mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
Make small editorial changes
This commit is contained in:
Alistair Christie
@@ -3,10 +3,10 @@ Analyzing data flow in Java
|
||||
|
||||
You can use CodeQL to track the flow of data through a Java program to its use.
|
||||
|
||||
Overview
|
||||
--------
|
||||
About this article
|
||||
------------------
|
||||
|
||||
This topic describes how data flow analysis is implemented in the CodeQL libraries for Java and includes examples to help you write your own data flow queries.
|
||||
This article describes how data flow analysis is implemented in the CodeQL libraries for Java and includes examples to help you write your own data flow queries.
|
||||
The following sections describe how to use the libraries for local data flow, global data flow, and taint tracking.
|
||||
|
||||
For a more general introduction to modeling data flow, see :doc:`Introduction to data flow analysis with CodeQL <../intro-to-data-flow>`.
|
||||
@@ -19,7 +19,7 @@ Local data flow is data flow within a single method or callable. Local data flow
|
||||
Using local data flow
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The local data flow library is in the module ``DataFlow``, which defines the class ``Node`` denoting any element that data can flow through. ``Node``\ s are divided into expression nodes (``ExprNode``) and parameter nodes (``ParameterNode``). It is possible to map between data flow nodes and expressions/parameters using the member predicates ``asExpr`` and ``asParameter``:
|
||||
The local data flow library is in the module ``DataFlow``, which defines the class ``Node`` denoting any element that data can flow through. ``Node``\ s are divided into expression nodes (``ExprNode``) and parameter nodes (``ParameterNode``). You can map between data flow nodes and expressions/parameters using the member predicates ``asExpr`` and ``asParameter``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -47,9 +47,9 @@ or using the predicates ``exprNode`` and ``parameterNode``:
|
||||
*/
|
||||
ParameterNode parameterNode(Parameter p) { ... }
|
||||
|
||||
The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``. The predicate can be applied recursively (using the ``+`` and ``*`` operators), or through the predefined recursive predicate ``localFlow``, which is equivalent to ``localFlowStep*``.
|
||||
The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``. You can apply the predicate recursively by using the ``+`` and ``*`` operators, or by using the predefined recursive predicate ``localFlow``, which is equivalent to ``localFlowStep*``.
|
||||
|
||||
For example, finding flow from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows:
|
||||
For example, you can find flow from a parameter ``source`` to an expression ``sink`` in zero or more local steps:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -67,9 +67,9 @@ Local taint tracking extends local data flow by including non-value-preserving f
|
||||
|
||||
If ``x`` is a tainted string then ``y`` is also tainted.
|
||||
|
||||
The local taint tracking library is in the module ``TaintTracking``. Like local data flow, a predicate ``localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo)`` holds if there is an immediate taint propagation edge from the node ``nodeFrom`` to the node ``nodeTo``. The predicate can be applied recursively (using the ``+`` and ``*`` operators), or through the predefined recursive predicate ``localTaint``, which is equivalent to ``localTaintStep*``.
|
||||
The local taint tracking library is in the module ``TaintTracking``. Like local data flow, a predicate ``localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo)`` holds if there is an immediate taint propagation edge from the node ``nodeFrom`` to the node ``nodeTo``. You can apply the predicate recursively by using the ``+`` and ``*`` operators, or by using the predefined recursive predicate ``localTaint``, which is equivalent to ``localTaintStep*``.
|
||||
|
||||
For example, finding taint propagation from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows:
|
||||
For example, you can find taint propagation from a parameter ``source`` to an expression ``sink`` in zero or more local steps:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -78,7 +78,7 @@ For example, finding taint propagation from a parameter ``source`` to an express
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
The following query finds the filename passed to ``new FileReader(..)``.
|
||||
This query finds the filename passed to ``new FileReader(..)``.
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -90,7 +90,7 @@ The following query finds the filename passed to ``new FileReader(..)``.
|
||||
call.getCallee() = fileReader
|
||||
select call.getArgument(0)
|
||||
|
||||
Unfortunately, this will only give the expression in the argument, not the values which could be passed to it. So we use local data flow to find all expressions that flow into the argument:
|
||||
Unfortunately, this only gives the expression in the argument, not the values which could be passed to it. So we use local data flow to find all expressions that flow into the argument:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -104,7 +104,7 @@ Unfortunately, this will only give the expression in the argument, not the value
|
||||
DataFlow::localFlow(DataFlow::exprNode(src), DataFlow::exprNode(call.getArgument(0)))
|
||||
select src
|
||||
|
||||
Then we can make the source more specific, for example an access to a public parameter. The following query finds where a public parameter is passed to ``new FileReader(..)``:
|
||||
Then we can make the source more specific, for example an access to a public parameter. This query finds where a public parameter is passed to ``new FileReader(..)``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -118,7 +118,7 @@ Then we can make the source more specific, for example an access to a public par
|
||||
DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::exprNode(fc.getArgument(0)))
|
||||
select p
|
||||
|
||||
The following example finds calls to formatting functions where the format string is not hard-coded.
|
||||
This query finds calls to formatting functions where the format string is not hard-coded.
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -150,7 +150,7 @@ Global data flow tracks data flow throughout the entire program, and is therefor
|
||||
Using global data flow
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The global data flow library is used by extending the class ``DataFlow::Configuration`` as follows:
|
||||
You use the global data flow library by extending the class ``DataFlow::Configuration``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -168,7 +168,7 @@ The global data flow library is used by extending the class ``DataFlow::Configur
|
||||
}
|
||||
}
|
||||
|
||||
The following predicates are defined in the configuration:
|
||||
These predicates are defined in the configuration:
|
||||
|
||||
- ``isSource``—defines where data may flow from
|
||||
- ``isSink``—defines where data may flow to
|
||||
@@ -188,7 +188,7 @@ The data flow analysis is performed using the predicate ``hasFlow(DataFlow::Node
|
||||
Using global taint tracking
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Global taint tracking is to global data flow as local taint tracking is to local data flow. That is, global taint tracking extends global data flow with additional non-value-preserving steps. The global taint tracking library is used by extending the class ``TaintTracking::Configuration`` as follows:
|
||||
Global taint tracking is to global data flow as local taint tracking is to local data flow. That is, global taint tracking extends global data flow with additional non-value-preserving steps. You use the global taint tracking library by extending the class ``TaintTracking::Configuration``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -206,7 +206,7 @@ Global taint tracking is to global data flow as local taint tracking is to local
|
||||
}
|
||||
}
|
||||
|
||||
The following predicates are defined in the configuration:
|
||||
These predicates are defined in the configuration:
|
||||
|
||||
- ``isSource``—defines where taint may flow from
|
||||
- ``isSink``—defines where taint may flow to
|
||||
@@ -225,7 +225,7 @@ The data flow library contains some predefined flow sources. The class ``RemoteF
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
The following example shows a taint-tracking configuration that uses remote user input as data sources.
|
||||
This query shows a taint-tracking configuration that uses remote user input as data sources.
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
@@ -256,7 +256,7 @@ Exercise 4: Using the answers from 2 and 3, write a query which finds all global
|
||||
What next?
|
||||
----------
|
||||
|
||||
- Try the worked examples in the following topics: :doc:`Tutorial: Navigating the call graph <call-graph>` and :doc:`Tutorial: Working with source locations <source-locations>`.
|
||||
- Try the worked examples in these articles: :doc:`Tutorial: Navigating the call graph <call-graph>` and :doc:`Tutorial: Working with source locations <source-locations>`.
|
||||
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
|
||||
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user