You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
1.9 KiB
53 lines
1.9 KiB
property ForwardUncommitted
|
|
message "A ServletResponse was forwarded before being committed."
|
|
// TODO assume InterleavedResponse_Weak
|
|
prefix "javax.servlet"
|
|
prefix "javax.servlet.{ServletOutputStream,ServletResponse}"
|
|
prefix "java.io.PrintWriter"
|
|
nondet (start)
|
|
start -> start: *
|
|
start -> tracking: R = "ServletResponse.\<init\>"
|
|
tracking -> ok: flushBuffer(r)
|
|
tracking -> gotWriter: W = getWriter(r)
|
|
gotWriter -> ok: flush(w)
|
|
gotWriter -> ok: flushBuffer(r)
|
|
tracking -> gotStream: S = getOutputStream(r)
|
|
gotStream -> ok: flush(s)
|
|
gotStream -> ok: flushBuffer(r)
|
|
tracking -> error: "RequestDispatcher.forward"(*, *, r)
|
|
gotWriter -> error: "RequestDispatcher.forward"(*, *, r)
|
|
gotStream -> error: "RequestDispatcher.forward"(*, *, r)
|
|
|
|
// The documentation of ServletResponse.getOutputStream says that "either this
|
|
// method getWriter may be called to write to the body, not both." So,
|
|
// technically, the property is InterleavedResponse1. However, this property is
|
|
// broken, which is why we also have the weaker version InterleavedResponse2.
|
|
property InterleavedResponse1
|
|
message "A ServletResponse was asked for both a writer and a stream."
|
|
prefix "javax.servlet.ServletResponse"
|
|
nondet (start)
|
|
start -> start: *
|
|
start -> gotWriter: W = getWriter(R)
|
|
start -> gotStream: S = getOutputStream(R)
|
|
gotWriter -> error: getOutputStream(r)
|
|
gotStream -> error: getWriter(r)
|
|
|
|
property InterleavedResponse2
|
|
// vertex names: w = got writer; W = used writer; similarly for s, S
|
|
message "Incompatible methods for putting data into a response were used."
|
|
prefix "javax.servlet.ServletResponse"
|
|
nondet (start)
|
|
start -> start: *
|
|
start -> w: W = getWriter(R)
|
|
start -> s: S = getOutputStream(R)
|
|
w -> sw: S = getOutputStream(r)
|
|
s -> sw: W = getWriter(r)
|
|
w -> W: *(w)
|
|
sw -> sW: *(w)
|
|
s -> S: *(s)
|
|
sw -> Sw: *(s)
|
|
W -> sW: S = getOutputStream(r)
|
|
S -> Sw: W = getWriter(r)
|
|
sW -> error: *(s)
|
|
Sw -> error: *(w)
|