hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Only capture taint from own fields

Browse Source 
Also exclude `Charset` as relevant taint-carrying type. This is generally
what we want to lets us avoid tracking arguments that lead to FP.
This commit is contained in:
Benjamin Muskalla
2021-11-12 10:15:15 +01:00
parent 0234e77d2f
commit a0b7f267ff
4 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/utils/model-generator/CaptureSinkModels.ql
View File

@@ -16,7 +16,7 @@ class PropagateToSinkConfiguration extends TaintTracking::Configuration {
PropagateToSinkConfiguration() { this = "parameters or flowing into sinks" }
override predicate isSource(DataFlow::Node source) {
(source.asExpr() instanceof FieldAccess or source instanceof DataFlow::ParameterNode) and
(source.asExpr().(FieldAccess).isOwnFieldAccess() or source instanceof DataFlow::ParameterNode) and
source.getEnclosingCallable().isPublic() and
exists(RefType t |
t = source.getEnclosingCallable().getDeclaringType().getAnAncestor() and

4
java/ql/src/utils/model-generator/CaptureSummaryModels.ql
View File

@@ -190,8 +190,7 @@ class ParameterToReturnValueTaintConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink instanceof ReturnNodeExt }
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
node2.asExpr().(ConstructorCall).getAnArgument() = node1.asExpr() and
node1.asExpr().(Argument).getCall().getCallee().fromSource()
node2.asExpr().(ConstructorCall).getAnArgument() = node1.asExpr()
}
}
@@ -261,6 +260,7 @@ predicate isRelevantType(Type t) {
not t instanceof PrimitiveType and
not t instanceof BoxedType and
not t.(RefType).getAnAncestor().hasQualifiedName("java.lang", "Number") and
not t.(RefType).getAnAncestor().hasQualifiedName("java.nio.charset", "Charset") and
(
not t.(Array).getElementType() instanceof PrimitiveType or
isPrimitiveTypeUsedForBulkData(t.(Array).getElementType())