Java: cover wrapped constructor taint flow

tamasvajk · tamasvajk · commit e3534d16355b · 2021-03-16T12:10:28.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -697,3 +697,15 @@ predicate summaryStep(Node node1, Node node2, string kind) {
     interpretOutput(output, 0, ref, TNode(node2))
   )
 }
+
+/**
+ * Holds if `node1` to `node2` is specified as a flow step with the given kind, input and output
+ * in a CSV flow model.
+ */
+predicate summaryStep(Node node1, Node node2, string kind, string input, string output) {
+  exists(Top ref |
+    summaryElementRef(ref, input, output, kind) and
+    interpretInput(input, 0, ref, TNode(node1)) and
+    interpretOutput(output, 0, ref, TNode(node2))
+  )
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -166,6 +166,9 @@ private predicate inputStreamWrapper(Constructor c, int argi) {
 /** An object construction that preserves the data flow status of any of its arguments. */
 private predicate constructorStep(Expr tracked, ConstructorCall sink) {
   exists(int argi | sink.getArgument(argi) = tracked |
+    summaryStep(any(DataFlow::Node n | n.asExpr() = tracked),
+      any(DataFlow::Node n | n.asExpr() = sink), "taint", "Argument(" + argi + ")", "ReturnValue")
+    or
     // wrappers constructed by extension
     exists(Constructor c, Parameter p, SuperConstructorInvocationStmt sup |
       c = sink.getConstructor() and
