Preserving taint through arithmetic operations in Java
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
**Description of the issue**
As described in issue #4845, by default CodeQL does not propagate taint across arithmetic operations (e.g. addition) for Java.
I'm working on a query where taint tracking across arithmetic operations is required and I plan on submitting a pull request for a query bug fix. I ran into an issue or two and could use some advice on the specifics.
**Background information**
I added an `isAdditionalFlowStep` predicate to the module implementing `DataFlow::ConfigSig`, then extended `AdditionalValueStep` with a subclass that uses the `ArithExpr` class from `semmle.code.java.arithmetic.Overflow`, like this:
```
import semmle.code.java.arithmetic.Overflow
class ArithmeticExpressionStep extends AdditionalValueStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
node2.asExpr().(ArithExpr).getAnOperand() = node1.asExpr()
}
}
module MyConfig implements DataFlow::ConfigSig {
// other predicates here
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
any(AdditionalValueStep r).step(node1, node2)
}
}
```
**Questions**
1. Although this fixes the issue for binary arithmetic operands, unary operands still don't propagate taint. `ArithExpr` already checks for `UnaryAssignExpr`. I also tried adding the check `node2.asExpr().(UnaryAssignExpr).getExpr() = node1.asExpr()` but it still doesn't work - I can't quite figure out the syntax for passing taint through a unary operator using the two `node1` and `node2` parameters. Any ideas?
2. Is there a better class for doing this than `ArithExpr` from `semmle.code.java.arithmetic.Overflow`? It seems like a reasonable choice, just a but strange such a low level class would be specific to overflow operations rather than generic. I wanted to verify the use was acceptable before doing a PR.
Thanks!
Guia de contribuição
Avaliação
Esta issue ainda não foi avaliada.