hohn/codeql-dataflow-sql-injection
1
0
Fork 0
mirror of https://github.com/hohn/codeql-dataflow-sql-injection.git synced 2025-12-16 10:13:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

comment isAdditionalFlowStep--no longer needed

Browse Source
This commit is contained in:
Michael Hohn
2025-03-03 12:08:36 -08:00
committed by =Michael Hohn
parent 684b4c145a
commit bf69cb0f45
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
SqlInjection.ql
View File

@@ -21,21 +21,21 @@ module SqliFlowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node sanitizer) { none() }
predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// Extra taint step
// snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// But snprintf is a macro on mac os. The actual function's name is
// #undef snprintf
// #define snprintf(str, len, ...) \
// __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// #endif
exists(FunctionCall printf |
printf.getTarget().getName().matches("%snprintf%") and
printf.getArgument(0) = out.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument() and
// very specific: shifted index for macro.
printf.getArgument(6) = into.asExpr()
)
}
// predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// // Extra taint step
// // snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// // But snprintf is a macro on mac os. The actual function's name is
// // #undef snprintf
// // #define snprintf(str, len, ...) \
// // __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// // #endif
// exists(FunctionCall printf |
// printf.getTarget().getName().matches("%snprintf%") and
// printf.getArgument(0) = out.(DataFlow::PostUpdateNode).getPreUpdateNode().asIndirectArgument() and
// // very specific: shifted index for macro.
// printf.getArgument(6) = into.asExpr()
// )
// }
predicate isSink(DataFlow::Node sink) {
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);