mirror of
https://github.com/github/codeql.git
synced 2026-04-30 03:05:15 +02:00
Fix recursion in entrypointFieldStep
When using local taint tracking to define a RemoteFlowSource, a recursion was created because entrypointFieldStep adds new RemoteFlowSources and was a local taint step. This is fixed by converting entrypointFieldStep into a defaultAdditionalTaintStep instead of a localAdditionalTaintStep, i.e. it will only affect global taint tracking from now on.
This commit is contained in:
@@ -92,8 +92,6 @@ private module Cached {
|
||||
)
|
||||
or
|
||||
FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
|
||||
or
|
||||
entrypointFieldStep(src, sink)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -103,6 +101,7 @@ private module Cached {
|
||||
cached
|
||||
predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
|
||||
localAdditionalTaintStep(src, sink) or
|
||||
entrypointFieldStep(src, sink) or
|
||||
any(AdditionalTaintStep a).step(src, sink)
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user