hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

add unary type-tracking predicates

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-02-10 12:51:09 +01:00
parent c6668da02e
commit 8e316d2f05
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
javascript/ql/src/semmle/javascript/security/dataflow/IndirectCommandArgument.qll
View File

@@ -33,6 +33,13 @@ private DataFlow::Node commandArgument(SystemCommandExecution sys, DataFlow::Typ
exists(DataFlow::TypeBackTracker t2 | t = t2.smallstep(result, commandArgument(sys, t2)))
}
/**
* Gets a data-flow node whose value ends up being interpreted as the command argument in `sys`.
*/
private DataFlow::Node commandArgument(SystemCommandExecution sys) {
result = commandArgument(sys, DataFlow::TypeBackTracker::end())
}
/**
* Gets a data-flow node whose value ends up being interpreted as the argument list in `sys`
* after a flow summarized by `t`.
@@ -51,6 +58,13 @@ private DataFlow::SourceNode argumentList(SystemCommandExecution sys, DataFlow::
)
}
/**
* Gets a data-flow node whose value ends up being interpreted as the argument list in `sys`.
*/
private DataFlow::SourceNode argumentList(SystemCommandExecution sys) {
result = argumentList(sys, DataFlow::TypeBackTracker::end())
}
/**
* Holds if `source` contributes to the arguments of an indirect command execution `sys`.
*
@@ -73,13 +87,13 @@ private DataFlow::SourceNode argumentList(SystemCommandExecution sys, DataFlow::
predicate isIndirectCommandArgument(DataFlow::Node source, SystemCommandExecution sys) {
exists(DataFlow::ArrayCreationNode args, DataFlow::Node shell, string dashC |
shellCmd(shell.asExpr(), dashC) and
shell = commandArgument(sys, DataFlow::TypeBackTracker::end()) and
shell = commandArgument(sys) and
args.getAPropertyWrite().getRhs().mayHaveStringValue(dashC) and
args = argumentList(sys, DataFlow::TypeBackTracker::end()) and
args = argumentList(sys) and
(
source = argumentList(sys, DataFlow::TypeBackTracker::end())
source = argumentList(sys)
or
source = argumentList(sys, DataFlow::TypeBackTracker::end()).getAPropertyWrite().getRhs()
source = argumentList(sys).getAPropertyWrite().getRhs()
)
)
}