hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactor Security.CWE.CWE-022.TaintedPathLocal

Browse Source
This commit is contained in:
Ed Minnix
2023-03-15 13:10:58 -04:00
parent dce81cf0ae
commit e60e1a2ba9
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql
View File

@@ -18,32 +18,33 @@ import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.security.PathCreation import semmle.code.java.security.PathCreation
import semmle.code.java.security.PathSanitizer import semmle.code.java.security.PathSanitizer
import DataFlow::PathGraph
import TaintedPathCommon import TaintedPathCommon
class TaintedPathLocalConfig extends TaintTracking::Configuration { private module TaintedPathLocalConfig implements DataFlow::ConfigSig {
TaintedPathLocalConfig() { this = "TaintedPathLocalConfig" } predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput } predicate isSink(DataFlow::Node sink) {
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(PathCreation p).getAnInput() sink.asExpr() = any(PathCreation p).getAnInput()
or or
sinkNode(sink, "create-file") sinkNode(sink, "create-file")
} }
override predicate isSanitizer(DataFlow::Node sanitizer) { predicate isBarrier(DataFlow::Node sanitizer) {
sanitizer.getType() instanceof BoxedType or sanitizer.getType() instanceof BoxedType or
sanitizer.getType() instanceof PrimitiveType or sanitizer.getType() instanceof PrimitiveType or
sanitizer.getType() instanceof NumberType or sanitizer.getType() instanceof NumberType or
sanitizer instanceof PathInjectionSanitizer sanitizer instanceof PathInjectionSanitizer
} }
override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) { predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
any(TaintedPathAdditionalTaintStep s).step(n1, n2) any(TaintedPathAdditionalTaintStep s).step(n1, n2)
} }
} }
module TaintedPathLocalFlow = TaintTracking::Make<TaintedPathLocalConfig>;
import TaintedPathLocalFlow::PathGraph
/** /**
* Gets the data-flow node at which to report a path ending at `sink`. * Gets the data-flow node at which to report a path ending at `sink`.
* *
@@ -52,13 +53,13 @@ class TaintedPathLocalConfig extends TaintTracking::Configuration {
* continue to report there; otherwise we report directly at `sink`. * continue to report there; otherwise we report directly at `sink`.
*/ */
DataFlow::Node getReportingNode(DataFlow::Node sink) { DataFlow::Node getReportingNode(DataFlow::Node sink) {
any(TaintedPathLocalConfig c).hasFlowTo(sink) and TaintedPathLocalFlow::hasFlowTo(sink) and
if exists(PathCreation pc | pc.getAnInput() = sink.asExpr()) if exists(PathCreation pc | pc.getAnInput() = sink.asExpr())
then result.asExpr() = any(PathCreation pc | pc.getAnInput() = sink.asExpr()) then result.asExpr() = any(PathCreation pc | pc.getAnInput() = sink.asExpr())
else result = sink else result = sink
} }
from DataFlow::PathNode source, DataFlow::PathNode sink, TaintedPathLocalConfig conf from TaintedPathLocalFlow::PathNode source, TaintedPathLocalFlow::PathNode sink
where conf.hasFlowPath(source, sink) where TaintedPathLocalFlow::hasFlowPath(source, sink)
select getReportingNode(sink.getNode()), source, sink, "This path depends on a $@.", select getReportingNode(sink.getNode()), source, sink, "This path depends on a $@.",
source.getNode(), "user-provided value" source.getNode(), "user-provided value"