mirror of
https://github.com/hohn/codeql-dataflow-sql-injection-go.git
synced 2025-12-16 10:13:04 +01:00
Fixed the -- completely -- broken Sink query
This commit is contained in:
@@ -1,16 +1,21 @@
|
||||
/**
|
||||
* Identify the sink: the 3rd argument to exec.Command(...), i.e., index 2.
|
||||
* Uses AST/semantic matching via resolved call target and argument position.
|
||||
*/
|
||||
* @name Sink identification
|
||||
* @description Sink identification
|
||||
* @kind problem
|
||||
* @id go/demo/sink
|
||||
* @problem.severity warning
|
||||
|
||||
* Identify the sink: the 3rd argument to exec.Command(...), i.e., index 2.
|
||||
* Uses AST/semantic matching via resolved call target and argument position.
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
/** A sink expression corresponding to the 3rd argument to exec.Command. */
|
||||
predicate isSink(Expr e) {
|
||||
exists(Call c, Function f |
|
||||
f = c.getTarget() and
|
||||
f.getName() = "Command" and
|
||||
f.getDeclaringPackage().getName() = "exec" and
|
||||
exists(CallExpr c |
|
||||
c.getCalleeName() = "Command"
|
||||
and
|
||||
e = c.getArgument(2)
|
||||
)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user