Repository navigation
Expand file tree
/
Copy pathLang.qll
More file actions
122 lines (99 loc) · 4.16 KB
/
Copy pathLang.qll
File metadata and controls
122 lines (99 loc) · 4.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
/** Definitions related to the Apache Commons Lang library. */
overlay[local?]
module;
import java
private import semmle.code.java.dataflow.FlowSteps
/**
* The class `org.apache.commons.lang.RandomStringUtils` or `org.apache.commons.lang3.RandomStringUtils`.
*/
class TypeApacheRandomStringUtils extends Class {
TypeApacheRandomStringUtils() {
this.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"],
"RandomStringUtils")
}
}
/**
* DEPRECATED: Now modeled using data extensions instead.
*
* The method `deserialize` in either `org.apache.commons.lang.SerializationUtils`
* or `org.apache.commons.lang3.SerializationUtils`.
*/
deprecated class MethodApacheSerializationUtilsDeserialize extends Method {
MethodApacheSerializationUtilsDeserialize() {
this.getDeclaringType()
.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"],
"SerializationUtils") and
this.hasName("deserialize")
}
}
/**
* An Apache Commons-Lang StrBuilder method that returns `this`.
*/
private class ApacheStrBuilderFluentMethod extends FluentMethod {
ApacheStrBuilderFluentMethod() {
this.getReturnType().(RefType).hasQualifiedName("org.apache.commons.lang3.text", "StrBuilder")
}
}
/**
* The class `org.apache.commons.lang.SystemUtils` or `org.apache.commons.lang3.SystemUtils`.
*/
class TypeApacheSystemUtils extends Class {
TypeApacheSystemUtils() {
this.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "SystemUtils")
}
}
private predicate isStringLike(Type type) {
type.(RefType).hasQualifiedName("java.lang", ["String", "CharSequence"])
}
private predicate isCharacterSetType(Type type) {
isStringLike(type)
or
type.(Array).getElementType().(PrimitiveType).hasName("char")
}
/** A call to `StringUtils.contains` or `StringUtils.containsIgnoreCase`. */
private class ApacheStringUtilsSubstringMatch extends MethodCall, StringSubstringMatch::Range {
ApacheStringUtilsSubstringMatch() {
this.getMethod()
.getDeclaringType()
.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "StringUtils") and
this.getMethod().hasName(["contains", "containsIgnoreCase"]) and
isStringLike(this.getMethod().getParameterType(1))
}
override Expr getInputString() { result = this.getArgument(0) }
override Expr getMatchExpression() { result = this.getArgument(1) }
override predicate hasSubstringOnBranch(boolean branch) { branch = true }
override string getName() { result = "StringUtils." + this.getMethod().getName() }
}
/** A call to `StringUtils.containsAny` or `StringUtils.containsNone`. */
private class ApacheStringUtilsCharacterSetMatch extends MethodCall, StringCharacterSetMatch::Range {
ApacheStringUtilsCharacterSetMatch() {
this.getMethod()
.getDeclaringType()
.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "StringUtils") and
this.getMethod().hasName(["containsAny", "containsNone"]) and
isCharacterSetType(this.getMethod().getParameterType(1))
}
override Expr getInputString() { result = this.getArgument(0) }
override Expr getMatchExpression() { result = this.getArgument(1) }
override predicate hasMatchingCharacterOnBranch(boolean branch) {
this.getMethod().hasName("containsAny") and branch = true
or
this.getMethod().hasName("containsNone") and branch = false
}
override string getName() { result = "StringUtils." + this.getMethod().getName() }
}
/** A call to `StringUtils.replaceChars`. */
private class ApacheStringUtilsReplaceCharsCall extends MethodCall, StringReplacement::Range {
ApacheStringUtilsReplaceCharsCall() {
this.getMethod()
.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "StringUtils",
"replaceChars")
}
override Expr getInputString() { result = this.getArgument(0) }
override Expr getMatchExpression() { result = this.getArgument(1) }
override Expr getReplacement() { result = this.getArgument(2) }
override predicate matchExpressionIsCharacterSet() {
this.getMethod().getParameterType(1) instanceof TypeString
}
override string getName() { result = "StringUtils.replaceChars" }
}