github / github/codeql

Preserving taint through arithmetic operations in Java

Offen
#14,233 4 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

**Description of the issue**

As described in issue #4845, by default CodeQL does not propagate taint across arithmetic operations (e.g. addition) for Java.

I'm working on a query where taint tracking across arithmetic operations is required and I plan on submitting a pull request for a query bug fix. I ran into an issue or two and could use some advice on the specifics.

**Background information**

I added an `isAdditionalFlowStep` predicate to the module implementing `DataFlow::ConfigSig`, then extended `AdditionalValueStep` with a subclass that uses the `ArithExpr` class from `semmle.code.java.arithmetic.Overflow`, like this:
```
import semmle.code.java.arithmetic.Overflow

class ArithmeticExpressionStep extends AdditionalValueStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
node2.asExpr().(ArithExpr).getAnOperand() = node1.asExpr()
}
}

module MyConfig implements DataFlow::ConfigSig {
// other predicates here

predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(AdditionalValueStep r).step(node1, node2)
}
}
```

**Questions**

1. Although this fixes the issue for binary arithmetic operands, unary operands still don't propagate taint. `ArithExpr` already checks for `UnaryAssignExpr`. I also tried adding the check `node2.asExpr().(UnaryAssignExpr).getExpr() = node1.asExpr()` but it still doesn't work - I can't quite figure out the syntax for passing taint through a unary operator using the two `node1` and `node2` parameters. Any ideas?

2. Is there a better class for doing this than `ArithExpr` from `semmle.code.java.arithmetic.Overflow`? It seems like a reasonable choice, just a but strange such a low level class would be specific to overflow operations rather than generic. I wanted to verify the use was acceptable before doing a PR.

Thanks!

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.