Add query with passing tests; May need one update

Author: Keith Hoodlet

java/CWE-611/XXELocal.ql

@@ -17,7 +17,7 @@ import java
 import semmle.code.java.security.XmlParsers
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking2
-import DataFlow::PathGraph
+//import DataFlow::PathGraph
 import github.LocalSources
 
 class SafeSAXSourceFlowConfig extends TaintTracking2::Configuration {
@@ -42,15 +42,16 @@ class UnsafeXxeSink extends DataFlow::ExprNode {
   }
 }
 
-class XxeConfig extends TaintTracking::Configuration {
-  XxeConfig() { this = "XXE.ql::XxeConfig" }
+module XXELocalConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
 
-  override predicate isSource(DataFlow::Node src) { src instanceof LocalUserInput }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
+  predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
-where conf.hasFlowPath(source, sink)
+module XXELocalFlow = TaintTracking::Global<XXELocalConfig>;
+import XXELocalFlow::PathGraph
+
+from XXELocalFlow::PathNode source, XXELocalFlow::PathNode sink
+where XXELocalFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
   "user input"

tests/java-tests/CWE-611/XXELocal$MyHandler.class

@@ -0,0 +1,12 @@
+edges
+| XXELocal.java:15:39:15:63 | new FileInputStream(...) : FileInputStream | XXELocal.java:16:51:16:61 | inputStream : FileInputStream |
+| XXELocal.java:16:35:16:62 | new InputSource(...) : InputSource | XXELocal.java:24:25:24:35 | inputSource |
+| XXELocal.java:16:51:16:61 | inputStream : FileInputStream | XXELocal.java:16:35:16:62 | new InputSource(...) : InputSource |
+nodes
+| XXELocal.java:15:39:15:63 | new FileInputStream(...) : FileInputStream | semmle.label | new FileInputStream(...) : FileInputStream |
+| XXELocal.java:16:35:16:62 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
+| XXELocal.java:16:51:16:61 | inputStream : FileInputStream | semmle.label | inputStream : FileInputStream |
+| XXELocal.java:24:25:24:35 | inputSource | semmle.label | inputSource |
+subpaths
+#select
+| XXELocal.java:24:25:24:35 | inputSource | XXELocal.java:15:39:15:63 | new FileInputStream(...) : FileInputStream | XXELocal.java:24:25:24:35 | inputSource | Unsafe parsing of XML file from $@. | XXELocal.java:15:39:15:63 | new FileInputStream(...) | user input |

tests/java-tests/CWE-611/XXELocal.class

@@ -2,7 +2,10 @@
 import java.io.FileInputStream;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
+import org.xml.sax.Attributes;
 import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.helpers.DefaultHandler;
 import org.xml.sax.XMLReader;
 
 public class XXELocal {
@@ -18,20 +21,30 @@ public static void main(String[] args) throws Exception {
         // Parse XML
         SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();
         SAXParser saxParser = saxParserFactory.newSAXParser();
-        saxParser.parse(inputSource, xmlReader);
+        saxParser.parse(inputSource, new MyHandler());
     }
 
     private static XMLReader getXMLReader() throws Exception {
-        // Create XML reader
         SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();
         SAXParser saxParser = saxParserFactory.newSAXParser();
         XMLReader xmlReader = saxParser.getXMLReader();
+        return xmlReader;
+    }
 
-        // Set properties for XML reader
-        xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
-        xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-        xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    private static class MyHandler extends DefaultHandler {
+        @Override
+        public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+            // Handle start element
+        }
 
-        return xmlReader;
+        @Override
+        public void endElement(String uri, String localName, String qName) throws SAXException {
+            // Handle end element
+        }
+
+        @Override
+        public void characters(char[] ch, int start, int length) throws SAXException {
+            // Handle character data
+        }
     }
 }