hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10092 from zbazztian/zbazztian/string.replace-taint

Browse Source 
Java: Add additional taint steps for java.lang.String methods
This commit is contained in:
Tony Torralba
2022-08-30 12:24:37 +02:00
committed by GitHub
parent 55e5fa29cb da79ad854c
commit 1f83c5833b
11 changed files with 112 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
View File

@@ -27,8 +27,21 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
override predicate isSanitizer(DataFlow::Node node) {
node.getType() instanceof PrimitiveType or
node.getType() instanceof PrimitiveType
or
node.getType() instanceof BoxedType
or
exists(MethodAccess ma, string methodName, CompileTimeConstantExpr target |
node.asExpr() = ma and
ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
target = ma.getArgument(0) and
(
methodName = "replace" and target.getIntValue() = [10, 13] // 10 == "\n", 13 == "\r"
or
methodName = "replaceAll" and
target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
)
)
}
}