Skip to content

Commit babdee3

Browse files
jcogs33jcogs33
authored
Merge pull request #11779 from jcogs33/jcogs33/model-more-top-jdk-apis
Java: model top JDK APIs
2 parents 6b43ff4 + 10f0975 commit babdee3

25 files changed

+304
-84
lines changed

‎java/ql/lib/change-notes/2023-01-03-add-more-top-jdk-models.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added more dataflow models for frequently-used JDK APIs.
5+
* Removed summary model for `java.lang.String#endsWith(String)` and added neutral model for this API.
6+
* Added additional taint step for `java.lang.String#endsWith(String)` to `ConditionalBypassFlowConfig`.

‎java/ql/lib/ext/java.io.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ extensions:
6363
- ["java.io", "File", True, "getAbsolutePath", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
6464
- ["java.io", "File", True, "getCanonicalFile", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
6565
- ["java.io", "File", True, "getCanonicalPath", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
66+
- ["java.io", "File", True, "getName", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
6667
- ["java.io", "File", True, "toPath", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
6768
- ["java.io", "File", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
6869
- ["java.io", "File", True, "toURI", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
@@ -74,6 +75,7 @@ extensions:
7475
- ["java.io", "InputStream", True, "readNBytes", "(int)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
7576
- ["java.io", "InputStream", True, "transferTo", "(OutputStream)", "", "Argument[-1]", "Argument[0]", "taint", "manual"]
7677
- ["java.io", "InputStreamReader", False, "InputStreamReader", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
78+
- ["java.io", "IOException", False, "IOException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
7779
- ["java.io", "ObjectInput", True, "read", "", "", "Argument[-1]", "Argument[0]", "taint", "manual"]
7880
- ["java.io", "ObjectInputStream", False, "ObjectInputStream", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
7981
- ["java.io", "OutputStream", True, "write", "(byte[])", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
@@ -84,3 +86,9 @@ extensions:
8486
- ["java.io", "StringReader", False, "StringReader", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
8587
- ["java.io", "Writer", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
8688
- ["java.io", "Writer", True, "write", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
89+
90+
- addsTo:
91+
pack: codeql/java-all
92+
extensible: neutralModel
93+
data:
94+
- ["java.io", "File", "exists", "()", "manual"]

‎java/ql/lib/ext/java.lang.model.yml‎

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,22 +37,24 @@ extensions:
3737
- ["java.lang", "CharSequence", True, "charAt", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3838
- ["java.lang", "CharSequence", True, "subSequence", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
3939
- ["java.lang", "CharSequence", True, "toString", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
40+
- ["java.lang", "Exception", False, "Exception", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
4041
- ["java.lang", "IllegalArgumentException", False, "IllegalArgumentException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
4142
- ["java.lang", "IllegalStateException", False, "IllegalStateException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
42-
- ["java.lang", "Integer", False, "parseInt", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
43+
- ["java.lang", "IndexOutOfBoundsException", False, "IndexOutOfBoundsException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
4344
- ["java.lang", "Iterable", True, "forEach", "(Consumer)", "", "Argument[-1].Element", "Argument[0].Parameter[0]", "value", "manual"]
4445
- ["java.lang", "Iterable", True, "iterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4546
- ["java.lang", "Iterable", True, "spliterator", "()", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4647
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].Element", "ReturnValue.Element", "value", "manual"]
4748
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapKey", "ReturnValue.MapKey", "value", "manual"]
4849
- ["java.lang", "Object", True, "clone", "", "", "Argument[-1].MapValue", "ReturnValue.MapValue", "value", "manual"]
4950
- ["java.lang", "RuntimeException", False, "RuntimeException", "(String)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
51+
- ["java.lang", "RuntimeException", False, "RuntimeException", "(String,Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "value", "manual"]
52+
- ["java.lang", "RuntimeException", False, "RuntimeException", "(String,Throwable)", "", "Argument[1]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
5053
- ["java.lang", "RuntimeException", False, "RuntimeException", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
5154
- ["java.lang", "String", False, "String", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
5255
- ["java.lang", "String", False, "concat", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
5356
- ["java.lang", "String", False, "concat", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
5457
- ["java.lang", "String", False, "copyValueOf", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
55-
- ["java.lang", "String", False, "endsWith", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
5658
- ["java.lang", "String", False, "format", "(Locale,String,Object[])", "", "Argument[1]", "ReturnValue", "taint", "manual"]
5759
- ["java.lang", "String", False, "format", "(Locale,String,Object[])", "", "Argument[2].ArrayElement", "ReturnValue", "taint", "manual"]
5860
- ["java.lang", "String", False, "format", "(String,Object[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
@@ -87,34 +89,56 @@ extensions:
8789
- ["java.lang", "String", False, "valueOf", "(char)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8890
- ["java.lang", "String", False, "valueOf", "(char[])", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8991
- ["java.lang", "String", False, "valueOf", "(char[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
90-
- ["java.lang", "String", False, "valueOf", "(int)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
9192
- ["java.lang", "StringBuffer", True, "StringBuffer", "(CharSequence)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
9293
- ["java.lang", "StringBuffer", True, "StringBuffer", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
9394
- ["java.lang", "StringBuilder", True, "StringBuilder", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
9495
- ["java.lang", "System", False, "arraycopy", "", "", "Argument[0]", "Argument[2]", "taint", "manual"]
9596
- ["java.lang", "Throwable", False, "Throwable", "(Throwable)", "", "Argument[0]", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "value", "manual"]
96-
- ["java.lang", "Throwable", False, "getCause", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "ReturnValue", "value", "manual"]
97-
- ["java.lang", "Throwable", False, "getMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
97+
- ["java.lang", "Throwable", True, "getCause", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.cause]", "ReturnValue", "value", "manual"]
98+
- ["java.lang", "Throwable", True, "getMessage", "()", "", "Argument[-1].SyntheticField[java.lang.Throwable.message]", "ReturnValue", "value", "manual"]
9899

99100
- addsTo:
100101
pack: codeql/java-all
101102
extensible: neutralModel
102103
data:
104+
- ["java.lang", "AbstractStringBuilder", "length", "()", "manual"]
105+
- ["java.lang", "Boolean", "equals", "(Object)", "manual"]
106+
- ["java.lang", "Class", "getClassLoader", "()", "manual"]
103107
- ["java.lang", "Class", "getName", "()", "manual"]
104108
- ["java.lang", "Class", "getSimpleName", "()", "manual"]
109+
- ["java.lang", "Class", "isAssignableFrom", "(Class)", "manual"]
105110
- ["java.lang", "Enum", "Enum", "(String,int)", "manual"]
106111
- ["java.lang", "Enum", "equals", "(Object)", "manual"]
107112
- ["java.lang", "Enum", "name", "()", "manual"]
108113
- ["java.lang", "Enum", "toString", "()", "manual"]
114+
- ["java.lang", "Long", "equals", "(Object)", "manual"]
109115
- ["java.lang", "Object", "equals", "(Object)", "manual"]
110116
- ["java.lang", "Object", "getClass", "()", "manual"]
111117
- ["java.lang", "Object", "hashCode", "()", "manual"]
112118
- ["java.lang", "Object", "toString", "()", "manual"]
113119
- ["java.lang", "String", "contains", "(CharSequence)", "manual"]
120+
- ["java.lang", "String", "endsWith", "(String)", "manual"]
114121
- ["java.lang", "String", "equals", "(Object)", "manual"]
115122
- ["java.lang", "String", "equalsIgnoreCase", "(String)", "manual"]
116123
- ["java.lang", "String", "hashCode", "()", "manual"]
124+
- ["java.lang", "String", "indexOf", "(String)", "manual"]
117125
- ["java.lang", "String", "isEmpty", "()", "manual"]
118126
- ["java.lang", "String", "length", "()", "manual"]
119127
- ["java.lang", "String", "startsWith", "(String)", "manual"]
120128
- ["java.lang", "System", "currentTimeMillis", "()", "manual"]
129+
- ["java.lang", "System", "nanoTime", "()", "manual"]
130+
- ["java.lang", "Thread", "currentThread", "()", "manual"]
131+
- ["java.lang", "Thread", "sleep", "(long)", "manual"]
132+
133+
# The below APIs have numeric flow and are currently being stored as neutral models.
134+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
135+
- ["java.lang", "Integer", "intValue", "()", "manual"] # taint-numeric
136+
- ["java.lang", "Integer", "parseInt", "(String)", "manual"] # taint-numeric
137+
- ["java.lang", "Integer", "toString", "(int)", "manual"] # taint-numeric
138+
- ["java.lang", "Integer", "valueOf", "(int)", "manual"] # taint-numeric
139+
- ["java.lang", "Long", "longValue", "()", "manual"] # taint-numeric
140+
- ["java.lang", "Long", "parseLong", "(String)", "manual"] # taint-numeric
141+
- ["java.lang", "Long", "toString", "()", "manual"] # taint-numeric
142+
- ["java.lang", "Math", "min", "(int,int)", "manual"] # value-numeric
143+
- ["java.lang", "String", "valueOf", "(int)", "manual"] # taint-numeric
144+
- ["java.lang", "String", "valueOf", "(long)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.math.model.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: summaryModel
4+
extensible: neutralModel
55
data:
6-
- ["java.math", "BigDecimal", False, "BigDecimal", "(String)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
6+
- ["java.math", "BigDecimal", "compareTo", "(BigDecimal)", "manual"]
7+
8+
# The below APIs have numeric flow and are currently being stored as neutral models.
9+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
10+
- ["java.math", "BigDecimal", "BigDecimal", "(String)", "manual"] # taint-numeric
11+
- ["java.math", "BigDecimal", "valueOf", "(double)", "manual"] # taint-numeric
12+
- ["java.math", "BigDecimal", "valueOf", "(long)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.sql.model.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,16 @@ extensions:
1919
pack: codeql/java-all
2020
extensible: summaryModel
2121
data:
22+
- ["java.sql", "PreparedStatement", True, "setString", "(int,String)", "", "Argument[1]", "Argument[-1]", "value", "manual"]
2223
- ["java.sql", "ResultSet", True, "getString", "(String)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
24+
25+
- addsTo:
26+
pack: codeql/java-all
27+
extensible: neutralModel
28+
data:
29+
- ["java.sql", "ResultSet", "next", "()", "manual"]
30+
31+
# The below APIs have numeric flow and are currently being stored as neutral models.
32+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
33+
- ["java.sql", "PreparedStatement", "setInt", "(int,int)", "manual"] # value-numeric
34+
- ["java.sql", "ResultSet", "getInt", "(String)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.text.model.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: neutralModel
5+
data:
6+
# The below APIs have numeric flow and are currently being stored as neutral models.
7+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
8+
- ["java.text", "DateFormat", "format", "(Date)", "manual"] # taint-numeric
9+
- ["java.text", "SimpleDateFormat", "SimpleDateFormat", "(String)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.time.model.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: neutralModel
5+
data:
6+
- ["java.time", "Instant", "now", "()", "manual"]
7+
- ["java.time", "ZonedDateTime", "now", "()", "manual"]
8+
9+
# The below APIs have numeric flow and are currently being stored as neutral models.
10+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
11+
- ["java.time", "LocalDate", "of", "(int,int,int)", "manual"] # taint-numeric

‎java/ql/lib/ext/java.util.concurrent.atomic.model.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["java.util.concurrent.atomic", "AtomicReference", False, "AtomicReference", "(Object)", "", "Argument[0]", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicReference.value]", "value", "manual"]
7+
- ["java.util.concurrent.atomic", "AtomicReference", False, "get", "()", "", "Argument[-1].SyntheticField[java.util.concurrent.atomic.AtomicReference.value]", "ReturnValue", "value", "manual"]
8+
9+
- addsTo:
10+
pack: codeql/java-all
11+
extensible: neutralModel
12+
data:
13+
# The below APIs have numeric flow and are currently being stored as neutral models.
14+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
15+
- ["java.util.concurrent.atomic", "AtomicInteger", "AtomicInteger", "(int)", "manual"] # value-numeric
16+
- ["java.util.concurrent.atomic", "AtomicInteger", "get", "()", "manual"] # value-numeric

‎java/ql/lib/ext/java.util.concurrent.model.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,14 @@ extensions:
2121
- ["java.util.concurrent", "TransferQueue", True, "transfer", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
2222
- ["java.util.concurrent", "TransferQueue", True, "tryTransfer", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
2323
- ["java.util.concurrent", "TransferQueue", True, "tryTransfer", "(Object,long,TimeUnit)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
24+
25+
- addsTo:
26+
pack: codeql/java-all
27+
extensible: neutralModel
28+
data:
29+
- ["java.util.concurrent", "CountDownLatch", "countDown", "()", "manual"]
30+
31+
# The below APIs have numeric flow and are currently being stored as neutral models.
32+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
33+
- ["java.util.concurrent", "CountDownLatch", "CountDownLatch", "(int)", "manual"] # value-numeric
34+
- ["java.util.concurrent", "CountDownLatch", "getCount", "()", "manual"] # value-numeric

‎java/ql/lib/ext/java.util.model.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,8 @@ extensions:
335335
- ["java.util", "Stack", True, "peek", "()", "", "Argument[-1].Element", "ReturnValue", "value", "manual"]
336336
- ["java.util", "Stack", True, "pop", "()", "", "Argument[-1].Element", "ReturnValue", "value", "manual"]
337337
- ["java.util", "Stack", True, "push", "(Object)", "", "Argument[0]", "Argument[-1].Element", "value", "manual"]
338+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
339+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
338340
- ["java.util", "StringTokenizer", False, "StringTokenizer", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
339341
- ["java.util", "StringTokenizer", False, "nextElement", "()", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
340342
- ["java.util", "StringTokenizer", False, "nextToken", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
@@ -360,8 +362,13 @@ extensions:
360362
pack: codeql/java-all
361363
extensible: neutralModel
362364
data:
363-
- ["java.util", "Collections", "emptyList", "()", "manual"]
365+
- ["java.util", "ArrayList", "ArrayList", "(int)", "manual"]
366+
- ["java.util", "ArrayList", "size", "()", "manual"]
367+
- ["java.util", "Collection", "isEmpty", "()", "manual"]
364368
- ["java.util", "Collection", "size", "()", "manual"]
369+
- ["java.util", "Collections", "emptyList", "()", "manual"]
370+
- ["java.util", "Collections", "emptyMap", "()", "manual"]
371+
- ["java.util", "Collections", "emptySet", "()", "manual"]
365372
- ["java.util", "Iterator", "hasNext", "()", "manual"]
366373
- ["java.util", "List", "contains", "(Object)", "manual"]
367374
- ["java.util", "List", "isEmpty", "()", "manual"]
@@ -371,10 +378,21 @@ extensions:
371378
- ["java.util", "Map", "size", "()", "manual"]
372379
- ["java.util", "Objects", "equals", "(Object,Object)", "manual"]
373380
- ["java.util", "Objects", "hash", "(Object[])", "manual"]
381+
- ["java.util", "Objects", "nonNull", "(Object)", "manual"]
374382
- ["java.util", "Optional", "empty", "()", "manual"]
375383
- ["java.util", "Optional", "isPresent", "()", "manual"]
376384
- ["java.util", "Set", "contains", "(Object)", "manual"]
377385
- ["java.util", "Set", "isEmpty", "()", "manual"]
378386
- ["java.util", "Set", "size", "()", "manual"]
379387
- ["java.util", "UUID", "randomUUID", "()", "manual"]
380388
- ["java.util", "UUID", "toString", "()", "manual"]
389+
390+
# The below APIs are currently being stored as neutral models since `WithoutElement` has not yet been implemented for Java.
391+
# When `WithoutElement` is implemented, these should be changed to summary models of the form `Argument[-1].WithoutElement -> Argument[-1]`.
392+
- ["java.util", "List", "clear", "()", "manual"]
393+
- ["java.util", "Map", "clear", "()", "manual"]
394+
395+
# The below APIs have numeric flow and are currently being stored as neutral models.
396+
# These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
397+
- ["java.util", "Date", "Date", "(long)", "manual"] # taint-numeric
398+
- ["java.util", "Date", "getTime", "()", "manual"] # taint-numeric

0 commit comments

Comments
 (0)