Skip to content

Commit 4be731d

Browse files
aschackmullaschackmull
committed
Java: Adjust reference to static method and add test.
1 parent 80ee92a commit 4be731d

File tree

11 files changed

+348
-8
lines changed

11 files changed

+348
-8
lines changed

‎java/ql/src/semmle/code/java/frameworks/FastJson.qll

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,14 @@
55
import java
66

77
/**
8-
* The class `com.alibaba.fastjson.JSON` or `com.alibaba.fastjson.JSONObject`.
8+
* The class `com.alibaba.fastjson.JSON`.
99
*/
1010
class FastJson extends RefType {
11-
FastJson() {
12-
this.hasQualifiedName("com.alibaba.fastjson", "JSON") or
13-
this.hasQualifiedName("com.alibaba.fastjson", "JSONObject")
14-
}
11+
FastJson() { this.hasQualifiedName("com.alibaba.fastjson", "JSON") }
1512
}
1613

1714
/**
18-
* A FastJson parse method. This is either `parse` or `parseObject` on either
19-
* `com.alibaba.fastjson.JSON` or `com.alibaba.fastjson.JSONObject`.
15+
* A FastJson parse method. This is either `JSON.parse` or `JSON.parseObject`.
2016
*/
2117
class FastJsonParseMethod extends Method {
2218
FastJsonParseMethod() {

‎java/ql/test/query-tests/security/CWE-502/B.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
import java.io.*;
2+
import java.net.Socket;
3+
import com.alibaba.fastjson.JSON;
4+
5+
public class B {
6+
public Object deserializeJson1(Socket sock) {
7+
InputStream inputStream = sock.getInputStream();
8+
return JSON.parseObject(inputStream, null); // unsafe
9+
}
10+
11+
public Object deserializeJson2(Socket sock) {
12+
InputStream inputStream = sock.getInputStream();
13+
byte[] bytes = new byte[100];
14+
inputStream.read(bytes);
15+
return JSON.parse(bytes); // unsafe
16+
}
17+
18+
public Object deserializeJson3(Socket sock) {
19+
InputStream inputStream = sock.getInputStream();
20+
byte[] bytes = new byte[100];
21+
inputStream.read(bytes);
22+
String s = new String(bytes);
23+
return JSON.parseObject(s); // unsafe
24+
}
25+
26+
public Object deserializeJson4(Socket sock) {
27+
InputStream inputStream = sock.getInputStream();
28+
byte[] bytes = new byte[100];
29+
inputStream.read(bytes);
30+
String s = new String(bytes);
31+
return JSON.parse(s); // unsafe
32+
}
33+
}

‎java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ edges
1616
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
1717
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input |
1818
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
19+
| B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream |
20+
| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes |
21+
| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s |
22+
| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:31:23:31:23 | s |
1923
| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
2024
nodes
2125
| A.java:13:31:13:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -42,6 +46,14 @@ nodes
4246
| A.java:73:28:73:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
4347
| A.java:74:24:74:28 | input | semmle.label | input |
4448
| A.java:75:24:75:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
49+
| B.java:7:31:7:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
50+
| B.java:8:29:8:39 | inputStream | semmle.label | inputStream |
51+
| B.java:12:31:12:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
52+
| B.java:15:23:15:27 | bytes | semmle.label | bytes |
53+
| B.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
54+
| B.java:23:29:23:29 | s | semmle.label | s |
55+
| B.java:27:31:27:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
56+
| B.java:31:23:31:23 | s | semmle.label | s |
4557
| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | semmle.label | entityStream : InputStream |
4658
| TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) | semmle.label | new ObjectInputStream(...) |
4759
#select
@@ -62,4 +74,8 @@ nodes
6274
| A.java:73:17:73:56 | parse(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
6375
| A.java:74:12:74:38 | loadAs(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
6476
| A.java:75:12:75:61 | loadAs(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
77+
| B.java:8:12:8:46 | parseObject(...) | B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream | Unsafe deserialization of $@. | B.java:7:31:7:51 | getInputStream(...) | user input |
78+
| B.java:15:12:15:28 | parse(...) | B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes | Unsafe deserialization of $@. | B.java:12:31:12:51 | getInputStream(...) | user input |
79+
| B.java:23:12:23:30 | parseObject(...) | B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s | Unsafe deserialization of $@. | B.java:19:31:19:51 | getInputStream(...) | user input |
80+
| B.java:31:12:31:24 | parse(...) | B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:31:23:31:23 | s | Unsafe deserialization of $@. | B.java:27:31:27:51 | getInputStream(...) | user input |
6581
| TestMessageBodyReader.java:22:18:22:65 | readObject(...) | TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) | Unsafe deserialization of $@. | TestMessageBodyReader.java:20:55:20:78 | entityStream | user input |

‎java/ql/test/query-tests/security/CWE-502/options

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/snakeyaml-1.21:${testdir}/../../../stubs/xstream-1.4.10:${testdir}/../../../stubs/kryo-4.0.2:${testdir}/../../../stubs/jsr311-api-1.1.1
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/snakeyaml-1.21:${testdir}/../../../stubs/xstream-1.4.10:${testdir}/../../../stubs/kryo-4.0.2:${testdir}/../../../stubs/jsr311-api-1.1.1:${testdir}/../../../stubs/fastjson-1.2.74

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
/*
2+
* Copyright 1999-2017 Alibaba Group.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package com.alibaba.fastjson;
17+
18+
import java.io.IOException;
19+
import java.io.InputStream;
20+
import java.lang.reflect.Type;
21+
import java.nio.charset.Charset;
22+
import java.nio.charset.CharsetDecoder;
23+
import java.util.*;
24+
25+
import com.alibaba.fastjson.parser.*;
26+
import com.alibaba.fastjson.parser.deserializer.ParseProcess;
27+
28+
public abstract class JSON {
29+
public static Object parse(String text) {
30+
return null;
31+
}
32+
33+
public static Object parse(String text, ParserConfig config) {
34+
return null;
35+
}
36+
37+
public static Object parse(String text, ParserConfig config, Feature... features) {
38+
return null;
39+
}
40+
41+
public static Object parse(String text, ParserConfig config, int features) {
42+
return null;
43+
}
44+
45+
public static Object parse(String text, int features) {
46+
return null;
47+
}
48+
49+
public static Object parse(byte[] input, Feature... features) {
50+
return null;
51+
}
52+
53+
public static Object parse(byte[] input, int off, int len, CharsetDecoder charsetDecoder, Feature... features) {
54+
return null;
55+
}
56+
57+
public static Object parse(byte[] input, int off, int len, CharsetDecoder charsetDecoder, int features) {
58+
return null;
59+
}
60+
61+
public static Object parse(String text, Feature... features) {
62+
return null;
63+
}
64+
65+
public static JSONObject parseObject(String text, Feature... features) {
66+
return null;
67+
}
68+
69+
public static JSONObject parseObject(String text) {
70+
return null;
71+
}
72+
73+
public static <T> T parseObject(String text, TypeReference<T> type, Feature... features) {
74+
return null;
75+
}
76+
77+
public static <T> T parseObject(String json, Class<T> clazz, Feature... features) {
78+
return null;
79+
}
80+
81+
public static <T> T parseObject(String text, Class<T> clazz, ParseProcess processor, Feature... features) {
82+
return null;
83+
}
84+
85+
public static <T> T parseObject(String json, Type type, Feature... features) {
86+
return null;
87+
}
88+
89+
public static <T> T parseObject(String input, Type clazz, ParseProcess processor, Feature... features) {
90+
return null;
91+
}
92+
93+
public static <T> T parseObject(String input, Type clazz, int featureValues, Feature... features) {
94+
return null;
95+
}
96+
97+
public static <T> T parseObject(String input, Type clazz, ParserConfig config, Feature... features) {
98+
return null;
99+
}
100+
101+
public static <T> T parseObject(String input, Type clazz, ParserConfig config, int featureValues,
102+
Feature... features) {
103+
return null;
104+
}
105+
106+
public static <T> T parseObject(String input, Type clazz, ParserConfig config, ParseProcess processor,
107+
int featureValues, Feature... features) {
108+
return null;
109+
}
110+
111+
public static <T> T parseObject(byte[] bytes, Type clazz, Feature... features) {
112+
return null;
113+
}
114+
115+
public static <T> T parseObject(byte[] bytes, int offset, int len, Charset charset, Type clazz, Feature... features) {
116+
return null;
117+
}
118+
119+
public static <T> T parseObject(byte[] bytes,
120+
Charset charset,
121+
Type clazz,
122+
ParserConfig config,
123+
ParseProcess processor,
124+
int featureValues,
125+
Feature... features) {
126+
return null;
127+
}
128+
129+
public static <T> T parseObject(byte[] bytes, int offset, int len,
130+
Charset charset,
131+
Type clazz,
132+
ParserConfig config,
133+
ParseProcess processor,
134+
int featureValues,
135+
Feature... features) {
136+
return null;
137+
}
138+
139+
public static <T> T parseObject(byte[] input,
140+
int off,
141+
int len,
142+
CharsetDecoder charsetDecoder,
143+
Type clazz,
144+
Feature... features) {
145+
return null;
146+
}
147+
148+
public static <T> T parseObject(char[] input, int length, Type clazz, Feature... features) {
149+
return null;
150+
}
151+
152+
public static <T> T parseObject(InputStream is,
153+
Type type,
154+
Feature... features) throws IOException {
155+
return null;
156+
}
157+
158+
public static <T> T parseObject(InputStream is,
159+
Charset charset,
160+
Type type,
161+
Feature... features) throws IOException {
162+
return null;
163+
}
164+
165+
public static <T> T parseObject(InputStream is,
166+
Charset charset,
167+
Type type,
168+
ParserConfig config,
169+
Feature... features) throws IOException {
170+
return null;
171+
}
172+
173+
public static <T> T parseObject(InputStream is,
174+
Charset charset,
175+
Type type,
176+
ParserConfig config,
177+
ParseProcess processor,
178+
int featureValues,
179+
Feature... features) throws IOException {
180+
return null;
181+
}
182+
183+
public static <T> T parseObject(String text, Class<T> clazz) {
184+
return null;
185+
}
186+
187+
public static JSONArray parseArray(String text) {
188+
return null;
189+
}
190+
191+
public static JSONArray parseArray(String text, ParserConfig parserConfig) {
192+
return null;
193+
}
194+
195+
public static <T> List<T> parseArray(String text, Class<T> clazz) {
196+
return null;
197+
}
198+
199+
public static <T> List<T> parseArray(String text, Class<T> clazz, ParserConfig config) {
200+
return null;
201+
}
202+
203+
public static List<Object> parseArray(String text, Type[] types) {
204+
return null;
205+
}
206+
207+
public static List<Object> parseArray(String text, Type[] types, ParserConfig config) {
208+
return null;
209+
}
210+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSONArray.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/*
2+
* Copyright 1999-2017 Alibaba Group.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package com.alibaba.fastjson;
17+
18+
public class JSONArray extends JSON {
19+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSONObject.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/*
2+
* Copyright 1999-2017 Alibaba Group.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package com.alibaba.fastjson;
17+
18+
public class JSONObject extends JSON {
19+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/TypeReference.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package com.alibaba.fastjson;
2+
3+
public class TypeReference<T> {
4+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/parser/Feature.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/*
2+
* Copyright 1999-2017 Alibaba Group.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package com.alibaba.fastjson.parser;
17+
18+
public enum Feature {
19+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/parser/ParserConfig.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/*
2+
* Copyright 1999-2017 Alibaba Group.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package com.alibaba.fastjson.parser;
17+
18+
public class ParserConfig {
19+
public void setSafeMode(boolean safeMode) { }
20+
}

‎java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/parser/deserializer/ParseProcess.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package com.alibaba.fastjson.parser.deserializer;
2+
3+
public interface ParseProcess {
4+
}

0 commit comments

Comments
 (0)