hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 15:16:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Re-factor most queries and tests to use threat models.

Browse Source
This commit is contained in:
Michael Nebel
2023-10-04 14:01:58 +02:00
parent f0fb065446
commit 40e63a63e2
74 changed files with 105 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll
View File

@@ -30,7 +30,7 @@ deprecated class IntentRedirectionConfiguration extends TaintTracking::Configura
/** A taint tracking configuration for tainted Intents being used to start Android components. */
module IntentRedirectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentRedirectionSink }
@@ -57,7 +57,7 @@ private class OriginalIntentSanitizer extends IntentRedirectionSanitizer {
* flowing directly to sinks that start Android components.
*/
private module SameIntentBeingRelaunchedConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentRedirectionSink }
@@ -93,7 +93,7 @@ private class IntentWithTaintedComponent extends DataFlow::Node {
* A taint tracking configuration for tainted data flowing to an `Intent`'s component.
*/
private module TaintedIntentComponentConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
any(IntentSetComponent setComponent).getSink() = sink.asExpr()

2
java/ql/lib/semmle/code/java/security/ArbitraryApkInstallation.qll
View File

@@ -74,7 +74,7 @@ class ExternalApkSource extends DataFlow::Node {
sourceNode(this, "android-external-storage-dir") or
this.asExpr().(MethodAccess).getMethod() instanceof UriConstructorMethod or
this.asExpr().(StringLiteral).getValue().matches("file://%") or
this instanceof RemoteFlowSource
this instanceof ThreatModelFlowSource
}
}

4
java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
View File

@@ -6,7 +6,7 @@ private import semmle.code.java.security.ArithmeticCommon
/** A taint-tracking configuration to reason about overflow from unvalidated user input. */
module RemoteUserInputOverflowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
@@ -17,7 +17,7 @@ module RemoteUserInputOverflowConfig implements DataFlow::ConfigSig {
/** A taint-tracking configuration to reason about underflow from unvalidated user input. */
module RemoteUserInputUnderflowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }

2
java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
View File

@@ -52,7 +52,7 @@ private class DefaultCommandInjectionSanitizer extends CommandInjectionSanitizer
* A taint-tracking configuration for unvalidated user input that is used to run an external process.
*/
module RemoteUserInputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }

2
java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
View File

@@ -57,7 +57,7 @@ deprecated class ConditionalBypassFlowConfig extends TaintTracking::Configuratio
* A taint tracking configuration for untrusted data flowing to sensitive conditions.
*/
module ConditionalBypassFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { conditionControlsMethod(_, sink.asExpr()) }

4
java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
View File

@@ -106,10 +106,10 @@ deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configu
}
/**
* Taint tracking configuration for flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
* Taint tracking configuration for flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s.
*/
module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}

2
java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringQuery.qll
View File

@@ -8,7 +8,7 @@ private import semmle.code.java.StringFormat
* A taint-tracking configuration for externally controlled format string vulnerabilities.
*/
module ExternallyControlledFormatStringConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(StringFormat formatCall).getFormatArgument()

2
java/ql/lib/semmle/code/java/security/FragmentInjectionQuery.qll
View File

@@ -28,7 +28,7 @@ deprecated class FragmentInjectionTaintConf extends TaintTracking::Configuration
* that is used to create Android fragments dynamically.
*/
module FragmentInjectionTaintConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof FragmentInjectionSink }

2
java/ql/lib/semmle/code/java/security/GroovyInjectionQuery.qll
View File

@@ -28,7 +28,7 @@ deprecated class GroovyInjectionConfig extends TaintTracking::Configuration {
* that is used to evaluate a Groovy expression.
*/
module GroovyInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof GroovyInjectionSink }

8
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
View File

@@ -5,10 +5,11 @@ private import semmle.code.java.security.internal.ArraySizing
private import semmle.code.java.dataflow.FlowSources
/**
* A taint-tracking configuration to reason about improper validation of user-provided size used for array construction.
* A taint-tracking configuration to reason about improper validation of
* user-provided size used for array construction.
*/
module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), _)
@@ -16,7 +17,8 @@ module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSi
}
/**
* Taint-tracking flow for improper validation of user-provided size used for array construction.
* Taint-tracking flow for improper validation of user-provided size used
* for array construction.
*/
module ImproperValidationOfArrayConstructionFlow =
TaintTracking::Global<ImproperValidationOfArrayConstructionConfig>;

5
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayIndexQuery.qll
View File

@@ -5,10 +5,11 @@ private import semmle.code.java.security.internal.ArraySizing
private import semmle.code.java.dataflow.FlowSources
/**
* A taint-tracking configuration to reason about improper validation of user-provided array index.
* A taint-tracking configuration to reason about improper validation
* of user-provided array index.
*/
module ImproperValidationOfArrayIndexConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
any(CheckableArrayAccess caa).canThrowOutOfBounds(sink.asExpr())

2
java/ql/lib/semmle/code/java/security/InsecureBeanValidationQuery.qll
View File

@@ -46,7 +46,7 @@ class SetMessageInterpolatorCall extends MethodAccess {
* to the argument of a method that builds constraint error messages.
*/
module BeanValidationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof BeanValidationSink }
}

2
java/ql/lib/semmle/code/java/security/IntentUriPermissionManipulationQuery.qll
View File

@@ -39,7 +39,7 @@ deprecated class IntentUriPermissionManipulationConf extends TaintTracking::Conf
* A taint tracking configuration for user-provided Intents being returned to third party apps.
*/
module IntentUriPermissionManipulationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof IntentUriPermissionManipulationSink }

2
java/ql/lib/semmle/code/java/security/JexlInjectionQuery.qll
View File

@@ -63,7 +63,7 @@ deprecated class JexlInjectionConfig extends TaintTracking::Configuration {
* It supports both JEXL 2 and 3.
*/
module JexlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof JexlEvaluationSink }

2
java/ql/lib/semmle/code/java/security/JndiInjectionQuery.qll
View File

@@ -33,7 +33,7 @@ deprecated class JndiInjectionFlowConfig extends TaintTracking::Configuration {
* A taint-tracking configuration for unvalidated user input that is used in JNDI lookup.
*/
module JndiInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof JndiInjectionSink }

2
java/ql/lib/semmle/code/java/security/LdapInjectionQuery.qll
View File

@@ -8,7 +8,7 @@ import semmle.code.java.security.LdapInjection
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
module LdapInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof LdapInjectionSink }

2
java/ql/lib/semmle/code/java/security/LogInjectionQuery.qll
View File

@@ -27,7 +27,7 @@ deprecated class LogInjectionConfiguration extends TaintTracking::Configuration
* A taint-tracking configuration for tracking untrusted user input used in log entries.
*/
module LogInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof LogInjectionSink }

2
java/ql/lib/semmle/code/java/security/MvelInjectionQuery.qll
View File

@@ -32,7 +32,7 @@ deprecated class MvelInjectionFlowConfig extends TaintTracking::Configuration {
* that is used to construct and evaluate a MVEL expression.
*/
module MvelInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof MvelEvaluationSink }

2
java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
View File

@@ -85,7 +85,7 @@ private predicate smallExpr(Expr e) {
* numeric cast.
*/
module NumericCastFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(NumericNarrowingCastExpr cast).getExpr() and

2
java/ql/lib/semmle/code/java/security/OgnlInjectionQuery.qll
View File

@@ -29,7 +29,7 @@ deprecated class OgnlInjectionFlowConfig extends TaintTracking::Configuration {
* A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
*/
module OgnlInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof OgnlInjectionSink }

2
java/ql/lib/semmle/code/java/security/PartialPathTraversalQuery.qll
View File

@@ -29,7 +29,7 @@ deprecated class PartialPathTraversalFromRemoteConfig extends TaintTracking::Con
* and remains vulnerable to Partial Path Traversal.
*/
module PartialPathTraversalFromRemoteConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node node) { node instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node node) {
any(PartialPathTraversalMethodAccess ma).getQualifier() = node.asExpr()

2
java/ql/lib/semmle/code/java/security/RequestForgeryConfig.qll
View File

@@ -37,7 +37,7 @@ deprecated class RequestForgeryConfiguration extends TaintTracking::Configuratio
*/
module RequestForgeryConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource and
source instanceof ThreatModelFlowSource and
// Exclude results of remote HTTP requests: fetching something else based on that result
// is no worse than following a redirect returned by the remote server, and typically
// we're requesting a resource via https which we trust to only send us to safe URLs.

2
java/ql/lib/semmle/code/java/security/ResponseSplittingQuery.qll
View File

@@ -9,7 +9,7 @@ import semmle.code.java.security.ResponseSplitting
*/
module ResponseSplittingConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource and
source instanceof ThreatModelFlowSource and
not source instanceof SafeHeaderSplittingSource
}

2
java/ql/lib/semmle/code/java/security/SensitiveResultReceiverQuery.qll
View File

@@ -18,7 +18,7 @@ private class ResultReceiverSendCall extends MethodAccess {
}
private module UntrustedResultReceiverConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node node) { node instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node node) {
node.asExpr() = any(ResultReceiverSendCall c).getReceiver()

2
java/ql/lib/semmle/code/java/security/SpelInjectionQuery.qll
View File

@@ -29,7 +29,7 @@ deprecated class SpelInjectionConfig extends TaintTracking::Configuration {
* that is used to construct and evaluate a SpEL expression.
*/
module SpelInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof SpelExpressionEvaluationSink }

2
java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll
View File

@@ -52,7 +52,7 @@ private class TaintPreservingUriCtorParam extends Parameter {
* A taint-tracking configuration for tracking flow from remote sources to the creation of a path.
*/
module TaintedPathConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sinkNode(sink, "path-injection") }

2
java/ql/lib/semmle/code/java/security/TemplateInjection.qll
View File

@@ -62,7 +62,7 @@ abstract class TemplateInjectionSanitizerWithState extends DataFlow::Node {
abstract predicate hasState(DataFlow::FlowState state);
}
private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof RemoteFlowSource
private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof ThreatModelFlowSource
{ }
private class DefaultTemplateInjectionSink extends TemplateInjectionSink {

3
java/ql/lib/semmle/code/java/security/TrustBoundaryViolationQuery.qll
View File

@@ -12,7 +12,8 @@ private import semmle.code.java.frameworks.owasp.Esapi
*/
abstract class TrustBoundaryViolationSource extends DataFlow::Node { }
private class RemoteSource extends TrustBoundaryViolationSource instanceof RemoteFlowSource { }
private class ThreatModelSource extends TrustBoundaryViolationSource instanceof ThreatModelFlowSource
{ }
/**
* A sink for data that crosses a trust boundary.

2
java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll
View File

@@ -27,7 +27,7 @@ deprecated class FetchUntrustedResourceConfiguration extends TaintTracking::Conf
* A taint configuration tracking flow from untrusted inputs to a resource fetching call.
*/
module FetchUntrustedResourceConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlResourceSink }

2
java/ql/lib/semmle/code/java/security/UnsafeContentUriResolutionQuery.qll
View File

@@ -30,7 +30,7 @@ deprecated class UnsafeContentResolutionConf extends TaintTracking::Configuratio
* A taint-tracking configuration to find paths from remote sources to content URI resolutions.
*/
module UnsafeContentResolutionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof ContentUriResolutionSink }

4
java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
View File

@@ -324,7 +324,7 @@ deprecated class UnsafeDeserializationConfig extends TaintTracking::Configuratio
/** Tracks flows from remote user input to a deserialization sink. */
private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserializationSink }
@@ -448,7 +448,7 @@ deprecated class UnsafeTypeConfig extends TaintTracking2::Configuration {
* If this is user-controlled, arbitrary code could be executed while instantiating the user-specified type.
*/
module UnsafeTypeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeTypeSink }

2
java/ql/lib/semmle/code/java/security/UrlRedirectQuery.qll
View File

@@ -8,7 +8,7 @@ private import semmle.code.java.security.UrlRedirect
* A taint-tracking configuration for reasoning about URL redirections.
*/
module UrlRedirectConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UrlRedirectSink }
}

2
java/ql/lib/semmle/code/java/security/XPathInjectionQuery.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.java.security.XPath
* A taint-tracking configuration for reasoning about XPath injection vulnerabilities.
*/
module XPathInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XPathInjectionSink }
}

2
java/ql/lib/semmle/code/java/security/XsltInjectionQuery.qll
View File

@@ -31,7 +31,7 @@ deprecated class XsltInjectionFlowConfig extends TaintTracking::Configuration {
* A taint-tracking configuration for unvalidated user input that is used in XSLT transformation.
*/
module XsltInjectionFlowConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XsltInjectionSink }

2
java/ql/lib/semmle/code/java/security/XxeRemoteQuery.qll
View File

@@ -28,7 +28,7 @@ deprecated class XxeConfig extends TaintTracking::Configuration {
* A taint-tracking configuration for unvalidated remote user input that is used in XML external entity expansion.
*/
module XxeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof XxeSink }

2
java/ql/lib/semmle/code/java/security/regexp/PolynomialReDoSQuery.qll
View File

@@ -66,7 +66,7 @@ deprecated predicate hasPolynomialReDoSResult(
/** A configuration for Polynomial ReDoS queries. */
module PolynomialRedosConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
exists(SuperlinearBackTracking::PolynomialBackTrackingTerm regexp |

2
java/ql/lib/semmle/code/java/security/regexp/RegexInjectionQuery.qll
View File

@@ -24,7 +24,7 @@ deprecated class RegexInjectionConfiguration extends TaintTracking::Configuratio
* A taint-tracking configuration for untrusted user input used to construct regular expressions.
*/
module RegexInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof RegexInjectionSink }