hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix finding more sources

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-09-30 12:08:29 +02:00
parent 38579ef25b
commit c616eb1473
4 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/utils/model-generator/CaptureSinkModels.ql
View File

@@ -16,7 +16,7 @@ class PropagateToSinkConfiguration extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) {
exists(MethodAccess ma |
ma = source.asExpr() and
ma.getAChildExpr() = source.asExpr() and
ma.getAnEnclosingStmt().getEnclosingCallable().isPublic() and
ma.getAnEnclosingStmt().getEnclosingCallable().fromSource()
)
@@ -25,7 +25,11 @@ class PropagateToSinkConfiguration extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) }
}
string asInputArgument(Expr source) { result = "Argument[" + source.(Argument).getPosition() + "]" }
string asInputArgument(Expr source) {
result = "Argument[" + source.(Argument).getPosition() + "]"
or
result = source.(VarAccess).getVariable().toString()
}
string captureSink(Callable api) {
exists(DataFlow::Node src, DataFlow::Node sink, PropagateToSinkConfiguration config, string kind |

4
java/ql/src/utils/model-generator/CaptureSourceModels.ql
View File

@@ -33,7 +33,7 @@ predicate specificSourceNode(DataFlow::Node node, string output, string kind) {
exists(InterpretNode n | Private::External::isSourceNode(n, output, kind) and n.asNode() = node)
}
string captureSink(Callable api) {
string captureSource(Callable api) {
exists(
DataFlow::Node src, DataFlow::Node sink, FromSourceConfiguration config, string kind,
string output
@@ -47,6 +47,6 @@ string captureSink(Callable api) {
from Callable api, string sink
where
sink = captureSink(api) and
sink = captureSource(api) and
not isInTestFile(api)
select sink order by sink

2
java/ql/test/utils/model-generator/CaptureSinkModels.expected
View File

@@ -1 +1,3 @@
| p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];create-file; |
| p;Sinks;true;readUrl;(URL,Charset);;url;open-url; |
| p;Sources;true;readUrl;(URL);;url;open-url; |

1
java/ql/test/utils/model-generator/p/Sinks.java
View File

@@ -14,7 +14,6 @@ public class Sinks {
return Files.copy(sourceFile, targetDirectory.resolve(sourceFile.getFileName()), copyOptions);
}
// TODO: not detected
public String readUrl(final URL url, Charset encoding) throws IOException {
try (InputStream in = url.openStream()) {
byte[] bytes = in.readAllBytes();