Skip to content

Commit 43b425d

Browse files
atorralbaatorralba
authored
Merge pull request #9002 from atorralba/atorralba/https-urls-improvs
Java: Add OkHttp and Retrofit models
2 parents 506e09e + 2d3b15f commit 43b425d

File tree

117 files changed

+6173
-11
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

117 files changed

+6173
-11
lines changed

‎java/ql/lib/change-notes/2022-05-02-okhttp-retrofit-models.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added models for the libraries OkHttp and Retrofit.

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,10 @@ private module Frameworks {
102102
private import semmle.code.java.frameworks.JsonJava
103103
private import semmle.code.java.frameworks.Logging
104104
private import semmle.code.java.frameworks.Objects
105+
private import semmle.code.java.frameworks.OkHttp
105106
private import semmle.code.java.frameworks.Optional
106107
private import semmle.code.java.frameworks.Regex
108+
private import semmle.code.java.frameworks.Retrofit
107109
private import semmle.code.java.frameworks.Stream
108110
private import semmle.code.java.frameworks.Strings
109111
private import semmle.code.java.frameworks.ratpack.Ratpack

‎java/ql/lib/semmle/code/java/frameworks/OkHttp.qll

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/**
2+
* Provides classes and predicates for working with the OkHttp client.
3+
*/
4+
5+
import java
6+
private import semmle.code.java.dataflow.ExternalFlow
7+
8+
private class OkHttpOpenUrlSinks extends SinkModelCsv {
9+
override predicate row(string row) {
10+
row =
11+
[
12+
"okhttp3;Request;true;Request;;;Argument[0];open-url",
13+
"okhttp3;Request$Builder;true;url;;;Argument[0];open-url"
14+
]
15+
}
16+
}
17+
18+
private class OKHttpSummaries extends SummaryModelCsv {
19+
override predicate row(string row) {
20+
row =
21+
[
22+
"okhttp3;HttpUrl;false;parse;;;Argument[0];ReturnValue;taint",
23+
"okhttp3;HttpUrl;false;uri;;;Argument[-1];ReturnValue;taint",
24+
"okhttp3;HttpUrl;false;url;;;Argument[-1];ReturnValue;taint",
25+
"okhttp3;HttpUrl$Builder;false;addEncodedPathSegment;;;Argument[-1];ReturnValue;value",
26+
"okhttp3;HttpUrl$Builder;false;addEncodedPathSegment;;;Argument[0];Argument[-1];taint",
27+
"okhttp3;HttpUrl$Builder;false;addEncodedPathSegments;;;Argument[-1];ReturnValue;value",
28+
"okhttp3;HttpUrl$Builder;false;addEncodedPathSegments;;;Argument[0];Argument[-1];taint",
29+
"okhttp3;HttpUrl$Builder;false;addEncodedQueryParameter;;;Argument[-1];ReturnValue;value",
30+
"okhttp3;HttpUrl$Builder;false;addEncodedQueryParameter;;;Argument[0];Argument[-1];taint",
31+
"okhttp3;HttpUrl$Builder;false;addPathSegment;;;Argument[-1];ReturnValue;value",
32+
"okhttp3;HttpUrl$Builder;false;addPathSegment;;;Argument[0];Argument[-1];taint",
33+
"okhttp3;HttpUrl$Builder;false;addPathSegments;;;Argument[-1];ReturnValue;value",
34+
"okhttp3;HttpUrl$Builder;false;addPathSegments;;;Argument[0];Argument[-1];taint",
35+
"okhttp3;HttpUrl$Builder;false;addQueryParameter;;;Argument[-1];ReturnValue;value",
36+
"okhttp3;HttpUrl$Builder;false;addQueryParameter;;;Argument[0..1];Argument[-1];taint",
37+
"okhttp3;HttpUrl$Builder;false;build;;;Argument[-1];ReturnValue;taint",
38+
"okhttp3;HttpUrl$Builder;false;encodedFragment;;;Argument[-1];ReturnValue;value",
39+
"okhttp3;HttpUrl$Builder;false;encodedFragment;;;Argument[0];Argument[-1];taint",
40+
"okhttp3;HttpUrl$Builder;false;encodedPassword;;;Argument[-1];ReturnValue;value",
41+
"okhttp3;HttpUrl$Builder;false;encodedPath;;;Argument[-1];ReturnValue;value",
42+
"okhttp3;HttpUrl$Builder;false;encodedPath;;;Argument[0];Argument[-1];taint",
43+
"okhttp3;HttpUrl$Builder;false;encodedQuery;;;Argument[-1];ReturnValue;value",
44+
"okhttp3;HttpUrl$Builder;false;encodedQuery;;;Argument[0];Argument[-1];taint",
45+
"okhttp3;HttpUrl$Builder;false;encodedUsername;;;Argument[-1];ReturnValue;value",
46+
"okhttp3;HttpUrl$Builder;false;fragment;;;Argument[-1];ReturnValue;value",
47+
"okhttp3;HttpUrl$Builder;false;fragment;;;Argument[0];Argument[-1];taint",
48+
"okhttp3;HttpUrl$Builder;false;host;;;Argument[-1];ReturnValue;value",
49+
"okhttp3;HttpUrl$Builder;false;host;;;Argument[0];Argument[-1];taint",
50+
"okhttp3;HttpUrl$Builder;false;password;;;Argument[-1];ReturnValue;value",
51+
"okhttp3;HttpUrl$Builder;false;port;;;Argument[-1];ReturnValue;value",
52+
"okhttp3;HttpUrl$Builder;false;port;;;Argument[0];Argument[-1];taint",
53+
"okhttp3;HttpUrl$Builder;false;query;;;Argument[-1];ReturnValue;value",
54+
"okhttp3;HttpUrl$Builder;false;query;;;Argument[0];Argument[-1];taint",
55+
"okhttp3;HttpUrl$Builder;false;removeAllEncodedQueryParameters;;;Argument[-1];ReturnValue;value",
56+
"okhttp3;HttpUrl$Builder;false;removeAllQueryParameters;;;Argument[-1];ReturnValue;value",
57+
"okhttp3;HttpUrl$Builder;false;removePathSegment;;;Argument[-1];ReturnValue;value",
58+
"okhttp3;HttpUrl$Builder;false;scheme;;;Argument[-1];ReturnValue;value",
59+
"okhttp3;HttpUrl$Builder;false;scheme;;;Argument[0];Argument[-1];taint",
60+
"okhttp3;HttpUrl$Builder;false;setEncodedPathSegment;;;Argument[-1];ReturnValue;value",
61+
"okhttp3;HttpUrl$Builder;false;setEncodedPathSegment;;;Argument[0];Argument[-1];taint",
62+
"okhttp3;HttpUrl$Builder;false;setEncodedQueryParameter;;;Argument[-1];ReturnValue;value",
63+
"okhttp3;HttpUrl$Builder;false;setEncodedQueryParameter;;;Argument[0];Argument[-1];taint",
64+
"okhttp3;HttpUrl$Builder;false;setPathSegment;;;Argument[-1];ReturnValue;value",
65+
"okhttp3;HttpUrl$Builder;false;setPathSegment;;;Argument[0];Argument[-1];taint",
66+
"okhttp3;HttpUrl$Builder;false;setQueryParameter;;;Argument[-1];ReturnValue;value",
67+
"okhttp3;HttpUrl$Builder;false;setQueryParameter;;;Argument[0];Argument[-1];taint",
68+
"okhttp3;HttpUrl$Builder;false;username;;;Argument[-1];ReturnValue;value",
69+
]
70+
}
71+
}

‎java/ql/lib/semmle/code/java/frameworks/Retrofit.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/**
2+
* Provides classes and predicates for working with the Retrofit API client.
3+
*/
4+
5+
import java
6+
private import semmle.code.java.dataflow.ExternalFlow
7+
8+
private class RetrofitOpenUrlSinks extends SinkModelCsv {
9+
override predicate row(string row) {
10+
row = "retrofit2;Retrofit$Builder;true;baseUrl;;;Argument[0];open-url"
11+
}
12+
}

‎java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,7 @@ import java
1414
import semmle.code.java.security.HttpsUrlsQuery
1515
import DataFlow::PathGraph
1616

17-
from DataFlow::PathNode source, DataFlow::PathNode sink, MethodAccess m, HttpStringLiteral s
18-
where
19-
source.getNode().asExpr() = s and
20-
sink.getNode().asExpr() = m.getQualifier() and
21-
any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
22-
select m, source, sink, "URL may have been constructed with HTTP protocol, using $@.", s,
23-
"this source"
17+
from DataFlow::PathNode source, DataFlow::PathNode sink
18+
where any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
19+
select sink.getNode(), source, sink, "URL may have been constructed with HTTP protocol, using $@.",
20+
source.getNode(), "this source"

‎java/ql/src/change-notes/2022-05-02-non-https-urls-simplified.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The query `java/non-https-urls` has been simplified
5+
and no longer requires its sinks to be `MethodAccess`es.

0 commit comments

Comments
 (0)