Skip to content

Commit 5838c5d

Browse files
d10cd10c
authored
Merge branch 'main' into swift/rename-functions
2 parents 6f804ff + 3578816 commit 5838c5d

7 files changed

Lines changed: 124 additions & 12 deletions

File tree

‎docs/codeql/query-help/index.rst‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
CodeQL query help
22
-----------------
33

4-
View the query help for the queries included in the ``code-scanning``, ``security-extended``, and ``security-and-quality`` query suites for the languages supported by CodeQL.
4+
View the query help for the queries included in the ``default``, ``security-extended``, and ``security-and-quality`` query suites for the languages supported by CodeQL.
55

66
- :doc:`CodeQL query help for C and C++ <cpp>`
77
- :doc:`CodeQL query help for C# <csharp>`
@@ -15,20 +15,20 @@ View the query help for the queries included in the ``code-scanning``, ``securit
1515

1616
.. pull-quote:: Information
1717

18-
Each query help article includes:
19-
18+
Each query help article includes:
19+
2020
- A summary of key metadata for the query.
2121
- Information about which query suites the query is included in.
2222
- A link to the query in the `CodeQL repository <https://github.com/github/codeql>`__.
2323
- A description of the potential vulnerability that the query identifies and a recommendation for how to avoid introducing the problem to your code.
2424

2525

26-
For a full list of the CWEs covered by these queries, see ":doc:`CodeQL CWE coverage <codeql-cwe-coverage>`."
26+
For a full list of the CWEs covered by these queries, see ":doc:`CodeQL CWE coverage <codeql-cwe-coverage>`."
2727

2828
.. toctree::
2929
:hidden:
3030
:titlesonly:
31-
31+
3232
cpp
3333
csharp
3434
go
@@ -37,4 +37,3 @@ For a full list of the CWEs covered by these queries, see ":doc:`CodeQL CWE cove
3737
python
3838
ruby
3939
codeql-cwe-coverage
40-

‎docs/codeql/reusables/query-help-overview.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
Visit the articles below to see the documentation for the queries included in the following query suites:
22

3-
- ``code-scanning``: queries run by default in CodeQL code scanning on GitHub.
4-
- ``security-extended``: queries from ``code-scanning``, plus extra security queries with slightly lower precision and severity.
5-
- ``security-and-quality``: queries from ``code-scanning``, ``security-extended``, plus extra maintainability and reliability queries.
3+
- ``default``: queries run by default in CodeQL code scanning on GitHub.
4+
- ``security-extended``: queries from ``default``, plus extra security queries with slightly lower precision and severity.
5+
- ``security-and-quality``: queries from ``default``, ``security-extended``, plus extra maintainability and reliability queries.

‎java/ql/lib/change-notes/2022-09-22-stringjoiner-summaries.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added new flow steps for `java.util.StringJoiner`.

‎java/ql/lib/ext/java.util.model.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -338,8 +338,14 @@ extensions:
338338
- ["java.util", "Stack", True, "peek", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
339339
- ["java.util", "Stack", True, "pop", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
340340
- ["java.util", "Stack", True, "push", "(Object)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
341-
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
342-
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
341+
- ["java.util", "StringJoiner", False, "StringJoiner", "", "", "Argument[0..2]", "Argument[this]", "taint", "manual"]
342+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[this]", "ReturnValue", "value", "manual"]
343+
- ["java.util", "StringJoiner", False, "add", "(CharSequence)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
344+
- ["java.util", "StringJoiner", False, "merge", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
345+
- ["java.util", "StringJoiner", False, "merge", "", "", "Argument[this]", "ReturnValue", "value", "manual"]
346+
- ["java.util", "StringJoiner", False, "setEmptyValue", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
347+
- ["java.util", "StringJoiner", False, "setEmptyValue", "", "", "Argument[this]", "ReturnValue", "value", "manual"]
348+
- ["java.util", "StringJoiner", False, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
343349
- ["java.util", "StringTokenizer", False, "StringTokenizer", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
344350
- ["java.util", "StringTokenizer", False, "nextElement", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
345351
- ["java.util", "StringTokenizer", False, "nextToken", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]

‎java/ql/test/ext/TestModels/Test.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ public void test() throws Exception {
9393
sink(sj1.add((CharSequence)source())); // $hasTaintFlow
9494

9595
StringJoiner sj2 = (StringJoiner)source();
96-
sink(sj2.add("test")); // $hasTaintFlow
96+
sink(sj2.add("test")); // $hasValueFlow
9797
}
9898

9999
// top 300-500 JDK APIs tests

‎java/ql/test/library-tests/dataflow/taint/StringJoinerTests.java‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
import java.util.StringJoiner;
2+
3+
public class StringJoinerTests {
4+
5+
Object taint() {
6+
return null;
7+
}
8+
9+
void sink(Object o) {}
10+
11+
public void test() throws Exception {
12+
{
13+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence);;Argument[0];Argument[-1];taint;manual"
14+
StringJoiner out = null;
15+
CharSequence in = (CharSequence) taint();
16+
out = new StringJoiner(in);
17+
sink(out);
18+
}
19+
{
20+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[-1];taint;manual"
21+
StringJoiner out = null;
22+
CharSequence in = (CharSequence) taint();
23+
out = new StringJoiner(in, null, null);
24+
sink(out);
25+
}
26+
{
27+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[-1];taint;manual"
28+
StringJoiner out = null;
29+
CharSequence in = (CharSequence) taint();
30+
out = new StringJoiner(null, in, null);
31+
sink(out);
32+
}
33+
{
34+
// "java.util;StringJoiner;false;StringJoiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[-1];taint;manual"
35+
StringJoiner out = null;
36+
CharSequence in = (CharSequence) taint();
37+
out = new StringJoiner(null, null, in);
38+
sink(out);
39+
}
40+
{
41+
// "java.util;StringJoiner;false;add;;;Argument[-1];ReturnValue;value;manual"
42+
StringJoiner out = null;
43+
StringJoiner in = (StringJoiner) taint();
44+
out = in.add(null);
45+
sink(out);
46+
}
47+
{
48+
// "java.util;StringJoiner;false;add;;;Argument[0];Argument[-1];taint;manual"
49+
StringJoiner out = null;
50+
CharSequence in = (CharSequence) taint();
51+
out.add(in);
52+
sink(out);
53+
}
54+
{
55+
// "java.util;StringJoiner;false;merge;;;Argument[-1];ReturnValue;value;manual"
56+
StringJoiner out = null;
57+
StringJoiner in = (StringJoiner) taint();
58+
out = in.merge(null);
59+
sink(out);
60+
}
61+
{
62+
// "java.util;StringJoiner;false;merge;;;Argument[0];Argument[-1];taint;manual"
63+
StringJoiner out = null;
64+
StringJoiner in = (StringJoiner) taint();
65+
out.merge(in);
66+
sink(out);
67+
}
68+
{
69+
// "java.util;StringJoiner;false;setEmptyValue;;;Argument[-1];ReturnValue;taint;manual"
70+
StringJoiner out = null;
71+
StringJoiner in = (StringJoiner) taint();
72+
out = in.setEmptyValue(null);
73+
sink(out);
74+
}
75+
{
76+
// "java.util;StringJoiner;false;setEmptyValue;;;Argument[0];Argument[-1];taint;manual"
77+
StringJoiner out = null;
78+
CharSequence in = (CharSequence) taint();
79+
out.setEmptyValue(in);
80+
sink(out);
81+
}
82+
{
83+
// "java.util;StringJoiner;false;toString;;;Argument[-1];ReturnValue;taint;manual"
84+
String out = null;
85+
StringJoiner in = (StringJoiner) taint();
86+
out = in.toString();
87+
sink(out);
88+
}
89+
90+
}
91+
92+
}

‎java/ql/test/library-tests/dataflow/taint/test.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,17 @@
7171
| StringBuilderTests.java:70:15:70:21 | taint(...) | StringBuilderTests.java:73:10:73:26 | new String(...) |
7272
| StringBuilderTests.java:79:15:79:21 | taint(...) | StringBuilderTests.java:80:10:80:40 | toString(...) |
7373
| StringBuilderTests.java:86:15:86:21 | taint(...) | StringBuilderTests.java:87:10:87:27 | substring(...) |
74+
| StringJoinerTests.java:15:37:15:43 | taint(...) | StringJoinerTests.java:17:9:17:11 | out |
75+
| StringJoinerTests.java:22:37:22:43 | taint(...) | StringJoinerTests.java:24:9:24:11 | out |
76+
| StringJoinerTests.java:29:37:29:43 | taint(...) | StringJoinerTests.java:31:9:31:11 | out |
77+
| StringJoinerTests.java:36:37:36:43 | taint(...) | StringJoinerTests.java:38:9:38:11 | out |
78+
| StringJoinerTests.java:43:37:43:43 | taint(...) | StringJoinerTests.java:45:9:45:11 | out |
79+
| StringJoinerTests.java:50:37:50:43 | taint(...) | StringJoinerTests.java:52:9:52:11 | out |
80+
| StringJoinerTests.java:57:37:57:43 | taint(...) | StringJoinerTests.java:59:9:59:11 | out |
81+
| StringJoinerTests.java:64:37:64:43 | taint(...) | StringJoinerTests.java:66:9:66:11 | out |
82+
| StringJoinerTests.java:71:37:71:43 | taint(...) | StringJoinerTests.java:73:9:73:11 | out |
83+
| StringJoinerTests.java:78:37:78:43 | taint(...) | StringJoinerTests.java:80:9:80:11 | out |
84+
| StringJoinerTests.java:85:37:85:43 | taint(...) | StringJoinerTests.java:87:9:87:11 | out |
7485
| Varargs.java:7:8:7:14 | taint(...) | Varargs.java:14:10:14:10 | s |
7586
| Varargs.java:8:8:8:14 | taint(...) | Varargs.java:19:10:19:10 | s |
7687
| Varargs.java:8:17:8:23 | taint(...) | Varargs.java:19:10:19:10 | s |

0 commit comments

Comments
 (0)