Skip to content

Commit ee750f6

Browse files
michaelnebelmichaelnebel
committed
Fix various compilation issues.
1 parent e08ab32 commit ee750f6

File tree

17 files changed

+23
-108
lines changed

17 files changed

+23
-108
lines changed

‎csharp/src/audit/explore/Dependencies.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
private import csharp
1111
private import semmle.code.csharp.dispatch.Dispatch
12-
private import Telemetry.ExternalApi
12+
private import semmle.code.csharp.telemetry.ExternalApi
1313

1414
private predicate getRelevantUsages(string namespace, int usages) {
1515
usages =

‎csharp/src/library_sources/ExternalAPIsQuery.qll

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -98,19 +98,6 @@ class ExternalApiDataNode extends DataFlow::Node {
9898
}
9999
}
100100

101-
/**
102-
* DEPRECATED: Use `RemoteSourceToExternalApi` instead.
103-
*
104-
* A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
105-
*/
106-
deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
107-
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
108-
109-
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
110-
111-
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
112-
}
113-
114101
/** A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s. */
115102
private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
116103
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }

‎csharp/src/security/dataflow/flowsources/AuthCookie.qll

Lines changed: 0 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -114,61 +114,6 @@ Expr getAValueForProp(ObjectCreation create, Assignment a, string prop) {
114114
*/
115115
predicate isPropertySet(ObjectCreation oc, string prop) { exists(getAValueForProp(oc, _, prop)) }
116116

117-
/**
118-
* Tracks if a callback used in `OnAppendCookie` sets a cookie property to `true`.
119-
*/
120-
abstract deprecated private class OnAppendCookieTrackingConfig extends DataFlow::Configuration {
121-
bindingset[this]
122-
OnAppendCookieTrackingConfig() { any() }
123-
124-
/**
125-
* Specifies the cookie property name to track.
126-
*/
127-
abstract string propertyName();
128-
129-
override predicate isSource(DataFlow::Node source) {
130-
exists(PropertyWrite pw, Assignment delegateAssign, Callable c |
131-
pw.getProperty().getName() = "OnAppendCookie" and
132-
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreBuilderCookiePolicyOptions and
133-
delegateAssign.getLValue() = pw and
134-
(
135-
exists(LambdaExpr lambda |
136-
delegateAssign.getRValue() = lambda and
137-
lambda = c
138-
)
139-
or
140-
exists(DelegateCreation delegate |
141-
delegateAssign.getRValue() = delegate and
142-
delegate.getArgument().(CallableAccess).getTarget() = c
143-
)
144-
) and
145-
c.getParameter(0) = source.asParameter()
146-
)
147-
}
148-
149-
override predicate isSink(DataFlow::Node sink) {
150-
exists(PropertyWrite pw, Assignment a |
151-
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
152-
pw.getProperty().getName() = this.propertyName() and
153-
a.getLValue() = pw and
154-
exists(Expr val |
155-
DataFlow::localExprFlow(val, a.getRValue()) and
156-
val.getValue() = "true"
157-
) and
158-
sink.asExpr() = pw.getQualifier()
159-
)
160-
}
161-
162-
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
163-
node2.asExpr() =
164-
any(PropertyRead pr |
165-
pr.getQualifier() = node1.asExpr() and
166-
pr.getProperty().getDeclaringType() instanceof
167-
MicrosoftAspNetCoreCookiePolicyAppendCookieContext
168-
)
169-
}
170-
}
171-
172117
private signature string propertyName();
173118

174119
/**

‎java/lib/ghsl/Encoding.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import java
22
import semmle.code.java.dataflow.DataFlow
33
import semmle.code.java.dataflow.FlowSources
4-
import semmle.code.java.dataflow.TaintTracking2
54

65
module Base64 {
76
abstract class Encoding extends DataFlow::Node { }

‎java/lib/ghsl/Logging.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import java
22
import semmle.code.java.dataflow.DataFlow
33
import semmle.code.java.dataflow.FlowSources
4-
import semmle.code.java.dataflow.TaintTracking2
54

65
abstract class LoggingMethodsSinks extends DataFlow::Node { }
76

‎java/lib/ghsl/SensitiveInformation.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import java
22
import semmle.code.java.dataflow.DataFlow
33
import semmle.code.java.dataflow.FlowSources
4-
import semmle.code.java.dataflow.TaintTracking2
54

65
abstract class SensitiveInformationSources extends DataFlow::Node { }
76

‎java/lib/semmle/code/java/security/SpringUrlRedirect.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ private class SpringViewUrlRedirectSink extends SpringUrlRedirectSink {
5353
)
5454
or
5555
exists(MethodCall ma, RedirectAppendCall rac |
56-
DataFlow2::localExprFlow(rac.getQualifier(), ma.getQualifier()) and
56+
DataFlow::localExprFlow(rac.getQualifier(), ma.getQualifier()) and
5757
ma.getMethod().hasName("append") and
5858
ma.getArgument(0) = this.asExpr() and
5959
any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable())

‎java/src/audit/CWE-079/XSSJSPLenient.ql

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313

1414
import java
1515
import semmle.code.java.dataflow.FlowSources
16-
import semmle.code.java.dataflow.TaintTracking2
1716
import semmle.code.java.security.XSS
1817
import semmle.code.java.frameworks.Servlets
1918
import JSPLocations
@@ -129,11 +128,11 @@ class ForEachStep extends XssAdditionalTaintStep {
129128
v.getType().getName() = "ForEachTag" and
130129
exists(DataFlow::Node ctxSrc |
131130
ContextFlow::ContextFlow::flow(ctxSrc,
132-
DataFlow2::exprNode(methodCallOn("setPageContext", v).getArgument(0))) and
133-
ContextFlow::ContextFlow::flow(ctxSrc, DataFlow2::exprNode(eval.getCtxExpr()))
131+
DataFlow::exprNode(methodCallOn("setPageContext", v).getArgument(0))) and
132+
ContextFlow::ContextFlow::flow(ctxSrc, DataFlow::exprNode(eval.getCtxExpr()))
134133
// config
135-
// .hasFlow(ctxSrc, DataFlow2::exprNode(methodCallOn("setPageContext", v).getArgument(0))) and
136-
// config.hasFlow(ctxSrc, DataFlow2::exprNode(eval.getCtxExpr()))
134+
// .hasFlow(ctxSrc, DataFlow::exprNode(methodCallOn("setPageContext", v).getArgument(0))) and
135+
// config.hasFlow(ctxSrc, DataFlow::exprNode(eval.getCtxExpr()))
137136
) and
138137
node1.asExpr() = methodCallOn("setItems", v).getArgument(0) and
139138
node2.asExpr() = eval and
@@ -169,7 +168,7 @@ class RedirectToJsp extends ReturnStmt {
169168
File jsp;
170169

171170
RedirectToJsp() {
172-
exists(DataFlow2::Node strLit, DataFlow2::Node retVal |
171+
exists(DataFlow::Node strLit, DataFlow::Node retVal |
173172
strLit.asExpr().(StringLiteral).getValue().splitAt("/") + "_jsp.java" = jsp.getBaseName()
174173
|
175174
retVal.asExpr() = this.getResult() and LiteralConfig::LiteralFlow::flow(strLit, retVal)

‎java/src/library_sources/ExternalAPIs.qll

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -97,19 +97,6 @@ class ExternalApiDataNode extends DataFlow::Node {
9797
string getMethodDescription() { result = this.getMethod().getQualifiedName() }
9898
}
9999

100-
/**
101-
* DEPRECATED: Use `UntrustedDataToExternalApiFlow` instead.
102-
*
103-
* A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
104-
*/
105-
deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
106-
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
107-
108-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
109-
110-
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
111-
}
112-
113100
/**
114101
* Taint tracking configuration for flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s.
115102
*/

‎java/src/security/CWE-079/XSSJSP.ql

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212

1313
import java
1414
import semmle.code.java.dataflow.FlowSources
15-
import semmle.code.java.dataflow.TaintTracking2
1615
import semmle.code.java.security.XSS
1716
import JSPLocations
1817

@@ -48,10 +47,16 @@ class JSPTaintStep extends XssAdditionalTaintStep {
4847
.getValue()
4948
.regexpMatch(".*\\$\\{" + key.getValue() + "\\}.*") and
5049
(
51-
exists(RedirectToJsp rtj | rtj.(ControlFlowNode).getAPredecessor*() = addAttr)
50+
exists(RedirectToJsp rtj, ControlFlowNode cfn |
51+
cfn.asStmt() = rtj and cfn.getAPredecessor*().asExpr() = addAttr
52+
)
5253
implies
5354
propEval.getFile() =
54-
any(RedirectToJsp rtj | rtj.(ControlFlowNode).getAPredecessor*() = addAttr).getJspFile()
55+
any(RedirectToJsp rtj |
56+
exists(ControlFlowNode cfn |
57+
cfn.asStmt() = rtj and cfn.getAPredecessor*().asExpr() = addAttr
58+
)
59+
).getJspFile()
5560
)
5661
|
5762
node1.asExpr() = addAttr.getArgument(1) and
@@ -74,7 +79,7 @@ class RedirectToJsp extends ReturnStmt {
7479
File jsp;
7580

7681
RedirectToJsp() {
77-
exists(DataFlow2::Node strLit, DataFlow2::Node retVal |
82+
exists(DataFlow::Node strLit, DataFlow::Node retVal |
7883
strLit.asExpr().(StringLiteral).getValue().splitAt("/") + "_jsp.java" = jsp.getBaseName()
7984
|
8085
retVal.asExpr() = this.getResult() and LiteralConfig::LiteralFlow::flow(strLit, retVal)

‎java/src/security/CWE-208/NonConstantTimeCheckOnSignatureQuery.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ private class ProduceCiphertextCall extends ProduceCryptoCall {
9595
}
9696

9797
/** Holds if `fromNode` to `toNode` is a dataflow step that updates a cryptographic operation. */
98-
private predicate updateCryptoOperationStep(DataFlow2::Node fromNode, DataFlow2::Node toNode) {
98+
private predicate updateCryptoOperationStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
9999
exists(MethodCall call, Method m |
100100
m = call.getMethod() and
101101
call.getQualifier() = toNode.asExpr() and
@@ -111,7 +111,7 @@ private predicate updateCryptoOperationStep(DataFlow2::Node fromNode, DataFlow2:
111111
}
112112

113113
/** Holds if `fromNode` to `toNode` is a dataflow step that creates a hash. */
114-
private predicate createMessageDigestStep(DataFlow2::Node fromNode, DataFlow2::Node toNode) {
114+
private predicate createMessageDigestStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
115115
exists(MethodCall ma, Method m | m = ma.getMethod() |
116116
m.getDeclaringType().hasQualifiedName("java.security", "MessageDigest") and
117117
m.hasStringSignature("digest()") and
@@ -135,7 +135,7 @@ private predicate createMessageDigestStep(DataFlow2::Node fromNode, DataFlow2::N
135135
}
136136

137137
/** Holds if `fromNode` to `toNode` is a dataflow step that updates a hash. */
138-
private predicate updateMessageDigestStep(DataFlow2::Node fromNode, DataFlow2::Node toNode) {
138+
private predicate updateMessageDigestStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
139139
exists(MethodCall ma, Method m | m = ma.getMethod() |
140140
m.hasQualifiedName("java.security", "MessageDigest", "update") and
141141
ma.getArgument(0) = fromNode.asExpr() and
@@ -154,7 +154,7 @@ private module UserInputInCryptoOperationConfig implements DataFlow::ConfigSig {
154154
exists(ProduceCryptoCall call | call.getQualifier() = sink.asExpr())
155155
}
156156

157-
predicate isAdditionalFlowStep(DataFlow2::Node fromNode, DataFlow2::Node toNode) {
157+
predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
158158
updateCryptoOperationStep(fromNode, toNode)
159159
or
160160
createMessageDigestStep(fromNode, toNode)

‎java/src/security/CWE-326/Base64Encryption.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
import java
1515
import semmle.code.java.dataflow.DataFlow
1616
import semmle.code.java.dataflow.FlowSources
17-
import semmle.code.java.dataflow.TaintTracking2
1817
// import DataFlow::PathGraph
1918
// Internal
2019
import ghsl.SensitiveInformation

‎java/src/security/CWE-338/WeakPRNG.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import java
1616
import semmle.code.java.dataflow.DataFlow
1717
import semmle.code.java.dataflow.FlowSources
18-
import semmle.code.java.dataflow.TaintTracking2
1918

2019
abstract class RandomNumberGeneratorSinks extends DataFlow::Node { }
2120

‎java/src/security/CWE-532/SensitiveInformation.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
import java
1515
import semmle.code.java.dataflow.DataFlow
1616
import semmle.code.java.dataflow.FlowSources
17-
import semmle.code.java.dataflow.TaintTracking2
1817
//import DataFlow::PathGraph
1918
// Internal
2019
import ghsl.Logging

‎java/src/security/CWE-611/XXELocal.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
import java
1717
import semmle.code.java.security.XmlParsers
1818
import semmle.code.java.dataflow.FlowSources
19-
import semmle.code.java.dataflow.TaintTracking2
2019
//import DataFlow::PathGraph
2120
import ghsl.LocalSources
2221

‎java/src/security/CWE-625/PermissiveDotRegexQuery.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,11 @@ private class CompileRegexSink extends DataFlow::ExprNode {
9090
* A data flow configuration for regular expressions that include permissive dots.
9191
*/
9292
private module PermissiveDotRegexConfig implements DataFlow::ConfigSig {
93-
predicate isSource(DataFlow2::Node src) { src.asExpr() instanceof PermissiveDotStr }
93+
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof PermissiveDotStr }
9494

95-
predicate isSink(DataFlow2::Node sink) { sink instanceof CompileRegexSink }
95+
predicate isSink(DataFlow::Node sink) { sink instanceof CompileRegexSink }
9696

97-
predicate isBarrier(DataFlow2::Node node) {
97+
predicate isBarrier(DataFlow::Node node) {
9898
exists(
9999
MethodCall ma, Field f // Pattern.compile(PATTERN, Pattern.DOTALL)
100100
|

‎java/src/security/CWE-798/HardcodedBase64Usage.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
import java
1515
import semmle.code.java.dataflow.DataFlow
1616
import semmle.code.java.dataflow.FlowSources
17-
import semmle.code.java.dataflow.TaintTracking2
1817
// Internal
1918
import ghsl.Encoding
2019
import ghsl.Hardcoded

0 commit comments

Comments
 (0)