mirror of
https://github.com/github/codeql.git
synced 2026-04-25 16:55:19 +02:00
Remove reference to PathCreation
ZipSlip no longer needs to make this exclusion, since PathCreation arguments are no longer path-injection sinks
This commit is contained in:
@@ -41,28 +41,5 @@ module ZipSlipFlow = TaintTracking::Global<ZipSlipConfig>;
|
||||
* A sink that represents a file creation, such as a file write, copy or move operation.
|
||||
*/
|
||||
private class FileCreationSink extends DataFlow::Node {
|
||||
FileCreationSink() {
|
||||
sinkNode(this, "path-injection") and
|
||||
not isPathCreation(this)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a path creation node that doesn't imply a read/write filesystem operation.
|
||||
* This is to avoid creating new spurious alerts, since `PathCreation` sinks weren't
|
||||
* previously part of this query.
|
||||
*/
|
||||
private predicate isPathCreation(DataFlow::Node sink) {
|
||||
exists(PathCreation pc |
|
||||
pc.getAnInput() = sink.asExpr()
|
||||
or
|
||||
pc.getAnInput().(Argument).isVararg() and sink.(DataFlow::ImplicitVarargsArray).getCall() = pc
|
||||
|
|
||||
// exclude actual read/write operations included in `PathCreation`
|
||||
not pc.(Call)
|
||||
.getCallee()
|
||||
.getDeclaringType()
|
||||
.hasQualifiedName("java.io",
|
||||
["FileInputStream", "FileOutputStream", "FileReader", "FileWriter"])
|
||||
)
|
||||
FileCreationSink() { sinkNode(this, "path-injection") }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user