Skip to content

Commit a0bf68f

Browse files
jorgectfjorgectf
committed
Generally extend TaintTracking::AdditionalTaintStep 
1 parent ded9663 commit a0bf68f

3 files changed

Lines changed: 72 additions & 92 deletions

File tree

‎java/ql/lib/semmle/code/java/frameworks/MyBatis.qll‎

Lines changed: 70 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -105,94 +105,88 @@ class TypeParam extends Interface {
105105
TypeParam() { this.hasQualifiedName("org.apache.ibatis.annotations", "Param") }
106106
}
107107

108-
module ProviderInjection {
109-
private class MyBatisAbstractSQL extends RefType {
110-
MyBatisAbstractSQL() { this.hasQualifiedName("org.apache.ibatis.jdbc", "AbstractSQL") }
111-
}
112-
113-
private class MyBatisProvider extends RefType {
114-
MyBatisProvider() {
115-
this.hasQualifiedName("org.apache.ibatis.annotations",
116-
["Select", "Delete", "Insert", "Update"] + "Provider")
117-
}
118-
}
108+
private class MyBatisAbstractSQL extends RefType {
109+
MyBatisAbstractSQL() { this.hasQualifiedName("org.apache.ibatis.jdbc", "AbstractSQL") }
110+
}
119111

120-
private class MyBatisAbstractSQLMethodNames extends string {
121-
MyBatisAbstractSQLMethodNames() {
122-
this in [
123-
"SELECT", "OFFSET_ROWS", "FETCH_FIRST_ROWS_ONLY", "OFFSET", "LIMIT", "ORDER_BY", "HAVING",
124-
"GROUP_BY", "WHERE", "OUTER_JOIN", "RIGHT_OUTER_JOIN", "LEFT_OUTER_JOIN", "INNER_JOIN",
125-
"JOIN", "FROM", "DELETE_FROM", "SELECT_DISTINCT", "SELECT", "INTO_VALUES", "INTO_COLUMNS",
126-
"VALUES", "INSERT_INTO", "SET", "UPDATE"
127-
]
128-
}
112+
private class MyBatisProvider extends RefType {
113+
MyBatisProvider() {
114+
this.hasQualifiedName("org.apache.ibatis.annotations",
115+
["Select", "Delete", "Insert", "Update"] + "Provider")
129116
}
117+
}
130118

131-
class MyBatisInjectionSink extends DataFlow::Node {
132-
MyBatisInjectionSink() {
133-
exists(Annotation a, Method m, TypeLiteral type, Class c |
134-
a.getType() instanceof MyBatisProvider and
135-
type = a.getValue(["type", "value"]) and
136-
c.hasMethod(m, type.getTypeName().getType()) and
137-
m.hasName(a.getValue("method").(StringLiteral).getValue()) and
138-
this.asExpr() = m.getBody().getAStmt().(ReturnStmt).getResult()
139-
)
140-
}
119+
private class MyBatisAbstractSQLMethodNames extends string {
120+
MyBatisAbstractSQLMethodNames() {
121+
this in [
122+
"SELECT", "OFFSET_ROWS", "FETCH_FIRST_ROWS_ONLY", "OFFSET", "LIMIT", "ORDER_BY", "HAVING",
123+
"GROUP_BY", "WHERE", "OUTER_JOIN", "RIGHT_OUTER_JOIN", "LEFT_OUTER_JOIN", "INNER_JOIN",
124+
"JOIN", "FROM", "DELETE_FROM", "SELECT_DISTINCT", "SELECT", "INTO_VALUES", "INTO_COLUMNS",
125+
"VALUES", "INSERT_INTO", "SET", "UPDATE"
126+
]
141127
}
128+
}
142129

143-
class MyBatisAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
144-
abstract override predicate step(DataFlow::Node node1, DataFlow::Node node2);
130+
class MyBatisInjectionSink extends DataFlow::Node {
131+
MyBatisInjectionSink() {
132+
exists(Annotation a, Method m, TypeLiteral type, Class c |
133+
a.getType() instanceof MyBatisProvider and
134+
type = a.getValue(["type", "value"]) and
135+
c.hasMethod(m, type.getTypeName().getType()) and
136+
m.hasName(a.getValue("method").(StringLiteral).getValue()) and
137+
this.asExpr() = m.getBody().getAStmt().(ReturnStmt).getResult()
138+
)
145139
}
140+
}
146141

147-
private class MyBatisProviderStep extends MyBatisAdditionalTaintStep {
148-
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
149-
exists(
150-
MethodAccess ma, Annotation a, Method annotatedMethod, Method providerMethod,
151-
TypeLiteral type, Class c
152-
|
153-
a.getType() instanceof MyBatisProvider and
154-
annotatedMethod.getAnAnnotation() = a and
155-
ma.getMethod() = annotatedMethod and
156-
ma.getAnArgument() = n1.asExpr() and
157-
type = a.getValue(["type", "value"]) and
158-
providerMethod.hasName(a.getValue("method").(StringLiteral).getValue()) and
159-
c.hasMethod(providerMethod, type.getTypeName().getType()) and
160-
providerMethod.getAParameter() = n2.asParameter()
161-
)
162-
}
142+
private class MyBatisProviderStep extends TaintTracking::AdditionalTaintStep {
143+
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
144+
exists(
145+
MethodAccess ma, Annotation a, Method annotatedMethod, Method providerMethod,
146+
TypeLiteral type, Class c
147+
|
148+
a.getType() instanceof MyBatisProvider and
149+
annotatedMethod.getAnAnnotation() = a and
150+
ma.getMethod() = annotatedMethod and
151+
ma.getAnArgument() = n1.asExpr() and
152+
type = a.getValue(["type", "value"]) and
153+
providerMethod.hasName(a.getValue("method").(StringLiteral).getValue()) and
154+
c.hasMethod(providerMethod, type.getTypeName().getType()) and
155+
providerMethod.getAParameter() = n2.asParameter()
156+
)
163157
}
158+
}
164159

165-
private class MyBatisAbstractSQLToStringStep extends MyBatisAdditionalTaintStep {
166-
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
167-
exists(MethodAccess ma |
168-
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
169-
ma.getMethod().getName() = "toString" and
170-
ma.getQualifier() = node1.asExpr() and
171-
ma = node2.asExpr()
172-
)
173-
}
160+
private class MyBatisAbstractSQLToStringStep extends TaintTracking::AdditionalTaintStep {
161+
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
162+
exists(MethodAccess ma |
163+
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
164+
ma.getMethod().getName() = "toString" and
165+
ma.getQualifier() = node1.asExpr() and
166+
ma = node2.asExpr()
167+
)
174168
}
169+
}
175170

176-
private class MyBatisAbstractSQLMethodsStep extends MyBatisAdditionalTaintStep {
177-
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
178-
exists(MethodAccess ma |
179-
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
180-
ma.getMethod().getName() instanceof MyBatisAbstractSQLMethodNames and
181-
ma.getArgument([0, 1]) = node1.asExpr() and
182-
ma = node2.asExpr()
183-
)
184-
}
171+
private class MyBatisAbstractSQLMethodsStep extends TaintTracking::AdditionalTaintStep {
172+
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
173+
exists(MethodAccess ma |
174+
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
175+
ma.getMethod().getName() instanceof MyBatisAbstractSQLMethodNames and
176+
ma.getArgument([0, 1]) = node1.asExpr() and
177+
ma = node2.asExpr()
178+
)
185179
}
180+
}
186181

187-
private class MyBatisAbstractSQLAnonymousClassStep extends MyBatisAdditionalTaintStep {
188-
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
189-
exists(MethodAccess ma, ClassInstanceExpr c |
190-
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
191-
ma.getMethod().getName() instanceof MyBatisAbstractSQLMethodNames and
192-
c.getAnonymousClass().getACallable() = ma.getCaller() and
193-
node1.asExpr() = ma and
194-
node2.asExpr() = c
195-
)
196-
}
182+
private class MyBatisAbstractSQLAnonymousClassStep extends TaintTracking::AdditionalTaintStep {
183+
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
184+
exists(MethodAccess ma, ClassInstanceExpr c |
185+
ma.getMethod().getDeclaringType().getSourceDeclaration() instanceof MyBatisAbstractSQL and
186+
ma.getMethod().getName() instanceof MyBatisAbstractSQLMethodNames and
187+
c.getAnonymousClass().getACallable() = ma.getCaller() and
188+
node1.asExpr() = ma and
189+
node2.asExpr() = c
190+
)
197191
}
198192
}

‎java/ql/lib/semmle/code/java/security/OgnlInjection.qll‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import java
44
private import semmle.code.java.dataflow.DataFlow
55
private import semmle.code.java.dataflow.ExternalFlow
6+
private import semmle.code.java.frameworks.MyBatis
67

78
/**
89
* A data flow sink for unvalidated user input that is used in OGNL EL evaluation.
@@ -123,12 +124,4 @@ private class DefaultOgnlInjectionAdditionalTaintStep extends OgnlInjectionAddit
123124
}
124125
}
125126

126-
private import semmle.code.java.frameworks.MyBatis::ProviderInjection
127-
128127
private class MyBatisOgnlInjectionSink extends OgnlInjectionSink instanceof MyBatisInjectionSink { }
129-
130-
private class MyBatisAbstractSQLOgnlInjectionStep extends OgnlInjectionAdditionalTaintStep {
131-
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
132-
any(MyBatisAdditionalTaintStep step).step(node1, node2)
133-
}
134-
}

‎java/ql/lib/semmle/code/java/security/QueryInjection.qll‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import java
44
import semmle.code.java.dataflow.DataFlow
55
import semmle.code.java.frameworks.javaee.Persistence
6+
private import semmle.code.java.frameworks.MyBatis
67
import semmle.code.java.dataflow.ExternalFlow
78

89
/** A sink for database query language injection vulnerabilities. */
@@ -67,12 +68,4 @@ private class MongoJsonStep extends AdditionalQueryInjectionTaintStep {
6768
}
6869
}
6970

70-
private import semmle.code.java.frameworks.MyBatis::ProviderInjection
71-
7271
private class MyBatisSqlInjectionSink extends QueryInjectionSink instanceof MyBatisInjectionSink { }
73-
74-
private class MyBatisAbstractSQLInjectionStep extends AdditionalQueryInjectionTaintStep {
75-
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
76-
any(MyBatisAdditionalTaintStep step).step(node1, node2)
77-
}
78-
}

0 commit comments

Comments
 (0)