forked from github/codeql
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathStrings.qll
More file actions
61 lines (59 loc) · 4.28 KB
/
Copy pathStrings.qll
File metadata and controls
61 lines (59 loc) · 4.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
/** Definitions of taint steps in String and String-related classes of the JDK */
import java
private import semmle.code.java.dataflow.ExternalFlow
private class StringSummaryCsv extends SummaryModelCsv {
override predicate row(string row) {
row =
[
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
"java.lang;String;false;concat;(String);;Argument[0];ReturnValue;taint",
"java.lang;String;false;concat;(String);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;copyValueOf;;;Argument[0];ReturnValue;taint",
"java.lang;String;false;endsWith;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;format;(Locale,String,Object[]);;Argument[1];ReturnValue;taint",
"java.lang;String;false;format;(Locale,String,Object[]);;ArrayElement of Argument[2];ReturnValue;taint",
"java.lang;String;false;format;(String,Object[]);;Argument[0];ReturnValue;taint",
"java.lang;String;false;format;(String,Object[]);;ArrayElement of Argument[1];ReturnValue;taint",
"java.lang;String;false;formatted;(Object[]);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;formatted;(Object[]);;ArrayElement of Argument[0];ReturnValue;taint",
"java.lang;String;false;getChars;;;Argument[-1];Argument[2];taint",
"java.lang;String;false;getBytes;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;indent;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;intern;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint",
"java.lang;String;false;repeat;(int);;Argument[-1];ReturnValue;taint",
"java.lang;String;false;split;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;String;;;Argument[0];Argument[-1];taint",
"java.lang;String;false;strip;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;stripIndent;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;stripLeading;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;stripTrailing;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;substring;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;toCharArray;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;toLowerCase;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;toString;;;Argument[-1];ReturnValue;value",
"java.lang;String;false;toUpperCase;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;translateEscapes;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;trim;;;Argument[-1];ReturnValue;taint",
"java.lang;String;false;valueOf;(char);;Argument[0];ReturnValue;taint",
"java.lang;String;false;valueOf;(char[],int,int);;Argument[0];ReturnValue;taint",
"java.lang;String;false;valueOf;(char[]);;Argument[0];ReturnValue;taint",
"java.io;StringWriter;true;append;;;Argument[0];Argument[-1];taint",
"java.io;StringWriter;true;append;;;Argument[-1];ReturnValue;value",
"java.io;StringWriter;true;write;;;Argument[0];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;AbstractStringBuilder;(String);;Argument[0];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;append;;;Argument[0];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;append;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;insert;;;Argument[1];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;insert;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;replace;;;Argument[-1];ReturnValue;value",
"java.lang;AbstractStringBuilder;true;replace;;;Argument[2];Argument[-1];taint",
"java.lang;AbstractStringBuilder;true;toString;;;Argument[-1];ReturnValue;taint",
"java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint",
"java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint",
"java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint",
"java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint",
"java.lang;CharSequence;true;toString;;;Argument[-1];ReturnValue;taint"
]
}
}