hohn/codeql-dataflow-sql-injection
1
0
Fork 0
mirror of https://github.com/hohn/codeql-dataflow-sql-injection.git synced 2025-12-16 18:23:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

sql injection: try flow configuration (with pathgraph). Not ready

Browse Source
This commit is contained in:
Michael Hohn
2020-07-20 14:26:44 -07:00
committed by =Michael Hohn
parent 7aa51e67c8
commit aa5d019740
1 changed files with 4 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
SqlInjection.ql
View File

@@ -8,6 +8,7 @@
import cpp import cpp
import semmle.code.cpp.dataflow.TaintTracking import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph
class SqliFlowConfig extends TaintTracking::Configuration { class SqliFlowConfig extends TaintTracking::Configuration {
SqliFlowConfig() { this = "SqliFlow" } SqliFlowConfig() { this = "SqliFlow" }
@@ -33,13 +34,6 @@ class SqliFlowConfig extends TaintTracking::Configuration {
} }
} }
// from SqliFlowConfig conf, DataFlow::PathNode source, DataFlow::PathNode sink from SqliFlowConfig conf, DataFlow::PathNode source, DataFlow::PathNode sink
// where conf.hasFlowPath(source, sink) where conf.hasFlowPath(source, sink)
// select sink, source, sink, "Possible SQL injection" select sink, source, sink, "Possible SQL injection"
// Sink identification
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
from FunctionCall exec, DataFlow::Node sink
where
exec.getTarget().getName() = "sqlite3_exec" and
exec.getArgument(1) = sink.asExpr()
select exec, sink