Skip to content

Commit 01d7bee

Browse files
michaelnebelmichaelnebel
authored
Merge pull request #81 from GitHubSecurityLab/java/promotemodels
Java: Use the models packs in the query pack and promote experimental models.
2 parents 00ea65f + 6dd34ce commit 01d7bee

36 files changed

+4285
-4321
lines changed

‎java/ext-library-sources/manual/empty.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data: []

‎java/ext-library-sources/qlpack.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,3 @@ dataExtensions:
88
- 'manual/**/*.yml'
99
- 'generated/*.yml'
1010
- 'generated/**/*.yml'
11-
- 'experimental/*.yml'

‎java/ext/experimental/android.webkit.model.yml

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎java/ext/experimental/com.jfinal.core.model.yml

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎java/ext/experimental/empty.model.yml

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎java/ext/experimental/java.io.model.yml

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎java/ext/experimental/javax.servlet.http.model.yml

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎java/ext/generated/empty.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data: []

‎java/ext/manual/android.webkit.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["android.webkit", "WebResourceRequest", False, "getUrl", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] # android-web-resource-response

‎java/ext/experimental/com.google.common.io.model.yml renamed to ‎java/ext/manual/com.google.common.io.model.yml

File renamed without changes.

‎java/ext/experimental/com.jcraft.jsch.model.yml renamed to ‎java/ext/manual/com.jcraft.jsch.model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: experimentalSinkModel
4+
extensible: sinkModel
55
data:
6-
- ["com.jcraft.jsch", "ChannelExec", True, "setCommand", "", "", "Argument[0]", "command-injection", "manual", "jsch-os-injection"]
6+
- ["com.jcraft.jsch", "ChannelExec", True, "setCommand", "", "", "Argument[0]", "command-injection", "manual"] #jsch-os-injection

‎java/ext/manual/com.jfinal.core.model.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sourceModel
5+
data:
6+
- ["com.jfinal.core", "Controller", True, "get", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
7+
- ["com.jfinal.core", "Controller", True, "getBoolean", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
8+
- ["com.jfinal.core", "Controller", True, "getCookie", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
9+
- ["com.jfinal.core", "Controller", True, "getCookieObject", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
10+
- ["com.jfinal.core", "Controller", True, "getCookieObjects", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
11+
- ["com.jfinal.core", "Controller", True, "getCookieToInt", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
12+
- ["com.jfinal.core", "Controller", True, "getCookieToLong", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
13+
- ["com.jfinal.core", "Controller", True, "getDate", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
14+
- ["com.jfinal.core", "Controller", True, "getFile", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
15+
- ["com.jfinal.core", "Controller", True, "getFiles", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
16+
- ["com.jfinal.core", "Controller", True, "getHeader", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
17+
- ["com.jfinal.core", "Controller", True, "getInt", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
18+
- ["com.jfinal.core", "Controller", True, "getKv", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
19+
- ["com.jfinal.core", "Controller", True, "getLong", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
20+
- ["com.jfinal.core", "Controller", True, "getPara", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
21+
- ["com.jfinal.core", "Controller", True, "getParaMap", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
22+
- ["com.jfinal.core", "Controller", True, "getParaToBoolean", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
23+
- ["com.jfinal.core", "Controller", True, "getParaToDate", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
24+
- ["com.jfinal.core", "Controller", True, "getParaToInt", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
25+
- ["com.jfinal.core", "Controller", True, "getParaToLong", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
26+
- ["com.jfinal.core", "Controller", True, "getParaValues", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
27+
- ["com.jfinal.core", "Controller", True, "getParaValuesToInt", "", "", "ReturnValue", "remote", "manual"] #file-path-injection
28+
- ["com.jfinal.core", "Controller", True, "getParaValuesToLong", "", "", "ReturnValue", "remote", "manual"] #file-path-injection

‎java/ext/manual/java.io.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: summaryModel
5+
data:
6+
- ["java.io", "FileInputStream", True, "FileInputStream", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] # android-web-resource-response

‎java/ext/experimental/java.lang.model.yml renamed to ‎java/ext/manual/java.lang.model.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: experimentalSinkModel
4+
extensible: sinkModel
55
data:
6-
- ["java.lang", "Thread", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual", "thread-resource-abuse"]
6+
- ["java.lang", "Thread", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual"] #thread-resource-abuse
77
- addsTo:
88
pack: codeql/java-all
9-
extensible: experimentalSummaryModel
9+
extensible: summaryModel
1010
data:
11-
- ["java.lang", "Math", False, "max", "", "", "Argument[0..1]", "ReturnValue", "value", "manual", "thread-resource-abuse"]
12-
- ["java.lang", "Math", False, "min", "", "", "Argument[0..1]", "ReturnValue", "value", "manual", "thread-resource-abuse"]
11+
- ["java.lang", "Math", False, "max", "", "", "Argument[0..1]", "ReturnValue", "value", "manual"] #thread-resource-abuse
12+
- ["java.lang", "Math", False, "min", "", "", "Argument[0..1]", "ReturnValue", "value", "manual"] #thread-resource-abuse

‎java/ext/experimental/java.util.concurrent.model.yml renamed to ‎java/ext/manual/java.util.concurrent.model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: experimentalSinkModel
4+
extensible: sinkModel
55
data:
6-
- ["java.util.concurrent", "TimeUnit", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual", "thread-resource-abuse"]
6+
- ["java.util.concurrent", "TimeUnit", True, "sleep", "", "", "Argument[0]", "thread-pause", "manual"] #thread-resource-abuse

‎java/ext/manual/javax.servlet.http.model.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sourceModel
5+
data:
6+
- ["javax.servlet.http", "HttpServletRequest", False, "getPathInfo", "()", "", "ReturnValue", "uri-path", "manual"] #permissive-dot-regex-query
7+
- ["javax.servlet.http", "HttpServletRequest", False, "getPathTranslated", "()", "", "ReturnValue", "uri-path", "manual"] #permissive-dot-regex-query
8+
- ["javax.servlet.http", "HttpServletRequest", False, "getRequestURI", "()", "", "ReturnValue", "uri-path", "manual"] #permissive-dot-regex-query
9+
- ["javax.servlet.http", "HttpServletRequest", False, "getRequestURL", "()", "", "ReturnValue", "uri-path", "manual"] #permissive-dot-regex-query
10+
- ["javax.servlet.http", "HttpServletRequest", False, "getServletPath", "()", "", "ReturnValue", "uri-path", "manual"] #permissive-dot-regex-query

‎java/ext/experimental/org.apache.logging.log4j.message.model.yml renamed to ‎java/ext/manual/org.apache.logging.log4j.message.model.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
extensions:
22
- addsTo:
33
pack: codeql/java-all
4-
extensible: experimentalSummaryModel
4+
extensible: summaryModel
55
data:
6-
- ["org.apache.logging.log4j.message", "MapMessage", True, "put", "", "", "Argument[1]", "Argument[this]", "taint", "manual", "log4j-injection"]
7-
- ["org.apache.logging.log4j.message", "MapMessage", True, "putAll", "", "", "Argument[0].MapValue", "Argument[this]", "taint", "manual", "log4j-injection"]
8-
- ["org.apache.logging.log4j.message", "MapMessage", True, "with", "", "", "Argument[this]", "ReturnValue", "value", "manual", "log4j-injection"]
9-
- ["org.apache.logging.log4j.message", "MapMessage", True, "with", "", "", "Argument[1]", "Argument[this]", "taint", "manual", "log4j-injection"]
6+
- ["org.apache.logging.log4j.message", "MapMessage", True, "put", "", "", "Argument[1]", "Argument[this]", "taint", "manual"] #log4j-injection
7+
- ["org.apache.logging.log4j.message", "MapMessage", True, "putAll", "", "", "Argument[0].MapValue", "Argument[this]", "taint", "manual"] #log4j-injection
8+
- ["org.apache.logging.log4j.message", "MapMessage", True, "with", "", "", "Argument[this]", "ReturnValue", "value", "manual"] #log4j-injection
9+
- ["org.apache.logging.log4j.message", "MapMessage", True, "with", "", "", "Argument[1]", "Argument[this]", "taint", "manual"] #log4j-injection

0 commit comments

Comments
 (0)