Repository navigation
Expand file tree
/
Copy pathProtobuf.qll
More file actions
69 lines (59 loc) · 2.12 KB
/
Copy pathProtobuf.qll
File metadata and controls
69 lines (59 loc) · 2.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
/**
* Provides classes and predicates for working with the Protobuf framework.
*/
overlay[local?]
module;
import java
import semmle.code.java.dataflow.FlowSteps
/**
* The interface `com.google.protobuf.Parser`.
*/
class ProtobufParser extends Interface {
ProtobufParser() { this.hasQualifiedName("com.google.protobuf", "Parser") }
/**
* Gets a method named `parseFrom` (or similar) declared on a subtype of `com.google.protobuf.Parser`.
*/
Method getAParseFromMethod() {
result.getDeclaringType().getAnAncestor().getSourceDeclaration() = this and
result.getName().matches("parse%From")
}
}
/**
* The interface `com.google.protobuf.MessageLite`.
*/
class ProtobufMessageLite extends Interface {
ProtobufMessageLite() { this.hasQualifiedName("com.google.protobuf", "MessageLite") }
/**
* Gets a static method named `parseFrom` (or similar) declared on a subtype of the `MessageLite` interface.
*/
Method getAParseFromMethod() {
result = this.getASubtype+().getAMethod() and
result.getName().matches("parse%From") and
result.isStatic()
}
/**
* Gets a getter method declared on a subtype of the `MessageLite` interface.
*/
Method getAGetterMethod() {
exists(RefType decl | decl = result.getDeclaringType() and decl = this.getASubtype+() |
exists(string name, string suffix | suffix = ["", "list", "map", "ordefault", "orthrow"] |
exists(Field f | f.getDeclaringType() = decl |
f.getName().toLowerCase().replaceAll("_", "") = name
) and
result.getName().toLowerCase() = "get" + name + suffix
)
)
}
}
private class TaintPreservingGetterMethod extends TaintPreservingCallable {
TaintPreservingGetterMethod() { this = any(ProtobufMessageLite p).getAGetterMethod() }
override predicate returnsTaintFrom(int arg) { arg = -1 }
}
private class TaintPreservingParseFromMethod extends TaintPreservingCallable {
TaintPreservingParseFromMethod() {
exists(ProtobufParser p | this = p.getAParseFromMethod())
or
exists(ProtobufMessageLite m | this = m.getAParseFromMethod())
}
override predicate returnsTaintFrom(int arg) { arg = 0 }
}