hohn/codeql-dataflow-sql-injection
1
0
Fork 0
mirror of https://github.com/hohn/codeql-dataflow-sql-injection.git synced 2025-12-16 10:13:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

Taint Flow Configuration

Browse Source
This commit is contained in:
Michael Hohn
2020-07-22 13:48:45 -07:00
committed by =Michael Hohn
parent 4fcd08f394
commit d0507b79d6
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
codeql-dataflow-sql-injection.md
View File

@@ -435,17 +435,17 @@ or
## The Data Flow Framework ## The CodeQL Data Flow Configuration
The previous queries identify our source and sink. To use global data flow and The previous queries identify our source, sink and one additional flow step. To
taint tracking we need some additional codeql setup: use global data flow and taint tracking we need some additional codeql setup:
- a taint flow configuration - a taint flow configuration
- use path queries - the path problem header and imports
- add extra taint steps for taint flow - a query formatted for path problems.
These are done next. These are done next.
### Taint Flow Configuration ### Taint Flow Configuration
The way we configure global data flow is by creating a custom extension of the The way we configure global taint flow is by creating a custom extension of the
`TaintTracking::Configuration` class, and speciyfing `isSource`, `isSink`, and `TaintTracking::Configuration` class, and speciyfing `isSource`, `isSink`, and
`isAdditionalTaintStep` predicates. A starting configuration can look like the `isAdditionalTaintStep` predicates. A starting configuration can look like the
following, with details to follow. following, with details to follow.
@@ -455,17 +455,19 @@ class SqliFlowConfig extends TaintTracking::Configuration {
SqliFlowConfig() { this = "SqliFlow" } SqliFlowConfig() { this = "SqliFlow" }
override predicate isSource(DataFlow::Node source) { override predicate isSource(DataFlow::Node source) {
// Use sqliSourceProduction(this, source) in that case // count = read(STDIN_FILENO, buf, BUFSIZE);
sqliSourceDemo(source)
}
override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
stlBslTaintStep(n1, n2)
} }
override predicate isSanitizer(DataFlow::Node sanitizer) { none() } override predicate isSanitizer(DataFlow::Node sanitizer) { none() }
override predicate isSink(DataFlow::Node sink) { sqliSink(sink, _) } override predicate isAdditionalTaintStep(DataFlow::Node into, DataFlow::Node out) {
// Extra taint step for
// snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
}
override predicate isSink(DataFlow::Node sink) {
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
}
} }
``` ```