hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 15:05:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add command injection sink kind

Browse Source
This commit is contained in:
Tony Torralba
2023-03-28 10:23:37 +02:00
parent aeaeade75e
commit 534725f9eb
6 changed files with 101 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-078/ExecTainted.ql
View File

@@ -13,14 +13,12 @@
*/
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.ExternalProcess
import semmle.code.java.security.CommandLineQuery
import RemoteUserInputToArgumentToExecFlow::PathGraph
from
RemoteUserInputToArgumentToExecFlow::PathNode source,
RemoteUserInputToArgumentToExecFlow::PathNode sink, ArgumentToExec execArg
RemoteUserInputToArgumentToExecFlow::PathNode sink, Expr execArg
where execIsTainted(source, sink, execArg)
select execArg, source, sink, "This command line depends on a $@.", source.getNode(),
"user-provided value"

1
java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
View File

@@ -13,7 +13,6 @@
*/
import java
import semmle.code.java.security.ExternalProcess
import semmle.code.java.security.CommandLineQuery
/**

6
java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.ql
View File

@@ -13,16 +13,14 @@
*/
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.ExternalProcess
import semmle.code.java.security.CommandLineQuery
import JSchOSInjection
import RemoteUserInputToArgumentToExecFlow::PathGraph
import JSchOSInjection
// This is a clone of query `java/command-line-injection` that also includes experimental sinks.
from
RemoteUserInputToArgumentToExecFlow::PathNode source,
RemoteUserInputToArgumentToExecFlow::PathNode sink, ArgumentToExec execArg
RemoteUserInputToArgumentToExecFlow::PathNode sink, Expr execArg
where execIsTainted(source, sink, execArg)
select execArg, source, sink, "This command line depends on a $@.", source.getNode(),
"user-provided value"