hohn/codeql-dataflow-sql-injection
1
0
Fork 0
mirror of https://github.com/hohn/codeql-dataflow-sql-injection.git synced 2025-12-15 17:53:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

update from pre/postUpdate node to new forms

Browse Source
This commit is contained in:
Michael Hohn
2025-03-05 11:12:35 -08:00
committed by =Michael Hohn
parent bf69cb0f45
commit bc7cda5274
1 changed files with 1 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
SqlInjection.ql
View File

@@ -15,28 +15,12 @@ module SqliFlowConfig implements DataFlow::ConfigSig {
// count = read(STDIN_FILENO, buf, BUFSIZE);
exists(FunctionCall read |
read.getTarget().getName() = "read" and
read.getArgument(1) = source.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument()
read.getArgument(1) = source.asDefiningArgument()
)
}
predicate isBarrier(DataFlow::Node sanitizer) { none() }
// predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// // Extra taint step
// // snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// // But snprintf is a macro on mac os. The actual function's name is
// // #undef snprintf
// // #define snprintf(str, len, ...) \
// // __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// // #endif
// exists(FunctionCall printf |
// printf.getTarget().getName().matches("%snprintf%") and
// printf.getArgument(0) = out.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument() and
// // very specific: shifted index for macro.
// printf.getArgument(6) = into.asExpr()
// )
// }
predicate isSink(DataFlow::Node sink) {
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
exists(FunctionCall exec |