hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 13:34:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add readStep back to local taint flow

Browse Source
This commit is contained in:
Owen Mansel-Chan
2024-12-13 13:30:18 +00:00
parent 3a3e053f12
commit e9dcd69cc0
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -37,8 +37,7 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
or
// Treat container flow as taint for the local taint flow relation
exists(DataFlow::Content c | DataFlowPrivate::containerContent(c) |
// `DataFlowPrivate::readStep` has already been included in
// `localAdditionalTaintStep`.
DataFlowPrivate::readStep(src, c, sink) or
DataFlowPrivate::storeStep(src, c, sink) or
FlowSummaryImpl::Private::Steps::summaryGetterStep(src, c, sink, _) or
FlowSummaryImpl::Private::Steps::summarySetterStep(src, c, sink, _)

1
go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected
View File

@@ -15,6 +15,7 @@
| main.go:47:20:47:21 | next key-value pair in range | main.go:47:2:50:2 | range statement[1] |
| main.go:47:20:47:21 | xs | main.go:47:2:50:2 | range statement[1] |
| main.go:56:8:56:11 | true | main.go:56:2:56:3 | ch |
| main.go:57:4:57:5 | ch | main.go:57:2:57:5 | <-... |
| strings.go:9:24:9:24 | s | strings.go:9:8:9:38 | call to Replace |
| strings.go:9:32:9:34 | "_" | strings.go:9:8:9:38 | call to Replace |
| strings.go:10:27:10:27 | s | strings.go:10:8:10:42 | call to ReplaceAll |