hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16550 from aschackmull/java/zipslip-number-sanitizer

Browse Source 
Java: Improve sanitizer for java/zipslip
This commit is contained in:
Anders Schack-Mulligen
2024-05-22 12:43:44 +02:00
committed by GitHub
parent 84e412fe36 7828cb8f5a
commit a078dcf1f2
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll
View File

@@ -6,6 +6,7 @@ import semmle.code.java.security.PathSanitizer
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.security.PathCreation
private import semmle.code.java.security.Sanitizers
/**
* A method that returns the name of an archive entry.
@@ -39,7 +40,10 @@ module ZipSlipConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink }
predicate isBarrier(DataFlow::Node node) { node instanceof PathInjectionSanitizer }
predicate isBarrier(DataFlow::Node node) {
node instanceof SimpleTypeSanitizer or
node instanceof PathInjectionSanitizer
}
}
/** Tracks flow from archive entries to file creation. */

4
java/ql/src/change-notes/2024-05-22-zipslip-number-sanitizer.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The sanitizer of the query `java/zipslip` has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.