Skip to content

Java: Improve alert wording in java/integer-multiplication-cast-to-long. #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
semmle-qlci merged 3 commits into from
Sep 13, 2018
Merged

Java: Improve alert wording in java/integer-multiplication-cast-to-long. #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ccbd8aa
Java: Improve alert message of IntMultToLong.
aschackmull Sep 12, 2018
1bbc67b
Java: Autoformat query.
aschackmull Sep 12, 2018
b9acdf5
Java: Update qltest.
aschackmull Sep 13, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions java/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
* external/cwe/cwe-197
* external/cwe/cwe-681
*/

import java
import semmle.code.java.dataflow.RangeUtils
import semmle.code.java.Conversions
Expand All @@ -25,7 +26,8 @@ predicate small(MulExpr e) {
lhs = e.getLeftOperand().getProperExpr().(ConstantIntegerExpr).getIntValue() and
rhs = e.getRightOperand().getProperExpr().(ConstantIntegerExpr).getIntValue() and
lhs * rhs = res and
t.getOrdPrimitiveType().getMinValue() <= res and res <= t.getOrdPrimitiveType().getMaxValue()
t.getOrdPrimitiveType().getMinValue() <= res and
res <= t.getOrdPrimitiveType().getMaxValue()
)
}

Expand All @@ -52,4 +54,7 @@ where
// not obviously small and ok
not small(e) and
e.getEnclosingCallable().fromSource()
select c, "$@ converted to "+ destType.getName() +" by use in " + ("a " + c.kind()).regexpReplaceAll("^a ([aeiou])", "an $1") + ".", e, sourceType.getName() + " multiplication"
select c,
"Potential overflow in $@ before it is converted to " + destType.getName() + " by use in " +
("a " + c.kind()).regexpReplaceAll("^a ([aeiou])", "an $1") + ".", e,
sourceType.getName() + " multiplication"
8 changes: 4 additions & 4 deletions java/ql/test/query-tests/security/CWE-190/semmle/tests/IntMultToLong.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
| Test.java:20:23:20:48 | ... * ... | $@ converted to long by use in an assignment context. | Test.java:20:23:20:48 | ... * ... | int multiplication |
| Test.java:27:23:27:52 | ... + ... | $@ converted to long by use in an assignment context. | Test.java:27:23:27:48 | ... * ... | int multiplication |
| Test.java:34:23:34:63 | ...?...:... | $@ converted to long by use in an assignment context. | Test.java:34:30:34:55 | ... * ... | int multiplication |
| Test.java:41:25:41:49 | ... * ... | $@ converted to double by use in an assignment context. | Test.java:41:25:41:49 | ... * ... | long multiplication |
| Test.java:20:23:20:48 | ... * ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:20:23:20:48 | ... * ... | int multiplication |
| Test.java:27:23:27:52 | ... + ... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:27:23:27:48 | ... * ... | int multiplication |
| Test.java:34:23:34:63 | ...?...:... | Potential overflow in $@ before it is converted to long by use in an assignment context. | Test.java:34:30:34:55 | ... * ... | int multiplication |
| Test.java:41:25:41:49 | ... * ... | Potential overflow in $@ before it is converted to double by use in an assignment context. | Test.java:41:25:41:49 | ... * ... | long multiplication |