hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Constrain location overrides to actual sources/sinks

Browse Source
This commit is contained in:
Nora Dimitrijević
2025-10-16 14:19:05 +02:00
parent 96e1536769
commit a0975e7e19
13 changed files with 45 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
View File

@@ -19,9 +19,9 @@ module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
}
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
overflowSink(exp, sink.asExpr())
)
}
}
@@ -45,9 +45,9 @@ module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
}
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
underflowSink(exp, sink.asExpr())
)
}
}

12
java/ql/lib/semmle/code/java/security/ArithmeticUncontrolledQuery.qll
View File

@@ -25,9 +25,9 @@ module ArithmeticUncontrolledOverflowConfig implements DataFlow::ConfigSig {
}
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
overflowSink(exp, sink.asExpr())
)
}
}
@@ -48,9 +48,9 @@ module ArithmeticUncontrolledUnderflowConfig implements DataFlow::ConfigSig {
}
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
underflowSink(exp, sink.asExpr())
)
}
}

8
java/ql/lib/semmle/code/java/security/BrokenCryptoAlgorithmQuery.qll
View File

@@ -36,9 +36,11 @@ module InsecureCryptoConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() | result = c.getLocation())
exists(CryptoAlgoSpec c | sink.asExpr() = c.getAlgoSpec() |
result = c.getLocation()
or
result = sink.getLocation()
)
}
}

8
java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
View File

@@ -66,9 +66,11 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
// ExecTainted.ql queries use the argument as the primary location;
// ExecUnescaped.ql does not (used to prevent overlapping results).
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(Expr argument | argumentToExec(argument, sink) | result = argument.getLocation())
exists(Expr argument | argumentToExec(argument, sink) |
result = argument.getLocation()
or
result = sink.getLocation()
)
}
}

4
java/ql/lib/semmle/code/java/security/ConditionalBypassQuery.qll
View File

@@ -51,9 +51,7 @@ module ConditionalBypassFlowConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(MethodCall m, Expr e | result = [m, e].getLocation() |
exists(MethodCall m, Expr e | result = [[m, e].getLocation(), sink.getLocation()] |
conditionControlsMethod(m, e) and
sink.asExpr() = e
)

7
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
View File

@@ -21,10 +21,11 @@ module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation()
or
result = sink.getLocation()
|
arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
)
}

7
java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionQuery.qll
View File

@@ -18,10 +18,11 @@ module ImproperValidationOfArrayConstructionConfig implements DataFlow::ConfigSi
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation()
or
result = sink.getLocation()
|
arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
)
}

2
java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
View File

@@ -313,7 +313,7 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
result = sink.(UnsafeDeserializationSink).getLocation()
or
result = sink.(UnsafeDeserializationSink).getMethodCall().getLocation()
}