diff --git a/java/ql/lib/change-notes/2023-08-23-apache-cxf-models.md b/java/ql/lib/change-notes/2023-08-23-apache-cxf-models.md new file mode 100644 index 00000000000..fbd0fef3b7f --- /dev/null +++ b/java/ql/lib/change-notes/2023-08-23-apache-cxf-models.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Added new dataflow models for the Apache CXF framework. diff --git a/java/ql/lib/ext/org.apache.cxf.catalog.model.yml b/java/ql/lib/ext/org.apache.cxf.catalog.model.yml new file mode 100644 index 00000000000..9f453be772f --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.catalog.model.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.catalog", "OASISCatalogManager", True, "loadCatalog", "(URL)", "", "Argument[0]", "request-forgery", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.common.classloader.model.yml b/java/ql/lib/ext/org.apache.cxf.common.classloader.model.yml new file mode 100644 index 00000000000..131d1242fd0 --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.common.classloader.model.yml @@ -0,0 +1,8 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.common.classloader", "ClassLoaderUtils", True, "getResourceAsStream", "(String,Class)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.common.classloader", "ClassLoaderUtils", True, "getURLClassLoader", "(URL[],ClassLoader)", "", "Argument[0]", "request-forgery", "manual"] + - ["org.apache.cxf.common.classloader", "ClassLoaderUtils", True, "getURLClassLoader", "(List,ClassLoader)", "", "Argument[0]", "request-forgery", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.common.jaxb.model.yml b/java/ql/lib/ext/org.apache.cxf.common.jaxb.model.yml new file mode 100644 index 00000000000..86fcf9605ed --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.common.jaxb.model.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.common.jaxb", "JAXBUtils", True, "createFileCodeWriter", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.common.logging.model.yml b/java/ql/lib/ext/org.apache.cxf.common.logging.model.yml new file mode 100644 index 00000000000..5bde245534b --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.common.logging.model.yml @@ -0,0 +1,11 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String)", "", "Argument[2]", "log-injection", "manual"] + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String,Object)", "", "Argument[2]", "log-injection", "manual"] + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String,Object[])", "", "Argument[2]", "log-injection", "manual"] + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String,Throwable)", "", "Argument[2]", "log-injection", "manual"] + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String,Throwable,Object)", "", "Argument[2]", "log-injection", "manual"] + - ["org.apache.cxf.common.logging", "LogUtils", True, "log", "(Logger,Level,String,Throwable,Object[])", "", "Argument[2]", "log-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.configuration.jsse.model.yml b/java/ql/lib/ext/org.apache.cxf.configuration.jsse.model.yml new file mode 100644 index 00000000000..590cfbc0b6c --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.configuration.jsse.model.yml @@ -0,0 +1,7 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.configuration.jsse", "SSLUtils", True, "loadFile", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.configuration.jsse", "TLSClientParameters", True, "setHostnameVerifier", "(HostnameVerifier)", "", "Argument[0]", "hostname-verification", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.feature.transform.model.yml b/java/ql/lib/ext/org.apache.cxf.feature.transform.model.yml new file mode 100644 index 00000000000..04bca0634d5 --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.feature.transform.model.yml @@ -0,0 +1,8 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.transform", "XSLTUtils", True, "transform", "(Templates,InputStream)", "", "Argument[0]", "xslt-injection", "manual"] + - ["org.apache.cxf.transform", "XSLTUtils", True, "transform", "(Templates,Reader)", "", "Argument[0]", "xslt-injection", "manual"] + - ["org.apache.cxf.transform", "XSLTUtils", True, "transform", "(Templates,Document)", "", "Argument[0]", "xslt-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.helpers.model.yml b/java/ql/lib/ext/org.apache.cxf.helpers.model.yml new file mode 100644 index 00000000000..5e8a29e2b11 --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.helpers.model.yml @@ -0,0 +1,15 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.helpers", "FileUtils", True, "delete", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.helpers", "FileUtils", True, "delete", "(File,boolean)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.helpers", "FileUtils", True, "mkdir", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.helpers", "FileUtils", True, "readLines", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.helpers", "FileUtils", True, "removeDir", "(File)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.helpers", "XPathUtils", True, "getValue", "(String,Node,QName)", "", "Argument[0]", "xpath-injection", "manual"] + - ["org.apache.cxf.helpers", "XPathUtils", True, "getValueList", "(String,Node)", "", "Argument[0]", "xpath-injection", "manual"] + - ["org.apache.cxf.helpers", "XPathUtils", True, "getValueNode", "(String,Node)", "", "Argument[0]", "xpath-injection", "manual"] + - ["org.apache.cxf.helpers", "XPathUtils", True, "getValueString", "(String,Node)", "", "Argument[0]", "xpath-injection", "manual"] + - ["org.apache.cxf.helpers", "XPathUtils", True, "isExist", "(String,Node,QName)", "", "Argument[0]", "xpath-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.resource.model.yml b/java/ql/lib/ext/org.apache.cxf.resource.model.yml new file mode 100644 index 00000000000..c73c9a4ac8a --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.resource.model.yml @@ -0,0 +1,14 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.resource", "ExtendedURIResolver", True, "resolve", "(String,String)", "", "Argument[0]", "request-forgery", "manual"] + - ["org.apache.cxf.resource", "ExtendedURIResolver", True, "resolve", "(String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "URIResolver", "(String)", "", "Argument[0]", "request-forgery", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "URIResolver", "(String,String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "URIResolver", "(String,String)", "", "Argument[1]", "request-forgery", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "URIResolver", "(String,String,Class)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "URIResolver", "(String,String,Class)", "", "Argument[1]", "request-forgery", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "resolve", "(String,String,Class)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.resource", "URIResolver", True, "resolve", "(String,String,Class)", "", "Argument[1]", "request-forgery", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.staxutils.model.yml b/java/ql/lib/ext/org.apache.cxf.staxutils.model.yml new file mode 100644 index 00000000000..959fc3d6e82 --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.staxutils.model.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.staxutils", "StaxUtils", True, "read", "(File)", "", "Argument[0]", "path-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.tools.corba.utils.model.yml b/java/ql/lib/ext/org.apache.cxf.tools.corba.utils.model.yml new file mode 100644 index 00000000000..c6bb4c0d90b --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.tools.corba.utils.model.yml @@ -0,0 +1,9 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.tools.corba.utils", "FileOutputStreamFactory", true, "FileOutputStreamFactory", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.corba.utils", "FileOutputStreamFactory", true, "FileOutputStreamFactory", "(String,FileOutputStreamFactory)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.corba.utils", "OutputStreamFactory", true, "createOutputStream", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.corba.utils", "OutputStreamFactory", true, "createOutputStream", "(String,String)", "", "Argument[0..1]", "path-injection", "manual"] diff --git a/java/ql/lib/ext/org.apache.cxf.tools.util.model.yml b/java/ql/lib/ext/org.apache.cxf.tools.util.model.yml new file mode 100644 index 00000000000..aeebecb82e3 --- /dev/null +++ b/java/ql/lib/ext/org.apache.cxf.tools.util.model.yml @@ -0,0 +1,15 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "FileWriterUtil", "(String,OutputStreamCreator)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "buildDir", "(String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getFileToWrite", "(String,String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getFileToWrite", "(String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getWriter", "(File,String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getWriter", "(String,String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getWriter", "(String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getWriter", "(String,String,String)", "", "Argument[0]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "FileWriterUtil", True, "getWriter", "(String,String,String)", "", "Argument[1]", "path-injection", "manual"] + - ["org.apache.cxf.tools.util", "OutputStreamCreator", true, "createOutputStream", "(File)", "", "Argument[0]", "path-injection", "manual"] diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected index 2f9a646f9c1..8ebc5a03a31 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected @@ -19,114 +19,170 @@ edges | Test.java:100:32:100:32 | t : String | Test.java:100:12:100:45 | new URI(...) | | Test.java:100:32:100:32 | t : String | Test.java:101:41:101:41 | t : String | | Test.java:101:41:101:41 | t : String | Test.java:101:12:101:54 | new URI(...) | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:35:61:35:68 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:37:41:37:48 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:39:56:39:63 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:41:46:41:53 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:43:38:43:45 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:45:36:45:43 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:47:31:47:38 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:49:33:49:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:51:27:51:34 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:53:27:53:34 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:55:40:55:47 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:57:47:57:54 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:59:40:59:47 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:61:38:61:45 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:63:33:63:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:65:33:65:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:67:41:67:48 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:69:42:69:49 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:71:37:71:44 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:73:29:73:36 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:75:37:75:44 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:77:28:77:35 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:79:33:79:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:81:40:81:47 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:83:40:83:47 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:84:40:84:47 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:86:38:86:45 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:88:28:88:35 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:89:28:89:35 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:90:28:90:35 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:92:34:92:41 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:93:34:93:41 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:95:33:95:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:97:42:97:49 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:99:50:99:57 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:101:54:101:61 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:103:50:103:57 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:105:35:105:42 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:107:48:107:55 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:109:37:109:44 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:111:35:111:42 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:116:37:116:44 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:118:74:118:81 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:120:68:120:75 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:122:68:122:75 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:124:30:124:37 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:129:30:129:37 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:134:33:134:40 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:136:27:136:34 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:138:28:138:35 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:140:29:140:36 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:145:27:145:34 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:147:26:147:33 | source(...) : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:152:29:152:36 | source(...) : String | -| mad/Test.java:35:61:35:68 | source(...) : String | mad/Test.java:35:52:35:68 | (...)... | -| mad/Test.java:37:41:37:48 | source(...) : String | mad/Test.java:37:32:37:48 | (...)... | -| mad/Test.java:39:56:39:63 | source(...) : String | mad/Test.java:39:47:39:63 | (...)... | -| mad/Test.java:41:46:41:53 | source(...) : String | mad/Test.java:41:39:41:53 | (...)... | -| mad/Test.java:43:38:43:45 | source(...) : String | mad/Test.java:43:31:43:45 | (...)... | -| mad/Test.java:45:36:45:43 | source(...) : String | mad/Test.java:45:29:45:43 | (...)... | -| mad/Test.java:47:31:47:38 | source(...) : String | mad/Test.java:47:24:47:38 | (...)... | -| mad/Test.java:49:33:49:40 | source(...) : String | mad/Test.java:49:24:49:40 | (...)... | -| mad/Test.java:51:27:51:34 | source(...) : String | mad/Test.java:51:20:51:34 | (...)... | -| mad/Test.java:53:27:53:34 | source(...) : String | mad/Test.java:53:20:53:34 | (...)... | -| mad/Test.java:55:40:55:47 | source(...) : String | mad/Test.java:55:33:55:47 | (...)... | -| mad/Test.java:57:47:57:54 | source(...) : String | mad/Test.java:57:40:57:54 | (...)... | -| mad/Test.java:59:40:59:47 | source(...) : String | mad/Test.java:59:33:59:47 | (...)... | -| mad/Test.java:61:38:61:45 | source(...) : String | mad/Test.java:61:31:61:45 | (...)... | -| mad/Test.java:63:33:63:40 | source(...) : String | mad/Test.java:63:26:63:40 | (...)... | -| mad/Test.java:65:33:65:40 | source(...) : String | mad/Test.java:65:26:65:40 | (...)... | -| mad/Test.java:67:41:67:48 | source(...) : String | mad/Test.java:67:34:67:48 | (...)... | -| mad/Test.java:69:42:69:49 | source(...) : String | mad/Test.java:69:35:69:49 | (...)... | -| mad/Test.java:71:37:71:44 | source(...) : String | mad/Test.java:71:30:71:44 | (...)... | -| mad/Test.java:73:29:73:36 | source(...) : String | mad/Test.java:73:22:73:36 | (...)... | -| mad/Test.java:75:37:75:44 | source(...) : String | mad/Test.java:75:30:75:44 | (...)... | -| mad/Test.java:77:28:77:35 | source(...) : String | mad/Test.java:77:21:77:35 | (...)... | -| mad/Test.java:79:33:79:40 | source(...) : String | mad/Test.java:79:26:79:40 | (...)... | -| mad/Test.java:81:40:81:47 | source(...) : String | mad/Test.java:81:33:81:47 | (...)... | -| mad/Test.java:83:40:83:47 | source(...) : String | mad/Test.java:83:33:83:47 | (...)... | -| mad/Test.java:84:40:84:47 | source(...) : String | mad/Test.java:84:33:84:47 | (...)... | -| mad/Test.java:86:38:86:45 | source(...) : String | mad/Test.java:86:31:86:45 | (...)... | -| mad/Test.java:88:28:88:35 | source(...) : String | mad/Test.java:88:21:88:35 | (...)... | -| mad/Test.java:89:28:89:35 | source(...) : String | mad/Test.java:89:21:89:35 | (...)... | -| mad/Test.java:90:28:90:35 | source(...) : String | mad/Test.java:90:21:90:35 | (...)... | -| mad/Test.java:92:34:92:41 | source(...) : String | mad/Test.java:92:27:92:41 | (...)... | -| mad/Test.java:93:34:93:41 | source(...) : String | mad/Test.java:93:27:93:41 | (...)... | -| mad/Test.java:95:33:95:40 | source(...) : String | mad/Test.java:95:26:95:40 | (...)... | -| mad/Test.java:97:42:97:49 | source(...) : String | mad/Test.java:97:35:97:49 | (...)... | -| mad/Test.java:99:50:99:57 | source(...) : String | mad/Test.java:99:41:99:57 | (...)... | -| mad/Test.java:101:54:101:61 | source(...) : String | mad/Test.java:101:45:101:61 | (...)... | -| mad/Test.java:103:50:103:57 | source(...) : String | mad/Test.java:103:43:103:57 | (...)... | -| mad/Test.java:105:35:105:42 | source(...) : String | mad/Test.java:105:28:105:42 | (...)... | -| mad/Test.java:107:48:107:55 | source(...) : String | mad/Test.java:107:41:107:55 | (...)... | -| mad/Test.java:109:37:109:44 | source(...) : String | mad/Test.java:109:28:109:44 | (...)... | -| mad/Test.java:111:35:111:42 | source(...) : String | mad/Test.java:111:28:111:42 | (...)... | -| mad/Test.java:116:37:116:44 | source(...) : String | mad/Test.java:116:30:116:44 | (...)... | -| mad/Test.java:118:74:118:81 | source(...) : String | mad/Test.java:118:40:118:81 | (...)... | -| mad/Test.java:120:68:120:75 | source(...) : String | mad/Test.java:120:34:120:75 | (...)... | -| mad/Test.java:122:68:122:75 | source(...) : String | mad/Test.java:122:34:122:75 | (...)... | -| mad/Test.java:124:30:124:37 | source(...) : String | mad/Test.java:124:23:124:37 | (...)... | -| mad/Test.java:129:30:129:37 | source(...) : String | mad/Test.java:129:23:129:37 | (...)... | -| mad/Test.java:134:33:134:40 | source(...) : String | mad/Test.java:134:23:134:40 | (...)... | -| mad/Test.java:136:27:136:34 | source(...) : String | mad/Test.java:136:20:136:34 | (...)... | -| mad/Test.java:138:28:138:35 | source(...) : String | mad/Test.java:138:21:138:35 | (...)... | -| mad/Test.java:140:29:140:36 | source(...) : String | mad/Test.java:140:22:140:36 | (...)... | -| mad/Test.java:145:27:145:34 | source(...) : String | mad/Test.java:145:20:145:34 | (...)... | -| mad/Test.java:147:26:147:33 | source(...) : String | mad/Test.java:147:19:147:33 | (...)... | -| mad/Test.java:152:29:152:36 | source(...) : String | mad/Test.java:152:20:152:36 | (...)... | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:45:61:45:68 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:47:41:47:48 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:49:56:49:63 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:51:46:51:53 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:53:38:53:45 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:55:36:55:43 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:57:31:57:38 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:59:33:59:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:61:27:61:34 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:63:27:63:34 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:65:40:65:47 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:67:47:67:54 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:69:40:69:47 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:71:38:71:45 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:73:33:73:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:75:33:75:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:77:41:77:48 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:79:42:79:49 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:81:37:81:44 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:83:29:83:36 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:85:37:85:44 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:87:28:87:35 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:89:33:89:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:91:40:91:47 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:93:40:93:47 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:94:40:94:47 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:96:38:96:45 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:98:28:98:35 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:99:28:99:35 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:100:28:100:35 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:102:34:102:41 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:103:34:103:41 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:105:33:105:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:107:42:107:49 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:109:50:109:57 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:111:54:111:61 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:113:50:113:57 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:115:35:115:42 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:117:48:117:55 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:119:37:119:44 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:121:35:121:42 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:123:55:123:62 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:125:47:125:54 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:127:47:127:54 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:131:35:131:42 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:135:56:135:63 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:137:56:137:63 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:141:59:141:66 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:143:59:143:66 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:145:58:145:65 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:147:34:147:41 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:149:34:149:41 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:151:44:151:51 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:153:31:153:38 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:155:46:155:53 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:157:46:157:53 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:159:67:159:74 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:161:67:161:74 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:163:73:163:80 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:166:37:166:44 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:168:48:168:55 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:170:54:170:61 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:172:69:172:76 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:174:47:174:54 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:176:49:176:56 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:178:64:178:71 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:180:49:180:56 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:182:64:182:71 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:184:61:184:68 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:190:37:190:44 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:192:74:192:81 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:194:68:194:75 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:196:68:196:75 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:198:30:198:37 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:203:30:203:37 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:208:33:208:40 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:210:27:210:34 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:212:28:212:35 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:214:29:214:36 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:219:27:219:34 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:221:26:221:33 | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:226:29:226:36 | source(...) : String | +| mad/Test.java:45:61:45:68 | source(...) : String | mad/Test.java:45:52:45:68 | (...)... | +| mad/Test.java:47:41:47:48 | source(...) : String | mad/Test.java:47:32:47:48 | (...)... | +| mad/Test.java:49:56:49:63 | source(...) : String | mad/Test.java:49:47:49:63 | (...)... | +| mad/Test.java:51:46:51:53 | source(...) : String | mad/Test.java:51:39:51:53 | (...)... | +| mad/Test.java:53:38:53:45 | source(...) : String | mad/Test.java:53:31:53:45 | (...)... | +| mad/Test.java:55:36:55:43 | source(...) : String | mad/Test.java:55:29:55:43 | (...)... | +| mad/Test.java:57:31:57:38 | source(...) : String | mad/Test.java:57:24:57:38 | (...)... | +| mad/Test.java:59:33:59:40 | source(...) : String | mad/Test.java:59:24:59:40 | (...)... | +| mad/Test.java:61:27:61:34 | source(...) : String | mad/Test.java:61:20:61:34 | (...)... | +| mad/Test.java:63:27:63:34 | source(...) : String | mad/Test.java:63:20:63:34 | (...)... | +| mad/Test.java:65:40:65:47 | source(...) : String | mad/Test.java:65:33:65:47 | (...)... | +| mad/Test.java:67:47:67:54 | source(...) : String | mad/Test.java:67:40:67:54 | (...)... | +| mad/Test.java:69:40:69:47 | source(...) : String | mad/Test.java:69:33:69:47 | (...)... | +| mad/Test.java:71:38:71:45 | source(...) : String | mad/Test.java:71:31:71:45 | (...)... | +| mad/Test.java:73:33:73:40 | source(...) : String | mad/Test.java:73:26:73:40 | (...)... | +| mad/Test.java:75:33:75:40 | source(...) : String | mad/Test.java:75:26:75:40 | (...)... | +| mad/Test.java:77:41:77:48 | source(...) : String | mad/Test.java:77:34:77:48 | (...)... | +| mad/Test.java:79:42:79:49 | source(...) : String | mad/Test.java:79:35:79:49 | (...)... | +| mad/Test.java:81:37:81:44 | source(...) : String | mad/Test.java:81:30:81:44 | (...)... | +| mad/Test.java:83:29:83:36 | source(...) : String | mad/Test.java:83:22:83:36 | (...)... | +| mad/Test.java:85:37:85:44 | source(...) : String | mad/Test.java:85:30:85:44 | (...)... | +| mad/Test.java:87:28:87:35 | source(...) : String | mad/Test.java:87:21:87:35 | (...)... | +| mad/Test.java:89:33:89:40 | source(...) : String | mad/Test.java:89:26:89:40 | (...)... | +| mad/Test.java:91:40:91:47 | source(...) : String | mad/Test.java:91:33:91:47 | (...)... | +| mad/Test.java:93:40:93:47 | source(...) : String | mad/Test.java:93:33:93:47 | (...)... | +| mad/Test.java:94:40:94:47 | source(...) : String | mad/Test.java:94:33:94:47 | (...)... | +| mad/Test.java:96:38:96:45 | source(...) : String | mad/Test.java:96:31:96:45 | (...)... | +| mad/Test.java:98:28:98:35 | source(...) : String | mad/Test.java:98:21:98:35 | (...)... | +| mad/Test.java:99:28:99:35 | source(...) : String | mad/Test.java:99:21:99:35 | (...)... | +| mad/Test.java:100:28:100:35 | source(...) : String | mad/Test.java:100:21:100:35 | (...)... | +| mad/Test.java:102:34:102:41 | source(...) : String | mad/Test.java:102:27:102:41 | (...)... | +| mad/Test.java:103:34:103:41 | source(...) : String | mad/Test.java:103:27:103:41 | (...)... | +| mad/Test.java:105:33:105:40 | source(...) : String | mad/Test.java:105:26:105:40 | (...)... | +| mad/Test.java:107:42:107:49 | source(...) : String | mad/Test.java:107:35:107:49 | (...)... | +| mad/Test.java:109:50:109:57 | source(...) : String | mad/Test.java:109:41:109:57 | (...)... | +| mad/Test.java:111:54:111:61 | source(...) : String | mad/Test.java:111:45:111:61 | (...)... | +| mad/Test.java:113:50:113:57 | source(...) : String | mad/Test.java:113:43:113:57 | (...)... | +| mad/Test.java:115:35:115:42 | source(...) : String | mad/Test.java:115:28:115:42 | (...)... | +| mad/Test.java:117:48:117:55 | source(...) : String | mad/Test.java:117:41:117:55 | (...)... | +| mad/Test.java:119:37:119:44 | source(...) : String | mad/Test.java:119:28:119:44 | (...)... | +| mad/Test.java:121:35:121:42 | source(...) : String | mad/Test.java:121:28:121:42 | (...)... | +| mad/Test.java:123:55:123:62 | source(...) : String | mad/Test.java:123:46:123:62 | (...)... | +| mad/Test.java:125:47:125:54 | source(...) : String | mad/Test.java:125:40:125:54 | (...)... | +| mad/Test.java:127:47:127:54 | source(...) : String | mad/Test.java:127:40:127:54 | (...)... | +| mad/Test.java:131:35:131:42 | source(...) : String | mad/Test.java:131:26:131:42 | (...)... | +| mad/Test.java:135:56:135:63 | source(...) : String | mad/Test.java:135:49:135:63 | (...)... | +| mad/Test.java:137:56:137:63 | source(...) : String | mad/Test.java:137:49:137:63 | (...)... | +| mad/Test.java:141:59:141:66 | source(...) : String | mad/Test.java:141:52:141:66 | (...)... | +| mad/Test.java:143:59:143:66 | source(...) : String | mad/Test.java:143:52:143:66 | (...)... | +| mad/Test.java:145:58:145:65 | source(...) : String | mad/Test.java:145:49:145:65 | (...)... | +| mad/Test.java:147:34:147:41 | source(...) : String | mad/Test.java:147:25:147:41 | (...)... | +| mad/Test.java:149:34:149:41 | source(...) : String | mad/Test.java:149:25:149:41 | (...)... | +| mad/Test.java:151:44:151:51 | source(...) : String | mad/Test.java:151:35:151:51 | (...)... | +| mad/Test.java:153:31:153:38 | source(...) : String | mad/Test.java:153:24:153:38 | (...)... | +| mad/Test.java:155:46:155:53 | source(...) : String | mad/Test.java:155:37:155:53 | (...)... | +| mad/Test.java:157:46:157:53 | source(...) : String | mad/Test.java:157:37:157:53 | (...)... | +| mad/Test.java:159:67:159:74 | source(...) : String | mad/Test.java:159:58:159:74 | (...)... | +| mad/Test.java:161:67:161:74 | source(...) : String | mad/Test.java:161:58:161:74 | (...)... | +| mad/Test.java:163:73:163:80 | source(...) : String | mad/Test.java:163:64:163:80 | (...)... | +| mad/Test.java:166:37:166:44 | source(...) : String | mad/Test.java:166:28:166:44 | (...)... | +| mad/Test.java:168:48:168:55 | source(...) : String | mad/Test.java:168:39:168:55 | (...)... | +| mad/Test.java:170:54:170:61 | source(...) : String | mad/Test.java:170:45:170:61 | (...)... | +| mad/Test.java:172:69:172:76 | source(...) : String | mad/Test.java:172:60:172:76 | (...)... | +| mad/Test.java:174:47:174:54 | source(...) : String | mad/Test.java:174:40:174:54 | (...)... | +| mad/Test.java:176:49:176:56 | source(...) : String | mad/Test.java:176:40:176:56 | (...)... | +| mad/Test.java:178:64:178:71 | source(...) : String | mad/Test.java:178:55:178:71 | (...)... | +| mad/Test.java:180:49:180:56 | source(...) : String | mad/Test.java:180:40:180:56 | (...)... | +| mad/Test.java:182:64:182:71 | source(...) : String | mad/Test.java:182:55:182:71 | (...)... | +| mad/Test.java:184:61:184:68 | source(...) : String | mad/Test.java:184:54:184:68 | (...)... | +| mad/Test.java:190:37:190:44 | source(...) : String | mad/Test.java:190:30:190:44 | (...)... | +| mad/Test.java:192:74:192:81 | source(...) : String | mad/Test.java:192:40:192:81 | (...)... | +| mad/Test.java:194:68:194:75 | source(...) : String | mad/Test.java:194:34:194:75 | (...)... | +| mad/Test.java:196:68:196:75 | source(...) : String | mad/Test.java:196:34:196:75 | (...)... | +| mad/Test.java:198:30:198:37 | source(...) : String | mad/Test.java:198:23:198:37 | (...)... | +| mad/Test.java:203:30:203:37 | source(...) : String | mad/Test.java:203:23:203:37 | (...)... | +| mad/Test.java:208:33:208:40 | source(...) : String | mad/Test.java:208:23:208:40 | (...)... | +| mad/Test.java:210:27:210:34 | source(...) : String | mad/Test.java:210:20:210:34 | (...)... | +| mad/Test.java:212:28:212:35 | source(...) : String | mad/Test.java:212:21:212:35 | (...)... | +| mad/Test.java:214:29:214:36 | source(...) : String | mad/Test.java:214:22:214:36 | (...)... | +| mad/Test.java:219:27:219:34 | source(...) : String | mad/Test.java:219:20:219:34 | (...)... | +| mad/Test.java:221:26:221:33 | source(...) : String | mad/Test.java:221:19:221:33 | (...)... | +| mad/Test.java:226:29:226:36 | source(...) : String | mad/Test.java:226:20:226:36 | (...)... | nodes | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String | | Test.java:24:20:24:23 | temp | semmle.label | temp | @@ -152,115 +208,171 @@ nodes | Test.java:100:32:100:32 | t : String | semmle.label | t : String | | Test.java:101:12:101:54 | new URI(...) | semmle.label | new URI(...) | | Test.java:101:41:101:41 | t : String | semmle.label | t : String | -| mad/Test.java:30:16:30:36 | getHostName(...) : String | semmle.label | getHostName(...) : String | -| mad/Test.java:35:52:35:68 | (...)... | semmle.label | (...)... | -| mad/Test.java:35:61:35:68 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:37:32:37:48 | (...)... | semmle.label | (...)... | -| mad/Test.java:37:41:37:48 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:39:47:39:63 | (...)... | semmle.label | (...)... | -| mad/Test.java:39:56:39:63 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:41:39:41:53 | (...)... | semmle.label | (...)... | -| mad/Test.java:41:46:41:53 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:43:31:43:45 | (...)... | semmle.label | (...)... | -| mad/Test.java:43:38:43:45 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:45:29:45:43 | (...)... | semmle.label | (...)... | -| mad/Test.java:45:36:45:43 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:47:24:47:38 | (...)... | semmle.label | (...)... | -| mad/Test.java:47:31:47:38 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:49:24:49:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:49:33:49:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:51:20:51:34 | (...)... | semmle.label | (...)... | -| mad/Test.java:51:27:51:34 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:53:20:53:34 | (...)... | semmle.label | (...)... | -| mad/Test.java:53:27:53:34 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:55:33:55:47 | (...)... | semmle.label | (...)... | -| mad/Test.java:55:40:55:47 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:57:40:57:54 | (...)... | semmle.label | (...)... | -| mad/Test.java:57:47:57:54 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:59:33:59:47 | (...)... | semmle.label | (...)... | -| mad/Test.java:59:40:59:47 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:61:31:61:45 | (...)... | semmle.label | (...)... | -| mad/Test.java:61:38:61:45 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:63:26:63:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:63:33:63:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:65:26:65:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:65:33:65:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:67:34:67:48 | (...)... | semmle.label | (...)... | -| mad/Test.java:67:41:67:48 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:69:35:69:49 | (...)... | semmle.label | (...)... | -| mad/Test.java:69:42:69:49 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:71:30:71:44 | (...)... | semmle.label | (...)... | -| mad/Test.java:71:37:71:44 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:73:22:73:36 | (...)... | semmle.label | (...)... | -| mad/Test.java:73:29:73:36 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:75:30:75:44 | (...)... | semmle.label | (...)... | -| mad/Test.java:75:37:75:44 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:77:21:77:35 | (...)... | semmle.label | (...)... | -| mad/Test.java:77:28:77:35 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:79:26:79:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:79:33:79:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:81:33:81:47 | (...)... | semmle.label | (...)... | -| mad/Test.java:81:40:81:47 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:83:33:83:47 | (...)... | semmle.label | (...)... | -| mad/Test.java:83:40:83:47 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:84:33:84:47 | (...)... | semmle.label | (...)... | -| mad/Test.java:84:40:84:47 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:86:31:86:45 | (...)... | semmle.label | (...)... | -| mad/Test.java:86:38:86:45 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:88:21:88:35 | (...)... | semmle.label | (...)... | -| mad/Test.java:88:28:88:35 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:89:21:89:35 | (...)... | semmle.label | (...)... | -| mad/Test.java:89:28:89:35 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:90:21:90:35 | (...)... | semmle.label | (...)... | -| mad/Test.java:90:28:90:35 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:92:27:92:41 | (...)... | semmle.label | (...)... | -| mad/Test.java:92:34:92:41 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:93:27:93:41 | (...)... | semmle.label | (...)... | -| mad/Test.java:93:34:93:41 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:95:26:95:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:95:33:95:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:97:35:97:49 | (...)... | semmle.label | (...)... | -| mad/Test.java:97:42:97:49 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:99:41:99:57 | (...)... | semmle.label | (...)... | -| mad/Test.java:99:50:99:57 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:101:45:101:61 | (...)... | semmle.label | (...)... | -| mad/Test.java:101:54:101:61 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:103:43:103:57 | (...)... | semmle.label | (...)... | -| mad/Test.java:103:50:103:57 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:105:28:105:42 | (...)... | semmle.label | (...)... | -| mad/Test.java:105:35:105:42 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:107:41:107:55 | (...)... | semmle.label | (...)... | -| mad/Test.java:107:48:107:55 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:109:28:109:44 | (...)... | semmle.label | (...)... | -| mad/Test.java:109:37:109:44 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:111:28:111:42 | (...)... | semmle.label | (...)... | -| mad/Test.java:111:35:111:42 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:116:30:116:44 | (...)... | semmle.label | (...)... | -| mad/Test.java:116:37:116:44 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:118:40:118:81 | (...)... | semmle.label | (...)... | -| mad/Test.java:118:74:118:81 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:120:34:120:75 | (...)... | semmle.label | (...)... | -| mad/Test.java:120:68:120:75 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:122:34:122:75 | (...)... | semmle.label | (...)... | -| mad/Test.java:122:68:122:75 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:124:23:124:37 | (...)... | semmle.label | (...)... | -| mad/Test.java:124:30:124:37 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:129:23:129:37 | (...)... | semmle.label | (...)... | -| mad/Test.java:129:30:129:37 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:134:23:134:40 | (...)... | semmle.label | (...)... | -| mad/Test.java:134:33:134:40 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:136:20:136:34 | (...)... | semmle.label | (...)... | -| mad/Test.java:136:27:136:34 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:138:21:138:35 | (...)... | semmle.label | (...)... | -| mad/Test.java:138:28:138:35 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:140:22:140:36 | (...)... | semmle.label | (...)... | -| mad/Test.java:140:29:140:36 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:145:20:145:34 | (...)... | semmle.label | (...)... | -| mad/Test.java:145:27:145:34 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:147:19:147:33 | (...)... | semmle.label | (...)... | -| mad/Test.java:147:26:147:33 | source(...) : String | semmle.label | source(...) : String | -| mad/Test.java:152:20:152:36 | (...)... | semmle.label | (...)... | -| mad/Test.java:152:29:152:36 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:40:16:40:36 | getHostName(...) : String | semmle.label | getHostName(...) : String | +| mad/Test.java:45:52:45:68 | (...)... | semmle.label | (...)... | +| mad/Test.java:45:61:45:68 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:47:32:47:48 | (...)... | semmle.label | (...)... | +| mad/Test.java:47:41:47:48 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:49:47:49:63 | (...)... | semmle.label | (...)... | +| mad/Test.java:49:56:49:63 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:51:39:51:53 | (...)... | semmle.label | (...)... | +| mad/Test.java:51:46:51:53 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:53:31:53:45 | (...)... | semmle.label | (...)... | +| mad/Test.java:53:38:53:45 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:55:29:55:43 | (...)... | semmle.label | (...)... | +| mad/Test.java:55:36:55:43 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:57:24:57:38 | (...)... | semmle.label | (...)... | +| mad/Test.java:57:31:57:38 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:59:24:59:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:59:33:59:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:61:20:61:34 | (...)... | semmle.label | (...)... | +| mad/Test.java:61:27:61:34 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:63:20:63:34 | (...)... | semmle.label | (...)... | +| mad/Test.java:63:27:63:34 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:65:33:65:47 | (...)... | semmle.label | (...)... | +| mad/Test.java:65:40:65:47 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:67:40:67:54 | (...)... | semmle.label | (...)... | +| mad/Test.java:67:47:67:54 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:69:33:69:47 | (...)... | semmle.label | (...)... | +| mad/Test.java:69:40:69:47 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:71:31:71:45 | (...)... | semmle.label | (...)... | +| mad/Test.java:71:38:71:45 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:73:26:73:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:73:33:73:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:75:26:75:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:75:33:75:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:77:34:77:48 | (...)... | semmle.label | (...)... | +| mad/Test.java:77:41:77:48 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:79:35:79:49 | (...)... | semmle.label | (...)... | +| mad/Test.java:79:42:79:49 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:81:30:81:44 | (...)... | semmle.label | (...)... | +| mad/Test.java:81:37:81:44 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:83:22:83:36 | (...)... | semmle.label | (...)... | +| mad/Test.java:83:29:83:36 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:85:30:85:44 | (...)... | semmle.label | (...)... | +| mad/Test.java:85:37:85:44 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:87:21:87:35 | (...)... | semmle.label | (...)... | +| mad/Test.java:87:28:87:35 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:89:26:89:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:89:33:89:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:91:33:91:47 | (...)... | semmle.label | (...)... | +| mad/Test.java:91:40:91:47 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:93:33:93:47 | (...)... | semmle.label | (...)... | +| mad/Test.java:93:40:93:47 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:94:33:94:47 | (...)... | semmle.label | (...)... | +| mad/Test.java:94:40:94:47 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:96:31:96:45 | (...)... | semmle.label | (...)... | +| mad/Test.java:96:38:96:45 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:98:21:98:35 | (...)... | semmle.label | (...)... | +| mad/Test.java:98:28:98:35 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:99:21:99:35 | (...)... | semmle.label | (...)... | +| mad/Test.java:99:28:99:35 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:100:21:100:35 | (...)... | semmle.label | (...)... | +| mad/Test.java:100:28:100:35 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:102:27:102:41 | (...)... | semmle.label | (...)... | +| mad/Test.java:102:34:102:41 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:103:27:103:41 | (...)... | semmle.label | (...)... | +| mad/Test.java:103:34:103:41 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:105:26:105:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:105:33:105:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:107:35:107:49 | (...)... | semmle.label | (...)... | +| mad/Test.java:107:42:107:49 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:109:41:109:57 | (...)... | semmle.label | (...)... | +| mad/Test.java:109:50:109:57 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:111:45:111:61 | (...)... | semmle.label | (...)... | +| mad/Test.java:111:54:111:61 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:113:43:113:57 | (...)... | semmle.label | (...)... | +| mad/Test.java:113:50:113:57 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:115:28:115:42 | (...)... | semmle.label | (...)... | +| mad/Test.java:115:35:115:42 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:117:41:117:55 | (...)... | semmle.label | (...)... | +| mad/Test.java:117:48:117:55 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:119:28:119:44 | (...)... | semmle.label | (...)... | +| mad/Test.java:119:37:119:44 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:121:28:121:42 | (...)... | semmle.label | (...)... | +| mad/Test.java:121:35:121:42 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:123:46:123:62 | (...)... | semmle.label | (...)... | +| mad/Test.java:123:55:123:62 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:125:40:125:54 | (...)... | semmle.label | (...)... | +| mad/Test.java:125:47:125:54 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:127:40:127:54 | (...)... | semmle.label | (...)... | +| mad/Test.java:127:47:127:54 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:131:26:131:42 | (...)... | semmle.label | (...)... | +| mad/Test.java:131:35:131:42 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:135:49:135:63 | (...)... | semmle.label | (...)... | +| mad/Test.java:135:56:135:63 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:137:49:137:63 | (...)... | semmle.label | (...)... | +| mad/Test.java:137:56:137:63 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:141:52:141:66 | (...)... | semmle.label | (...)... | +| mad/Test.java:141:59:141:66 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:143:52:143:66 | (...)... | semmle.label | (...)... | +| mad/Test.java:143:59:143:66 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:145:49:145:65 | (...)... | semmle.label | (...)... | +| mad/Test.java:145:58:145:65 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:147:25:147:41 | (...)... | semmle.label | (...)... | +| mad/Test.java:147:34:147:41 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:149:25:149:41 | (...)... | semmle.label | (...)... | +| mad/Test.java:149:34:149:41 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:151:35:151:51 | (...)... | semmle.label | (...)... | +| mad/Test.java:151:44:151:51 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:153:24:153:38 | (...)... | semmle.label | (...)... | +| mad/Test.java:153:31:153:38 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:155:37:155:53 | (...)... | semmle.label | (...)... | +| mad/Test.java:155:46:155:53 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:157:37:157:53 | (...)... | semmle.label | (...)... | +| mad/Test.java:157:46:157:53 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:159:58:159:74 | (...)... | semmle.label | (...)... | +| mad/Test.java:159:67:159:74 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:161:58:161:74 | (...)... | semmle.label | (...)... | +| mad/Test.java:161:67:161:74 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:163:64:163:80 | (...)... | semmle.label | (...)... | +| mad/Test.java:163:73:163:80 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:166:28:166:44 | (...)... | semmle.label | (...)... | +| mad/Test.java:166:37:166:44 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:168:39:168:55 | (...)... | semmle.label | (...)... | +| mad/Test.java:168:48:168:55 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:170:45:170:61 | (...)... | semmle.label | (...)... | +| mad/Test.java:170:54:170:61 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:172:60:172:76 | (...)... | semmle.label | (...)... | +| mad/Test.java:172:69:172:76 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:174:40:174:54 | (...)... | semmle.label | (...)... | +| mad/Test.java:174:47:174:54 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:176:40:176:56 | (...)... | semmle.label | (...)... | +| mad/Test.java:176:49:176:56 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:178:55:178:71 | (...)... | semmle.label | (...)... | +| mad/Test.java:178:64:178:71 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:180:40:180:56 | (...)... | semmle.label | (...)... | +| mad/Test.java:180:49:180:56 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:182:55:182:71 | (...)... | semmle.label | (...)... | +| mad/Test.java:182:64:182:71 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:184:54:184:68 | (...)... | semmle.label | (...)... | +| mad/Test.java:184:61:184:68 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:190:30:190:44 | (...)... | semmle.label | (...)... | +| mad/Test.java:190:37:190:44 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:192:40:192:81 | (...)... | semmle.label | (...)... | +| mad/Test.java:192:74:192:81 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:194:34:194:75 | (...)... | semmle.label | (...)... | +| mad/Test.java:194:68:194:75 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:196:34:196:75 | (...)... | semmle.label | (...)... | +| mad/Test.java:196:68:196:75 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:198:23:198:37 | (...)... | semmle.label | (...)... | +| mad/Test.java:198:30:198:37 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:203:23:203:37 | (...)... | semmle.label | (...)... | +| mad/Test.java:203:30:203:37 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:208:23:208:40 | (...)... | semmle.label | (...)... | +| mad/Test.java:208:33:208:40 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:210:20:210:34 | (...)... | semmle.label | (...)... | +| mad/Test.java:210:27:210:34 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:212:21:212:35 | (...)... | semmle.label | (...)... | +| mad/Test.java:212:28:212:35 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:214:22:214:36 | (...)... | semmle.label | (...)... | +| mad/Test.java:214:29:214:36 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:219:20:219:34 | (...)... | semmle.label | (...)... | +| mad/Test.java:219:27:219:34 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:221:19:221:33 | (...)... | semmle.label | (...)... | +| mad/Test.java:221:26:221:33 | source(...) : String | semmle.label | source(...) : String | +| mad/Test.java:226:20:226:36 | (...)... | semmle.label | (...)... | +| mad/Test.java:226:29:226:36 | source(...) : String | semmle.label | source(...) : String | subpaths #select | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | This path depends on a $@. | Test.java:19:18:19:38 | getHostName(...) | user-provided value | @@ -274,57 +386,85 @@ subpaths | Test.java:99:3:99:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value | | Test.java:100:3:100:46 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value | | Test.java:101:3:101:55 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) | This path depends on a $@. | Test.java:95:14:95:34 | getHostName(...) | user-provided value | -| mad/Test.java:35:52:35:68 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:35:52:35:68 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:37:32:37:48 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:37:32:37:48 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:39:47:39:63 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:39:47:39:63 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:41:39:41:53 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:41:39:41:53 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:43:31:43:45 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:43:31:43:45 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:45:29:45:43 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:45:29:45:43 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:47:24:47:38 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:47:24:47:38 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:49:9:49:41 | new FileReader(...) | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:49:24:49:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:51:20:51:34 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:51:20:51:34 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:53:20:53:34 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:53:20:53:34 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:55:33:55:47 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:55:33:55:47 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:57:40:57:54 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:57:40:57:54 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:59:33:59:47 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:59:33:59:47 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:61:31:61:45 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:61:31:61:45 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:63:26:63:40 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:63:26:63:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:65:26:65:40 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:65:26:65:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:67:34:67:48 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:67:34:67:48 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:69:35:69:49 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:69:35:69:49 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:71:30:71:44 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:71:30:71:44 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:73:22:73:36 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:73:22:73:36 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:75:30:75:44 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:75:30:75:44 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:77:21:77:35 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:77:21:77:35 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:79:26:79:40 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:79:26:79:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:81:33:81:47 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:81:33:81:47 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:83:33:83:47 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:83:33:83:47 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:84:33:84:47 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:84:33:84:47 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:86:31:86:45 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:86:31:86:45 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:88:21:88:35 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:88:21:88:35 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:89:21:89:35 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:89:21:89:35 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:90:21:90:35 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:90:21:90:35 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:92:27:92:41 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:92:27:92:41 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:93:27:93:41 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:93:27:93:41 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:95:26:95:40 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:95:26:95:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:97:35:97:49 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:97:35:97:49 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:99:41:99:57 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:99:41:99:57 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:101:45:101:61 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:101:45:101:61 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:103:43:103:57 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:103:43:103:57 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:105:28:105:42 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:105:28:105:42 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:107:41:107:55 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:107:41:107:55 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:109:28:109:44 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:109:28:109:44 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:111:28:111:42 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:111:28:111:42 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:116:30:116:44 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:116:30:116:44 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:118:40:118:81 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:118:40:118:81 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:120:34:120:75 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:120:34:120:75 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:122:34:122:75 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:122:34:122:75 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:124:23:124:37 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:124:23:124:37 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:129:23:129:37 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:129:23:129:37 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:134:23:134:40 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:134:23:134:40 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:136:20:136:34 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:136:20:136:34 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:138:21:138:35 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:138:21:138:35 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:140:22:140:36 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:140:22:140:36 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:145:20:145:34 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:145:20:145:34 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:147:19:147:33 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:147:19:147:33 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | -| mad/Test.java:152:20:152:36 | (...)... | mad/Test.java:30:16:30:36 | getHostName(...) : String | mad/Test.java:152:20:152:36 | (...)... | This path depends on a $@. | mad/Test.java:30:16:30:36 | getHostName(...) | user-provided value | +| mad/Test.java:45:52:45:68 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:45:52:45:68 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:47:32:47:48 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:47:32:47:48 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:49:47:49:63 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:49:47:49:63 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:51:39:51:53 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:51:39:51:53 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:53:31:53:45 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:53:31:53:45 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:55:29:55:43 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:55:29:55:43 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:57:24:57:38 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:57:24:57:38 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:59:9:59:41 | new FileReader(...) | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:59:24:59:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:61:20:61:34 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:61:20:61:34 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:63:20:63:34 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:63:20:63:34 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:65:33:65:47 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:65:33:65:47 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:67:40:67:54 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:67:40:67:54 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:69:33:69:47 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:69:33:69:47 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:71:31:71:45 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:71:31:71:45 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:73:26:73:40 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:73:26:73:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:75:26:75:40 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:75:26:75:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:77:34:77:48 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:77:34:77:48 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:79:35:79:49 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:79:35:79:49 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:81:30:81:44 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:81:30:81:44 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:83:22:83:36 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:83:22:83:36 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:85:30:85:44 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:85:30:85:44 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:87:21:87:35 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:87:21:87:35 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:89:26:89:40 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:89:26:89:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:91:33:91:47 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:91:33:91:47 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:93:33:93:47 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:93:33:93:47 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:94:33:94:47 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:94:33:94:47 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:96:31:96:45 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:96:31:96:45 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:98:21:98:35 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:98:21:98:35 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:99:21:99:35 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:99:21:99:35 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:100:21:100:35 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:100:21:100:35 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:102:27:102:41 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:102:27:102:41 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:103:27:103:41 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:103:27:103:41 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:105:26:105:40 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:105:26:105:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:107:35:107:49 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:107:35:107:49 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:109:41:109:57 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:109:41:109:57 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:111:45:111:61 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:111:45:111:61 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:113:43:113:57 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:113:43:113:57 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:115:28:115:42 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:115:28:115:42 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:117:41:117:55 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:117:41:117:55 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:119:28:119:44 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:119:28:119:44 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:121:28:121:42 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:121:28:121:42 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:123:46:123:62 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:123:46:123:62 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:125:40:125:54 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:125:40:125:54 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:127:40:127:54 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:127:40:127:54 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:131:26:131:42 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:131:26:131:42 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:135:49:135:63 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:135:49:135:63 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:137:49:137:63 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:137:49:137:63 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:141:52:141:66 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:141:52:141:66 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:143:52:143:66 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:143:52:143:66 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:145:49:145:65 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:145:49:145:65 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:147:25:147:41 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:147:25:147:41 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:149:25:149:41 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:149:25:149:41 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:151:35:151:51 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:151:35:151:51 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:153:24:153:38 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:153:24:153:38 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:155:37:155:53 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:155:37:155:53 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:157:37:157:53 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:157:37:157:53 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:159:58:159:74 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:159:58:159:74 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:161:58:161:74 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:161:58:161:74 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:163:64:163:80 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:163:64:163:80 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:166:28:166:44 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:166:28:166:44 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:168:39:168:55 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:168:39:168:55 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:170:45:170:61 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:170:45:170:61 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:172:60:172:76 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:172:60:172:76 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:174:40:174:54 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:174:40:174:54 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:176:40:176:56 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:176:40:176:56 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:178:55:178:71 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:178:55:178:71 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:180:40:180:56 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:180:40:180:56 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:182:55:182:71 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:182:55:182:71 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:184:54:184:68 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:184:54:184:68 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:190:30:190:44 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:190:30:190:44 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:192:40:192:81 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:192:40:192:81 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:194:34:194:75 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:194:34:194:75 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:196:34:196:75 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:196:34:196:75 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:198:23:198:37 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:198:23:198:37 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:203:23:203:37 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:203:23:203:37 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:208:23:208:40 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:208:23:208:40 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:210:20:210:34 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:210:20:210:34 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:212:21:212:35 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:212:21:212:35 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:214:22:214:36 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:214:22:214:36 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:219:20:219:34 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:219:20:219:34 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:221:19:221:33 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:221:19:221:33 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | +| mad/Test.java:226:20:226:36 | (...)... | mad/Test.java:40:16:40:36 | getHostName(...) : String | mad/Test.java:226:20:226:36 | (...)... | This path depends on a $@. | mad/Test.java:40:16:40:36 | getHostName(...) | user-provided value | diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java index 086e19ab127..169f3535c6b 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/mad/Test.java @@ -11,6 +11,16 @@ import java.nio.file.Files; import java.nio.file.Path; import javax.activation.FileDataSource; import javax.xml.transform.stream.StreamResult; +import org.apache.cxf.common.classloader.ClassLoaderUtils; +import org.apache.cxf.common.jaxb.JAXBUtils; +import org.apache.cxf.configuration.jsse.SSLUtils; +import org.apache.cxf.resource.ExtendedURIResolver; +import org.apache.cxf.resource.URIResolver; +import org.apache.cxf.staxutils.StaxUtils; +import org.apache.cxf.tools.corba.utils.FileOutputStreamFactory; +import org.apache.cxf.tools.corba.utils.OutputStreamFactory; +import org.apache.cxf.tools.util.FileWriterUtil; +import org.apache.cxf.tools.util.OutputStreamCreator; import org.apache.commons.io.FileUtils; import org.apache.tools.ant.AntClassLoader; import org.apache.tools.ant.DirectoryScanner; @@ -109,6 +119,70 @@ public class Test { new FileDataSource((String) source()); // "javax.activation;FileDataSource;true;FileDataSource;(File);;Argument[0];path-injection;manual" new FileDataSource((File) source()); + // "org.apache.cxf.common.classloader;ClassLoaderUtils;true;getResourceAsStream;(String,Class);;Argument[0];path-injection;manual" + ClassLoaderUtils.getResourceAsStream((String) source(), null); + // "org.apache.cxf.common.jaxb;JAXBUtils;true;createFileCodeWriter;(File);;Argument[0];path-injection;manual" + JAXBUtils.createFileCodeWriter((File) source()); + // "org.apache.cxf.common.jaxb;JAXBUtils;true;createFileCodeWriter;(File,String);;Argument[0];path-injection;manual" + JAXBUtils.createFileCodeWriter((File) source(), null); + // "org.apache.cxf.configuration.jsse:SSLUtils;true;loadFile;(String);;Argument[0];path-injection;manual" + new SSLUtils() { + public void test() { + loadFile((String) source()); + } + }; + // "org.apache.cxf.helpers;FileUtils;true;delete;(File);;Argument[0];path-injection;manual" + org.apache.cxf.helpers.FileUtils.delete((File) source()); + // "org.apache.cxf.helpers;FileUtils;true;delete;(File,boolean);;Argument[0];path-injection;manual" + org.apache.cxf.helpers.FileUtils.delete((File) source(), false); + // "org.apache.cxf.helpers;FileUtils;true;mkdir;(File);;Argument[0];path-injection;manual" + org.apache.cxf.helpers.FileUtils.mkDir((File) source()); + // "org.apache.cxf.helpers;FileUtils;true;readLines;(File);;Argument[0];path-injection;manual" + org.apache.cxf.helpers.FileUtils.readLines((File) source()); + // "org.apache.cxf.helpers;FileUtils;true;removeDir;(File);;Argument[0];path-injection;manual" + org.apache.cxf.helpers.FileUtils.removeDir((File) source()); + // "org.apache.cxf.resource;ExtendedURIResolver;true;resolve;(String,String);;Argument[1];path-injection;manual" + new ExtendedURIResolver().resolve(null, (String) source()); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;URIResolver;(String,String);;Argument[0];path-injection;manual" + new URIResolver((String) source(), null); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;URIResolver;(String,String,Class);;Argument[0];path-injection;manual" + new URIResolver((String) source(), null, null); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;resolve;(String,String,Class);;Argument[0];path-injection;manual" + new URIResolver().resolve((String) source(), null, null); // $ SSRF + // "org.apache.cxf.staxutils;StaxUtils;true;read;(File);;Argument[0];path-injection;manual" + StaxUtils.read((File) source()); // $ SSRF + // "org.apache.cxf.tools.corba.utils;FileOutputStreamFactory;true;FileOutputStreamFactory;(String);;Argument[0];path-injection;manual" + new FileOutputStreamFactory((String) source()); // $ SSRF + // "org.apache.cxf.tools.corba.utils;FileOutputStreamFactory;true;FileOutputStreamFactory;(String,FileOutputStreamFactory);;Argument[0];path-injection;manual" + new FileOutputStreamFactory((String) source(), null); // $ SSRF + // "org.apache.cxf.tools.corba.utils;OutputStreamFactory;true;createOutputStream;(String);;Argument[0];path-injection;manual" + new FileOutputStreamFactory().createOutputStream((String) source()); // $ SSRF + // "org.apache.cxf.tools.corba.utils;OutputStreamFactory;true;createOutputStream;(String,String);;Argument[0];path-injection;manual" + new FileOutputStreamFactory().createOutputStream((String) source(), null); // $ SSRF + // "org.apache.cxf.tools.corba.utils;OutputStreamFactory;true;createOutputStream;(String,String);;Argument[1];path-injection;manual" + new FileOutputStreamFactory().createOutputStream(null, (String) source()); // $ SSRF + // @formatter:off + // "org.apache.cxf.tools.util;FileWriterUtil;true;FileWriterUtil;(String,OutputStreamCreator);;Argument[0];path-injection;manual" + new FileWriterUtil((String) source(), null); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;buildDir;(String);;Argument[0];path-injection;manual" + new FileWriterUtil().buildDir((String) source()); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getFileToWrite;(String,String);;Argument[0];path-injection;manual" + new FileWriterUtil().getFileToWrite((String) source(), (String) null); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getFileToWrite;(String,String);;Argument[1];path-injection;manual" + new FileWriterUtil().getFileToWrite((String) null, (String) source()); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getWriter;(File,String);;Argument[0];path-injection;manual" + new FileWriterUtil().getWriter((File) source(), (String) null); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getWriter;(String,String);;Argument[0];path-injection;manual" + new FileWriterUtil().getWriter((String) source(), null); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getWriter;(String,String);;Argument[1];path-injection;manual" + new FileWriterUtil().getWriter((String) null, (String) source()); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getWriter;(String,String,String);;Argument[0];path-injection;manual" + new FileWriterUtil().getWriter((String) source(), null, null); // $ SSRF + // "org.apache.cxf.tools.util;FileWriterUtil;true;getWriter;(String,String,String);;Argument[1];path-injection;manual" + new FileWriterUtil().getWriter((String) null, (String) source(), null); // $ SSRF + // "org.apache.cxf.tools.util;OutputStreamCreator;true;createOutputStream;(File);;Argument[0];path-injection;manual" + new OutputStreamCreator().createOutputStream((File) source()); // $ SSRF + // @formatter:on } void test(AntClassLoader acl) { diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options index 99f205115cd..6f6c5a27888 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options @@ -1 +1 @@ -// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6:${testdir}/../../../../../stubs/cargo:${testdir}/../../../../../stubs/apache-ant-1.10.13:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0:${testdir}/../../../../../stubs/jmh-1.3.6:${testdir}/../../../../../stubs/springframework-5.3.8:${testdir}/../../../../../stubs/jaxws-api-2.0 \ No newline at end of file +// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6:${testdir}/../../../../../stubs/cargo:${testdir}/../../../../../stubs/apache-ant-1.10.13:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0:${testdir}/../../../../../stubs/jmh-1.3.6:${testdir}/../../../../../stubs/springframework-5.3.8:${testdir}/../../../../../stubs/jaxws-api-2.0:${testdir}/../../../../../stubs/apache-cxf diff --git a/java/ql/test/query-tests/security/CWE-117/LogInjectionTest.java b/java/ql/test/query-tests/security/CWE-117/LogInjectionTest.java index 4bcdb197e15..a28a55cbbba 100644 --- a/java/ql/test/query-tests/security/CWE-117/LogInjectionTest.java +++ b/java/ql/test/query-tests/security/CWE-117/LogInjectionTest.java @@ -3,6 +3,7 @@ import java.util.logging.LogRecord; import java.util.regex.Pattern; import com.google.common.flogger.LoggingApi; import org.apache.commons.logging.Log; +import org.apache.cxf.common.logging.LogUtils; import org.apache.log4j.Category; import org.apache.logging.log4j.Level; import org.apache.logging.log4j.LogBuilder; @@ -2122,5 +2123,21 @@ public class LogInjectionTest { android.util.Log.e("", (String) source()); // $ hasTaintFlow android.util.Log.wtf("", (String) source()); // $ hasTaintFlow } + { + // @formatter:off + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source()); // $ hasTaintFlow + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String,Object);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source(), (Object) null); // $ hasTaintFlow + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String,Object[]);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source(), (Object[]) null); // $ hasTaintFlow + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String,Throwable);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source(), (Throwable) null); // $ hasTaintFlow + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String,Throwable,Object);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source(), (Throwable) null, (Object) null); // $ hasTaintFlow + // "org.apache.cxf.common.logging;LogUtils;true;log;(Logger,Level,String,Throwable,Object[]);;Argument[2];log-injection;manual" + LogUtils.log(null, null, (String) source(), (Throwable) null, (Object) null, (Object) null); // $ hasTaintFlow + // @formatter:on + } } } diff --git a/java/ql/test/query-tests/security/CWE-117/options b/java/ql/test/query-tests/security/CWE-117/options index 01138ecc34b..372b08b0806 100644 --- a/java/ql/test/query-tests/security/CWE-117/options +++ b/java/ql/test/query-tests/security/CWE-117/options @@ -1 +1 @@ -//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-log4j-1.2.17:${testdir}/../../../stubs/apache-log4j-2.14.1:${testdir}/../../../stubs/apache-commons-logging-1.2:${testdir}/../../../stubs/jboss-logging-3.4.2:${testdir}/../../../stubs/slf4j-2.0.0:${testdir}/../../../stubs/scijava-common-2.87.1:${testdir}/../../../stubs/flogger-0.7.1:${testdir}/../../../stubs/google-android-9.0.0 \ No newline at end of file +//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-log4j-1.2.17:${testdir}/../../../stubs/apache-log4j-2.14.1:${testdir}/../../../stubs/apache-commons-logging-1.2:${testdir}/../../../stubs/jboss-logging-3.4.2:${testdir}/../../../stubs/slf4j-2.0.0:${testdir}/../../../stubs/scijava-common-2.87.1:${testdir}/../../../stubs/flogger-0.7.1:${testdir}/../../../stubs/google-android-9.0.0:${testdir}/../../../stubs/apache-cxf \ No newline at end of file diff --git a/java/ql/test/query-tests/security/CWE-918/mad/Test.java b/java/ql/test/query-tests/security/CWE-918/mad/Test.java index 29cb7abd793..5bf070bbe50 100644 --- a/java/ql/test/query-tests/security/CWE-918/mad/Test.java +++ b/java/ql/test/query-tests/security/CWE-918/mad/Test.java @@ -4,10 +4,15 @@ import java.net.Socket; import java.net.SocketAddress; import java.net.URL; import java.net.URLClassLoader; +import java.util.List; import javax.activation.URLDataSource; import javax.servlet.http.HttpServletRequest; import javafx.scene.web.WebEngine; import org.apache.commons.jelly.JellyContext; +import org.apache.cxf.catalog.OASISCatalogManager; +import org.apache.cxf.common.classloader.ClassLoaderUtils; +import org.apache.cxf.resource.ExtendedURIResolver; +import org.apache.cxf.resource.URIResolver; import org.codehaus.cargo.container.installer.ZipURLInstaller; import org.kohsuke.stapler.HttpResponses; import play.libs.ws.WSClient; @@ -35,7 +40,7 @@ public class Test { ((URL) source()).openStream(); // $ SSRF } - public void test(URLClassLoader cl) throws Exception { + public void test() throws Exception { // "java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader);;Argument[1];open-url;manual" new URLClassLoader("", (URL[]) source(), null); // $ SSRF // "java.net;URLClassLoader;false;URLClassLoader;(String,URL[],ClassLoader,URLStreamHandlerFactory);;Argument[1];open-url;manual" @@ -62,6 +67,24 @@ public class Test { new JellyContext((URL) source()); // $ SSRF // "javax.activation;URLDataSource;true;URLDataSource;(URL);;Argument[0];request-forgery;manual" new URLDataSource((URL) source()); // $ SSRF + // "org.apache.cxf.catalog;OASISCatalogManager;true;loadCatalog;(URL);;Argument[0];request-forgery;manual" + new OASISCatalogManager().loadCatalog((URL) source()); // $ SSRF + // @formatter:off + // "org.apache.cxf.common.classloader;ClassLoaderUtils;true;getURLClassLoader;(URL[],ClassLoader);;Argument[0];request-forgery;manual" + new ClassLoaderUtils().getURLClassLoader((URL[]) source(), null); // $ SSRF + // "org.apache.cxf.common.classloader;ClassLoaderUtils;true;getURLClassLoader;(List,ClassLoader);;Argument[0];request-forgery;manual" + new ClassLoaderUtils().getURLClassLoader((List) source(), null); // $ SSRF + // "org.apache.cxf.resource;ExtendedURIResolver;true;resolve;(String,String);;Argument[0];request-forgery;manual"] + new ExtendedURIResolver().resolve((String) source(), null); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;URIResolver;(String);;Argument[0];request-forgery;manual"] + new URIResolver((String) source()); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;URIResolver;(String,String);;Argument[1];request-forgery;manual"] + new URIResolver(null, (String) source()); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;URIResolver;(String,String,Class);;Argument[1];request-forgery;manual"] + new URIResolver(null, (String) source(), null); // $ SSRF + // "org.apache.cxf.resource;URIResolver;true;resolve;(String,String,Class);;Argument[1];request-forgery;manual" + new URIResolver().resolve(null, (String) source(), null); // $ SSRF + // @formatter:on } public void test(WebEngine webEngine) { diff --git a/java/ql/test/query-tests/security/CWE-918/options b/java/ql/test/query-tests/security/CWE-918/options index 64fb822e2af..4158843ef98 100644 --- a/java/ql/test/query-tests/security/CWE-918/options +++ b/java/ql/test/query-tests/security/CWE-918/options @@ -1 +1 @@ -//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0 +//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/catalog/OASISCatalogManager.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/catalog/OASISCatalogManager.java new file mode 100644 index 00000000000..096ebe8b75c --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/catalog/OASISCatalogManager.java @@ -0,0 +1,7 @@ +package org.apache.cxf.catalog; + +import java.net.URL; + +public class OASISCatalogManager { + public final void loadCatalog(URL catalogURL) {} +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/classloader/ClassLoaderUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/classloader/ClassLoaderUtils.java new file mode 100644 index 00000000000..e1f3f3407ee --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/classloader/ClassLoaderUtils.java @@ -0,0 +1,19 @@ +package org.apache.cxf.common.classloader; + +import java.io.InputStream; +import java.net.URL; +import java.util.List; + +public class ClassLoaderUtils { + public static ClassLoader getURLClassLoader(URL[] urls, ClassLoader parent) { + return null; + } + + public static ClassLoader getURLClassLoader(List urlList, ClassLoader parent) { + return null; + } + + public static InputStream getResourceAsStream(String resourceName, Class callingClass) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/jaxb/JAXBUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/jaxb/JAXBUtils.java new file mode 100644 index 00000000000..86bc017b6f2 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/jaxb/JAXBUtils.java @@ -0,0 +1,13 @@ +package org.apache.cxf.common.jaxb; + +import java.io.File; + +public class JAXBUtils { + public static Object createFileCodeWriter(File f) { + return null; + } + + public static Object createFileCodeWriter(File f, String encoding) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/logging/LogUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/logging/LogUtils.java new file mode 100644 index 00000000000..bc0119f1e63 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/common/logging/LogUtils.java @@ -0,0 +1,20 @@ +package org.apache.cxf.common.logging; + +import java.util.logging.Level; +import java.util.logging.Logger; + +public class LogUtils { + public static void log(Logger logger, Level level, String message) {} + + public static void log(Logger logger, Level level, String message, Object parameter) {} + + public static void log(Logger logger, Level level, String message, Object[] parameters) {} + + public static void log(Logger logger, Level level, String message, Throwable throwable) {} + + public static void log(Logger logger, Level level, String message, Throwable throwable, + Object parameter) {} + + public static void log(Logger logger, Level level, String message, Throwable throwable, + Object... parameters) {} +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/configuration/jsse/SSLUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/configuration/jsse/SSLUtils.java new file mode 100644 index 00000000000..a9613edd8e1 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/configuration/jsse/SSLUtils.java @@ -0,0 +1,7 @@ +package org.apache.cxf.configuration.jsse; + +public class SSLUtils { + protected static byte[] loadFile(String fileName) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/helpers/FileUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/helpers/FileUtils.java new file mode 100644 index 00000000000..e6515acc1c9 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/helpers/FileUtils.java @@ -0,0 +1,65 @@ +package org.apache.cxf.helpers; + +import java.io.File; +import java.util.List; + +public class FileUtils { + public static File createTempFile(String prefix, String suffix) { + return null; + } + + public static File createTempFile(String prefix, String suffix, File parentDir, + boolean deleteOnExit) { + return null; + } + + public static File createTmpDir() { + return null; + } + + public static File createTmpDir(boolean addHook) { + return null; + } + + public static void delete(File f) {} + + public static void delete(File f, boolean inShutdown) {} + + public static boolean exists(File file) { + return false; + } + + public static File getDefaultTempDir() { + return null; + } + + public static List getFiles(File dir, String pattern) { + return null; + } + + public static List getFilesRecurseUsingSuffix(File dir, String suffix) { + return null; + } + + public static List getFilesUsingSuffix(File dir, String suffix) { + return null; + } + + public static boolean isValidFileName(String name) { + return false; + } + + public static void maybeDeleteDefaultTempDir() {} + + public static void mkDir(File dir) {} + + public static List readLines(File file) { + return null; + } + + public static void removeDir(File d) {} + + public static String stripPath(String name) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/ExtendedURIResolver.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/ExtendedURIResolver.java new file mode 100644 index 00000000000..1858337c7e5 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/ExtendedURIResolver.java @@ -0,0 +1,9 @@ +package org.apache.cxf.resource; + +import org.xml.sax.InputSource; + +public class ExtendedURIResolver { + public InputSource resolve(String curUri, String baseUri) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/URIResolver.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/URIResolver.java new file mode 100644 index 00000000000..6e94734fcd3 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/resource/URIResolver.java @@ -0,0 +1,13 @@ +package org.apache.cxf.resource; + +public class URIResolver { + public URIResolver() {} + + public URIResolver(String path) {} + + public URIResolver(String baseUriStr, String uriStr) {} + + public URIResolver(String baseUriStr, String uriStr, Class calling) {} + + public void resolve(String baseUriStr, String uriStr, Class callingCls) {} +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/staxutils/StaxUtils.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/staxutils/StaxUtils.java new file mode 100644 index 00000000000..3106c985014 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/staxutils/StaxUtils.java @@ -0,0 +1,10 @@ +package org.apache.cxf.staxutils; + +import java.io.File; +import org.w3c.dom.Document; + +public class StaxUtils { + public static Document read(File is) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/FileOutputStreamFactory.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/FileOutputStreamFactory.java new file mode 100644 index 00000000000..2f2e55b58ec --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/FileOutputStreamFactory.java @@ -0,0 +1,19 @@ +package org.apache.cxf.tools.corba.utils; + +import java.io.OutputStream; + +public class FileOutputStreamFactory implements OutputStreamFactory { + public FileOutputStreamFactory() {} + + public FileOutputStreamFactory(String dir) {} + + public FileOutputStreamFactory(String dir, FileOutputStreamFactory p) {} + + public OutputStream createOutputStream(String name) { + return null; + } + + public OutputStream createOutputStream(String packageName, String name) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/OutputStreamFactory.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/OutputStreamFactory.java new file mode 100644 index 00000000000..e740fd8f031 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/corba/utils/OutputStreamFactory.java @@ -0,0 +1,9 @@ +package org.apache.cxf.tools.corba.utils; + +import java.io.OutputStream; + +public interface OutputStreamFactory { + OutputStream createOutputStream(String name); + + OutputStream createOutputStream(String packageName, String name); +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/FileWriterUtil.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/FileWriterUtil.java new file mode 100644 index 00000000000..a42f8facd3d --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/FileWriterUtil.java @@ -0,0 +1,30 @@ +package org.apache.cxf.tools.util; + +import java.io.File; +import java.io.Writer; + +public class FileWriterUtil { + public FileWriterUtil() {} + + public FileWriterUtil(String targetDir, OutputStreamCreator osc) {} + + public File buildDir(String packageName) { + return null; + } + + public File getFileToWrite(String packageName, String fileName) { + return null; + } + + public Writer getWriter(File fn, String encoding) { + return null; + } + + public Writer getWriter(String packageName, String fileName) { + return null; + } + + public Writer getWriter(String packageName, String fileName, String encoding) { + return null; + } +} diff --git a/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/OutputStreamCreator.java b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/OutputStreamCreator.java new file mode 100644 index 00000000000..9cac1e27e53 --- /dev/null +++ b/java/ql/test/stubs/apache-cxf/org/apache/cxf/tools/util/OutputStreamCreator.java @@ -0,0 +1,11 @@ +package org.apache.cxf.tools.util; + +import java.io.File; +import java.io.OutputStream; + +public class OutputStreamCreator { + public OutputStream createOutputStream(File file) { + return null; + } + +}