Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Java: Extend String dataflow models #7019

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+35 −8
Draft

Java: Extend String dataflow models #7019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion java/ql/lib/semmle/code/java/frameworks/Objects.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/** Definitions of taint steps in Objects class of the JDK */
/** Definitions of taint steps in `java.util.Objects` class of the JDK */

import java
private import semmle.code.java.dataflow.ExternalFlow
Expand All @@ -12,6 +12,7 @@ private class ObjectsSummaryCsv extends SummaryModelCsv {
"java.util;Objects;false;requireNonNullElse;;;Argument[0];ReturnValue;value",
"java.util;Objects;false;requireNonNullElse;;;Argument[1];ReturnValue;value",
"java.util;Objects;false;requireNonNullElseGet;;;Argument[0];ReturnValue;value",
"java.util;Objects;false;requireNonNullElseGet;;;ReturnValue of Argument[1];ReturnValue;value",
"java.util;Objects;false;toString;;;Argument[1];ReturnValue;value"
]
}
Expand Down
40 changes: 33 additions & 7 deletions java/ql/lib/semmle/code/java/frameworks/Strings.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,28 @@ private class StringSummaryCsv extends SummaryModelCsv {
"java.lang;String;false;concat;(String);;Argument[0];ReturnValue;taint",
"java.lang;String;false;concat;(String);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;copyValueOf;;;Argument[0];ReturnValue;taint",
"java.lang;String;false;endsWith;;;Argument[-1];ReturnValue;taint",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have removed this because no other boolean returning methods are modelled.

"java.lang;String;false;describeConstable;;;Argument[-1];Element of ReturnValue;value",
"java.lang;String;false;format;(Locale,String,Object[]);;Argument[1];ReturnValue;taint",
"java.lang;String;false;format;(Locale,String,Object[]);;ArrayElement of Argument[2];ReturnValue;taint",
"java.lang;String;false;format;(String,Object[]);;Argument[0];ReturnValue;taint",
"java.lang;String;false;format;(String,Object[]);;ArrayElement of Argument[1];ReturnValue;taint",
"java.lang;String;false;formatted;(Object[]);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;formatted;(Object[]);;ArrayElement of Argument[0];ReturnValue;taint",
"java.lang;String;false;getChars;;;Argument[-1];Argument[2];taint",
"java.lang;String;false;getBytes;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;getBytes;(int,int,byte[],int);;Argument[-1];Argument[2];taint",
"java.lang;String;false;getChars;;;Argument[-1];Argument[2];taint",
"java.lang;String;false;indent;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;intern;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint",
"java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint", // TODO: ArrayElement of Argument?
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this here and maybe also in other cases use ArrayElement of Argument instead? What is the difference between tracking taint form an array (or varargs?) compared to tracking taint from the elements?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because TaintTracking::Configuration specifies an allowImplicitRead method that allows implicit reads from an array, collection or map-value (i.e., we can treat y = propagateTaint(x) or sinkTaint(x) as if they were y = propagateTaint(x[n]) or sinkTaint(x.get(n))), in practice it doesn't make much difference for typical taint-tracking applications. In addition it specifies an isAdditionalFlowStep implementation that provides the opposite blurring of taint, saying that reading from a tainted map or tainted array yields tainted content.

In summary, for taint-tracking purposes Field and SyntheticField content continue to be faithfully distinguished, but array, collection and map content are blurred in both directions, with a tainted whole implying a tainted element and vice versa. You can specify them for clarity in the CSV description, but it won't make much (any?) difference to your results.

"java.lang;String;false;lines;;;Argument[-1];Element of ReturnValue;taint",
"java.lang;String;false;repeat;(int);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;replace;;;Argument[1];ReturnValue;taint",
"java.lang;String;false;replace;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;replaceAll;;;Argument[1];ReturnValue;taint",
"java.lang;String;false;replaceAll;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;replaceFirst;;;Argument[1];ReturnValue;taint",
"java.lang;String;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
Comment on lines +29 to +34
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These ones have non-CSV models that should be cleaned up concurrently (search for "replaceAll" for example)

"java.lang;String;false;resolveConstantDesc;;;Argument[-1];ReturnValue;value",
"java.lang;String;false;split;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;String;;;Argument[0];Argument[-1];taint",
"java.lang;String;false;strip;;;Argument[-1];ReturnValue;taint",
Expand All @@ -35,26 +44,43 @@ private class StringSummaryCsv extends SummaryModelCsv {
"java.lang;String;false;toLowerCase;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;toString;;;Argument[-1];ReturnValue;value",
"java.lang;String;false;toUpperCase;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;transform;;;Argument[-1];Parameter[0] of Argument[0];value",
"java.lang;String;false;transform;;;ReturnValue of Argument[0];ReturnValue;value",
"java.lang;String;false;translateEscapes;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;trim;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;valueOf;(char);;Argument[0];ReturnValue;taint",
"java.lang;String;false;valueOf;(char[],int,int);;Argument[0];ReturnValue;taint",
"java.lang;String;false;valueOf;(char[]);;Argument[0];ReturnValue;taint",
// TODO: Should `append` and `write` be modelled for Appendable and Writer instead?
// Could then remove some of the modelled `append` method here and for StringBuilder
Comment on lines +54 to +55
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should Appendable and Writer be modelled?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sounds like a positive step to me

"java.io;StringWriter;true;append;;;Argument[0];Argument[-1];taint",
"java.io;StringWriter;true;append;;;Argument[-1];ReturnValue;value",
"java.io;StringWriter;true;getBuffer;;;Argument[-1];ReturnValue;taint",
"java.io;StringWriter;true;toString;;;Argument[-1];ReturnValue;taint",
"java.io;StringWriter;true;write;;;Argument[0];Argument[-1];taint",
// Note: `AbstractStringBuilder` is a JDK internal superclass of StringBuilder and StringBuffer
// Some of the methods are not modelled because they are already modelled for CharSequence
"java.lang;AbstractStringBuilder;true;AbstractStringBuilder;(String);;Argument[0];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;append;;;Argument[0];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;append;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;appendCodePoint;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;delete;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;deleteCharAt;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;getChars;;;Argument[-1];Argument[2];value",
"java.lang;AbstractStringBuilder;true;insert;;;Argument[1];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;insert;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;replace;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;replace;;;Argument[2];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;toString;;;Argument[-1];ReturnValue;taint",
"java.lang;AbstractStringBuilder;true;replace;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;reverse;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;substring;;;Argument[-1];ReturnValue;value",
"java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint",
"java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint",
"java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint",
"java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint"
"java.lang;StringBuilder;true;StringBuilder;(CharSequence);;Argument[0];Argument[-1];taint",
"java.lang;StringBuilder;true;StringBuilder;(String);;Argument[0];Argument[-1];taint",
Comment on lines +78 to +79
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have specified the parameter types here to avoid tracking StringBuilder(int) where the argument only represents the capacitiy.

"java.lang;CharSequence;true;chars;;;Argument[-1];Element of ReturnValue;taint",
"java.lang;CharSequence;true;codePoints;;;Argument[-1];Element of ReturnValue;taint",
"java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint",
"java.lang;CharSequence;true;toString;;;Argument[-1];ReturnValue;taint"
]
}
}