mirror of
https://github.com/github/codeql.git
synced 2026-01-26 12:52:57 +01:00
30 lines
1.3 KiB
Plaintext
30 lines
1.3 KiB
Plaintext
/** Provides taint-tracking configurations to reason about arithmetic with unvalidated user input. */
|
|
|
|
import java
|
|
private import semmle.code.java.dataflow.FlowSources
|
|
private import semmle.code.java.security.ArithmeticCommon
|
|
|
|
/** A taint-tracking configuration to reason about overflow from unvalidated user input. */
|
|
module RemoteUserInputOverflowConfig implements DataFlow::ConfigSig {
|
|
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
|
|
|
|
predicate isSink(DataFlow::Node sink) { overflowSink(_, sink.asExpr()) }
|
|
|
|
predicate isBarrier(DataFlow::Node n) { overflowBarrier(n) }
|
|
}
|
|
|
|
/** A taint-tracking configuration to reason about underflow from unvalidated user input. */
|
|
module RemoteUserInputUnderflowConfig implements DataFlow::ConfigSig {
|
|
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
|
|
|
|
predicate isSink(DataFlow::Node sink) { underflowSink(_, sink.asExpr()) }
|
|
|
|
predicate isBarrier(DataFlow::Node n) { underflowBarrier(n) }
|
|
}
|
|
|
|
/** Taint-tracking flow for overflow from unvalidated user input. */
|
|
module RemoteUserInputOverflow = TaintTracking::Global<RemoteUserInputOverflowConfig>;
|
|
|
|
/** Taint-tracking flow for underflow from unvalidated user input. */
|
|
module RemoteUserInputUnderflow = TaintTracking::Global<RemoteUserInputUnderflowConfig>;
|