hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

rename more acronyms

Browse Source
This commit is contained in:
erik-krogh
2022-08-24 12:59:07 +02:00
parent 06afe9c0f4
commit cc7a9ef97a
93 changed files with 693 additions and 451 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
View File

@@ -117,12 +117,12 @@ predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
}
/** Holds if a DSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
predicate hasShortDSAKeyPair(MethodAccess ma, string msg) {
predicate hasShortDsaKeyPair(MethodAccess ma, string msg) {
hasShortAsymmetricKeyPair(ma, msg, "DSA") or hasShortAsymmetricKeyPair(ma, msg, "DH")
}
/** Holds if a RSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
predicate hasShortRSAKeyPair(MethodAccess ma, string msg) {
predicate hasShortRsaKeyPair(MethodAccess ma, string msg) {
hasShortAsymmetricKeyPair(ma, msg, "RSA")
}
@@ -147,7 +147,7 @@ predicate hasShortECKeyPair(MethodAccess ma, string msg) {
from Expr e, string msg
where
hasShortAESKey(e, msg) or
hasShortDSAKeyPair(e, msg) or
hasShortRSAKeyPair(e, msg) or
hasShortDsaKeyPair(e, msg) or
hasShortRsaKeyPair(e, msg) or
hasShortECKeyPair(e, msg)
select e, msg

10
java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
View File

@@ -21,8 +21,8 @@ import DataFlow::PathGraph
/**
* Taint configuration tracking flow from untrusted inputs to number conversion calls in exported Android compononents.
*/
class NFELocalDoSConfiguration extends TaintTracking::Configuration {
NFELocalDoSConfiguration() { this = "NFELocalDoSConfiguration" }
class NfeLocalDoSConfiguration extends TaintTracking::Configuration {
NfeLocalDoSConfiguration() { this = "NFELocalDoSConfiguration" }
/** Holds if source is a remote flow source */
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -31,17 +31,17 @@ class NFELocalDoSConfiguration extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) {
exists(Expr e |
e.getEnclosingCallable().getDeclaringType().(ExportableAndroidComponent).isExported() and
throwsNFE(e) and
throwsNfe(e) and
not exists(TryStmt t |
t.getBlock() = e.getAnEnclosingStmt() and
catchesNFE(t)
catchesNfe(t)
) and
sink.asExpr() = e
)
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, NFELocalDoSConfiguration conf
from DataFlow::PathNode source, DataFlow::PathNode sink, NfeLocalDoSConfiguration conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink,
"Uncaught NumberFormatException in an exported Android component due to $@.", source.getNode(),