Skip to content

Commit 33f5620

Browse files
atorralbaatorralba
committed
Add more models
1 parent c56e0f7 commit 33f5620

File tree

2 files changed

+201
-44
lines changed

2 files changed

+201
-44
lines changed

‎java/ql/lib/semmle/code/java/dataflow/internal/ContainerFlow.qll

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,8 +245,20 @@ private class ContainerFlowSummaries extends SummaryModelCsv {
245245
"java.util;Properties;true;getProperty;(String,String);;Argument[-1].MapValue;ReturnValue;value;manual",
246246
"java.util;Properties;true;getProperty;(String,String);;Argument[1];ReturnValue;value;manual",
247247
"java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual",
248-
"java.util;Scanner;true;next;(Pattern);;Argument[-1];ReturnValue;taint;manual",
249-
"java.util;Scanner;true;next;(String);;Argument[-1];ReturnValue;taint;manual",
248+
"java.util;Scanner;true;findInLine;;;Argument[-1];ReturnValue;taint;manual",
249+
"java.util;Scanner;true;findWithinHorizon;;;Argument[-1];ReturnValue;taint;manual",
250+
"java.util;Scanner;true;findWithinHorizon;;;Argument[-1];ReturnValue;taint;manual",
251+
"java.util;Scanner;true;next;;;Argument[-1];ReturnValue;taint;manual",
252+
"java.util;Scanner;true;nextBigDecimal;;;Argument[-1];ReturnValue;taint;manual",
253+
"java.util;Scanner;true;nextBigInteger;;;Argument[-1];ReturnValue;taint;manual",
254+
"java.util;Scanner;true;nextBoolean;;;Argument[-1];ReturnValue;taint;manual",
255+
"java.util;Scanner;true;nextByte;;;Argument[-1];ReturnValue;taint;manual",
256+
"java.util;Scanner;true;nextDouble;;;Argument[-1];ReturnValue;taint;manual",
257+
"java.util;Scanner;true;nextFloat;;;Argument[-1];ReturnValue;taint;manual",
258+
"java.util;Scanner;true;nextInt;;;Argument[-1];ReturnValue;taint;manual",
259+
"java.util;Scanner;true;nextLine;;;Argument[-1];ReturnValue;taint;manual",
260+
"java.util;Scanner;true;nextLong;;;Argument[-1];ReturnValue;taint;manual",
261+
"java.util;Scanner;true;nextShort;;;Argument[-1];ReturnValue;taint;manual",
250262
"java.util;Scanner;true;reset;;;Argument[-1];ReturnValue;value;manual",
251263
"java.util;Scanner;true;skip;;;Argument[-1];ReturnValue;value;manual",
252264
"java.util;Scanner;true;useDelimiter;;;Argument[-1];ReturnValue;value;manual",

‎java/ql/test/library-tests/scanner/Test.java

Lines changed: 187 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
import java.io.File;
44
import java.io.InputStream;
5+
import java.math.BigDecimal;
6+
import java.math.BigInteger;
57
import java.nio.channels.ReadableByteChannel;
68
import java.nio.charset.Charset;
79
import java.nio.file.Path;
@@ -11,173 +13,316 @@
1113
// Test case generated by GenerateFlowTestCase.ql
1214
public class Test {
1315

14-
Object source() { return null; }
15-
void sink(Object o) { }
16+
Object source() {
17+
return null;
18+
}
19+
20+
void sink(Object o) {}
1621

1722
public void test() throws Exception {
1823

1924
{
2025
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
2126
Scanner out = null;
22-
File in = (File)source();
27+
File in = (File) source();
2328
out = new Scanner(in);
2429
sink(out); // $ hasTaintFlow
2530
}
2631
{
2732
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
2833
Scanner out = null;
29-
File in = (File)source();
30-
out = new Scanner(in, (Charset)null);
34+
File in = (File) source();
35+
out = new Scanner(in, (Charset) null);
3136
sink(out); // $ hasTaintFlow
3237
}
3338
{
3439
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
3540
Scanner out = null;
36-
File in = (File)source();
37-
out = new Scanner(in, (String)null);
41+
File in = (File) source();
42+
out = new Scanner(in, (String) null);
3843
sink(out); // $ hasTaintFlow
3944
}
4045
{
4146
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
4247
Scanner out = null;
43-
InputStream in = (InputStream)source();
48+
InputStream in = (InputStream) source();
4449
out = new Scanner(in);
4550
sink(out); // $ hasTaintFlow
4651
}
4752
{
4853
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
4954
Scanner out = null;
50-
InputStream in = (InputStream)source();
51-
out = new Scanner(in, (Charset)null);
55+
InputStream in = (InputStream) source();
56+
out = new Scanner(in, (Charset) null);
5257
sink(out); // $ hasTaintFlow
5358
}
5459
{
5560
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
5661
Scanner out = null;
57-
InputStream in = (InputStream)source();
58-
out = new Scanner(in, (String)null);
62+
InputStream in = (InputStream) source();
63+
out = new Scanner(in, (String) null);
5964
sink(out); // $ hasTaintFlow
6065
}
6166
{
6267
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
6368
Scanner out = null;
64-
Path in = (Path)source();
69+
Path in = (Path) source();
6570
out = new Scanner(in);
6671
sink(out); // $ hasTaintFlow
6772
}
6873
{
6974
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
7075
Scanner out = null;
71-
Path in = (Path)source();
72-
out = new Scanner(in, (Charset)null);
76+
Path in = (Path) source();
77+
out = new Scanner(in, (Charset) null);
7378
sink(out); // $ hasTaintFlow
7479
}
7580
{
7681
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
7782
Scanner out = null;
78-
Path in = (Path)source();
79-
out = new Scanner(in, (String)null);
83+
Path in = (Path) source();
84+
out = new Scanner(in, (String) null);
8085
sink(out); // $ hasTaintFlow
8186
}
8287
{
8388
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
8489
Scanner out = null;
85-
Readable in = (Readable)source();
90+
Readable in = (Readable) source();
8691
out = new Scanner(in);
8792
sink(out); // $ hasTaintFlow
8893
}
8994
{
9095
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
9196
Scanner out = null;
92-
ReadableByteChannel in = (ReadableByteChannel)source();
97+
ReadableByteChannel in = (ReadableByteChannel) source();
9398
out = new Scanner(in);
9499
sink(out); // $ hasTaintFlow
95100
}
96101
{
97102
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
98103
Scanner out = null;
99-
ReadableByteChannel in = (ReadableByteChannel)source();
100-
out = new Scanner(in, (Charset)null);
104+
ReadableByteChannel in = (ReadableByteChannel) source();
105+
out = new Scanner(in, (Charset) null);
101106
sink(out); // $ hasTaintFlow
102107
}
103108
{
104109
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
105110
Scanner out = null;
106-
ReadableByteChannel in = (ReadableByteChannel)source();
107-
out = new Scanner(in, (String)null);
111+
ReadableByteChannel in = (ReadableByteChannel) source();
112+
out = new Scanner(in, (String) null);
108113
sink(out); // $ hasTaintFlow
109114
}
110115
{
111116
// "java.util;Scanner;true;Scanner;;;Argument[0];Argument[-1];taint;manual"
112117
Scanner out = null;
113-
String in = (String)source();
118+
String in = (String) source();
114119
out = new Scanner(in);
115120
sink(out); // $ hasTaintFlow
116121
}
117122
{
118-
// "java.util;Scanner;true;next;(Pattern);;Argument[-1];ReturnValue;taint;manual"
123+
// "java.util;Scanner;true;findInLine;;;Argument[-1];ReturnValue;taint;manual"
124+
String out = null;
125+
Scanner in = (Scanner) source();
126+
out = in.findInLine((Pattern) null);
127+
sink(out); // $ hasTaintFlow
128+
}
129+
{
130+
// "java.util;Scanner;true;findInLine;;;Argument[-1];ReturnValue;taint;manual"
131+
String out = null;
132+
Scanner in = (Scanner) source();
133+
out = in.findInLine((String) null);
134+
sink(out); // $ hasTaintFlow
135+
}
136+
{
137+
// "java.util;Scanner;true;findWithinHorizon;;;Argument[-1];ReturnValue;taint;manual"
138+
String out = null;
139+
Scanner in = (Scanner) source();
140+
out = in.findWithinHorizon((Pattern) null, 0);
141+
sink(out); // $ hasTaintFlow
142+
}
143+
{
144+
// "java.util;Scanner;true;findWithinHorizon;;;Argument[-1];ReturnValue;taint;manual"
145+
String out = null;
146+
Scanner in = (Scanner) source();
147+
out = in.findWithinHorizon((String) null, 0);
148+
sink(out); // $ hasTaintFlow
149+
}
150+
{
151+
// "java.util;Scanner;true;next;;;Argument[-1];ReturnValue;taint;manual"
152+
String out = null;
153+
Scanner in = (Scanner) source();
154+
out = in.next((Pattern) null);
155+
sink(out); // $ hasTaintFlow
156+
}
157+
{
158+
// "java.util;Scanner;true;next;;;Argument[-1];ReturnValue;taint;manual"
159+
String out = null;
160+
Scanner in = (Scanner) source();
161+
out = in.next((String) null);
162+
sink(out); // $ hasTaintFlow
163+
}
164+
{
165+
// "java.util;Scanner;true;next;;;Argument[-1];ReturnValue;taint;manual"
119166
String out = null;
120-
Scanner in = (Scanner)source();
121-
out = in.next((Pattern)null);
167+
Scanner in = (Scanner) source();
168+
out = in.next();
169+
sink(out); // $ hasTaintFlow
170+
}
171+
{
172+
// "java.util;Scanner;true;nextBigDecimal;;;Argument[-1];ReturnValue;taint;manual"
173+
BigDecimal out = null;
174+
Scanner in = (Scanner) source();
175+
out = in.nextBigDecimal();
176+
sink(out); // $ hasTaintFlow
177+
}
178+
{
179+
// "java.util;Scanner;true;nextBigInteger;;;Argument[-1];ReturnValue;taint;manual"
180+
BigInteger out = null;
181+
Scanner in = (Scanner) source();
182+
out = in.nextBigInteger();
183+
sink(out); // $ hasTaintFlow
184+
}
185+
{
186+
// "java.util;Scanner;true;nextBigInteger;;;Argument[-1];ReturnValue;taint;manual"
187+
BigInteger out = null;
188+
Scanner in = (Scanner) source();
189+
out = in.nextBigInteger(0);
190+
sink(out); // $ hasTaintFlow
191+
}
192+
{
193+
// "java.util;Scanner;true;nextBoolean;;;Argument[-1];ReturnValue;taint;manual"
194+
boolean out = false;
195+
Scanner in = (Scanner) source();
196+
out = in.nextBoolean();
197+
sink(out); // $ hasTaintFlow
198+
}
199+
{
200+
// "java.util;Scanner;true;nextByte;;;Argument[-1];ReturnValue;taint;manual"
201+
byte out = 0;
202+
Scanner in = (Scanner) source();
203+
out = in.nextByte();
204+
sink(out); // $ hasTaintFlow
205+
}
206+
{
207+
// "java.util;Scanner;true;nextByte;;;Argument[-1];ReturnValue;taint;manual"
208+
byte out = 0;
209+
Scanner in = (Scanner) source();
210+
out = in.nextByte(0);
211+
sink(out); // $ hasTaintFlow
212+
}
213+
{
214+
// "java.util;Scanner;true;nextDouble;;;Argument[-1];ReturnValue;taint;manual"
215+
double out = 0;
216+
Scanner in = (Scanner) source();
217+
out = in.nextDouble();
218+
sink(out); // $ hasTaintFlow
219+
}
220+
{
221+
// "java.util;Scanner;true;nextFloat;;;Argument[-1];ReturnValue;taint;manual"
222+
float out = 0;
223+
Scanner in = (Scanner) source();
224+
out = in.nextFloat();
225+
sink(out); // $ hasTaintFlow
226+
}
227+
{
228+
// "java.util;Scanner;true;nextInt;;;Argument[-1];ReturnValue;taint;manual"
229+
int out = 0;
230+
Scanner in = (Scanner) source();
231+
out = in.nextInt();
232+
sink(out); // $ hasTaintFlow
233+
}
234+
{
235+
// "java.util;Scanner;true;nextInt;;;Argument[-1];ReturnValue;taint;manual"
236+
int out = 0;
237+
Scanner in = (Scanner) source();
238+
out = in.nextInt(0);
122239
sink(out); // $ hasTaintFlow
123240
}
124241
{
125-
// "java.util;Scanner;true;next;(String);;Argument[-1];ReturnValue;taint;manual"
242+
// "java.util;Scanner;true;nextLine;;;Argument[-1];ReturnValue;taint;manual"
126243
String out = null;
127-
Scanner in = (Scanner)source();
128-
out = in.next((String)null);
244+
Scanner in = (Scanner) source();
245+
out = in.nextLine();
246+
sink(out); // $ hasTaintFlow
247+
}
248+
{
249+
// "java.util;Scanner;true;nextLong;;;Argument[-1];ReturnValue;taint;manual"
250+
long out = 0;
251+
Scanner in = (Scanner) source();
252+
out = in.nextLong();
253+
sink(out); // $ hasTaintFlow
254+
}
255+
{
256+
// "java.util;Scanner;true;nextLong;;;Argument[-1];ReturnValue;taint;manual"
257+
long out = 0;
258+
Scanner in = (Scanner) source();
259+
out = in.nextLong(0);
260+
sink(out); // $ hasTaintFlow
261+
}
262+
{
263+
// "java.util;Scanner;true;nextShort;;;Argument[-1];ReturnValue;taint;manual"
264+
short out = 0;
265+
Scanner in = (Scanner) source();
266+
out = in.nextShort();
267+
sink(out); // $ hasTaintFlow
268+
}
269+
{
270+
// "java.util;Scanner;true;nextShort;;;Argument[-1];ReturnValue;taint;manual"
271+
short out = 0;
272+
Scanner in = (Scanner) source();
273+
out = in.nextShort(0);
129274
sink(out); // $ hasTaintFlow
130275
}
131276
{
132277
// "java.util;Scanner;true;reset;;;Argument[-1];ReturnValue;value;manual"
133278
Scanner out = null;
134-
Scanner in = (Scanner)source();
279+
Scanner in = (Scanner) source();
135280
out = in.reset();
136281
sink(out); // $ hasValueFlow
137282
}
138283
{
139284
// "java.util;Scanner;true;skip;;;Argument[-1];ReturnValue;value;manual"
140285
Scanner out = null;
141-
Scanner in = (Scanner)source();
142-
out = in.skip((Pattern)null);
286+
Scanner in = (Scanner) source();
287+
out = in.skip((Pattern) null);
143288
sink(out); // $ hasValueFlow
144289
}
145290
{
146291
// "java.util;Scanner;true;skip;;;Argument[-1];ReturnValue;value;manual"
147292
Scanner out = null;
148-
Scanner in = (Scanner)source();
149-
out = in.skip((String)null);
293+
Scanner in = (Scanner) source();
294+
out = in.skip((String) null);
150295
sink(out); // $ hasValueFlow
151296
}
152297
{
153298
// "java.util;Scanner;true;useDelimiter;;;Argument[-1];ReturnValue;value;manual"
154299
Scanner out = null;
155-
Scanner in = (Scanner)source();
156-
out = in.useDelimiter((Pattern)null);
300+
Scanner in = (Scanner) source();
301+
out = in.useDelimiter((Pattern) null);
157302
sink(out); // $ hasValueFlow
158303
}
159304
{
160305
// "java.util;Scanner;true;useDelimiter;;;Argument[-1];ReturnValue;value;manual"
161306
Scanner out = null;
162-
Scanner in = (Scanner)source();
163-
out = in.useDelimiter((String)null);
307+
Scanner in = (Scanner) source();
308+
out = in.useDelimiter((String) null);
164309
sink(out); // $ hasValueFlow
165310
}
166311
{
167312
// "java.util;Scanner;true;useLocale;;;Argument[-1];ReturnValue;value;manual"
168313
Scanner out = null;
169-
Scanner in = (Scanner)source();
314+
Scanner in = (Scanner) source();
170315
out = in.useLocale(null);
171316
sink(out); // $ hasValueFlow
172317
}
173318
{
174319
// "java.util;Scanner;true;useRadix;;;Argument[-1];ReturnValue;value;manual"
175320
Scanner out = null;
176-
Scanner in = (Scanner)source();
321+
Scanner in = (Scanner) source();
177322
out = in.useRadix(0);
178323
sink(out); // $ hasValueFlow
179324
}
180325

181326
}
182327

183-
}
328+
}

0 commit comments

Comments
 (0)