hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Support outgoing taint flow from fields

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-09-24 15:50:46 +02:00
parent c3462be2c9
commit cd11ef3bf6
4 changed files with 111 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
java/ql/src/utils/model-generator/CaptureSummaryModels.ql
View File

@@ -11,7 +11,10 @@ import semmle.code.java.dataflow.internal.DataFlowImplCommon
string captureFlow(Callable api) {
result = captureQualifierFlow(api) or
result = captureParameterFlowToReturnValue(api)
result = captureParameterFlowToReturnValue(api) or
// TODO: merge next two?
result = captureFieldFlowOut(api) or
result = captureFieldFlowIntoParam(api)
}
string captureQualifierFlow(Callable api) {
@@ -22,6 +25,30 @@ string captureQualifierFlow(Callable api) {
result = asValueModel(api, "Argument[-1]", "ReturnValue")
}
string captureFieldFlowOut(Callable api) {
exists(FieldAccess fa, ReturnStmt rtn |
not (fa.getField().isStatic() and fa.getField().isFinal()) and
rtn.getEnclosingCallable() = api and
not api.getReturnType() instanceof PrimitiveType and
not api.getDeclaringType() instanceof EnumType and
TaintTracking::localTaint(DataFlow::exprNode(fa), DataFlow::exprNode(rtn.getResult()))
|
result = asTaintModel(api, "Argument[-1]", "ReturnValue")
)
}
string captureFieldFlowIntoParam(Callable api) {
exists(FieldAccess fa, DataFlow::PostUpdateNode pn |
not (fa.getField().isStatic() and fa.getField().isFinal()) and
pn.getPreUpdateNode().asExpr() = api.getAParameter().getAnAccess() and
TaintTracking::localTaint(DataFlow::exprNode(fa), pn)
|
result =
asTaintModel(api, "Argument[-1]",
parameterAccess(pn.getPreUpdateNode().asExpr().(VarAccess).getVariable()))
)
}
class ParameterToReturnValueTaintConfig extends TaintTracking::Configuration {
ParameterToReturnValueTaintConfig() { this = "ParameterToReturnValueTaintConfig" }