Skip to content

Commit b23b5ae

Browse files
owen-mcCopilot
owen-mc
and
Copilot
committed
Add tests with SPURIOUS results for sanitization
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 4f593bf commit b23b5ae

9 files changed

Lines changed: 7271 additions & 7011 deletions

File tree

‎java/ql/test/library-tests/pathsanitizer/Test.java‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.nio.file.Path;
44
import java.nio.file.Paths;
55
import android.net.Uri;
6+
import com.google.common.base.CharMatcher;
7+
import org.apache.commons.lang3.StringUtils;
68

79
public class Test {
810

@@ -227,6 +229,13 @@ public void dotDotCheckGuard() throws Exception {
227229
else
228230
sink(source); // $ hasTaintFlow
229231
}
232+
{
233+
String source = (String) source();
234+
if (source.startsWith("/safe") && !StringUtils.contains(source, ".."))
235+
sink(source); // $ SPURIOUS: hasTaintFlow
236+
else
237+
sink(source); // $ hasTaintFlow
238+
}
230239
{
231240
String source = (String) source();
232241
if (source.startsWith("/safe") && source.indexOf("..") == -1)
@@ -440,6 +449,17 @@ public void blockListGuard() throws Exception {
440449
sink(normalized); // $ hasTaintFlow
441450
}
442451
}
452+
{
453+
String source = (String) source();
454+
String normalized = Paths.get(source).normalize().toString();
455+
if (!StringUtils.contains(normalized, "/data")) {
456+
sink(source); // $ SPURIOUS: hasTaintFlow
457+
sink(normalized); // $ SPURIOUS: hasTaintFlow
458+
} else {
459+
sink(source); // $ hasTaintFlow
460+
sink(normalized); // $ hasTaintFlow
461+
}
462+
}
443463
{
444464
String source = (String) source();
445465
String normalized = Paths.get(source).normalize().toString();
@@ -830,6 +850,11 @@ public void directoryCharsSanitizer() throws Exception {
830850
source = source.replace(".", "").replace("/", "");
831851
sink(source); // Safe
832852
}
853+
{
854+
String source = (String) source();
855+
source = source.replace('.', '_').replace('/', '_');
856+
sink(source); // $ SPURIOUS: hasTaintFlow
857+
}
833858
{
834859
String source = (String) source();
835860
source = source.replace(".", "").replace("/", "").replace("\\", "");
@@ -859,5 +884,46 @@ public void directoryCharsSanitizer() throws Exception {
859884
source = source.replace("../", "");
860885
sink(source); // $ hasTaintFlow
861886
}
887+
{
888+
String source = (String) source();
889+
source = StringUtils.replaceChars(source, "./\\", "_");
890+
sink(source); // $ SPURIOUS: hasTaintFlow
891+
}
892+
{
893+
String source = (String) source();
894+
source = CharMatcher.anyOf("./\\").replaceFrom(source, '_');
895+
sink(source); // $ SPURIOUS: hasTaintFlow
896+
}
897+
{
898+
String source = (String) source();
899+
source = CharMatcher.anyOf("./\\").removeFrom(source);
900+
sink(source); // $ SPURIOUS: hasTaintFlow
901+
}
902+
{
903+
String source = (String) source();
904+
source = CharMatcher.anyOf("/\\").removeFrom(source);
905+
sink(source); // $ hasTaintFlow
906+
}
907+
{
908+
String source = (String) source();
909+
if (StringUtils.containsNone(source, "./\\"))
910+
sink(source); // $ SPURIOUS: hasTaintFlow
911+
else
912+
sink(source); // $ hasTaintFlow
913+
}
914+
{
915+
String source = (String) source();
916+
if (CharMatcher.anyOf("./\\").matchesNoneOf(source))
917+
sink(source); // $ SPURIOUS: hasTaintFlow
918+
else
919+
sink(source); // $ hasTaintFlow
920+
}
921+
{
922+
String source = (String) source();
923+
if (CharMatcher.anyOf("/\\").matchesNoneOf(source))
924+
sink(source); // $ hasTaintFlow
925+
else
926+
sink(source); // $ hasTaintFlow
927+
}
862928
}
863929
}

‎java/ql/test/library-tests/pathsanitizer/options‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/google-android-9.0.0
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../stubs/google-android-9.0.0:${testdir}/../../stubs/apache-commons-lang3-3.7:${testdir}/../../stubs/guava-30.0
22
//codeql-extractor-kotlin-options: ${testdir}/../../stubs/google-android-9.0.0

‎java/ql/test/query-tests/security/CWE-117/LibrarySanitizers.java‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
package loginjection;
2+
3+
import com.google.common.base.CharMatcher;
4+
import org.apache.logging.log4j.Logger;
5+
6+
public class LibrarySanitizers {
7+
public String source() {
8+
return null;
9+
}
10+
11+
public void testJdkSanitizers() {
12+
String source = source(); // $ Source
13+
Logger logger = null;
14+
15+
logger.debug(source.replace("\n", "")); // Safe
16+
logger.debug(source.replace("\n", "\n")); // $ Alert
17+
logger.debug(source.replace("\n", "\r")); // $ Alert
18+
logger.debug(source.replace("\r", "")); // Safe
19+
logger.debug(source.replace("\r", "\n")); // $ Alert
20+
logger.debug(source.replace("\r", "\r")); // $ Alert
21+
logger.debug(source.replace("something_else", "")); // $ Alert
22+
logger.debug("\n".replace("\n", source)); // $ Alert
23+
logger.debug(source.replace('\n', '_')); // Safe
24+
logger.debug(source.replace('\n', '\n')); // $ Alert
25+
logger.debug(source.replace('\n', '\r')); // $ Alert
26+
logger.debug(source.replace('\r', '_')); // Safe
27+
logger.debug(source.replace('\r', '\n')); // $ Alert
28+
logger.debug(source.replace('\r', '\r')); // $ Alert
29+
logger.debug(source.replace('-', '_')); // $ Alert
30+
logger.debug(source.replaceAll("\n", "")); // Safe
31+
logger.debug(source.replaceAll("\n", "\n")); // $ Alert
32+
logger.debug(source.replaceAll("\n", "\r")); // $ Alert
33+
logger.debug(source.replaceAll("\r", "")); // Safe
34+
logger.debug(source.replaceAll("\r", "\n")); // $ Alert
35+
logger.debug(source.replaceAll("\r", "\r")); // $ Alert
36+
logger.debug(source.replaceAll("\\n", "")); // Safe
37+
logger.debug(source.replaceAll("\\n", "\n")); // $ Alert
38+
logger.debug(source.replaceAll("\\n", "\r")); // $ Alert
39+
logger.debug(source.replaceAll("\\r", "")); // Safe
40+
logger.debug(source.replaceAll("\\r", "\n")); // $ Alert
41+
logger.debug(source.replaceAll("\\r", "\r")); // $ Alert
42+
logger.debug(source.replaceAll("\\R", "")); // Safe
43+
logger.debug(source.replaceAll("\\R", "\n")); // $ Alert
44+
logger.debug(source.replaceAll("\\R", "\r")); // $ Alert
45+
logger.debug(source.replaceAll("[^a-zA-Z]", "")); // Safe
46+
logger.debug(source.replaceAll("[^a-zA-Z]", "\n")); // $ Alert
47+
logger.debug(source.replaceAll("[^a-zA-Z]", "\r")); // $ Alert
48+
logger.debug(source.replaceAll("[^a-zA-Z\n]", "")); // $ Alert
49+
logger.debug(source.replaceAll("[^a-zA-Z\r]", "")); // $ Alert
50+
logger.debug(source.replaceAll("[^a-zA-Z\\R]", "")); // $ Alert
51+
}
52+
53+
public void testSanitizers() {
54+
String source = source(); // $ Source
55+
Logger logger = null;
56+
57+
logger.debug(org.apache.commons.text.StringEscapeUtils.escapeJava(source)); // $ SPURIOUS: Alert
58+
logger.debug(org.apache.commons.lang3.StringEscapeUtils.escapeJava(source)); // $ SPURIOUS: Alert
59+
logger.debug(org.owasp.encoder.Encode.forJava(source)); // $ SPURIOUS: Alert
60+
61+
logger.debug(CharMatcher.anyOf("\r\n").removeFrom(source)); // $ SPURIOUS: Alert
62+
logger.debug(CharMatcher.anyOf("\r\n").replaceFrom(source, '_')); // $ SPURIOUS: Alert
63+
logger.debug(CharMatcher.anyOf("\r\n").replaceFrom(source, "_")); // $ SPURIOUS: Alert
64+
65+
logger.debug(org.apache.commons.lang3.StringUtils.replaceChars(source, "\r\n", "__")); // $ SPURIOUS: Alert
66+
logger.debug(org.apache.commons.lang3.StringUtils.deleteWhitespace(source)); // $ SPURIOUS: Alert
67+
logger.debug(org.apache.commons.lang3.StringUtils.normalizeSpace(source)); // $ SPURIOUS: Alert
68+
logger.debug(org.springframework.util.StringUtils.trimAllWhitespace(source)); // $ SPURIOUS: Alert
69+
}
70+
71+
public void testAmbiguousGuavaMatcher(boolean condition) {
72+
String source = source(); // $ Source
73+
Logger logger = null;
74+
CharMatcher matcher;
75+
76+
if (condition) {
77+
matcher = CharMatcher.anyOf("\r\n");
78+
} else {
79+
matcher = CharMatcher.anyOf("x");
80+
}
81+
82+
logger.debug(matcher.removeFrom(source)); // $ Alert
83+
}
84+
85+
public void testGuards() {
86+
String source = source(); // $ Source
87+
Logger logger = null;
88+
89+
if (!source.contains("\n")) {
90+
logger.debug(source);
91+
}
92+
93+
if (!org.apache.commons.lang3.StringUtils.contains(source, "\n")) {
94+
logger.debug(source); // $ SPURIOUS: Alert
95+
}
96+
97+
if (!org.apache.commons.lang3.StringUtils.containsIgnoreCase(source, "\n")) {
98+
logger.debug(source); // $ SPURIOUS: Alert
99+
}
100+
101+
if (!org.apache.commons.lang3.StringUtils.containsAny(source, "\r\n")) {
102+
logger.debug(source); // $ SPURIOUS: Alert
103+
}
104+
105+
if (org.apache.commons.lang3.StringUtils.containsNone(source, "\r\n")) {
106+
logger.debug(source); // $ SPURIOUS: Alert
107+
}
108+
109+
if (!CharMatcher.anyOf("\r\n").matchesAnyOf(source)) {
110+
logger.debug(source); // $ SPURIOUS: Alert
111+
}
112+
113+
if (CharMatcher.anyOf("\r\n").matchesNoneOf(source)) {
114+
logger.debug(source); // $ SPURIOUS: Alert
115+
}
116+
117+
if (CharMatcher.noneOf("\r\n").matchesAllOf(source)) {
118+
logger.debug(source); // $ SPURIOUS: Alert
119+
}
120+
}
121+
}

0 commit comments

Comments
 (0)