hohn/codeql-dataflow-sql-injection
1
0
Fork 0
mirror of https://github.com/hohn/codeql-dataflow-sql-injection.git synced 2025-12-16 10:13:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

comment isAdditionalFlowStep--no longer needed

Browse Source
This commit is contained in:
Michael Hohn
2025-03-03 12:08:36 -08:00
committed by =Michael Hohn
parent 684b4c145a
commit bf69cb0f45
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
SqlInjection.ql
View File

@@ -21,21 +21,21 @@ module SqliFlowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node sanitizer) { none() } predicate isBarrier(DataFlow::Node sanitizer) { none() }
predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) { // predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// Extra taint step // // Extra taint step
// snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info); // // snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// But snprintf is a macro on mac os. The actual function's name is // // But snprintf is a macro on mac os. The actual function's name is
// #undef snprintf // // #undef snprintf
// #define snprintf(str, len, ...) \ // // #define snprintf(str, len, ...) \
// __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__) // // __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// #endif // // #endif
exists(FunctionCall printf | // exists(FunctionCall printf |
printf.getTarget().getName().matches("%snprintf%") and // printf.getTarget().getName().matches("%snprintf%") and
printf.getArgument(0) = out.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument() and // printf.getArgument(0) = out.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument() and
// very specific: shifted index for macro. // // very specific: shifted index for macro.
printf.getArgument(6) = into.asExpr() // printf.getArgument(6) = into.asExpr()
) // )
} // }
predicate isSink(DataFlow::Node sink) { predicate isSink(DataFlow::Node sink) {
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg); // rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);