hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 07:45:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Autoformat

Browse Source
This commit is contained in:
aegilops
2023-06-19 11:53:53 +01:00
parent 72d9d4736e
commit 8c9ccab9c9
1 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.ql
View File

@@ -11,24 +11,29 @@
* external/cwe/cwe-078
*/
import DataFlow::PathGraph
import CommandInjectionRuntimeExec
class RemoteSource extends Source { RemoteSource() { this instanceof RemoteFlowSource } }
class RemoteSource extends Source {
RemoteSource() { this instanceof RemoteFlowSource }
}
from DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf, MethodAccess call, DataFlow::Node sourceCmd, DataFlow::Node sinkCmd, ExecTaintConfiguration confCmd
where call.getMethod() instanceof RuntimeExecMethod
// this is a command-accepting call to exec, e.g. rt.exec(new String[]{"/bin/sh", ...})
and (
confCmd.hasFlow(sourceCmd, sinkCmd)
and sinkCmd.asExpr() = call.getArgument(0)
)
// it is tainted by untrusted user input
and (
conf.hasFlow(source.getNode(), sink.getNode())
and sink.getNode().asExpr() = call.getArgument(0)
)
select sink, source, sink, "Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
sourceCmd, sourceCmd.toString(),
source.getNode(), source.toString()
from
DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf,
MethodAccess call, DataFlow::Node sourceCmd, DataFlow::Node sinkCmd,
ExecTaintConfiguration confCmd
where
call.getMethod() instanceof RuntimeExecMethod and
// this is a command-accepting call to exec, e.g. rt.exec(new String[]{"/bin/sh", ...})
(
confCmd.hasFlow(sourceCmd, sinkCmd) and
sinkCmd.asExpr() = call.getArgument(0)
) and
// it is tainted by untrusted user input
(
conf.hasFlow(source.getNode(), sink.getNode()) and
sink.getNode().asExpr() = call.getArgument(0)
)
select sink, source, sink,
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
sourceCmd, sourceCmd.toString(), source.getNode(), source.toString()