Skip to content

Java: Promote regex injection query from experimental #11070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jcogs33 merged 23 commits into from
Nov 21, 2022
Merged

Java: Promote regex injection query from experimental #11070

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
32b1400
move files out of experimental
Oct 24, 2022
25436fe
update options and qlref files
Oct 24, 2022
833c5ed
move to .qll file and switch to InlineExpectations tests
Oct 24, 2022
6545cff
add Pattern.quote sanitizer
Oct 25, 2022
6ba7449
adjust imports
Oct 27, 2022
037a05c
add classes for Pattern, Matcher, and RegExUtils
Oct 27, 2022
f6f26fe
refactor code; add change note
Oct 31, 2022
50d638d
create RegexInjection.qll file
Oct 31, 2022
91491d9
refactor into more classes; add more test cases; add LITERAL sanitizer
Oct 31, 2022
5b089bb
split sanitizer into three
Nov 1, 2022
81ad10b
update sink names
Nov 1, 2022
eb30e8f
move Pattern.quote and Pattern.LITERAL models to Regex.qll
Nov 1, 2022
32f7348
update help file
Nov 1, 2022
5dcd3b2
clean up files
Nov 1, 2022
be548c1
switch sink to use csv models
Nov 3, 2022
5402001
remove original sanitizer
Nov 3, 2022
695d6f0
move files to regexp directory
Nov 3, 2022
0e93e71
update tests
Nov 3, 2022
e49c521
update change note
Nov 3, 2022
b99a1d2
update sink and tests
Nov 4, 2022
bada986
apply review comments
Nov 8, 2022
13decd3
update sink
Nov 8, 2022
9e2ec9d
apply docs review suggestion
Nov 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
update sink and tests
  • Loading branch information
Jami Cogswell Jami Cogswell
Jami Cogswell authored and Jami Cogswell committed Nov 8, 2022
commit b99a1d2cd9924b7261a205eb82ecbcfb1ae2b160
12 changes: 6 additions & 6 deletions java/ql/lib/semmle/code/java/regex/RegexFlowModels.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,12 @@ private class RegexSinkCsv extends SinkModelCsv {
"com.google.common.base;Splitter;false;split;(CharSequence);;Argument[-1];regex-use[0];manual",
"com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[-1];regex-use[0];manual",
"com.google.common.base;Splitter$MapSplitter;false;split;(CharSequence);;Argument[-1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;removeAll;(String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;removeFirst;(String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;removePattern;(String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;replaceAll;(String,String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;replaceFirst;(String,String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;replacePattern;(String,String,String);;Argument[1];regex-use[0];manual",
"org.apache.commons.lang3;RegExUtils;false;removeAll;(String,String);;Argument[1];regex-use;manual",
"org.apache.commons.lang3;RegExUtils;false;removeFirst;(String,String);;Argument[1];regex-use;manual",
"org.apache.commons.lang3;RegExUtils;false;removePattern;(String,String);;Argument[1];regex-use;manual",
"org.apache.commons.lang3;RegExUtils;false;replaceAll;(String,String,String);;Argument[1];regex-use;manual",
"org.apache.commons.lang3;RegExUtils;false;replaceFirst;(String,String,String);;Argument[1];regex-use;manual",
"org.apache.commons.lang3;RegExUtils;false;replacePattern;(String,String,String);;Argument[1];regex-use;manual",
]
}
}
4 changes: 1 addition & 3 deletions java/ql/lib/semmle/code/java/security/regexp/RegexInjection.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,7 @@ abstract class RegexInjectionSanitizer extends DataFlow::ExprNode { }
private class DefaultRegexInjectionSink extends RegexInjectionSink {
DefaultRegexInjectionSink() {
exists(string kind |
kind.matches([
"regex-use[]", "regex-use[f1]", "regex-use[f-1]", "regex-use[-1]", "regex-use[0]"
]) and
kind.matches(["regex-use[]", "regex-use[f1]", "regex-use[f-1]", "regex-use[-1]", "regex-use"]) and
sinkNode(this, kind)
)
}
Expand Down
16 changes: 14 additions & 2 deletions java/ql/test/query-tests/security/CWE-730/RegexInjectionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
import javax.servlet.ServletException;

import org.apache.commons.lang3.RegExUtils;
import com.google.common.base.Splitter;

public class RegexInjectionTest extends HttpServlet {
public boolean string1(javax.servlet.http.HttpServletRequest request) {
Expand Down Expand Up @@ -138,10 +139,10 @@ public boolean apache7(javax.servlet.http.HttpServletRequest request) {

// test `Pattern.quote` sanitizer
public boolean quoteTest(javax.servlet.http.HttpServletRequest request) {
String regex = request.getParameter("regex");
String pattern = request.getParameter("pattern");
String input = request.getParameter("input");

return input.matches(Pattern.quote(regex)); // Safe
return input.matches(Pattern.quote(pattern)); // Safe
}

// test `Pattern.LITERAL` sanitizer
Expand All @@ -151,4 +152,15 @@ public boolean literalTest(javax.servlet.http.HttpServletRequest request) {

return Pattern.compile(pattern, Pattern.LITERAL).matcher(input).matches(); // Safe
}

public Splitter guava1(javax.servlet.http.HttpServletRequest request) {
String pattern = request.getParameter("pattern");
return Splitter.onPattern(pattern); // $ hasRegexInjection
}

public Splitter guava2(javax.servlet.http.HttpServletRequest request) {
String pattern = request.getParameter("pattern");
// sink is `Pattern.compile`
return Splitter.on(Pattern.compile(pattern)); // $ hasRegexInjection
}
}