From 404ca27aecef46df2ce38887782c5728ef8043cd Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Mon, 11 Nov 2024 10:08:45 +0100 Subject: [PATCH] Java: Move non-experimental models out of the experimental folder. --- .../lib/ext/experimental/java.nio.model.yml | 8 ------ .../ext/experimental/java.util.zip.model.yml | 6 ----- .../org.apache.shiro.authc.model.yml | 6 ----- .../s3-transfer-manager.model.yml | 13 ---------- .../ext/experimental/spring-core.model.yml | 26 ------------------- java/ql/lib/ext/java.nio.model.yml | 8 ++++++ java/ql/lib/ext/java.util.zip.model.yml | 1 + ....model.yml => net.lingala.zip4j.model.yml} | 0 .../lib/ext/org.apache.shiro.authc.model.yml | 6 +++++ .../ext/org.springframework.core.io.model.yml | 22 ++++++++++++++++ ....amazon.awssdk.transfer.s3.model.model.yml | 13 ++++++++++ 11 files changed, 50 insertions(+), 59 deletions(-) delete mode 100644 java/ql/lib/ext/experimental/java.nio.model.yml delete mode 100644 java/ql/lib/ext/experimental/java.util.zip.model.yml delete mode 100644 java/ql/lib/ext/experimental/org.apache.shiro.authc.model.yml delete mode 100644 java/ql/lib/ext/experimental/s3-transfer-manager.model.yml delete mode 100644 java/ql/lib/ext/experimental/spring-core.model.yml rename java/ql/lib/ext/{experimental/zip4j.model.yml => net.lingala.zip4j.model.yml} (100%) create mode 100644 java/ql/lib/ext/org.apache.shiro.authc.model.yml create mode 100644 java/ql/lib/ext/software.amazon.awssdk.transfer.s3.model.model.yml diff --git a/java/ql/lib/ext/experimental/java.nio.model.yml b/java/ql/lib/ext/experimental/java.nio.model.yml deleted file mode 100644 index 6d6af865a395..000000000000 --- a/java/ql/lib/ext/experimental/java.nio.model.yml +++ /dev/null @@ -1,8 +0,0 @@ -extensions: - - addsTo: - pack: codeql/java-all - extensible: sinkModel - data: - - ["java.nio.file","FileSystems",true,"getFileSystem","(URI)","","Argument[0]","path-injection","manual"] - - ["java.nio.channels","AsynchronousFileChannel",true,"open","(Path,OpenOption[])","","Argument[0]","path-injection","manual"] - - ["java.nio.channels","AsynchronousFileChannel",true,"open","(Path,Set,ExecutorService,FileAttribute[])","","Argument[0]","path-injection","manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/experimental/java.util.zip.model.yml b/java/ql/lib/ext/experimental/java.util.zip.model.yml deleted file mode 100644 index fb7b8f6671b7..000000000000 --- a/java/ql/lib/ext/experimental/java.util.zip.model.yml +++ /dev/null @@ -1,6 +0,0 @@ -extensions: - - addsTo: - pack: codeql/java-all - extensible: sinkModel - data: - - ["java.util.zip","ZipFile",true,"ZipFile","(String)","","Argument[0]","path-injection","manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/experimental/org.apache.shiro.authc.model.yml b/java/ql/lib/ext/experimental/org.apache.shiro.authc.model.yml deleted file mode 100644 index 6602a9caf7c3..000000000000 --- a/java/ql/lib/ext/experimental/org.apache.shiro.authc.model.yml +++ /dev/null @@ -1,6 +0,0 @@ -extensions: - - addsTo: - pack: codeql/java-all - extensible: sourceModel - data: - - ["org.apache.shiro.authc","AuthenticationToken",true,"getCredentials","()","","ReturnValue","remote","manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/experimental/s3-transfer-manager.model.yml b/java/ql/lib/ext/experimental/s3-transfer-manager.model.yml deleted file mode 100644 index bd3a385ac04d..000000000000 --- a/java/ql/lib/ext/experimental/s3-transfer-manager.model.yml +++ /dev/null @@ -1,13 +0,0 @@ -extensions: - - addsTo: - pack: codeql/java-all - extensible: sinkModel - data: - - ["software.amazon.awssdk.transfer.s3.model","ResumableFileUpload",true,"serializeToFile","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","DownloadFileRequest$Builder",true,"destination","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","UploadFileRequest$Builder",true,"source","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","DownloadDirectoryRequest$Builder",true,"destination","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","ResumableFileDownload",true,"fromFile","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","ResumableFileDownload",true,"serializeToFile","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","ResumableFileUpload",true,"fromFile","(Path)","","Argument[0]","path-injection","manual"] - - ["software.amazon.awssdk.transfer.s3.model","UploadDirectoryRequest$Builder",true,"source","(Path)","","Argument[0]","path-injection","manual"] diff --git a/java/ql/lib/ext/experimental/spring-core.model.yml b/java/ql/lib/ext/experimental/spring-core.model.yml deleted file mode 100644 index a43486504723..000000000000 --- a/java/ql/lib/ext/experimental/spring-core.model.yml +++ /dev/null @@ -1,26 +0,0 @@ -extensions: - - addsTo: - pack: codeql/java-all - extensible: sinkModel - data: - - ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(FileSystem,String)","","Argument[1]","path-injection","manual"] - - ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(File)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(Path)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","FileSystemResource",true,"FileSystemResource","(String)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","FileUrlResource",true,"FileUrlResource","(String)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","FileUrlResource",true,"FileUrlResource","(URL)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","PathResource",true,"PathResource","(Path)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","PathResource",true,"PathResource","(String)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","PathResource",true,"PathResource","(URI)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","UrlResource",true,"UrlResource","(String,String,String)","","Argument[1]","path-injection","manual"] - - ["org.springframework.core.io","UrlResource",true,"UrlResource","(String,String)","","Argument[1]","path-injection","manual"] - - ["org.springframework.core.io","UrlResource",true,"UrlResource","(String)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","UrlResource",true,"UrlResource","(URI)","","Argument[0]","path-injection","manual"] - - ["org.springframework.core.io","UrlResource",true,"UrlResource","(URL)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(Path,Path)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(Path,Path)","","Argument[1]","path-injection","manual"] - - ["org.springframework.util","FileSystemUtils",true,"deleteRecursively","(File)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","FileSystemUtils",true,"deleteRecursively","(Path)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","ResourceUtils",true,"getFile","(String)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","FileCopyUtils",true,"copyToByteArray","(File)","","Argument[0]","path-injection","manual"] - - ["org.springframework.util","FileSystemUtils",true,"copyRecursively","(File,File)","","Argument[0]","path-injection","manual"] diff --git a/java/ql/lib/ext/java.nio.model.yml b/java/ql/lib/ext/java.nio.model.yml index 40c12b6c6332..773878827455 100644 --- a/java/ql/lib/ext/java.nio.model.yml +++ b/java/ql/lib/ext/java.nio.model.yml @@ -1,4 +1,12 @@ extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["java.nio.file", "FileSystems", True, "getFileSystem", "(URI)", "", "Argument[0]", "path-injection", "manual"] + - ["java.nio.channels", "AsynchronousFileChannel", True, "open", "(Path,OpenOption[])", "", "Argument[0]", "path-injection", "manual"] + - ["java.nio.channels", "AsynchronousFileChannel", True, "open", "(Path,Set,ExecutorService,FileAttribute[])", "", "Argument[0]", "path-injection", "manual"] + - addsTo: pack: codeql/java-all extensible: summaryModel diff --git a/java/ql/lib/ext/java.util.zip.model.yml b/java/ql/lib/ext/java.util.zip.model.yml index 51957db1e90b..dc24570995f8 100644 --- a/java/ql/lib/ext/java.util.zip.model.yml +++ b/java/ql/lib/ext/java.util.zip.model.yml @@ -25,3 +25,4 @@ extensions: extensible: sinkModel data: - ["java.util.zip", "ZipOutputStream", True, "putNextEntry", "(ZipEntry)", "", "Argument[0]", "file-content-store", "ai-manual"] + - ["java.util.zip", "ZipFile", True, "ZipFile", "(String)", "", "Argument[0]", "path-injection", "manual"] diff --git a/java/ql/lib/ext/experimental/zip4j.model.yml b/java/ql/lib/ext/net.lingala.zip4j.model.yml similarity index 100% rename from java/ql/lib/ext/experimental/zip4j.model.yml rename to java/ql/lib/ext/net.lingala.zip4j.model.yml diff --git a/java/ql/lib/ext/org.apache.shiro.authc.model.yml b/java/ql/lib/ext/org.apache.shiro.authc.model.yml new file mode 100644 index 000000000000..dbb3c06f40fd --- /dev/null +++ b/java/ql/lib/ext/org.apache.shiro.authc.model.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.shiro.authc", "AuthenticationToken", True, "getCredentials", "()", "", "ReturnValue", "remote", "manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/org.springframework.core.io.model.yml b/java/ql/lib/ext/org.springframework.core.io.model.yml index 86be969c03ac..7ef9e7ced4d1 100644 --- a/java/ql/lib/ext/org.springframework.core.io.model.yml +++ b/java/ql/lib/ext/org.springframework.core.io.model.yml @@ -6,6 +6,28 @@ extensions: - ["org.springframework.core.io", "Resource", True, "createRelative", "(String)", "", "Argument[0]", "path-injection", "manual"] - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "path-injection", "ai-manual"] - ["org.springframework.core.io", "ResourceLoader", True, "getResource", "(String)", "", "Argument[0]", "request-forgery", "manual"] + - ["org.springframework.core.io", "FileSystemResource", True, "FileSystemResource", "(FileSystem,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.springframework.core.io", "FileSystemResource", True, "FileSystemResource", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "FileSystemResource", True, "FileSystemResource", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "FileSystemResource", True, "FileSystemResource", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "FileUrlResource", True, "FileUrlResource", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "FileUrlResource", True, "FileUrlResource", "(URL)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "PathResource", True, "PathResource", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "PathResource", True, "PathResource", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "PathResource", True, "PathResource", "(URI)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "UrlResource", True, "UrlResource", "(String,String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.springframework.core.io", "UrlResource", True, "UrlResource", "(String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.springframework.core.io", "UrlResource", True, "UrlResource", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "UrlResource", True, "UrlResource", "(URI)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.core.io", "UrlResource", True, "UrlResource", "(URL)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "FileSystemUtils", True, "copyRecursively", "(Path,Path)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "FileSystemUtils", True, "copyRecursively", "(Path,Path)", "", "Argument[1]", "path-injection", "manual"] + - ["org.springframework.util", "FileSystemUtils", True, "deleteRecursively", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "FileSystemUtils", True, "deleteRecursively", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "ResourceUtils", True, "getFile", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "FileCopyUtils", True, "copyToByteArray", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.springframework.util", "FileSystemUtils", True, "copyRecursively", "(File,File)", "", "Argument[0]", "path-injection", "manual"] + - addsTo: pack: codeql/java-all extensible: summaryModel diff --git a/java/ql/lib/ext/software.amazon.awssdk.transfer.s3.model.model.yml b/java/ql/lib/ext/software.amazon.awssdk.transfer.s3.model.model.yml new file mode 100644 index 000000000000..e35ae485e392 --- /dev/null +++ b/java/ql/lib/ext/software.amazon.awssdk.transfer.s3.model.model.yml @@ -0,0 +1,13 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["software.amazon.awssdk.transfer.s3.model", "ResumableFileUpload", True, "serializeToFile", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "DownloadFileRequest$Builder", True, "destination", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "UploadFileRequest$Builder", True, "source", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "DownloadDirectoryRequest$Builder", True, "destination", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "ResumableFileDownload", True, "fromFile", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "ResumableFileDownload", True, "serializeToFile", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "ResumableFileUpload", True, "fromFile", "(Path)", "", "Argument[0]", "path-injection", "manual"] + - ["software.amazon.awssdk.transfer.s3.model", "UploadDirectoryRequest$Builder", True, "source", "(Path)", "", "Argument[0]", "path-injection", "manual"]