Skip to content

Commit 3868b38

Browse files
am0o0am0o0
committed
update inline tests
1 parent 0165696 commit 3868b38

6 files changed

Lines changed: 41 additions & 52 deletions

File tree

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/CommonsCompressHandler.java‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -35,29 +35,29 @@
3535
public class CommonsCompressHandler {
3636

3737
static void commonsCompressArchiveInputStream(InputStream inputStream) throws ArchiveException {
38-
new ArArchiveInputStream(inputStream); // $bomb
39-
new ArjArchiveInputStream(inputStream); // $bomb
40-
new CpioArchiveInputStream(inputStream); // $bomb
41-
new JarArchiveInputStream(inputStream); // $bomb
42-
new ZipArchiveInputStream(inputStream); // $bomb
38+
new ArArchiveInputStream(inputStream); // $ hasTaintFlow="inputStream"
39+
new ArjArchiveInputStream(inputStream); // $ hasTaintFlow="inputStream"
40+
new CpioArchiveInputStream(inputStream); // $ hasTaintFlow="inputStream"
41+
new JarArchiveInputStream(inputStream); // $ hasTaintFlow="inputStream"
42+
new ZipArchiveInputStream(inputStream); // $ hasTaintFlow="inputStream"
4343
}
4444

4545
public static void commonsCompressorInputStream(InputStream inputStream) throws IOException {
4646
BufferedInputStream in = new BufferedInputStream(inputStream);
4747
OutputStream out = Files.newOutputStream(Path.of("tmpfile"));
48-
GzipCompressorInputStream gzIn = new GzipCompressorInputStream(in); // $bomb
48+
GzipCompressorInputStream gzIn = new GzipCompressorInputStream(in); // $ hasTaintFlow="in"
4949
// for testing
50-
new BrotliCompressorInputStream(in); // $bomb
51-
new BZip2CompressorInputStream(in); // $bomb
52-
new DeflateCompressorInputStream(in); // $bomb
53-
new Deflate64CompressorInputStream(in); // $bomb
54-
new BlockLZ4CompressorInputStream(in); // $bomb
55-
new LZMACompressorInputStream(in); // $bomb
56-
new Pack200CompressorInputStream(in); // $bomb
57-
new SnappyCompressorInputStream(in); // $bomb
58-
new XZCompressorInputStream(in); // $bomb
59-
new ZCompressorInputStream(in); // $bomb
60-
new ZstdCompressorInputStream(in); // $bomb
50+
new BrotliCompressorInputStream(in); // $ hasTaintFlow="in"
51+
new BZip2CompressorInputStream(in); // $ hasTaintFlow="in"
52+
new DeflateCompressorInputStream(in); // $ hasTaintFlow="in"
53+
new Deflate64CompressorInputStream(in); // $ hasTaintFlow="in"
54+
new BlockLZ4CompressorInputStream(in); // $ hasTaintFlow="in"
55+
new LZMACompressorInputStream(in); // $ hasTaintFlow="in"
56+
new Pack200CompressorInputStream(in); // $ hasTaintFlow="in"
57+
new SnappyCompressorInputStream(in); // $ hasTaintFlow="in"
58+
new XZCompressorInputStream(in); // $ hasTaintFlow="in"
59+
new ZCompressorInputStream(in); // $ hasTaintFlow="in"
60+
new ZstdCompressorInputStream(in); // $ hasTaintFlow="in"
6161

6262
int buffersize = 4096;
6363
final byte[] buffer = new byte[buffersize];
@@ -72,7 +72,7 @@ public static void commonsCompressorInputStream(InputStream inputStream) throws
7272
static void commonsCompressArchiveInputStream2(InputStream inputStream) {
7373
byte[] readBuffer = new byte[4096];
7474
try (org.apache.commons.compress.archivers.zip.ZipArchiveInputStream zipInputStream =
75-
new org.apache.commons.compress.archivers.zip.ZipArchiveInputStream(inputStream)) { // $bomb
75+
new org.apache.commons.compress.archivers.zip.ZipArchiveInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
7676
ArchiveEntry entry = null;
7777
while ((entry = zipInputStream.getNextEntry()) != null) {
7878
if (!zipInputStream.canReadEntryData(entry)) {
@@ -104,7 +104,7 @@ static void commonsCompressArchiveStreamFactory(InputStream inputStream)
104104
File f = new File("tmpfile");
105105
try (OutputStream outputStream = new FileOutputStream(f)) {
106106
int readLen;
107-
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $bomb
107+
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $ hasTaintFlow="zipInputStream"
108108
outputStream.write(readBuffer, 0, readLen);
109109
}
110110
}
@@ -119,7 +119,7 @@ static void commonsCompressCompressorStreamFactory(InputStream inputStream)
119119
int buffersize = 4096;
120120
final byte[] buffer = new byte[buffersize];
121121
int n = 0;
122-
while (-1 != (n = in.read(buffer))) { // $bomb
122+
while (-1 != (n = in.read(buffer))) { // $ hasTaintFlow="in"
123123
out.write(buffer, 0, n);
124124
}
125125
out.close();

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/SnappyHandler.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ public class SnappyHandler {
1010
public static void SnappyZipInputStream(InputStream inputStream) throws IOException {
1111
int readLen;
1212
byte[] readBuffer = new byte[4096];
13-
try (SnappyInputStream zipInputStream = new SnappyInputStream(inputStream)) { // $bomb
13+
try (SnappyInputStream zipInputStream = new SnappyInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
1414
try (OutputStream outputStream = Files.newOutputStream(Paths.get("extractedFile"))) {
1515
while ((readLen = zipInputStream.read(readBuffer)) != -1) {
1616
outputStream.write(readBuffer, 0, readLen);

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/Zip4jHandler.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ public static void zip4jZipInputStream(InputStream inputStream) throws IOExcepti
1212
LocalFileHeader localFileHeader;
1313
int readLen;
1414
byte[] readBuffer = new byte[4096];
15-
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) { // $bomb
15+
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
1616
while ((localFileHeader = zipInputStream.getNextEntry()) != null) {
1717
File extractedFile = new File(localFileHeader.getFileName());
1818
try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
@@ -28,7 +28,7 @@ public static void zip4jZipInputStreamSafe(InputStream inputStream) throws IOExc
2828
LocalFileHeader localFileHeader;
2929
int readLen;
3030
byte[] readBuffer = new byte[4096];
31-
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) { // $bomb
31+
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
3232
while ((localFileHeader = zipInputStream.getNextEntry()) != null) {
3333
File extractedFile = new File(localFileHeader.getFileName());
3434
try (OutputStream outputStream = new FileOutputStream(extractedFile)) {

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/ZipHandler.java‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ public static void ZipInputStreamSafe(InputStream inputStream) throws IOExceptio
2424
// FileInputStream fis = new FileInputStream(filename);
2525
CRC32 checkSum = new CRC32();
2626
CheckedInputStream gzis = new CheckedInputStream(inputStream, checkSum);
27-
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $bomb
27+
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $ hasTaintFlow="new BufferedInputStream(...)"
2828
ZipEntry entry;
2929
int entries = 0;
3030
long total = 0;
@@ -38,7 +38,7 @@ public static void ZipInputStreamSafe(InputStream inputStream) throws IOExceptio
3838
}
3939
FileOutputStream fos = new FileOutputStream("/tmp/tmptmp");
4040
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
41-
while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $bomb
41+
while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
4242
dest.write(data, 0, count);
4343
total += count;
4444
}
@@ -63,7 +63,7 @@ public static void ZipInputStreamSafe2(InputStream inputStream) throws IOExcepti
6363
int BUFFER = 512;
6464
int TOOBIG = 100 * 1024 * 1024; // 100MB
6565
// FileInputStream fis = new FileInputStream(filename);
66-
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $bomb
66+
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $ hasTaintFlow="new BufferedInputStream(...)"
6767
ZipEntry entry;
6868
while ((entry = zis.getNextEntry()) != null) {
6969
System.out.println("Extracting: " + entry);
@@ -78,7 +78,7 @@ public static void ZipInputStreamSafe2(InputStream inputStream) throws IOExcepti
7878
}
7979
FileOutputStream fos = new FileOutputStream(entry.getName());
8080
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
81-
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $bomb
81+
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
8282
dest.write(data, 0, count);
8383
}
8484
dest.flush();
@@ -91,7 +91,7 @@ public static void ZipInputStreamSafe2(InputStream inputStream) throws IOExcepti
9191
public static void ZipInputStreamUnsafe(InputStream inputStream) throws IOException {
9292
int BUFFER = 512;
9393
// FileInputStream fis = new FileInputStream(filename);
94-
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $bomb
94+
try (ZipInputStream zis = new ZipInputStream(new BufferedInputStream(inputStream))) { // $ hasTaintFlow="new BufferedInputStream(...)"
9595
ZipEntry entry;
9696
while ((entry = zis.getNextEntry()) != null) {
9797
System.out.println("Extracting: " + entry);
@@ -100,7 +100,7 @@ public static void ZipInputStreamUnsafe(InputStream inputStream) throws IOExcept
100100
// Write the files to the disk
101101
FileOutputStream fos = new FileOutputStream(entry.getName());
102102
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
103-
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $bomb
103+
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
104104
dest.write(data, 0, count);
105105
}
106106
dest.flush();
@@ -112,12 +112,12 @@ public static void ZipInputStreamUnsafe(InputStream inputStream) throws IOExcept
112112

113113
public static void GZipInputStreamUnsafe(InputStream inputStream) throws IOException {
114114
int BUFFER = 512;
115-
try (GZIPInputStream gzis = new GZIPInputStream(inputStream)) { // $bomb
115+
try (GZIPInputStream gzis = new GZIPInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
116116
int count;
117117
byte[] data = new byte[BUFFER];
118118
FileOutputStream fos = new FileOutputStream("/tmp/tmp");
119119
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
120-
while ((count = gzis.read(data, 0, BUFFER)) != -1) { // $bomb
120+
while ((count = gzis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="gzis"
121121
dest.write(data, 0, count);
122122
}
123123
dest.flush();
@@ -127,12 +127,12 @@ public static void GZipInputStreamUnsafe(InputStream inputStream) throws IOExcep
127127

128128
public static void InflaterInputStreamUnsafe(InputStream inputStream) throws IOException {
129129
int BUFFER = 512;
130-
try (InflaterInputStream Izis = new InflaterInputStream(inputStream)) { // $bomb
130+
try (InflaterInputStream Izis = new InflaterInputStream(inputStream)) { // $ hasTaintFlow="inputStream"
131131
int count;
132132
byte[] data = new byte[BUFFER];
133133
FileOutputStream fos = new FileOutputStream("/tmp/tmp");
134134
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
135-
while ((count = Izis.read(data, 0, BUFFER)) != -1) { // $bomb
135+
while ((count = Izis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="Izis"
136136
dest.write(data, 0, count);
137137
}
138138
dest.flush();
@@ -142,7 +142,7 @@ public static void InflaterInputStreamUnsafe(InputStream inputStream) throws IOE
142142

143143
public static void InflaterUnsafe(byte[] inputBytes) throws DataFormatException, IOException {
144144
Inflater inflater = new Inflater();
145-
inflater.setInput(inputBytes); // $bomb
145+
inflater.setInput(inputBytes); // $ hasTaintFlow="inputBytes"
146146
try (final ByteArrayOutputStream outputStream = new ByteArrayOutputStream(inputBytes.length)) {
147147
byte[] buffer = new byte[1024];
148148
while (!inflater.finished()) {
@@ -156,7 +156,7 @@ public static void InflaterUnsafe(byte[] inputBytes) throws DataFormatException,
156156
public static void ZipFile1(String zipFilePath) throws DataFormatException, IOException {
157157
try {
158158
System.out.println("zipFilePath = " + zipFilePath);
159-
ZipFile zipFile = new ZipFile(zipFilePath); // $bomb
159+
ZipFile zipFile = new ZipFile(zipFilePath); // $ hasTaintFlow="zipFilePath"
160160
Enumeration<? extends ZipEntry> entries = zipFile.entries();
161161
while (entries.hasMoreElements()) {
162162
ZipEntry entry = entries.nextElement();
@@ -169,7 +169,7 @@ public static void ZipFile1(String zipFilePath) throws DataFormatException, IOEx
169169
} else {
170170
String destPath = "tmp" + File.separator + entry.getName();
171171

172-
try (InputStream inputStream = zipFile.getInputStream(entry); // $bomb
172+
try (InputStream inputStream = zipFile.getInputStream(entry); // $ hasTaintFlow="zipFile"
173173
FileOutputStream outputStream = new FileOutputStream(destPath);) {
174174
int data = inputStream.read();
175175
while (data != -1) {

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/test.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +0,0 @@
1-
testFailures
2-
failures

‎java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/test.ql‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,9 @@
11
import java
22
import experimental.semmle.code.java.security.DecompressionBombQuery
3-
import TestUtilities.InlineExpectationsTest
3+
import TestUtilities.InlineFlowTest
4+
import TaintFlowTestArgString<DecompressionBombsConfig, getArgString/2>
45

5-
module BombTest implements TestSig {
6-
string getARelevantTag() { result = "bomb" }
7-
8-
predicate hasActualResult(Location location, string element, string tag, string value) {
9-
tag = "bomb" and
10-
exists(DataFlow::Node sink | DecompressionBombsFlow::flowTo(sink) |
11-
sink.getLocation() = location and
12-
element = sink.toString() and
13-
value = ""
14-
)
15-
}
6+
string getArgString(DataFlow::Node src, DataFlow::Node sink) {
7+
exists(src) and
8+
result = "\"" + sink.toString() + "\""
169
}
17-
18-
import MakeTest<BombTest>

0 commit comments

Comments
 (0)