hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-05 18:50:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java/C++/C#: Add support for BarrierGuards.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2019-08-09 11:12:00 +02:00
parent 5e910a4808
commit 4550175b16
24 changed files with 221 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
View File

@@ -17,6 +17,17 @@ import semmle.code.java.dataflow.FlowSources
import PathsCommon
import DataFlow::PathGraph
class ContainsDotDotSanitizer extends DataFlow::BarrierGuard {
ContainsDotDotSanitizer() {
this.(MethodAccess).getMethod().hasName("contains") and
this.(MethodAccess).getAnArgument().(StringLiteral).getValue() = ".."
}
override predicate checks(Expr e, boolean branch) {
e = this.(MethodAccess).getQualifier() and branch = false
}
}
class TaintedPathConfig extends TaintTracking::Configuration {
TaintedPathConfig() { this = "TaintedPathConfig" }
@@ -29,6 +40,10 @@ class TaintedPathConfig extends TaintTracking::Configuration {
override predicate isSanitizer(DataFlow::Node node) {
exists(Type t | t = node.getType() | t instanceof BoxedType or t instanceof PrimitiveType)
}
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
guard instanceof ContainsDotDotSanitizer
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, PathCreation p, TaintedPathConfig conf