mirror of
https://github.com/github/codeql.git
synced 2025-12-30 15:46:34 +01:00
a82fa04d8a
This can't be seen on the example, but I went through quite a lot of iterations before arriving at this fairly simple solution.
27 lines
887 B
Plaintext
27 lines
887 B
Plaintext
/**
|
|
* @kind path-problem
|
|
*/
|
|
|
|
private import python
|
|
private import experimental.dataflow.DataFlow
|
|
private import experimental.dataflow.TaintTracking
|
|
import DataFlow::PathGraph
|
|
import SharedCode
|
|
|
|
class MyClassGetValueAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
|
|
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
|
// obj -> obj.get_value
|
|
nodeTo.asCfgNode().(AttrNode).getObject("get_value") = nodeFrom.asCfgNode() and
|
|
nodeTo = myClassGetValue(_)
|
|
or
|
|
// get_value -> get_value()
|
|
nodeFrom = myClassGetValue(_) and
|
|
nodeTo.asCfgNode().(CallNode).getFunction() = nodeFrom.asCfgNode()
|
|
}
|
|
}
|
|
|
|
from SharedConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
|
|
where config.hasFlowPath(source, sink)
|
|
select sink.getNode(), source, sink,
|
|
"test flow (proper): " + source.getNode().asCfgNode().getScope().getName()
|