Missing data flow
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
I use the following rule of TaintTracking to query the data flow from CONTEXT_THREAD_LOCAL to if(user), but it doesn't work.
It seems that there is no data flow from CONTEXT_THREAD_LOCAL to User user variable?
```
override predicate isSource(DataFlow::Node source) {
exists(FieldRead f | source.asExpr() = f |
not source.asExpr().getEnclosingStmt() instanceof IfStmt and
f.getField().isStatic()
)
}
override predicate isSink(DataFlow::Node sink) {
exists(IfStmt ret |
sink.asExpr() = ret.getCondition().getAChildExpr*()
)
}
```
```
@SuppressWarnings("resource")
public static User getCurrentUser() {
return CONTEXT_THREAD_LOCAL.get().user;
}
public static User getRequiredCurrentUser() {
User user = getCurrentUser();
if (user == null) {
throw new ApiException(ApiError.AUTH_SIGNIN_REQUIRED, null, "Need signin first.");
}
return user;
}
```
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.