hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update normalized path node

Browse Source
This commit is contained in:
luchua-bc
2022-02-11 12:38:05 +00:00
parent 12c53baba4
commit e3d0e9f083
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql
View File

@@ -25,7 +25,7 @@ class InjectFilePathConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(PathCreation p).getAnInput() and
not sink instanceof SanitizedNode
not sink instanceof NormalizedPathNode
}
override predicate isSanitizer(DataFlow::Node node) {

14
java/ql/src/experimental/Security/CWE/CWE-073/PathSanitizer.qll
View File

@@ -174,12 +174,10 @@ private class UrlDecodeSanitizer extends MethodAccess {
}
}
/** A sanitized node that is protected against path traversal vulnerabilities. */
abstract class SanitizedNode extends DataFlow::Node { }
class NodeWithPathNormalizer extends SanitizedNode {
NodeWithPathNormalizer() {
DataFlow::localExprFlow(this.asExpr(), any(PathNormalizeSanitizer ma))
/** A node with path normalization. */
class NormalizedPathNode extends DataFlow::Node {
NormalizedPathNode() {
TaintTracking::localExprTaint(this.asExpr(), any(PathNormalizeSanitizer ma))
}
}
@@ -188,8 +186,8 @@ private class PathDataModel extends SummaryModelCsv {
override predicate row(string row) {
row =
[
"java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;value",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;value"
"java.nio.file;Paths;true;get;;;Argument[0];ReturnValue;taint",
"java.nio.file;Path;true;normalize;;;Argument[-1];ReturnValue;taint"
]
}
}