Skip to content

Commit 5c929a3

Browse files
owen-mcCopilot
owen-mc
and
Copilot
committed
Add barrier models for sanitizers where possible
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent b23b5ae commit 5c929a3

6 files changed

Lines changed: 30 additions & 44 deletions

File tree

‎java/ql/lib/ext/org.apache.commons.lang3.model.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: barrierModel
5+
data:
6+
- ["org.apache.commons.lang3", "StringEscapeUtils", False, "escapeJava", "(String)", "", "ReturnValue", "log-injection", "manual"]
7+
- ["org.apache.commons.lang3", "StringUtils", False, "deleteWhitespace", "", "", "ReturnValue", "log-injection", "manual"]
8+
- ["org.apache.commons.lang3", "StringUtils", False, "normalizeSpace", "", "", "ReturnValue", "log-injection", "manual"]
29
- addsTo:
310
pack: codeql/java-all
411
extensible: sinkModel

‎java/ql/lib/ext/org.apache.commons.text.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: barrierModel
5+
data:
6+
- ["org.apache.commons.text", "StringEscapeUtils", False, "escapeJava", "(String)", "", "ReturnValue", "log-injection", "manual"]
27
- addsTo:
38
pack: codeql/java-all
49
extensible: summaryModel

‎java/ql/lib/ext/org.owasp.encoder.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: barrierModel
5+
data:
6+
- ["org.owasp.encoder", "Encode", False, "forJava", "(String)", "", "ReturnValue", "log-injection", "manual"]
27
- addsTo:
38
pack: codeql/java-all
49
extensible: summaryModel

‎java/ql/lib/ext/org.springframework.util.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: barrierModel
5+
data:
6+
- ["org.springframework.util", "StringUtils", False, "trimAllWhitespace", "", "", "ReturnValue", "log-injection", "manual"]
27
- addsTo:
38
pack: codeql/java-all
49
extensible: sinkModel

‎java/ql/test/query-tests/security/CWE-117/LibrarySanitizers.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,18 +54,18 @@ public void testSanitizers() {
5454
String source = source(); // $ Source
5555
Logger logger = null;
5656

57-
logger.debug(org.apache.commons.text.StringEscapeUtils.escapeJava(source)); // $ SPURIOUS: Alert
58-
logger.debug(org.apache.commons.lang3.StringEscapeUtils.escapeJava(source)); // $ SPURIOUS: Alert
59-
logger.debug(org.owasp.encoder.Encode.forJava(source)); // $ SPURIOUS: Alert
57+
logger.debug(org.apache.commons.text.StringEscapeUtils.escapeJava(source));
58+
logger.debug(org.apache.commons.lang3.StringEscapeUtils.escapeJava(source));
59+
logger.debug(org.owasp.encoder.Encode.forJava(source));
6060

6161
logger.debug(CharMatcher.anyOf("\r\n").removeFrom(source)); // $ SPURIOUS: Alert
6262
logger.debug(CharMatcher.anyOf("\r\n").replaceFrom(source, '_')); // $ SPURIOUS: Alert
6363
logger.debug(CharMatcher.anyOf("\r\n").replaceFrom(source, "_")); // $ SPURIOUS: Alert
6464

6565
logger.debug(org.apache.commons.lang3.StringUtils.replaceChars(source, "\r\n", "__")); // $ SPURIOUS: Alert
66-
logger.debug(org.apache.commons.lang3.StringUtils.deleteWhitespace(source)); // $ SPURIOUS: Alert
67-
logger.debug(org.apache.commons.lang3.StringUtils.normalizeSpace(source)); // $ SPURIOUS: Alert
68-
logger.debug(org.springframework.util.StringUtils.trimAllWhitespace(source)); // $ SPURIOUS: Alert
66+
logger.debug(org.apache.commons.lang3.StringUtils.deleteWhitespace(source));
67+
logger.debug(org.apache.commons.lang3.StringUtils.normalizeSpace(source));
68+
logger.debug(org.springframework.util.StringUtils.trimAllWhitespace(source));
6969
}
7070

7171
public void testAmbiguousGuavaMatcher(boolean condition) {

‎java/ql/test/query-tests/security/CWE-117/LogInjectionTest.expected‎

Lines changed: 2 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,10 @@
2525
| LibrarySanitizers.java:48:22:48:57 | replaceAll(...) | LibrarySanitizers.java:12:25:12:32 | source(...) : String | LibrarySanitizers.java:48:22:48:57 | replaceAll(...) | This log entry depends on a $@. | LibrarySanitizers.java:12:25:12:32 | source(...) | user-provided value |
2626
| LibrarySanitizers.java:49:22:49:57 | replaceAll(...) | LibrarySanitizers.java:12:25:12:32 | source(...) : String | LibrarySanitizers.java:49:22:49:57 | replaceAll(...) | This log entry depends on a $@. | LibrarySanitizers.java:12:25:12:32 | source(...) | user-provided value |
2727
| LibrarySanitizers.java:50:22:50:58 | replaceAll(...) | LibrarySanitizers.java:12:25:12:32 | source(...) : String | LibrarySanitizers.java:50:22:50:58 | replaceAll(...) | This log entry depends on a $@. | LibrarySanitizers.java:12:25:12:32 | source(...) | user-provided value |
28-
| LibrarySanitizers.java:57:22:57:81 | escapeJava(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:57:22:57:81 | escapeJava(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
29-
| LibrarySanitizers.java:58:22:58:82 | escapeJava(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:58:22:58:82 | escapeJava(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
30-
| LibrarySanitizers.java:59:22:59:61 | forJava(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:59:22:59:61 | forJava(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
3128
| LibrarySanitizers.java:61:22:61:65 | removeFrom(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:61:22:61:65 | removeFrom(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
3229
| LibrarySanitizers.java:62:22:62:71 | replaceFrom(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:62:22:62:71 | replaceFrom(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
3330
| LibrarySanitizers.java:63:22:63:71 | replaceFrom(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:63:22:63:71 | replaceFrom(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
3431
| LibrarySanitizers.java:65:22:65:92 | replaceChars(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:65:22:65:92 | replaceChars(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
35-
| LibrarySanitizers.java:66:22:66:82 | deleteWhitespace(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:66:22:66:82 | deleteWhitespace(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
36-
| LibrarySanitizers.java:67:22:67:80 | normalizeSpace(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:67:22:67:80 | normalizeSpace(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
37-
| LibrarySanitizers.java:68:22:68:83 | trimAllWhitespace(...) | LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:68:22:68:83 | trimAllWhitespace(...) | This log entry depends on a $@. | LibrarySanitizers.java:54:25:54:32 | source(...) | user-provided value |
3832
| LibrarySanitizers.java:82:22:82:47 | removeFrom(...) | LibrarySanitizers.java:72:25:72:32 | source(...) : String | LibrarySanitizers.java:82:22:82:47 | removeFrom(...) | This log entry depends on a $@. | LibrarySanitizers.java:72:25:72:32 | source(...) | user-provided value |
3933
| LibrarySanitizers.java:94:26:94:31 | source | LibrarySanitizers.java:86:25:86:32 | source(...) : String | LibrarySanitizers.java:94:26:94:31 | source | This log entry depends on a $@. | LibrarySanitizers.java:86:25:86:32 | source(...) | user-provided value |
4034
| LibrarySanitizers.java:98:26:98:31 | source | LibrarySanitizers.java:86:25:86:32 | source(...) : String | LibrarySanitizers.java:98:26:98:31 | source | This log entry depends on a $@. | LibrarySanitizers.java:86:25:86:32 | source(...) | user-provided value |
@@ -1968,26 +1962,14 @@ edges
19681962
| LibrarySanitizers.java:48:22:48:27 | source : String | LibrarySanitizers.java:48:22:48:57 | replaceAll(...) | provenance | MaD:543 Sink:MaD:101 |
19691963
| LibrarySanitizers.java:49:22:49:27 | source : String | LibrarySanitizers.java:49:22:49:57 | replaceAll(...) | provenance | MaD:543 Sink:MaD:101 |
19701964
| LibrarySanitizers.java:50:22:50:27 | source : String | LibrarySanitizers.java:50:22:50:58 | replaceAll(...) | provenance | MaD:543 Sink:MaD:101 |
1971-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:57:75:57:80 | source : String | provenance | Src:MaD:536 |
1972-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:58:76:58:81 | source : String | provenance | Src:MaD:536 |
1973-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:59:55:59:60 | source : String | provenance | Src:MaD:536 |
19741965
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:61:59:61:64 | source : String | provenance | Src:MaD:536 |
19751966
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:62:60:62:65 | source : String | provenance | Src:MaD:536 |
19761967
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:63:60:63:65 | source : String | provenance | Src:MaD:536 |
19771968
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:65:72:65:77 | source : String | provenance | Src:MaD:536 |
1978-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:66:76:66:81 | source : String | provenance | Src:MaD:536 |
1979-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:67:74:67:79 | source : String | provenance | Src:MaD:536 |
1980-
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | LibrarySanitizers.java:68:77:68:82 | source : String | provenance | Src:MaD:536 |
1981-
| LibrarySanitizers.java:57:75:57:80 | source : String | LibrarySanitizers.java:57:22:57:81 | escapeJava(...) | provenance | MaD:548 Sink:MaD:101 |
1982-
| LibrarySanitizers.java:58:76:58:81 | source : String | LibrarySanitizers.java:58:22:58:82 | escapeJava(...) | provenance | MaD:544 Sink:MaD:101 |
1983-
| LibrarySanitizers.java:59:55:59:60 | source : String | LibrarySanitizers.java:59:22:59:61 | forJava(...) | provenance | MaD:549 Sink:MaD:101 |
19841969
| LibrarySanitizers.java:61:59:61:64 | source : String | LibrarySanitizers.java:61:22:61:65 | removeFrom(...) | provenance | MaD:538 Sink:MaD:101 |
19851970
| LibrarySanitizers.java:62:60:62:65 | source : String | LibrarySanitizers.java:62:22:62:71 | replaceFrom(...) | provenance | MaD:540 Sink:MaD:101 |
19861971
| LibrarySanitizers.java:63:60:63:65 | source : String | LibrarySanitizers.java:63:22:63:71 | replaceFrom(...) | provenance | MaD:539 Sink:MaD:101 |
1987-
| LibrarySanitizers.java:65:72:65:77 | source : String | LibrarySanitizers.java:65:22:65:92 | replaceChars(...) | provenance | MaD:547 Sink:MaD:101 |
1988-
| LibrarySanitizers.java:66:76:66:81 | source : String | LibrarySanitizers.java:66:22:66:82 | deleteWhitespace(...) | provenance | MaD:545 Sink:MaD:101 |
1989-
| LibrarySanitizers.java:67:74:67:79 | source : String | LibrarySanitizers.java:67:22:67:80 | normalizeSpace(...) | provenance | MaD:546 Sink:MaD:101 |
1990-
| LibrarySanitizers.java:68:77:68:82 | source : String | LibrarySanitizers.java:68:22:68:83 | trimAllWhitespace(...) | provenance | MaD:550 Sink:MaD:101 |
1972+
| LibrarySanitizers.java:65:72:65:77 | source : String | LibrarySanitizers.java:65:22:65:92 | replaceChars(...) | provenance | MaD:544 Sink:MaD:101 |
19911973
| LibrarySanitizers.java:72:25:72:32 | source(...) : String | LibrarySanitizers.java:82:41:82:46 | source : String | provenance | Src:MaD:536 |
19921974
| LibrarySanitizers.java:82:41:82:46 | source : String | LibrarySanitizers.java:82:22:82:47 | removeFrom(...) | provenance | MaD:538 Sink:MaD:101 |
19931975
| LibrarySanitizers.java:86:25:86:32 | source(...) : String | LibrarySanitizers.java:94:26:94:31 | source | provenance | Src:MaD:536 Sink:MaD:101 |
@@ -4492,13 +4474,7 @@ models
44924474
| 541 | Summary: java.lang; String; false; replace; ; ; Argument[1]; ReturnValue; taint; manual |
44934475
| 542 | Summary: java.lang; String; false; replace; ; ; Argument[this]; ReturnValue; taint; manual |
44944476
| 543 | Summary: java.lang; String; false; replaceAll; ; ; Argument[this]; ReturnValue; taint; manual |
4495-
| 544 | Summary: org.apache.commons.lang3; StringEscapeUtils; false; escapeJava; (String); ; Argument[0]; ReturnValue; taint; manual |
4496-
| 545 | Summary: org.apache.commons.lang3; StringUtils; false; deleteWhitespace; ; ; Argument[0]; ReturnValue; taint; manual |
4497-
| 546 | Summary: org.apache.commons.lang3; StringUtils; false; normalizeSpace; ; ; Argument[0]; ReturnValue; taint; manual |
4498-
| 547 | Summary: org.apache.commons.lang3; StringUtils; false; replaceChars; ; ; Argument[0]; ReturnValue; taint; manual |
4499-
| 548 | Summary: org.apache.commons.text; StringEscapeUtils; false; escapeJava; (String); ; Argument[0]; ReturnValue; taint; manual |
4500-
| 549 | Summary: org.owasp.encoder; Encode; false; forJava; (String); ; Argument[0]; ReturnValue; taint; manual |
4501-
| 550 | Summary: org.springframework.util; StringUtils; false; trimAllWhitespace; ; ; Argument[0]; ReturnValue; taint; manual |
4477+
| 544 | Summary: org.apache.commons.lang3; StringUtils; false; replaceChars; ; ; Argument[0]; ReturnValue; taint; manual |
45024478
nodes
45034479
| LibrarySanitizers.java:12:25:12:32 | source(...) : String | semmle.label | source(...) : String |
45044480
| LibrarySanitizers.java:16:22:16:27 | source : String | semmle.label | source : String |
@@ -4554,12 +4530,6 @@ nodes
45544530
| LibrarySanitizers.java:50:22:50:27 | source : String | semmle.label | source : String |
45554531
| LibrarySanitizers.java:50:22:50:58 | replaceAll(...) | semmle.label | replaceAll(...) |
45564532
| LibrarySanitizers.java:54:25:54:32 | source(...) : String | semmle.label | source(...) : String |
4557-
| LibrarySanitizers.java:57:22:57:81 | escapeJava(...) | semmle.label | escapeJava(...) |
4558-
| LibrarySanitizers.java:57:75:57:80 | source : String | semmle.label | source : String |
4559-
| LibrarySanitizers.java:58:22:58:82 | escapeJava(...) | semmle.label | escapeJava(...) |
4560-
| LibrarySanitizers.java:58:76:58:81 | source : String | semmle.label | source : String |
4561-
| LibrarySanitizers.java:59:22:59:61 | forJava(...) | semmle.label | forJava(...) |
4562-
| LibrarySanitizers.java:59:55:59:60 | source : String | semmle.label | source : String |
45634533
| LibrarySanitizers.java:61:22:61:65 | removeFrom(...) | semmle.label | removeFrom(...) |
45644534
| LibrarySanitizers.java:61:59:61:64 | source : String | semmle.label | source : String |
45654535
| LibrarySanitizers.java:62:22:62:71 | replaceFrom(...) | semmle.label | replaceFrom(...) |
@@ -4568,12 +4538,6 @@ nodes
45684538
| LibrarySanitizers.java:63:60:63:65 | source : String | semmle.label | source : String |
45694539
| LibrarySanitizers.java:65:22:65:92 | replaceChars(...) | semmle.label | replaceChars(...) |
45704540
| LibrarySanitizers.java:65:72:65:77 | source : String | semmle.label | source : String |
4571-
| LibrarySanitizers.java:66:22:66:82 | deleteWhitespace(...) | semmle.label | deleteWhitespace(...) |
4572-
| LibrarySanitizers.java:66:76:66:81 | source : String | semmle.label | source : String |
4573-
| LibrarySanitizers.java:67:22:67:80 | normalizeSpace(...) | semmle.label | normalizeSpace(...) |
4574-
| LibrarySanitizers.java:67:74:67:79 | source : String | semmle.label | source : String |
4575-
| LibrarySanitizers.java:68:22:68:83 | trimAllWhitespace(...) | semmle.label | trimAllWhitespace(...) |
4576-
| LibrarySanitizers.java:68:77:68:82 | source : String | semmle.label | source : String |
45774541
| LibrarySanitizers.java:72:25:72:32 | source(...) : String | semmle.label | source(...) : String |
45784542
| LibrarySanitizers.java:82:22:82:47 | removeFrom(...) | semmle.label | removeFrom(...) |
45794543
| LibrarySanitizers.java:82:41:82:46 | source : String | semmle.label | source : String |

0 commit comments

Comments
 (0)