hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2726 from aschackmull/java/outputstream-write-taint

Browse Source 
Java: Improve taint for OutputStream.write and InputStream.read.
This commit is contained in:
yo-h
2020-01-30 18:24:00 -05:00
committed by GitHub
parent 563be9f817 9bea581a23
commit b542b08c95
4 changed files with 59 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
java/ql/test/library-tests/dataflow/taint/A.java Normal file
View File

@@ -0,0 +1,27 @@
import java.io.*;
public class A {
byte[] taint() { return new byte[2]; }
void sink(Object o) { }
void test1() {
ByteArrayOutputStream bOutput = new ByteArrayOutputStream();
bOutput.write(taint(), 0, 1);
byte[] b = bOutput.toByteArray();
ByteArrayInputStream bInput = new ByteArrayInputStream(b);
byte[] b2 = new byte[10];
bInput.read(b2, 0, 1);
sink(b2);
}
void test2() {
ByteArrayOutputStream bOutput = new ByteArrayOutputStream();
bOutput.write(taint());
byte[] b = bOutput.toByteArray();
ByteArrayInputStream bInput = new ByteArrayInputStream(b);
byte[] b2 = new byte[10];
bInput.read(b2);
sink(b2);
}
}

2
java/ql/test/library-tests/dataflow/taint/test.expected Normal file
View File

@@ -0,0 +1,2 @@
| A.java:10:19:10:25 | taint(...) | A.java:15:10:15:11 | b2 |
| A.java:20:19:20:25 | taint(...) | A.java:25:10:25:11 | b2 |

18
java/ql/test/library-tests/dataflow/taint/test.ql Normal file
View File

@@ -0,0 +1,18 @@
import java
import semmle.code.java.dataflow.TaintTracking
class Conf extends TaintTracking::Configuration {
Conf() { this = "qqconf" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("taint")
}
override predicate isSink(DataFlow::Node n) {
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
}
}
from DataFlow::Node src, DataFlow::Node sink, Conf conf
where conf.hasFlow(src, sink)
select src, sink