feat(rules): Add security rules and sanitizers

.github/workflows/ci-rules.yaml

@@ -4,11 +4,13 @@ on:
   push:
     paths:
       - 'rules/**'
+      - 'core/opentaint-config/java-config/config/**'
       - '.github/workflows/ci-rules.yaml'
     branches: [ "main" ]
   pull_request:
     paths:
       - 'rules/**'
+      - 'core/opentaint-config/java-config/config/**'
       - '.github/workflows/ci-rules.yaml'
     branches: [ "main" ]
   workflow_dispatch:
@@ -70,6 +72,26 @@ jobs:
                --logs-file autobuild.log \
                --verbosity debug
 
+      - name: Use source propagators (overlay repo config into analyzer jar)
+        run: |
+          # The rule-test runner (--debug-run-rule-tests -> TestProjectAnalyzer)
+          # loads taint passThrough rules only from the analyzer jar's bundled
+          # /java-config resources (loadDefaultConfig -> ConfigLoader); it does NOT read
+          # --approximations-config. The released analyzer jar is built from main,
+          # so its bundled config lacks the propagators kept in this repo's source
+          # tree, which surfaces as false negatives. Overlay the in-repo propagators
+          # (core/opentaint-config/java-config/config/java-config -> jar entries under
+          # java-config/) so the rule tests run against the source config.
+          #
+          # Use `zip`, not `jar uf`: the analyzer is a shadow/fat jar with duplicate
+          # directory entries (e.g. `org/`). `jar uf` rewrites the whole archive via
+          # ZipOutputStream, which aborts on those pre-existing duplicates
+          # (java.util.zip.ZipException: duplicate entry: org/). `zip` copies existing
+          # entries as-is and only replaces/adds the config files.
+          apt-get update && apt-get install -y zip
+          JAR="$PWD/opentaint-analyzer/opentaint-project-analyzer.jar"
+          ( cd core/opentaint-config/java-config/config && zip -r "$JAR" java-config )
+
       - name: Run OpenTaint analyzer
         run: |
           java -Xmx8G -Djdk.util.jar.enableMultiRelease=false -Dorg.opentaint.ir.impl.storage.defaultBatchSize=2000 \

core/opentaint-config/java-config/config/java-config/jar-split/ant-1.10.14.yaml

@@ -0,0 +1,13 @@
+passThrough:
+- function: org.apache.tools.ant.types.FileSet#setDir
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.tools.ant.types.FileSet#path#java.lang.Object
+- function: org.apache.tools.ant.types.FileSet#setFile
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.tools.ant.types.FileSet#path#java.lang.Object

core/opentaint-config/java-config/config/java-config/jar-split/commons-codec-1.16.0.yaml

@@ -0,0 +1,17 @@
+passThrough:
+- function: org.apache.commons.codec.binary.Base64#encodeBase64String
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.codec.binary.Base64#encodeBase64URLSafeString
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.codec.binary.Base64#encodeBase64URLSafe
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.codec.binary.Base64#encodeBase64Chunked
+  copy:
+  - from: arg(0)
+    to: result

core/opentaint-config/java-config/config/java-config/jar-split/commons-io-2.15.1.yaml

@@ -0,0 +1,17 @@
+passThrough:
+- function: org.apache.commons.io.IOUtils#toString
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.io.IOUtils#toByteArray
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.io.IOUtils#toCharArray
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.apache.commons.io.IOUtils#readLines
+  copy:
+  - from: arg(0)
+    to: result

core/opentaint-config/java-config/config/java-config/jar-split/groovy-3.0.21.yaml

@@ -0,0 +1,36 @@
+passThrough:
+- function: org.codehaus.groovy.control.CompilationUnit#addSource
+  signature: (java.io.File) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.codehaus.groovy.control.CompilationUnit#source#java.lang.Object
+- function: org.codehaus.groovy.control.CompilationUnit#addSource
+  signature: (java.net.URL) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.codehaus.groovy.control.CompilationUnit#source#java.lang.Object
+- function: org.codehaus.groovy.control.CompilationUnit#addSource
+  signature: (java.lang.String, java.io.InputStream) *
+  copy:
+  - from: arg(1)
+    to:
+    - this
+    - .org.codehaus.groovy.control.CompilationUnit#source#java.lang.Object
+- function: org.codehaus.groovy.control.CompilationUnit#addSource
+  signature: (java.lang.String, java.lang.String) *
+  copy:
+  - from: arg(1)
+    to:
+    - this
+    - .org.codehaus.groovy.control.CompilationUnit#source#java.lang.Object
+- function: org.codehaus.groovy.control.CompilationUnit#addSource
+  signature: (org.codehaus.groovy.control.SourceUnit) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.codehaus.groovy.control.CompilationUnit#source#java.lang.Object

core/opentaint-config/java-config/config/java-config/jar-split/httpcore5-5.2.4.yaml

@@ -0,0 +1,43 @@
+passThrough:
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String, org.apache.hc.core5.http.ContentType) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String, java.nio.charset.Charset) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String, org.apache.hc.core5.http.ContentType, boolean) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String, java.nio.charset.Charset, boolean) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object
+- function: org.apache.hc.core5.http.io.entity.StringEntity#<init>
+  signature: (java.lang.String, org.apache.hc.core5.http.ContentType, java.lang.String, boolean) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .org.apache.hc.core5.http.io.entity.StringEntity#content#java.lang.Object

core/opentaint-config/java-config/config/java-config/jar-split/jenkins-core-2.426.3.yaml

@@ -0,0 +1,22 @@
+passThrough:
+- function: hudson.FilePath#<init>
+  signature: (hudson.remoting.VirtualChannel, java.lang.String) *
+  copy:
+  - from: arg(1)
+    to:
+    - this
+    - .hudson.FilePath#path#java.lang.Object
+- function: hudson.FilePath#<init>
+  signature: (java.io.File) *
+  copy:
+  - from: arg(0)
+    to:
+    - this
+    - .hudson.FilePath#path#java.lang.Object
+- function: hudson.FilePath#<init>
+  signature: (hudson.FilePath, java.lang.String) *
+  copy:
+  - from: arg(1)
+    to:
+    - this
+    - .hudson.FilePath#path#java.lang.Object

core/opentaint-config/java-config/config/java-config/jar-split/mvel2-2.5.2.Final.yaml

@@ -0,0 +1,21 @@
+passThrough:
+- function: org.mvel2.MVEL#compileExpression
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.mvel2.MVEL#compileSetExpression
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.mvel2.MVEL#compileGetExpression
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.mvel2.jsr223.MvelScriptEngine#compile
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.mvel2.jsr223.MvelScriptEngine#compiledScript
+  copy:
+  - from: arg(0)
+    to: result

core/opentaint-config/java-config/config/java-config/jar-split/okhttp-4.12.0.yaml

@@ -0,0 +1,166 @@
+passThrough:
+- function: okhttp3.Request$Builder#url
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#header
+  signature: (java.lang.String, java.lang.String) *
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#addHeader
+  signature: (java.lang.String, java.lang.String) *
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#headers
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#post
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#put
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#patch
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#delete
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#method
+  signature: (java.lang.String, okhttp3.RequestBody) *
+  copy:
+  - from: arg(0)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - result
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(0)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: arg(1)
+    to:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#get
+  copy:
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#head
+  copy:
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#removeHeader
+  copy:
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#cacheControl
+  copy:
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#tag
+  copy:
+  - from: this
+    to: result
+- function: okhttp3.Request$Builder#build
+  copy:
+  - from: this
+    to: result
+  - from:
+    - this
+    - .okhttp3.Request$Builder#url#java.lang.Object
+    to:
+    - result
+    - .okhttp3.Request#url#java.lang.Object

core/opentaint-config/java-config/config/java-config/jar-split/spring-jdbc-5.3.39.yaml

@@ -0,0 +1,13 @@
+passThrough:
+- function: org.springframework.jdbc.core.namedparam.NamedParameterUtils#parseSqlStatement
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.springframework.jdbc.core.namedparam.NamedParameterUtils#substituteNamedParameters
+  copy:
+  - from: arg(0)
+    to: result
+- function: org.springframework.jdbc.core.namedparam.NamedParameterUtils#parseSqlStatementIntoString
+  copy:
+  - from: arg(0)
+    to: result