Protobuf.qll

import semmle.code.java.dataflow.FlowSources

module Protobuf {
classProtoToCoreTaintStepextends TaintTracking::AdditionalTaintStep{
overridepredicatestep(DataFlow::Noden1, DataFlow::Noden2){
exists(MethodCallma|
ma.getMethod().getName().matches("toCore%")and
n2.asExpr()=maand
n1.asExpr()=ma.getArgument(0)
)
}
}

classByteStringThisReturnTaintStepextends TaintTracking::AdditionalTaintStep{
overridepredicatestep(DataFlow::Noden1, DataFlow::Noden2){
exists(MethodCallma|
//ma.getMethod().getName().matches(["toByteArray", "toString", "toStringUtf8", "substring", "concat", "asReadOnlyByteBuffer", "asReadOnlyByteBufferList"]) and
ma.getMethod().getName().matches("toByteArray")and
ma.getMethod()
 .getDeclaringType()
 .getASourceSupertype*()
 .(RefType)
 .hasQualifiedName("com.google.protobuf","ByteString")and
n1.asExpr()=ma.getQualifier()and
n2.asExpr()=ma
)
}
}

classByteStringArgReturnTaintStepextends TaintTracking::AdditionalTaintStep{
overridepredicatestep(DataFlow::Noden1, DataFlow::Noden2){
exists(MethodCallma|
ma.getMethod().getName().matches(["readFrom","copyFrom","concat"])and
ma.getMethod()
 .getDeclaringType()
 .getASourceSupertype*()
 .(RefType)
 .hasQualifiedName("com.google.protobuf","ByteString")and
n1.asExpr()=ma.getArgument(0)and
n2.asExpr()=ma
)
}
}

classRemoteSourceextendsRemoteFlowSource{
RemoteSource(){
exists(MethodCallma,Methodm|
ma.getMethod()=mand
m.getName().matches("get%")and
m.getDeclaringType()
 .getASourceSupertype*()
 .(RefType)
 .hasQualifiedName("com.google.protobuf","GeneratedMessageV3")and
this.asExpr()=ma
)
}

overridestringgetSourceType(){result="Protobuf Source"}
}
}