@@ -85,9 +85,9 @@ public CheckedSyncAction(int waitTime) {
8585
this.waitTime = waitTime;
8686
}
8787

88-
// GOOD: enforce an upper limit on wait time
8988
@Override
9089
public void run() {
90+
// GOOD: enforce an upper limit on wait time
9191
try {
9292
if (waitTime > 0 && waitTime < 5000) {
9393
Thread.sleep(waitTime);
@@ -105,9 +105,9 @@ public CheckedSyncAction2(int waitTime) {
105105
this.waitTime = waitTime;
106106
}
107107

108-
// GOOD: enforce an upper limit on wait time
109108
@Override
110109
public void run() {
110+
// GOOD: enforce an upper limit on wait time
111111
try {
112112
if (waitTime >= 5000) {
113113
// No action
@@ -121,7 +121,7 @@ public void run() {
121121
}
122122

123123
protected void doPost2(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
124-
// Get thread pause time from init container parameter
124+
// GOOD: Get thread pause time from init container parameter with validation
125125
String delayTimeStr = getServletContext().getInitParameter("DelayTime");
126126
try {
127127
int delayTime = Integer.valueOf(delayTimeStr);
@@ -131,7 +131,7 @@ protected void doPost2(HttpServletRequest request, HttpServletResponse response)
131131
}
132132

133133
protected void doHead(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
134-
// Get thread pause time from request cookie
134+
// BAD: Get thread pause time from request cookie without validation
135135
Cookie[] cookies = request.getCookies();
136136

137137
for ( int i=0; i<cookies.length; i++) {
@@ -168,25 +168,23 @@ int parseRetryAfter(String value) {
168168
}
169169

170170
protected void doHead2(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
171-
// Get thread pause time from request header
171+
// BAD: Get thread pause time from request header without validation
172172
String header = request.getHeader("Retry-After");
173173
int retryAfter = Integer.parseInt(header);
174174

175175
try {
176-
// BAD: wait for retry-after without input validation
177176
Thread.sleep(retryAfter);
178177
} catch (InterruptedException ignore) {
179178
// ignore
180179
}
181180
}
182181

183182
protected void doHead3(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
184-
// Get thread pause time from request header
183+
// GOOD: Get thread pause time from request header with validation
185184
String header = request.getHeader("Retry-After");
186185
int retryAfter = parseRetryAfter(header);
187186

188187
try {
189-
// GOOD: wait for retry-after with input validation
190188
Thread.sleep(retryAfter);
191189
} catch (InterruptedException ignore) {
192190
// ignore
@@ -203,7 +201,7 @@ private long getContentLength(HttpServletRequest request) {
203201
}
204202

205203
protected void doHead4(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
206-
// Get thread pause time from request header
204+
// BAD: Get thread pause time from request header without validation
207205
try {
208206
String uploadDelayStr = request.getParameter("delay");
209207
int uploadDelay = Integer.parseInt(uploadDelayStr);

0 commit comments

Comments
 (0)