Skip to content

Commit 5b651f2

Browse files
JLLeitschuhJLLeitschuh
committed
Fix insufficient tests and add documentation
1 parent b282c7f commit 5b651f2

8 files changed

Lines changed: 69 additions & 12 deletions

File tree

‎java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ private import semmle.code.java.dataflow.DataFlow
1010
* ensuring that they are visible to the taint tracking library.
1111
*/
1212
private module Frameworks {
13+
private import semmle.code.java.JDK
1314
private import semmle.code.java.frameworks.jackson.JacksonSerializability
1415
private import semmle.code.java.frameworks.android.AsyncTask
1516
private import semmle.code.java.frameworks.android.Intent

‎java/ql/lib/semmle/code/java/environment/SystemProperty.qll‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ private import semmle.code.java.frameworks.apache.Lang
55

66
/**
77
* Gets an expression that retrieves the value of `propertyName` from `System.getProperty()`.
8+
*
9+
* Note: Expression type is not just `String`.
810
*/
911
Expr getSystemProperty(string propertyName) {
1012
result = getSystemPropertyFromSystem(propertyName) or
@@ -20,8 +22,7 @@ Expr getSystemProperty(string propertyName) {
2022
private MethodAccess getSystemPropertyFromSystem(string propertyName) {
2123
result.(MethodAccessSystemGetProperty).hasCompileTimeConstantGetPropertyName(propertyName)
2224
or
23-
result.getMethod().hasName("lineSeparator") and
24-
propertyName = "line.separator"
25+
result.getMethod().hasName("lineSeparator") and propertyName = "line.separator"
2526
}
2627

2728
/**

‎java/ql/lib/semmle/code/java/os/OSCheck.qll‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,35 +57,45 @@ private class IsWindowsFromSystemProp extends IsWindowsGuard instanceof MethodAc
5757

5858
/**
5959
* Holds when the Guard is an equality check between the system property with the name `propertyName`
60-
* and the string or char constant `compareToLiteral`.
60+
* and the string or char constant `compareToLiteral`, and the branch evaluates to `branch`.
6161
*/
62-
private Guard isOsFromSystemPropertyEqualityCheck(string propertyName, string compareToLiteral) {
62+
private Guard isOsFromSystemPropertyEqualityCheck(
63+
string propertyName, string compareToLiteral, boolean branch
64+
) {
6365
result
6466
.isEquality(getSystemProperty(propertyName),
6567
any(Literal literal |
6668
(literal instanceof CharacterLiteral or literal instanceof StringLiteral) and
6769
literal.getValue() = compareToLiteral
68-
), _)
70+
), branch)
6971
}
7072

7173
private class IsWindowsFromCharPathSeparator extends IsWindowsGuard {
7274
IsWindowsFromCharPathSeparator() {
73-
this = isOsFromSystemPropertyEqualityCheck("path.separator", "\\")
75+
this = isOsFromSystemPropertyEqualityCheck("path.separator", ";", true) or
76+
this = isOsFromSystemPropertyEqualityCheck("path.separator", ":", false)
7477
}
7578
}
7679

7780
private class IsWindowsFromCharSeparator extends IsWindowsGuard {
78-
IsWindowsFromCharSeparator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ";") }
81+
IsWindowsFromCharSeparator() {
82+
this = isOsFromSystemPropertyEqualityCheck("file.separator", "\\", true) or
83+
this = isOsFromSystemPropertyEqualityCheck("file.separator", "/", false)
84+
}
7985
}
8086

8187
private class IsUnixFromCharPathSeparator extends IsUnixGuard {
8288
IsUnixFromCharPathSeparator() {
83-
this = isOsFromSystemPropertyEqualityCheck("path.separator", "/")
89+
this = isOsFromSystemPropertyEqualityCheck("path.separator", ":", true) or
90+
this = isOsFromSystemPropertyEqualityCheck("path.separator", ";", false)
8491
}
8592
}
8693

8794
private class IsUnixFromCharSeparator extends IsUnixGuard {
88-
IsUnixFromCharSeparator() { this = isOsFromSystemPropertyEqualityCheck("file.separator", ":") }
95+
IsUnixFromCharSeparator() {
96+
this = isOsFromSystemPropertyEqualityCheck("file.separator", "/", true) or
97+
this = isOsFromSystemPropertyEqualityCheck("file.separator", "\\", false)
98+
}
8999
}
90100

91101
private class IsUnixFromSystemProp extends IsSpecificUnixVariant instanceof MethodAccess {

‎java/ql/test/library-tests/os/Test.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ void testWindows() {
5757
onlyOnWindows();
5858
}
5959

60-
if (System.getProperty("path.separator").equals("\\")) {
60+
if (System.getProperty("path.separator").equals(";")) {
6161
onlyOnWindows();
6262
}
6363
}
@@ -94,7 +94,7 @@ void testUnix() {
9494
onlyOnUnix();
9595
}
9696

97-
if (System.getProperty("path.separator").equals("/")) {
97+
if (System.getProperty("path.separator").equals(":")) {
9898
onlyOnUnix();
9999
}
100100
}

‎java/ql/test/library-tests/os/unix-test.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,8 @@
22
| Test.java:66:13:66:95 | contains(...) |
33
| Test.java:70:13:70:84 | contains(...) |
44
| Test.java:74:13:74:34 | SystemUtils.IS_OS_UNIX |
5+
| Test.java:81:13:81:41 | ... == ... |
6+
| Test.java:85:13:85:37 | ... == ... |
7+
| Test.java:89:13:89:37 | ... == ... |
8+
| Test.java:93:13:93:33 | ... == ... |
59
| Test.java:97:13:97:60 | equals(...) |

‎java/ql/test/library-tests/os/windows-test.expected‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,8 @@
33
| Test.java:24:13:24:75 | contains(...) |
44
| Test.java:28:13:28:75 | contains(...) |
55
| Test.java:32:13:32:37 | SystemUtils.IS_OS_WINDOWS |
6-
| Test.java:60:13:60:61 | equals(...) |
6+
| Test.java:44:13:44:41 | ... == ... |
7+
| Test.java:48:13:48:37 | ... == ... |
8+
| Test.java:52:13:52:38 | ... == ... |
9+
| Test.java:56:13:56:34 | ... == ... |
10+
| Test.java:60:13:60:60 | equals(...) |

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/TempDirLocalInformationDisclosure.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ edges
6060
| Test.java:313:38:313:73 | getProperty(...) : String | Test.java:313:29:313:101 | new File(...) : File |
6161
| Test.java:313:38:313:73 | getProperty(...) : String | Test.java:316:35:316:46 | tempDirChild : File |
6262
| Test.java:316:35:316:46 | tempDirChild : File | Test.java:316:35:316:55 | toPath(...) |
63+
| Test.java:322:29:322:101 | new File(...) : File | Test.java:326:35:326:46 | tempDirChild : File |
64+
| Test.java:322:38:322:73 | getProperty(...) : String | Test.java:322:29:322:101 | new File(...) : File |
65+
| Test.java:322:38:322:73 | getProperty(...) : String | Test.java:326:35:326:46 | tempDirChild : File |
66+
| Test.java:326:35:326:46 | tempDirChild : File | Test.java:326:35:326:55 | toPath(...) |
6367
nodes
6468
| Files.java:10:24:10:69 | new File(...) : File | semmle.label | new File(...) : File |
6569
| Files.java:10:33:10:68 | getProperty(...) : String | semmle.label | getProperty(...) : String |
@@ -125,6 +129,10 @@ nodes
125129
| Test.java:313:38:313:73 | getProperty(...) : String | semmle.label | getProperty(...) : String |
126130
| Test.java:316:35:316:46 | tempDirChild : File | semmle.label | tempDirChild : File |
127131
| Test.java:316:35:316:55 | toPath(...) | semmle.label | toPath(...) |
132+
| Test.java:322:29:322:101 | new File(...) : File | semmle.label | new File(...) : File |
133+
| Test.java:322:38:322:73 | getProperty(...) : String | semmle.label | getProperty(...) : String |
134+
| Test.java:326:35:326:46 | tempDirChild : File | semmle.label | tempDirChild : File |
135+
| Test.java:326:35:326:55 | toPath(...) | semmle.label | toPath(...) |
128136
subpaths
129137
#select
130138
| Files.java:10:33:10:68 | getProperty(...) | Files.java:10:33:10:68 | getProperty(...) : String | Files.java:15:17:15:23 | tempDir | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Files.java:10:33:10:68 | getProperty(...) | system temp directory |
@@ -146,3 +154,4 @@ subpaths
146154
| Test.java:260:38:260:73 | getProperty(...) | Test.java:260:38:260:73 | getProperty(...) : String | Test.java:263:33:263:53 | toPath(...) | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:260:38:260:73 | getProperty(...) | system temp directory |
147155
| Test.java:294:38:294:73 | getProperty(...) | Test.java:294:38:294:73 | getProperty(...) : String | Test.java:298:35:298:55 | toPath(...) | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:294:38:294:73 | getProperty(...) | system temp directory |
148156
| Test.java:313:38:313:73 | getProperty(...) | Test.java:313:38:313:73 | getProperty(...) : String | Test.java:316:35:316:55 | toPath(...) | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:313:38:313:73 | getProperty(...) | system temp directory |
157+
| Test.java:322:38:322:73 | getProperty(...) | Test.java:322:38:322:73 | getProperty(...) : String | Test.java:326:35:326:55 | toPath(...) | Local information disclosure vulnerability from $@ due to use of file or directory readable by other local users. | Test.java:322:38:322:73 | getProperty(...) | system temp directory |

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/Test.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,4 +316,32 @@ void vulnerableBecauseCheckingForNotLinux() throws IOException {
316316
Files.createDirectory(tempDirChild.toPath());
317317
}
318318
}
319+
320+
void vulnerableBecauseInvertedFileSeparatorCheck() throws IOException {
321+
// GIVEN:
322+
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-directory");
323+
324+
// Oops, this check should be inverted
325+
if (File.separatorChar != '\\') {
326+
Files.createDirectory(tempDirChild.toPath()); // Creates with permissions 'drwxr-xr-x'
327+
}
328+
}
329+
330+
void safeBecauseFileSeparatorCheck() throws IOException {
331+
// GIVEN:
332+
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-directory");
333+
334+
if (File.separatorChar == '\\') {
335+
Files.createDirectory(tempDirChild.toPath());
336+
}
337+
}
338+
339+
void safeBecauseInvertedFileSeperatorCheck() throws IOException {
340+
// GIVEN:
341+
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-directory");
342+
343+
if (File.separatorChar != '/') {
344+
Files.createDirectory(tempDirChild.toPath());
345+
}
346+
}
319347
}

0 commit comments

Comments
 (0)