hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Allow null literals as sources in data flow.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2020-01-22 12:04:42 +01:00
parent 80997a3323
commit b92203a87f
4 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
View File

@@ -235,6 +235,8 @@ DataFlowType getErasedRepr(Type t) {
then result.(BoxedType).getPrimitiveType().getName() = "boolean"
else result = e
)
or
t instanceof NullType and result instanceof TypeObject
}
/** Gets a string representation of a type returned by `getErasedRepr`. */

9
java/ql/test/library-tests/dataflow/null/A.java Normal file
View File

@@ -0,0 +1,9 @@
public class A {
void sink(Object o) { }
void foo() {
Object src = null;
Object x = src;
sink(x);
}
}

4
java/ql/test/library-tests/dataflow/null/testnullflow.expected Normal file
View File

@@ -0,0 +1,4 @@
| A.java:5:18:5:21 | null | A.java:2:13:2:20 | o |
| A.java:5:18:5:21 | null | A.java:5:18:5:21 | null |
| A.java:5:18:5:21 | null | A.java:6:16:6:18 | src |
| A.java:5:18:5:21 | null | A.java:7:10:7:10 | x |

14
java/ql/test/library-tests/dataflow/null/testnullflow.ql Normal file
View File

@@ -0,0 +1,14 @@
import java
import semmle.code.java.dataflow.DataFlow
class Conf extends DataFlow::Configuration {
Conf() { this = "qqconf" }
override predicate isSource(DataFlow::Node n) { n.asExpr() instanceof NullLiteral }
override predicate isSink(DataFlow::Node n) { any() }
}
from Conf conf, DataFlow::Node src, DataFlow::Node sink
where conf.hasFlow(src, sink)
select src, sink