Skip to content

Commit 747a8e4

Browse files
smowtonsmowton
committed
Split up JexlInjection.qll
This avoids a DataFlow2::Configuration being in scope for all queries via the import from ExternalFlow.qll
1 parent 643f7df commit 747a8e4

File tree

5 files changed

+46
-43
lines changed

5 files changed

+46
-43
lines changed

‎java/ql/src/Security/CWE/CWE-094/JexlInjection.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
import java
1515
import semmle.code.java.dataflow.FlowSources
16-
import semmle.code.java.security.JexlInjection
16+
import semmle.code.java.security.JexlInjectionQuery
1717
import DataFlow::PathGraph
1818

1919
/**

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,10 @@ private module Frameworks {
9191
private import semmle.code.java.frameworks.spring.SpringBeans
9292
private import semmle.code.java.security.ResponseSplitting
9393
private import semmle.code.java.security.InformationLeak
94+
private import semmle.code.java.security.JexlInjectionSinkModels
9495
private import semmle.code.java.security.XSS
9596
private import semmle.code.java.security.LdapInjection
9697
private import semmle.code.java.security.XPath
97-
private import semmle.code.java.security.JexlInjection
9898
private import semmle.code.java.frameworks.android.SQLite
9999
private import semmle.code.java.frameworks.Jdbc
100100
private import semmle.code.java.frameworks.SpringJdbc

‎java/ql/src/semmle/code/java/security/JexlInjection.qll‎ renamed to ‎java/ql/src/semmle/code/java/security/JexlInjectionQuery.qll‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -15,46 +15,6 @@ private class DefaultJexlEvaluationSink extends JexlEvaluationSink {
1515
DefaultJexlEvaluationSink() { sinkNode(this, "jexl") }
1616
}
1717

18-
private class DefaultJexlInjectionSinkModel extends SinkModelCsv {
19-
override predicate row(string row) {
20-
row =
21-
[
22-
// JEXL2
23-
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
24-
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
25-
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(JexlContext,Object,String,Object);;Argument[2];jexl",
26-
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
27-
"org.apache.commons.jexl2;Expression;false;evaluate;;;Argument[-1];jexl",
28-
"org.apache.commons.jexl2;Expression;false;callable;;;Argument[-1];jexl",
29-
"org.apache.commons.jexl2;JexlExpression;false;evaluate;;;Argument[-1];jexl",
30-
"org.apache.commons.jexl2;JexlExpression;false;callable;;;Argument[-1];jexl",
31-
"org.apache.commons.jexl2;Script;false;execute;;;Argument[-1];jexl",
32-
"org.apache.commons.jexl2;Script;false;callable;;;Argument[-1];jexl",
33-
"org.apache.commons.jexl2;JexlScript;false;execute;;;Argument[-1];jexl",
34-
"org.apache.commons.jexl2;JexlScript;false;callable;;;Argument[-1];jexl",
35-
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
36-
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
37-
"org.apache.commons.jexl2;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
38-
// JEXL3
39-
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
40-
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
41-
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(JexlContext,Object,String);;Argument[2];jexl",
42-
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
43-
"org.apache.commons.jexl3;Expression;false;evaluate;;;Argument[-1];jexl",
44-
"org.apache.commons.jexl3;Expression;false;callable;;;Argument[-1];jexl",
45-
"org.apache.commons.jexl3;JexlExpression;false;evaluate;;;Argument[-1];jexl",
46-
"org.apache.commons.jexl3;JexlExpression;false;callable;;;Argument[-1];jexl",
47-
"org.apache.commons.jexl3;Script;false;execute;;;Argument[-1];jexl",
48-
"org.apache.commons.jexl3;Script;false;callable;;;Argument[-1];jexl",
49-
"org.apache.commons.jexl3;JexlScript;false;execute;;;Argument[-1];jexl",
50-
"org.apache.commons.jexl3;JexlScript;false;callable;;;Argument[-1];jexl",
51-
"org.apache.commons.jexl3;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
52-
"org.apache.commons.jexl3;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
53-
"org.apache.commons.jexl3;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl"
54-
]
55-
}
56-
}
57-
5818
/**
5919
* A unit class for adding additional taint steps.
6020
*

‎java/ql/src/semmle/code/java/security/JexlInjectionSinkModels.qll‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/** Provides sink models relating to Expression Langauge (JEXL) injection vulnerabilities. */
2+
3+
private import semmle.code.java.dataflow.ExternalFlow
4+
5+
private class DefaultJexlInjectionSinkModel extends SinkModelCsv {
6+
override predicate row(string row) {
7+
row =
8+
[
9+
// JEXL2
10+
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
11+
"org.apache.commons.jexl2;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
12+
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(JexlContext,Object,String,Object);;Argument[2];jexl",
13+
"org.apache.commons.jexl2;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
14+
"org.apache.commons.jexl2;Expression;false;evaluate;;;Argument[-1];jexl",
15+
"org.apache.commons.jexl2;Expression;false;callable;;;Argument[-1];jexl",
16+
"org.apache.commons.jexl2;JexlExpression;false;evaluate;;;Argument[-1];jexl",
17+
"org.apache.commons.jexl2;JexlExpression;false;callable;;;Argument[-1];jexl",
18+
"org.apache.commons.jexl2;Script;false;execute;;;Argument[-1];jexl",
19+
"org.apache.commons.jexl2;Script;false;callable;;;Argument[-1];jexl",
20+
"org.apache.commons.jexl2;JexlScript;false;execute;;;Argument[-1];jexl",
21+
"org.apache.commons.jexl2;JexlScript;false;callable;;;Argument[-1];jexl",
22+
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;evaluate;;;Argument[-1];jexl",
23+
"org.apache.commons.jexl2;UnifiedJEXL$Expression;false;prepare;;;Argument[-1];jexl",
24+
"org.apache.commons.jexl2;UnifiedJEXL$Template;false;evaluate;;;Argument[-1];jexl",
25+
// JEXL3
26+
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(JexlContext,Object,String);;Argument[2];jexl",
27+
"org.apache.commons.jexl3;JexlEngine;false;getProperty;(Object,String);;Argument[1];jexl",
28+
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(JexlContext,Object,String);;Argument[2];jexl",
29+
"org.apache.commons.jexl3;JexlEngine;false;setProperty;(Object,String,Object);;Argument[1];jexl",
30+
"org.apache.commons.jexl3;Expression;false;evaluate;;;Argument[-1];jexl",
31+
"org.apache.commons.jexl3;Expression;false;callable;;;Argument[-1];jexl",
32+
"org.apache.commons.jexl3;JexlExpression;false;evaluate;;;Argument[-1];jexl",
33+
"org.apache.commons.jexl3;JexlExpression;false;callable;;;Argument[-1];jexl",
34+
"org.apache.commons.jexl3;Script;false;execute;;;Argument[-1];jexl",
35+
"org.apache.commons.jexl3;Script;false;callable;;;Argument[-1];jexl",
36+
"org.apache.commons.jexl3;JexlScript;false;execute;;;Argument[-1];jexl",
37+
"org.apache.commons.jexl3;JexlScript;false;callable;;;Argument[-1];jexl",
38+
"org.apache.commons.jexl3;JxltEngine$Expression;false;evaluate;;;Argument[-1];jexl",
39+
"org.apache.commons.jexl3;JxltEngine$Expression;false;prepare;;;Argument[-1];jexl",
40+
"org.apache.commons.jexl3;JxltEngine$Template;false;evaluate;;;Argument[-1];jexl"
41+
]
42+
}
43+
}

‎java/ql/test/query-tests/security/CWE-094/JexlInjectionTest.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import java
22
import semmle.code.java.dataflow.DataFlow
33
import semmle.code.java.dataflow.FlowSteps
44
import semmle.code.java.dataflow.FlowSources
5-
import semmle.code.java.security.JexlInjection
5+
import semmle.code.java.security.JexlInjectionQuery
66
import TestUtilities.InlineExpectationsTest
77

88
class Conf extends TaintTracking::Configuration {

0 commit comments

Comments
 (0)