hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 07:15:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

use $ SPURIOUS: instead of "this test gives a FP"

Browse Source
This commit is contained in:
am0o0
2024-07-30 17:53:23 +02:00
parent 9662950405
commit 591b1b4f07
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/Zip4jHandler.java
View File

@@ -33,7 +33,7 @@ public class Zip4jHandler {
File extractedFile = new File(localFileHeader.getFileName());
try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
int totallRead = 0;
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $ hasTaintFlow="zipInputStream" "this test gives a FP"
while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $ SPURIOUS: hasTaintFlow="zipInputStream"
totallRead += readLen;
if (totallRead > 1024 * 1024 * 4) {
System.out.println("potential Bomb");

4
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/ZipHandler.java
View File

@@ -38,7 +38,7 @@ public class ZipHandler {
}
FileOutputStream fos = new FileOutputStream("/tmp/tmptmp");
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis" "this test gives a FP"
while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $ SPURIOUS: hasTaintFlow="zis"
dest.write(data, 0, count);
total += count;
}
@@ -78,7 +78,7 @@ public class ZipHandler {
}
FileOutputStream fos = new FileOutputStream(entry.getName());
BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis" "this test gives a FP"
while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ SPURIOUS: hasTaintFlow="zis"
dest.write(data, 0, count);
}
dest.flush();