Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a764a79

Browse files
artem-smotrakovartem-smotrakov
committed
Always bind arguments in TaintPropagatingCall
1 parent c13ee08 commit a764a79

2 files changed

Lines changed: 11 additions & 27 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,17 @@ private class TaintPropagatingCall extends Call {
5656

5757
TaintPropagatingCall() {
5858
taintFromExpr = this.getArgument(1) and
59-
exists(Method m | this.(MethodAccess).getMethod() = m |
60-
m.getDeclaringType() instanceof ExpressionFactory and
61-
m.hasName(["createValueExpression", "createMethodExpression"]) and
62-
taintFromExpr.getType() instanceof TypeString
63-
)
64-
or
65-
exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
66-
c.getDeclaringType() instanceof LambdaExpression and
67-
taintFromExpr.getType() instanceof ValueExpression
59+
(
60+
exists(Method m | this.(MethodAccess).getMethod() = m |
61+
m.getDeclaringType() instanceof ExpressionFactory and
62+
m.hasName(["createValueExpression", "createMethodExpression"]) and
63+
taintFromExpr.getType() instanceof TypeString
64+
)
65+
or
66+
exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
67+
c.getDeclaringType() instanceof LambdaExpression and
68+
taintFromExpr.getType() instanceof ValueExpression
69+
)
6870
)
6971
}
7072

‎java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,9 @@ edges
1010
| JakartaExpressionInjection.java:30:24:30:33 | expression : String | JakartaExpressionInjection.java:32:28:32:37 | expression |
1111
| JakartaExpressionInjection.java:37:24:37:33 | expression : String | JakartaExpressionInjection.java:39:32:39:41 | expression |
1212
| JakartaExpressionInjection.java:44:24:44:33 | expression : String | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
13-
| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression |
1413
| JakartaExpressionInjection.java:54:24:54:33 | expression : String | JakartaExpressionInjection.java:56:32:56:41 | expression |
15-
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression |
1614
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e |
17-
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
18-
| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
19-
| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e |
20-
| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression |
21-
| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
22-
| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression |
2315
| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e |
24-
| JakartaExpressionInjection.java:70:24:70:33 | expression : String | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
25-
| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
26-
| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e |
27-
| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression |
28-
| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression |
2916
| JakartaExpressionInjection.java:79:24:79:33 | expression : String | JakartaExpressionInjection.java:83:13:83:13 | e |
3017
nodes
3118
| JakartaExpressionInjection.java:22:25:22:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -35,18 +22,13 @@ nodes
3522
| JakartaExpressionInjection.java:37:24:37:33 | expression : String | semmle.label | expression : String |
3623
| JakartaExpressionInjection.java:39:32:39:41 | expression | semmle.label | expression |
3724
| JakartaExpressionInjection.java:44:24:44:33 | expression : String | semmle.label | expression : String |
38-
| JakartaExpressionInjection.java:48:49:48:104 | new LambdaExpression(...) : LambdaExpression | semmle.label | new LambdaExpression(...) : LambdaExpression |
3925
| JakartaExpressionInjection.java:49:13:49:28 | lambdaExpression | semmle.label | lambdaExpression |
4026
| JakartaExpressionInjection.java:54:24:54:33 | expression : String | semmle.label | expression : String |
4127
| JakartaExpressionInjection.java:56:32:56:41 | expression | semmle.label | expression |
4228
| JakartaExpressionInjection.java:61:24:61:33 | expression : String | semmle.label | expression : String |
43-
| JakartaExpressionInjection.java:64:33:64:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
4429
| JakartaExpressionInjection.java:65:13:65:13 | e | semmle.label | e |
45-
| JakartaExpressionInjection.java:65:13:65:13 | e : ValueExpression | semmle.label | e : ValueExpression |
4630
| JakartaExpressionInjection.java:70:24:70:33 | expression : String | semmle.label | expression : String |
47-
| JakartaExpressionInjection.java:73:33:73:96 | createValueExpression(...) : ValueExpression | semmle.label | createValueExpression(...) : ValueExpression |
4831
| JakartaExpressionInjection.java:74:13:74:13 | e | semmle.label | e |
49-
| JakartaExpressionInjection.java:74:13:74:13 | e : ValueExpression | semmle.label | e : ValueExpression |
5032
| JakartaExpressionInjection.java:79:24:79:33 | expression : String | semmle.label | expression : String |
5133
| JakartaExpressionInjection.java:83:13:83:13 | e | semmle.label | e |
5234
#select

0 commit comments

Comments
 (0)