hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Migrate String constructor to model

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-08-11 17:35:09 +02:00
parent dccdc3be5a
commit e0d978fd58
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/lib/semmle/code/java/dataflow/FlowSteps.qll
View File

@@ -10,6 +10,7 @@ private import semmle.code.java.dataflow.DataFlow
* ensuring that they are visible to the taint tracking library.
*/
private module Frameworks {
private import semmle.code.java.Strings
private import semmle.code.java.frameworks.jackson.JacksonSerializability
private import semmle.code.java.frameworks.android.Intent
private import semmle.code.java.frameworks.android.SQLite
@@ -108,12 +109,6 @@ private class StringTaintPreservingMethod extends TaintPreservingCallable {
}
}
private class StringTaintPreservingConstructor extends Constructor, TaintPreservingCallable {
StringTaintPreservingConstructor() { this.getDeclaringType() instanceof TypeString }
override predicate returnsTaintFrom(int arg) { arg = 0 }
}
private class NumberTaintPreservingCallable extends TaintPreservingCallable {
int argument;

14
java/ql/src/semmle/code/java/Strings.qll Normal file
View File

@@ -0,0 +1,14 @@
/** Definitions of taint steps in String and String-related classes of the JDK */
import java
private import semmle.code.java.dataflow.ExternalFlow
private class StringSummaryCsv extends SummaryModelCsv {
override predicate row(string row) {
row =
[
//`namespace; type; subtypes; name; signature; ext; input; output; kind`
"java.lang;String;false;String;;;Argument[0];Argument[-1];taint"
]
}
}