Java: Don't pass taint through the format methods of Console

joefarebrother · joefarebrother · commit efc3a2523790 · 2020-09-29T16:02:51.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -456,7 +456,8 @@ private predicate taintPreservingArgumentToMethod(Method method) {
   method.getDeclaringType() instanceof TypeString and
   method.hasName("join")
   or
-  method instanceof StringFormatMethod
+  method instanceof StringFormatMethod and
+  not method.getDeclaringType().hasQualifiedName("java.io", "Console")
 }
 
 /**
@@ -649,7 +650,8 @@ private predicate argToQualifierStep(Expr tracked, Expr sink) {
  */
 private predicate taintPreservingArgumentToQualifier(Method method) {
   method instanceof StringFormatMethod and
-  not method.getDeclaringType() instanceof TypeString
+  not method.getDeclaringType() instanceof TypeString and
+  not method.getDeclaringType().hasQualifiedName("java.io", "Console")
 }
 
 /**
