hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-04 22:56:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move to library

Browse Source
This commit is contained in:
Ed Minnix
2023-11-02 10:25:47 -04:00
parent 65d05bf3de
commit 8ed3f3c865
2 changed files with 42 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
java/ql/lib/semmle/code/java/security/TaintedEnvironmentVariableQuery.qll Normal file
View File

@@ -0,0 +1,36 @@
/** Modules to reason about the tainting of environment variables */
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.Maps
private import semmle.code.java.JDK
private module ProcessBuilderEnvironmentConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source.getType() instanceof TypeProcessBuilder }
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(MethodCall mc | mc.getQualifier() = node1.asExpr() and mc = node2.asExpr() |
mc.getMethod().hasQualifiedName("java.lang", "ProcessBuilder", "environment")
)
}
predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(MapPutCall mpc).getQualifier() }
}
private module ProcessBuilderEnvironmentFlow =
TaintTracking::Global<ProcessBuilderEnvironmentConfig>;
module ExecTaintedEnvironmentConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
predicate isSink(DataFlow::Node sink) {
sinkNode(sink, "environment-injection")
or
exists(MapPutCall mpc | mpc.getAnArgument() = sink.asExpr() |
ProcessBuilderEnvironmentFlow::flow(_, DataFlow::exprNode(mpc.getQualifier()))
)
}
}
module ExecTaintedEnvironmentFlow = TaintTracking::Global<ExecTaintedEnvironmentConfig>;