hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 09:43:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

refactor isAdditionalTaintStep to a utility predicate in InsecureRandomness

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-06-10 10:55:30 +02:00
parent 9189f23403
commit 9029dbacf5
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/src/semmle/javascript/security/dataflow/InsecureRandomness.qll
View File

@@ -36,16 +36,7 @@ module InsecureRandomness {
} }
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) { override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
// Assume that all operations on tainted values preserve taint: crypto is hard InsecureRandomness::isAdditionalTaintStep(pred, succ)
succ.asExpr().(BinaryExpr).getAnOperand() = pred.asExpr()
or
succ.asExpr().(UnaryExpr).getOperand() = pred.asExpr()
or
exists(DataFlow::MethodCallNode mc |
mc = DataFlow::globalVarRef("Math").getAMemberCall(_) and
pred = mc.getAnArgument() and
succ = mc
)
} }
} }
} }

16
javascript/ql/src/semmle/javascript/security/dataflow/InsecureRandomnessCustomizations.qll
View File

@@ -78,4 +78,20 @@ module InsecureRandomness {
class CryptoKeySink extends Sink { class CryptoKeySink extends Sink {
CryptoKeySink() { this instanceof CryptographicKey } CryptoKeySink() { this instanceof CryptographicKey }
} }
/**
* Holds if the step `pred` -> `succ` is an additional taint-step for random values that are not cryptographically secure.
*/
predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
// Assume that all operations on tainted values preserve taint: crypto is hard
succ.asExpr().(BinaryExpr).getAnOperand() = pred.asExpr()
or
succ.asExpr().(UnaryExpr).getOperand() = pred.asExpr()
or
exists(DataFlow::MethodCallNode mc |
mc = DataFlow::globalVarRef("Math").getAMemberCall(_) and
pred = mc.getAnArgument() and
succ = mc
)
}
} }