hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Use separate data-flow copy for PredictableSeedFlowConfiguration

Browse Source
This commit is contained in:
Tom Hvitved
2021-04-27 10:07:33 +02:00
parent a09c12acfe
commit 017beb6786
4 changed files with 4183 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/identical-files.json
View File

@@ -5,6 +5,7 @@
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",

10
java/ql/src/semmle/code/java/dataflow/DataFlow6.qll Normal file
View File

@@ -0,0 +1,10 @@
/**
* Provides classes for performing local (intra-procedural) and
* global (inter-procedural) data flow analyses.
*/
import java
module DataFlow6 {
import semmle.code.java.dataflow.internal.DataFlowImpl6
}

4166
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll Normal file
View File

File diff suppressed because it is too large Load Diff

12
java/ql/src/semmle/code/java/security/Random.qll
View File

@@ -1,6 +1,6 @@
import java
import semmle.code.java.dataflow.DefUse
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.DataFlow6
/**
* The `java.security.SecureRandom` class.
@@ -166,16 +166,16 @@ private predicate isSeeded(RValue use) {
)
}
private class PredictableSeedFlowConfiguration extends DataFlow::Configuration {
private class PredictableSeedFlowConfiguration extends DataFlow6::Configuration {
PredictableSeedFlowConfiguration() { this = "Random::PredictableSeedFlowConfiguration" }
override predicate isSource(DataFlow::Node source) {
override predicate isSource(DataFlow6::Node source) {
source.asExpr() instanceof PredictableSeedExpr
}
override predicate isSink(DataFlow::Node sink) { isSeeding(sink.asExpr(), _) }
override predicate isSink(DataFlow6::Node sink) { isSeeding(sink.asExpr(), _) }
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
override predicate isAdditionalFlowStep(DataFlow6::Node node1, DataFlow6::Node node2) {
predictableCalcStep(node1.asExpr(), node2.asExpr())
}
}
@@ -252,7 +252,7 @@ private predicate isSeeding(Expr arg, RValue use) {
private predicate isSeedingSource(Expr arg, RValue use, Expr source) {
isSeeding(arg, use) and
exists(PredictableSeedFlowConfiguration conf |
conf.hasFlow(DataFlow::exprNode(source), DataFlow::exprNode(arg))
conf.hasFlow(DataFlow6::exprNode(source), DataFlow6::exprNode(arg))
)
}