hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16128 from erik-krogh/java-info

Browse Source 
Java: add link to the source variable in the alert-message for `java/implicit-cast-in-compound-assignment`
This commit is contained in:
Erik Krogh Kristensen
2024-04-09 08:55:09 +02:00
committed by GitHub
parent e08790d21e 8cb6598f50
commit 44fba68015
3 changed files with 38 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql
View File

@@ -27,10 +27,23 @@ class DangerousAssignOpExpr extends AssignOp {
predicate problematicCasting(Type t, Expr e) { e.getType().(NumType).widerThan(t) }
from DangerousAssignOpExpr a, Expr e
Variable getVariable(Expr dest) {
result = dest.(VarAccess).getVariable()
or
result = dest.(ArrayAccess).getArray().(VarAccess).getVariable()
}
from DangerousAssignOpExpr a, Expr e, Top v
where
e = a.getSource() and
problematicCasting(a.getDest().getType(), e)
problematicCasting(a.getDest().getType(), e) and
(
v = getVariable(a.getDest())
or
// fallback, in case we can't easily determine the variable
not exists(getVariable(a.getDest())) and
v = a.getDest()
)
select a,
"Implicit cast of source type " + e.getType().getName() + " to narrower destination type " +
a.getDest().getType().getName() + "."
"Implicit cast of source type " + e.getType().getName() + " to narrower destination type $@.", v,
a.getDest().getType().getName()

6
java/ql/test/query-tests/security/CWE-190/semmle/tests/InformationLoss.expected
View File

@@ -1,2 +1,4 @@
| Test.java:68:5:68:25 | ...+=... | Implicit cast of source type long to narrower destination type int. |
| Test.java:87:4:87:9 | ...+=... | Implicit cast of source type long to narrower destination type int. |
| Test.java:68:5:68:25 | ...+=... | Implicit cast of source type long to narrower destination type $@. | Test.java:64:4:64:13 | int i | int |
| Test.java:87:4:87:9 | ...+=... | Implicit cast of source type long to narrower destination type $@. | Test.java:81:4:81:13 | int i | int |
| Test.java:289:5:289:30 | ...+=... | Implicit cast of source type long to narrower destination type $@. | Test.java:285:4:285:27 | int[] arr | int |
| Test.java:293:7:293:44 | ...+=... | Implicit cast of source type long to narrower destination type $@. | Test.java:293:7:293:24 | ...[...] | int |

17
java/ql/test/query-tests/security/CWE-190/semmle/tests/Test.java
View File

@@ -279,12 +279,29 @@ class Test {
// subsequently cast to narrower type int
int widenedThenNarrowed = (int) (data2 + 10L);
}
// InformationLoss
{
int[] arr = new int[10];
while (arr[2] < 1000000) {
// BAD: getLargeNumber is implicitly narrowed to an integer
// which will result in overflows if it is large
arr[2] += getLargeNumber();
}
// BAD.
getAnIntArray()[0] += getLargeNumber();
}
}
public static long getLargeNumber() {
return Long.MAX_VALUE / 2;
}
public static int[] getAnIntArray() {
return new int[10];
}
public static boolean properlyBounded(int i) {
return i < Integer.MAX_VALUE;
}