java inline expectations proof-of-concept with tests

java/ql/test/TestUtilities/JavaInlineExpectations.ql

@@ -0,0 +1,81 @@
+/**
+ * @kind test-postprocess
+ */
+
+import java
+
+external predicate queryResults(string relation, int row, int column, string data);
+
+predicate parsedExpectedResults(string filename, int line, string content){
+ exists(Javadoc doc |
+ isEolComment(doc) and
+ filename = doc.getLocation().getFile().getBaseName() and
+ line = doc.getLocation().getStartLine() and
+ line = doc.getLocation().getEndLine() and
+ content = doc.getChild(0).getText().trim()
+ )
+}
+
+predicate expectError(string filename, int line){
+ exists(string content |
+ parsedExpectedResults(filename, line, content) and content.indexOf("NOT OK") = 0
+ )
+}
+
+predicate expectPass(string filename, int line){
+ exists(string content |
+ parsedExpectedResults(filename, line, content) and content.indexOf("OK") = 0
+ )
+}
+
+predicate parsedActualResults(string filename, int line, int colStart, int colEnd, string content){
+ exists(int i, string posString, string lineString |
+ queryResults("#select", i, 0, posString) and
+ filename = posString.substring(0, posString.indexOf(":", 0, 0)) and
+ lineString = posString.substring(posString.indexOf(":", 0, 0) + 1, posString.indexOf(":", 1, 0)) and
+ lineString = posString.substring(posString.indexOf(":", 2, 0) + 1, posString.indexOf(":", 3, 0)) and
+ colStart =
+ posString.substring(posString.indexOf(":", 1, 0) + 1, posString.indexOf(":", 2, 0)).toInt() and
+ colEnd = posString.substring(posString.indexOf(":", 3, 0) + 1, posString.length()).toInt() and
+ line = lineString.toInt() and
+ queryResults("#select", i, 2, content)
+ )
+}
+
+predicate actualExpectedDiff(string type, string position, string error){
+ exists(string filename, int line, int colStart, int colEnd |
+ parsedActualResults(filename, line, colStart, colEnd, error) and
+ expectPass(filename, line) and
+ type = "unexpected alert" and
+ position = filename + ":" + line + ":" + colStart + ":" + line + ":" + colEnd
+ )
+ or
+ exists(string filename, int line |
+ expectError(filename, line) and
+ not parsedActualResults(filename, line, _, _, _) and
+ type = "expected alert" and
+ position = filename + ":" + line and
+ parsedExpectedResults(filename, line, error)
+ )
+ or
+ exists(string filename, int line, string content |
+ parsedExpectedResults(filename, line, content) and
+ not expectPass(filename, line) and
+ not expectError(filename, line) and
+ type = "invalid inline expectation" and
+ position = filename + ":" + line and
+ error = content
+ )
+}
+
+from int line, string position, int column, string content
+where
+ position = rank[line](string p | actualExpectedDiff(_, p, _) | p) and
+ (
+ column = 0 and content = position
+ or
+ column = 1 and actualExpectedDiff(content, position, _)
+ or
+ column = 2 and actualExpectedDiff(_, position, content)
+ )
+select "#select", line, column, content

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations1.ql

@@ -0,0 +1,6 @@
+/**
+ * @kind test-postprocess
+ */
+module;
+
+query predicate resultRelations(string name){name = "#select"}

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations2.ql

@@ -0,0 +1,8 @@
+/**
+ * @kind test-postprocess
+ */
+module;
+
+query predicate learnEdits(string name){none() }
+
+select "#select", 1, 1, "foo"

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations3.ql

@@ -0,0 +1,8 @@
+/**
+ * @kind test-postprocess
+ */
+module;
+
+query predicate extraQuery(string name){none() }
+
+select "#select", 1, 1, "foo"

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations4.ql

@@ -0,0 +1,8 @@
+/**
+ * @kind test-postprocess
+ */
+module;
+
+query predicate resultRelations(string name, int arity){name = "#select" and arity = 5 }
+
+select "#select", 1, 1, "foo"

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations5.ql

@@ -0,0 +1,5 @@
+/**
+ * @kind test-postprocess
+ */
+
+select "#select", "1", 1, "foo"

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations6.ql

@@ -0,0 +1,5 @@
+/**
+ * @kind test-postprocess
+ */
+
+select "#select", 1, 1, ["foo", "bar"]

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations7.ql

@@ -0,0 +1,10 @@
+/**
+ * @kind test-postprocess
+ */
+
+from int i, int j
+where
+ i in [1, 2] and
+ j in [1, 2] and
+ not (i = 2 and j = 2)
+select "#select", i, j, "foo"

java/ql/test/TestUtilities/ProblematicJavaInlineExpectations8.ql

@@ -0,0 +1 @@
+select "#select", 1, 1, "foo"

java/ql/test/TestUtilities/SinkModelNamespaceRoots.ql

@@ -0,0 +1,17 @@
+/**
+ * @kind test-postprocess
+ */
+
+import semmle.code.java.dataflow.ExternalFlow
+
+string sinkModuleNamespaceRoots(){
+ exists(string namespace, int dotIdx |
+ sinkModel(namespace, _, _, _, _, _, _, _, _, _) and
+ dotIdx = namespace.indexOf(".", 0, 0) and
+ result = namespace.substring(0, dotIdx)
+ )
+}
+
+from int line, string content
+where content = rank[line](string c | c = sinkModuleNamespaceRoots() | c)
+select "#select", line, 0, content

java/ql/test/TestUtilities/TestResultSorting.ql

@@ -0,0 +1,8 @@
+/**
+ * @kind test-postprocess
+ */
+query predicate resultRelations(string name){name in ["B", "D", "F"] }
+
+from int line, string name
+where name = rank[line](string n | n in ["A", "C", "E"] | n)
+select name, 0, 0, "empty"

java/ql/test/query-tests/Postprocessing/SortedResults/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/TestResultSorting.ql

java/ql/test/query-tests/Postprocessing/WithExtensible/OverlyLargeRangeQuery.expected

@@ -0,0 +1,19 @@
+| android |
+| androidx |
+| ch |
+| com |
+| freemarker |
+| groovy |
+| hudson |
+| io |
+| jakarta |
+| java |
+| javafx |
+| javax |
+| kotlin |
+| liquibase |
+| net |
+| ognl |
+| org |
+| play |
+| sun |

java/ql/test/query-tests/Postprocessing/WithExtensible/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/SinkModelNamespaceRoots.ql

java/ql/test/query-tests/Postprocessing/failing/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/JavaInlineExpectations.ql

java/ql/test/query-tests/Postprocessing/failing/SuspiciousRegexpRange.java

@@ -0,0 +1,37 @@
+import java.util.regex.Pattern;
+
+class SuspiciousRegexpRange{
+ void test(){
+ Pattern overlap1 = Pattern.compile("^[0-93-5]*$"); // NOT OK
+
+ Pattern overlap2 = Pattern.compile("[A-ZA-z]*"); // OK
+
+ Pattern isEmpty = Pattern.compile("^[z-a]*$"); // NOT OK
+
+ Pattern isAscii = Pattern.compile("^[\\x00-\\x7F]*$"); // NOT OK
+
+ Pattern printable = Pattern.compile("[!-~]*"); // OK - used to select most printable ASCII characters
+
+ Pattern codePoints = Pattern.compile("[^\\x21-\\x7E]|[[\\](){}<>/%]*"); // OK
+
+ Pattern NON_ALPHANUMERIC_REGEXP = Pattern.compile("([^\\#-~| |!])*"); // OK
+
+ Pattern smallOverlap = Pattern.compile("[0-9a-fA-f]*"); // NOT OK
+
+ Pattern weirdRange = Pattern.compile("[$-`]*"); // NOT OK
+
+ Pattern keywordOperator = Pattern.compile("[!\\~\\*\\/%+-<>\\^|=&]*"); // NOT OK
+
+ Pattern notYoutube = Pattern.compile("youtu.be/[a-z1-9.-_]+"); // NOT OK
+
+ Pattern numberToLetter = Pattern.compile("[7-F]*"); // NOT OK
+
+ Pattern overlapsWithClass1 = Pattern.compile("[0-9\\d]*"); // NOT OK
+
+ Pattern overlapsWithClass2 = Pattern.compile("[\\w,.-?:*+]*"); // NOT OK
+
+ Pattern nested = Pattern.compile("[[A-Za-z_][A-Za-z0-9._-]]*"); // OK, the dash it at the end
+
+ Pattern octal = Pattern.compile("[\000-\037\040-\045]*"); // OK
+ }
+}

java/ql/test/query-tests/Postprocessing/passing/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/JavaInlineExpectations.ql

java/ql/test/query-tests/Postprocessing/passing/SuspiciousRegexpRange.java

@@ -0,0 +1,37 @@
+import java.util.regex.Pattern;
+
+class SuspiciousRegexpRange{
+ void test(){
+ Pattern overlap1 = Pattern.compile("^[0-93-5]*$"); // NOT OK
+
+ Pattern overlap2 = Pattern.compile("[A-ZA-z]*"); // NOT OK
+
+ Pattern isEmpty = Pattern.compile("^[z-a]*$"); // NOT OK
+
+ Pattern isAscii = Pattern.compile("^[\\x00-\\x7F]*$"); // OK
+
+ Pattern printable = Pattern.compile("[!-~]*"); // OK - used to select most printable ASCII characters
+
+ Pattern codePoints = Pattern.compile("[^\\x21-\\x7E]|[[\\](){}<>/%]*"); // OK
+
+ Pattern NON_ALPHANUMERIC_REGEXP = Pattern.compile("([^\\#-~| |!])*"); // OK
+
+ Pattern smallOverlap = Pattern.compile("[0-9a-fA-f]*"); // NOT OK
+
+ Pattern weirdRange = Pattern.compile("[$-`]*"); // NOT OK
+
+ Pattern keywordOperator = Pattern.compile("[!\\~\\*\\/%+-<>\\^|=&]*"); // NOT OK
+
+ Pattern notYoutube = Pattern.compile("youtu.be/[a-z1-9.-_]+"); // NOT OK
+
+ Pattern numberToLetter = Pattern.compile("[7-F]*"); // NOT OK
+
+ Pattern overlapsWithClass1 = Pattern.compile("[0-9\\d]*"); // NOT OK
+
+ Pattern overlapsWithClass2 = Pattern.compile("[\\w,.-?:*+]*"); // NOT OK
+
+ Pattern nested = Pattern.compile("[[A-Za-z_][A-Za-z0-9._-]]*"); // OK, the dash it at the end
+
+ Pattern octal = Pattern.compile("[\000-\037\040-\045]*"); // OK
+ }
+}

java/ql/test/query-tests/Postprocessing/passingWithDiff/OverlyLargeRangeQuery.expected

@@ -0,0 +1,2 @@
+| SuspiciousRegexpRange.java:11 | expected alert | NOT OK |
+| SuspiciousRegexpRange.java:7:49:7:51 | unexpected alert | Suspicious character range that overlaps with A-Z in the same character class, and is equivalent to [A-Z\\[\\\\\\]^_`a-z]. |

java/ql/test/query-tests/Postprocessing/passingWithDiff/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/JavaInlineExpectations.ql

java/ql/test/query-tests/Postprocessing/passingWithDiff/SuspiciousRegexpRange.java

@@ -0,0 +1,37 @@
+import java.util.regex.Pattern;
+
+class SuspiciousRegexpRange{
+ void test(){
+ Pattern overlap1 = Pattern.compile("^[0-93-5]*$"); // NOT OK
+
+ Pattern overlap2 = Pattern.compile("[A-ZA-z]*"); // OK
+
+ Pattern isEmpty = Pattern.compile("^[z-a]*$"); // NOT OK
+
+ Pattern isAscii = Pattern.compile("^[\\x00-\\x7F]*$"); // NOT OK
+
+ Pattern printable = Pattern.compile("[!-~]*"); // OK - used to select most printable ASCII characters
+
+ Pattern codePoints = Pattern.compile("[^\\x21-\\x7E]|[[\\](){}<>/%]*"); // OK
+
+ Pattern NON_ALPHANUMERIC_REGEXP = Pattern.compile("([^\\#-~| |!])*"); // OK
+
+ Pattern smallOverlap = Pattern.compile("[0-9a-fA-f]*"); // NOT OK
+
+ Pattern weirdRange = Pattern.compile("[$-`]*"); // NOT OK
+
+ Pattern keywordOperator = Pattern.compile("[!\\~\\*\\/%+-<>\\^|=&]*"); // NOT OK
+
+ Pattern notYoutube = Pattern.compile("youtu.be/[a-z1-9.-_]+"); // NOT OK
+
+ Pattern numberToLetter = Pattern.compile("[7-F]*"); // NOT OK
+
+ Pattern overlapsWithClass1 = Pattern.compile("[0-9\\d]*"); // NOT OK
+
+ Pattern overlapsWithClass2 = Pattern.compile("[\\w,.-?:*+]*"); // NOT OK
+
+ Pattern nested = Pattern.compile("[[A-Za-z_][A-Za-z0-9._-]]*"); // OK, the dash it at the end
+
+ Pattern octal = Pattern.compile("[\000-\037\040-\045]*"); // OK
+ }
+}

java/ql/test/query-tests/Postprocessing/passingWithUnrecognised/OverlyLargeRangeQuery.expected

@@ -0,0 +1 @@
+| SuspiciousRegexpRange.java:13 | invalid inline expectation | IS OK - used to select most printable ASCII characters |

java/ql/test/query-tests/Postprocessing/passingWithUnrecognised/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/JavaInlineExpectations.ql

java/ql/test/query-tests/Postprocessing/passingWithUnrecognised/SuspiciousRegexpRange.java

@@ -0,0 +1,37 @@
+import java.util.regex.Pattern;
+
+class SuspiciousRegexpRange{
+ void test(){
+ Pattern overlap1 = Pattern.compile("^[0-93-5]*$"); // NOT OK
+
+ Pattern overlap2 = Pattern.compile("[A-ZA-z]*"); // NOT OK
+
+ Pattern isEmpty = Pattern.compile("^[z-a]*$"); // NOT OK
+
+ Pattern isAscii = Pattern.compile("^[\\x00-\\x7F]*$"); // OK
+
+ Pattern printable = Pattern.compile("[!-~]*"); // IS OK - used to select most printable ASCII characters
+
+ Pattern codePoints = Pattern.compile("[^\\x21-\\x7E]|[[\\](){}<>/%]*"); // OK
+
+ Pattern NON_ALPHANUMERIC_REGEXP = Pattern.compile("([^\\#-~| |!])*"); // OK
+
+ Pattern smallOverlap = Pattern.compile("[0-9a-fA-f]*"); // NOT OK
+
+ Pattern weirdRange = Pattern.compile("[$-`]*"); // NOT OK
+
+ Pattern keywordOperator = Pattern.compile("[!\\~\\*\\/%+-<>\\^|=&]*"); // NOT OK
+
+ Pattern notYoutube = Pattern.compile("youtu.be/[a-z1-9.-_]+"); // NOT OK
+
+ Pattern numberToLetter = Pattern.compile("[7-F]*"); // NOT OK
+
+ Pattern overlapsWithClass1 = Pattern.compile("[0-9\\d]*"); // NOT OK
+
+ Pattern overlapsWithClass2 = Pattern.compile("[\\w,.-?:*+]*"); // NOT OK
+
+ Pattern nested = Pattern.compile("[[A-Za-z_][A-Za-z0-9._-]]*"); // OK, the dash it at the end
+
+ Pattern octal = Pattern.compile("[\000-\037\040-\045]*"); // OK
+ }
+}

java/ql/test/query-tests/Postprocessing/postprocessingBug1/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations1.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug2/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations2.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug3/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations3.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug4/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations4.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug5/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations5.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug6/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations6.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug7/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations7.ql

java/ql/test/query-tests/Postprocessing/postprocessingBug8/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/ProblematicJavaInlineExpectations8.ql

java/ql/test/query-tests/Postprocessing/unrecognised/OverlyLargeRangeQuery.qlref

@@ -0,0 +1,2 @@
+query: Security/CWE/CWE-020/OverlyLargeRange.ql
+postprocess: TestUtilities/JavaInlineExpectations.ql