hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Removed bounds checking and only using literals - bounded() predicate did not work

Browse Source
This commit is contained in:
aegilops
2025-11-20 17:31:56 +00:00
parent 801cd72965
commit 29a5b27b13
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
View File

@@ -54,7 +54,7 @@ private class PrefixSuffixBarrier extends SensitiveLoggerBarrier {
exists(MethodCall mc, Method m, int limit |
limit = 7 and
mc.getMethod() = m
|
|
// substring in Java
(
m.hasQualifiedName("java.lang", "String", "substring") or
@@ -86,15 +86,17 @@ private class PrefixSuffixBarrier extends SensitiveLoggerBarrier {
/** A predicate to check single-argument method calls for a constant integer below a set limit. */
bindingset[limit, isKotlin]
private predicate singleArgLimit(MethodCall mc, int limit, boolean isKotlin) {
exists(int argIndex |
(if isKotlin = true then argIndex = 1 else argIndex = 0) and
bounded(mc.getArgument(argIndex), any(ZeroBound z), limit, true, _)
mc.getNumArgument() = 1 and
exists(int firstArgIndex |
(if isKotlin = true then firstArgIndex = 1 else firstArgIndex = 0) and
mc.getArgument(firstArgIndex).getUnderlyingExpr().(CompileTimeConstantExpr).getIntValue() <= limit
)
}
/** A predicate to check two-argument method calls for zero and a constant integer below a set limit. */
bindingset[limit, isKotlin]
private predicate twoArgLimit(MethodCall mc, int limit, boolean isKotlin) {
mc.getNumArgument() = 2 and
exists(int firstArgIndex, int secondArgIndex |
(
isKotlin = true and firstArgIndex = 1 and secondArgIndex = 2
@@ -102,7 +104,7 @@ private predicate twoArgLimit(MethodCall mc, int limit, boolean isKotlin) {
isKotlin = false and firstArgIndex = 0 and secondArgIndex = 1
) and
mc.getArgument(firstArgIndex).getUnderlyingExpr().(CompileTimeConstantExpr).getIntValue() = 0 and
bounded(mc.getArgument(secondArgIndex), any(ZeroBound z), limit, true, _)
mc.getArgument(secondArgIndex).getUnderlyingExpr().(CompileTimeConstantExpr).getIntValue() <= limit
)
}