codeql/java/ql/test/library-tests/frameworks/guava/TestCollect.java at sauyon/java-spring-stringutils · ByteDecoder/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
package com.google.common.collect;

import java.util.Map;
import java.util.SortedSet;
import java.util.SortedMap;
import java.util.Comparator;

class TestCollect {
    String taint() { return "tainted"; }

    void sink(Object o) {}

    void test1() {
        String x = taint();

        ImmutableSet<String> xs = ImmutableSet.of(x, "y", "z");
        sink(xs.asList()); // $numTaintFlow=1

        ImmutableSet<String> ys = ImmutableSet.of("a", "b", "c");

        sink(Sets.filter(Sets.union(xs, ys), y -> true)); // $numTaintFlow=1

        sink(Sets.newHashSet("a", "b", "c", "d", x)); // $numTaintFlow=1
    }

    void test2() {
        sink(ImmutableList.of(taint(), taint(), taint(), taint()));  // $numTaintFlow=4
        sink(ImmutableMap.of(taint(), taint(), taint(), taint()));  // $numTaintFlow=2
        sink(ImmutableMultimap.of(taint(), taint(), taint(), taint()));  // $numTaintFlow=2
        sink(ImmutableTable.of(taint(),taint(), taint()));  // $numTaintFlow=1
    }

    void test3() {
        String x = taint();

        ImmutableList.Builder<String> b = ImmutableList.builder();

        b.add("a");
        sink(b);
        b.add(x);
        sink(b.build()); // $numTaintFlow=1

        b = ImmutableList.builder();

        b.add("a").add(x);
        sink(b.build()); // $numTaintFlow=1

        sink(ImmutableList.builder().add("a").add(x).build()); // $numTaintFlow=1

        ImmutableMap.Builder<String, String> b2 = ImmutableMap.builder();
        b2.put(x,"v");
        sink(b2);
        b2.put("k",x);
        sink(b2.build()); // $numTaintFlow=1
    }

    void test4(Table<String, String, String> t1, Table<String, String, String> t2, Table<String, String, String> t3) {
        String x = taint();
        t1.put(x, "c", "v");
        sink(t1);
        t1.put("r", x, "v");
        sink(t1);
        t1.put("r", "c", x);
        sink(t1); // $numTaintFlow=1
        sink(t1.row("r")); // $numTaintFlow=1

        t2.putAll(t1);
        for (Table.Cell<String,String,String> c : t2.cellSet()) {
            sink(c.getValue()); // $numTaintFlow=1
        }

        sink(t1.remove("r", "c")); // $numTaintFlow=1

        t3.row("r").put("c", x);
        sink(t3);  // $ MISSING:numTaintFlow=1
    }

    void test4(Multimap<String, String> m1, Multimap<String, String> m2, Multimap<String, String> m3,
           Multimap<String, String> m4, Multimap<String, String> m5){
        String x = taint();
        m1.put("k", x);
        sink(m1); // $numTaintFlow=1
        sink(m1.get("k")); // $numTaintFlow=1

        m2.putAll("k", ImmutableList.of("a", x, "b"));
        sink(m2); // $numTaintFlow=1

        m3.putAll(m1);
        sink(m3); // $numTaintFlow=1

        m4.replaceValues("k", m1.replaceValues("k", ImmutableList.of("a")));
        for (Map.Entry<String, String> e : m4.entries()) {
            sink(e.getValue()); // $numTaintFlow=1
        }

        m5.asMap().get("k").add(x);
        sink(m5);  // $ MISSING:numTaintFlow=1
    }

    void test5(Comparator<String> comp, SortedSet<String> sorS, SortedMap<String, String> sorM) {
        ImmutableSortedSet<String> s = ImmutableSortedSet.of(taint());

        sink(s); // $numTaintFlow=1
        sink(ImmutableSortedSet.copyOf(s)); // $numTaintFlow=1
        sink(ImmutableSortedSet.copyOf(comp, s)); // $numTaintFlow=1

        sorS.add(taint());
        sink(ImmutableSortedSet.copyOfSorted(sorS)); // $numTaintFlow=1

        sink(ImmutableList.sortedCopyOf(s)); // $numTaintFlow=1
        sink(ImmutableList.sortedCopyOf(comp, s)); // $numTaintFlow=1

        ImmutableSortedMap<String, String> m = ImmutableSortedMap.of("k", taint());

        sink(m); // $numTaintFlow=1
        sink(ImmutableSortedMap.copyOf(m)); // $numTaintFlow=1
        sink(ImmutableSortedMap.copyOf(m, comp)); // $numTaintFlow=1

        sorM.put("k", taint());
        sink(ImmutableSortedMap.copyOfSorted(sorM)); // $numTaintFlow=1
    }
}