hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Add container flow to the local taint flow relation.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2021-09-16 11:14:30 +02:00
parent d3caa80274
commit 28e5dcef52
1 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -42,11 +42,28 @@ private module Cached {
*/
cached
predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
DataFlow::localFlowStep(src, sink) or
localAdditionalTaintStep(src, sink) or
DataFlow::localFlowStep(src, sink)
or
localAdditionalTaintStep(src, sink)
or
// Simple flow through library code is included in the exposed local
// step relation, even though flow is technically inter-procedural
FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
or
// Treat container flow as taint for the local taint flow relation
exists(DataFlow::Content c | containerContent(c) |
readStep(src, c, sink) or
storeStep(src, c, sink) or
FlowSummaryImpl::Private::Steps::summaryGetterStep(src, c, sink) or
FlowSummaryImpl::Private::Steps::summarySetterStep(src, c, sink)
)
}
private predicate containerContent(DataFlow::Content c) {
c instanceof DataFlow::ArrayContent or
c instanceof DataFlow::CollectionContent or
c instanceof DataFlow::MapKeyContent or
c instanceof DataFlow::MapValueContent
}
/**
@@ -65,12 +82,8 @@ private module Cached {
readStep(src, f, sink) and
not sink.getTypeBound() instanceof PrimitiveType and
not sink.getTypeBound() instanceof BoxedType and
not sink.getTypeBound() instanceof NumberType
|
f instanceof DataFlow::ArrayContent or
f instanceof DataFlow::CollectionContent or
f instanceof DataFlow::MapKeyContent or
f instanceof DataFlow::MapValueContent
not sink.getTypeBound() instanceof NumberType and
containerContent(f)
)
or
FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)