hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use a full dataflow config rather than local flow

Browse Source
This commit is contained in:
Joe Farebrother
2022-08-16 11:10:20 +01:00
parent fe5a61bdde
commit de69827711
4 changed files with 35 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java
View File

@@ -2,8 +2,16 @@ import javax.crypto.Cipher;
class RsaWithoutOaep {
public void test() throws Exception {
Cipher rsaBad = Cipher.getInstance("RSA/ECB/NoPadding"); // $hasResult
Cipher rsaBad = Cipher.getInstance("RSA/ECB/NoPadding"); // $hasTaintFlow
Cipher rsaGood = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding");
}
public Cipher getCipher(String spec) throws Exception {
return Cipher.getInstance(spec); // $hasTaintFlow
}
public void test2() throws Exception {
Cipher rsa = getCipher("RSA/ECB/NoPadding");
}
}

17
java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql
View File

@@ -1,19 +1,10 @@
import java
import TestUtilities.InlineExpectationsTest
import TestUtilities.InlineFlowTest
import semmle.code.java.security.RsaWithoutOaepQuery
class HasResult extends InlineExpectationsTest {
HasResult() { this = "HasResult" }
class HasFlowTest extends InlineFlowTest {
override DataFlow::Configuration getTaintFlowConfig() { result instanceof RsaWithoutOaepConfig }
override string getARelevantTag() { result = "hasResult" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasResult" and
value = "" and
exists(CryptoAlgoSpec c |
rsaWithoutOaepCall(c) and
location = c.getLocation() and
element = c.toString()
)
}
override DataFlow::Configuration getValueFlowConfig() { none() }
}