[Question][Java] Yaml summaryModel question

[chmodxxx]

Hello

I have the following two passthroughs that I want to model using yaml summaryModel :

1. AuthHeader.of(authHeader) : I want to pass the flow from the arg to the Qualifier
2. token.getBearerToken() : I want to pass the flow from the qualifier token to the result

This is my current yaml model :

extensions:
  - addsTo:
      pack: org/repo
      extensible: summaryModel
    data:
      - ["com.foo.bar", "AuthHeader", True, "getBearerToken", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"]
      - ["com.foo.bar", "AuthHeader", True, "of", "", "", "Argument[0]", "Argument[this]", "taint", "manual"]
      

For some reason this is not propagating in expressions like AuthHeader ah = AuthHeader.of(AuthHeader.of(AuthHeader.of(token).getBearerToken()).getBearerToken());

Is there something I missed ?

I also tried with having of() propagating from Argument[0] to ReturnValue but also didn't work

[jketema]

Hi @chmodxxx,

Thanks for your question. The models look good to me. Have you checked that flow propagates through the individual methods (before looking at the combined expression you're interested in)?

[chmodxxx]

Yep, The methods are just our unit tests with the only statement in the body is what I described above.

This is what we had in codeQL before, and I'm trying to migrate to models :

import java

class AuthHeader extends Class {
	AuthHeader() {
		hasQualifiedName("com.foo.bar", "AuthHeader")
	}

	Method getAFactoryMethod() {
		result = getAMethod() and (result.getName() = "of" or result.getName() = "valueOf")
	}

	Method getOfMethod() {
		result = getAMethod() and result.getName() = "of"
	}

	Method getValueOfMethod() {
		result = getAMethod() and result.getName() = "valueOf"
	}

	Method getBearerTokenMethod() {
		result = getAMethod() and result.getName() = "getBearerToken"
	}
}

class BearerToken extends Class {
	BearerToken() {
		hasQualifiedName("com.foo.bar", "BearerToken")
	}
}

predicate bearerTokenConversionToAuthHeader(Expr expr, MethodCall ma) {
    exists(AuthHeader ah |
		ma.getMethod() = ah.getOfMethod()
		and ma.getAnArgument() = expr)
}

predicate authHeaderConversionToBearerToken(Expr expr, MethodCall ma) {
    exists(AuthHeader ah |
		ma.getMethod() = ah.getBearerTokenMethod()
		and ma.getQualifier() = expr)
}

and we are using the predicates inside of a taintstep :

override predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
    authHeaderConversionToBearerToken(source.asExpr(), sink.asExpr()) or
    bearerTokenConversionToAuthHeader(source.asExpr(), sink.asExpr())
  }
  

[owen-mc]

That is very curious. It should work. You could try using partial flow to see where the taint gets to. The documentation is here. And looking at that page reminded me that fieldFlowBranchLimit could possibly be an issue - you could try setting it very high (say 500) in the flow configuration to rule that out.

[owen-mc]

Looking at the CodeQL from your last comment more closely, it seems to me that bearerTokenConversionToAuthHeader(source.asExpr(), sink.asExpr()) would propagate taint from ma.getAnArgument() to the method call (of()). So maybe the thing you tried

I also tried with having of() propagating from Argument[0] to ReturnValue but also didn't work

is better. Can you provide the signature for of, and any docstring?

[chmodxxx]

For simplicity I also used the model generator, it did almost write the same thing I wrote (but was specific in the arg type)

The code I'm testing with :
One liner in a function AuthHeader _ah = AuthHeader.of(auth.getBearerToken());

Also I'm not adding adding this model to java-all, I'm adding it to a custom pack we use (not sure if that makes a difference).

This is the signature of of (defined in the AuthHeader class cross repo):

public abstract class AuthHeader {
  public static AuthHeader of(BearerToken bearerToken) {
        return ImmutableAuthHeader.of(bearerToken);
    }
}

I will try with partial flow and check if there is anything obvious to me.

[owen-mc]

Given that 'of' is a static method, I would definitely model flow to ReturnValue instead of Argument[this].

[chmodxxx]

Interestingly, Dataflow configSig doesn't work but TaintTracking works just fine. Which I guess makes sense since I'm marking these passthroughs as returning taint.

Thanks @owen-mc , feel free to close this