hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use more flowTo.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2025-12-03 14:12:08 +01:00
parent dc6d3fe7ba
commit 78e1879c9e
18 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll
View File

@@ -10,7 +10,7 @@ import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll
View File

@@ -10,7 +10,7 @@ import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
View File

@@ -85,7 +85,7 @@ module RemoteSourceToExternalApi = TaintTracking::Global<RemoteSourceToExternalA
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { RemoteSourceToExternalApi::flow(_, this) } UntrustedExternalApiDataNode() { RemoteSourceToExternalApi::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { RemoteSourceToExternalApi::flow(result, this) } DataFlow::Node getAnUntrustedSource() { RemoteSourceToExternalApi::flow(result, this) }

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
View File

@@ -91,7 +91,7 @@ class ExponentialRegexSink extends DataFlow::ExprNode, Sink {
ExponentialRegexSink() { ExponentialRegexSink() {
exists(RegexOperation regexOperation | exists(RegexOperation regexOperation |
// Exponential regex flows to the pattern argument // Exponential regex flows to the pattern argument
ExponentialRegexDataFlow::flow(_, DataFlow::exprNode(regexOperation.getPattern())) ExponentialRegexDataFlow::flowToExpr(regexOperation.getPattern())
| |
// This is used as an input for this pattern // This is used as an input for this pattern
this.getExpr() = regexOperation.getInput() and this.getExpr() = regexOperation.getInput() and

2
csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
View File

@@ -53,7 +53,7 @@ where
// JsonConvert static method call, but with additional unsafe typename tracking // JsonConvert static method call, but with additional unsafe typename tracking
exists(DataFlow::Node settingsCallArg | exists(DataFlow::Node settingsCallArg |
JsonConvertTracking::flowPath(userInput.asPathNode3(), deserializeCallArg.asPathNode3()) and JsonConvertTracking::flowPath(userInput.asPathNode3(), deserializeCallArg.asPathNode3()) and
TypeNameTracking::flow(_, settingsCallArg) and TypeNameTracking::flowTo(settingsCallArg) and
sameParent(deserializeCallArg.getNode(), settingsCallArg) sameParent(deserializeCallArg.getNode(), settingsCallArg)
) )
select deserializeCallArg, userInput, deserializeCallArg, "$@ flows to unsafe deserializer.", select deserializeCallArg, userInput, deserializeCallArg, "$@ flows to unsafe deserializer.",

2
go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll
View File

@@ -27,7 +27,7 @@ module AllocationSizeOverflow {
private module FindLargeLensFlow = TaintTracking::Global<FindLargeLensConfig>; private module FindLargeLensFlow = TaintTracking::Global<FindLargeLensConfig>;
private DataFlow::CallNode getALargeLenCall() { private DataFlow::CallNode getALargeLenCall() {
exists(DataFlow::Node lenArg | FindLargeLensFlow::flow(_, lenArg) | exists(DataFlow::Node lenArg | FindLargeLensFlow::flowTo(lenArg) |
result.getArgument(0) = lenArg result.getArgument(0) = lenArg
) )
} }

2
go/ql/lib/semmle/go/security/ExternalAPIs.qll
View File

@@ -211,7 +211,7 @@ module UntrustedDataToUnknownExternalApiFlow =
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
go/ql/src/Security/CWE-601/OpenUrlRedirect.ql
View File

@@ -21,6 +21,6 @@ where
OpenUrlRedirect::Flow::flowPath(source, sink) and OpenUrlRedirect::Flow::flowPath(source, sink) and
// this excludes flow from safe parts of request URLs, for example the full URL when the // this excludes flow from safe parts of request URLs, for example the full URL when the
// doing a redirect from `http://<path>` to `https://<path>` // doing a redirect from `http://<path>` to `https://<path>`
not SafeUrlFlow::Flow::flow(_, sink.getNode()) not SafeUrlFlow::Flow::flowTo(sink.getNode())
select sink.getNode(), source, sink, "This path to an untrusted URL redirection depends on a $@.", select sink.getNode(), source, sink, "This path to an untrusted URL redirection depends on a $@.",
source.getNode(), "user-provided value" source.getNode(), "user-provided value"

2
go/ql/src/Security/CWE-918/RequestForgery.ql
View File

@@ -21,6 +21,6 @@ where
RequestForgery::Flow::flowPath(source, sink) and RequestForgery::Flow::flowPath(source, sink) and
request = sink.getNode().(RequestForgery::Sink).getARequest() and request = sink.getNode().(RequestForgery::Sink).getARequest() and
// this excludes flow from safe parts of request URLs, for example the full URL // this excludes flow from safe parts of request URLs, for example the full URL
not SafeUrlFlow::Flow::flow(_, sink.getNode()) not SafeUrlFlow::Flow::flowTo(sink.getNode())
select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(), select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(),
sink.getNode().(RequestForgery::Sink).getKind(), source, "user-provided value" sink.getNode().(RequestForgery::Sink).getKind(), source, "user-provided value"

4
javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll
View File

@@ -97,7 +97,7 @@ class ExternalApiDataNode extends DataFlow::Node instanceof Sink { }
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { ExternalAPIUsedWithUntrustedDataFlow::flow(_, this) } UntrustedExternalApiDataNode() { ExternalAPIUsedWithUntrustedDataFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { ExternalAPIUsedWithUntrustedDataFlow::flow(result, this) } DataFlow::Node getAnUntrustedSource() { ExternalAPIUsedWithUntrustedDataFlow::flow(result, this) }
@@ -110,7 +110,7 @@ private newtype TExternalApi =
/** An external API sink with `name`. */ /** An external API sink with `name`. */
MkExternalApiNode(string name) { MkExternalApiNode(string name) {
exists(Sink sink | exists(Sink sink |
ExternalAPIUsedWithUntrustedDataFlow::flow(_, sink) and ExternalAPIUsedWithUntrustedDataFlow::flowTo(sink) and
name = sink.getApiName() name = sink.getApiName()
) )
} }

2
javascript/ql/test/library-tests/FlowSummary/test.ql
View File

@@ -32,5 +32,5 @@ class BasicBarrierGuard extends DataFlow::CallNode {
deprecated class ConsistencyConfig extends ConsistencyConfiguration { deprecated class ConsistencyConfig extends ConsistencyConfiguration {
ConsistencyConfig() { this = "ConsistencyConfig" } ConsistencyConfig() { this = "ConsistencyConfig" }
override DataFlow::Node getAnAlert() { Flow::flow(_, result) } override DataFlow::Node getAnAlert() { Flow::flowTo(result) }
} }

2
javascript/ql/test/tutorials/Introducing the JavaScript libraries/query17.qll
View File

@@ -14,7 +14,7 @@ predicate passwordVarAssign(Variable v, DataFlow::Node nd) {
module PasswordFlow = DataFlow::Global<PasswordConfig>; module PasswordFlow = DataFlow::Global<PasswordConfig>;
query predicate test_query17(DataFlow::Node sink, string res) { query predicate test_query17(DataFlow::Node sink, string res) {
exists(Variable v | PasswordFlow::flow(_, sink) and passwordVarAssign(v, sink) | exists(Variable v | PasswordFlow::flowTo(sink) and passwordVarAssign(v, sink) |
res = "Password variable " + v.toString() + " is assigned a constant string." res = "Password variable " + v.toString() + " is assigned a constant string."
) )
} }

2
python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
View File

@@ -50,7 +50,7 @@ module FullServerSideRequestForgeryFlow = TaintTracking::Global<FullServerSideRe
*/ */
predicate fullyControlledRequest(Http::Client::Request request) { predicate fullyControlledRequest(Http::Client::Request request) {
forall(DataFlow::Node urlPart | urlPart = request.getAUrlPart() | forall(DataFlow::Node urlPart | urlPart = request.getAUrlPart() |
FullServerSideRequestForgeryFlow::flow(_, urlPart) FullServerSideRequestForgeryFlow::flowTo(urlPart)
) )
} }

2
python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
View File

@@ -182,7 +182,7 @@ module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExt
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
python/ql/src/meta/alerts/RemoteFlowSourcesReach.ql
View File

@@ -38,5 +38,5 @@ module RemoteFlowSourceReachConfig implements DataFlow::ConfigSig {
module RemoteFlowSourceReachFlow = TaintTracking::Global<RemoteFlowSourceReachConfig>; module RemoteFlowSourceReachFlow = TaintTracking::Global<RemoteFlowSourceReachConfig>;
from DataFlow::Node reachable from DataFlow::Node reachable
where RemoteFlowSourceReachFlow::flow(_, reachable) where RemoteFlowSourceReachFlow::flowTo(reachable)
select reachable, prettyNode(reachable) select reachable, prettyNode(reachable)

2
ruby/ql/src/queries/meta/TaintedNodes.ql
View File

@@ -28,5 +28,5 @@ private module BasicTaintConfig implements DataFlow::ConfigSig {
private module BasicTaintFlow = TaintTracking::Global<BasicTaintConfig>; private module BasicTaintFlow = TaintTracking::Global<BasicTaintConfig>;
from DataFlow::Node node from DataFlow::Node node
where BasicTaintFlow::flow(_, node) where BasicTaintFlow::flowTo(node)
select node, "Tainted node" select node, "Tainted node"

2
rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
View File

@@ -88,5 +88,5 @@ import InsecureCookieFlow::PathGraph
from InsecureCookieFlow::PathNode sourceNode, InsecureCookieFlow::PathNode sinkNode from InsecureCookieFlow::PathNode sourceNode, InsecureCookieFlow::PathNode sinkNode
where where
InsecureCookieFlow::flowPath(sourceNode, sinkNode) and InsecureCookieFlow::flowPath(sourceNode, sinkNode) and
not PartitionedCookieFlow::flow(_, sinkNode.getNode()) not PartitionedCookieFlow::flowTo(sinkNode.getNode())
select sinkNode.getNode(), sourceNode, sinkNode, "Cookie attribute 'Secure' is not set to true." select sinkNode.getNode(), sourceNode, sinkNode, "Cookie attribute 'Secure' is not set to true."

2
swift/ql/lib/codeql/swift/security/CleartextTransmissionExtensions.qll
View File

@@ -87,7 +87,7 @@ private class UrlTransmittedSink extends CleartextTransmissionSink {
// exclude `tel:` and similar URLs. These URLs necessarily contain // exclude `tel:` and similar URLs. These URLs necessarily contain
// sensitive data which you expect to transmit only by making the // sensitive data which you expect to transmit only by making the
// phone call (or similar operation). // phone call (or similar operation).
not ExcludeUrlFlow::flow(_, this) not ExcludeUrlFlow::flowTo(this)
} }
} }