hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Track taint for String.valueOf(..)

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-07-29 09:10:38 +02:00
parent d900fcaf42
commit b7b74b51a3
3 changed files with 30 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
View File

@@ -111,14 +111,14 @@ private class StringTaintPreservingMethod extends TaintPreservingCallable {
this.hasName([
"concat", "copyValueOf", "endsWith", "format", "formatted", "getBytes", "indent", "intern",
"join", "repeat", "split", "strip", "stripIndent", "stripLeading", "stripTrailing",
"substring", "toCharArray", "toLowerCase", "toString", "toUpperCase", "trim"
"substring", "toCharArray", "toLowerCase", "toString", "toUpperCase", "trim", "valueOf"
])
}
override predicate returnsTaintFrom(int arg) {
arg = -1 and not this.isStatic()
or
this.hasName(["concat", "copyValueOf"]) and arg = 0
this.hasName(["concat", "copyValueOf", "valueOf"]) and arg = 0
or
this.hasName(["format", "formatted", "join"]) and arg = [0 .. getNumberOfParameters()]
}