github / github/codeql

Missing data flow

未关闭
#10,980 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

I use the following rule of TaintTracking to query the data flow from CONTEXT_THREAD_LOCAL to if(user), but it doesn't work.

It seems that there is no data flow from CONTEXT_THREAD_LOCAL to User user variable?

```
override predicate isSource(DataFlow::Node source) {
exists(FieldRead f | source.asExpr() = f |
not source.asExpr().getEnclosingStmt() instanceof IfStmt and
f.getField().isStatic()
)
}

override predicate isSink(DataFlow::Node sink) {
exists(IfStmt ret |
sink.asExpr() = ret.getCondition().getAChildExpr*()
)
}
```

```
@SuppressWarnings("resource")
public static User getCurrentUser() {
return CONTEXT_THREAD_LOCAL.get().user;
}

public static User getRequiredCurrentUser() {
User user = getCurrentUser();
if (user == null) {
throw new ApiException(ApiError.AUTH_SIGNIN_REQUIRED, null, "Need signin first.");
}
return user;
}
```

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。