github / github/codeql

[Java] Dataflow through object

未关闭
#18,680 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

Hello,

I am getting some false positives with some of my queries, which are usually centered around a source node flowing into an object and then other data from that object flowing into a sink node.

Here is a simple example,

```
env.put(Context.SECURITY_CREDENTIALS, password);
LOG.error("connection error [{}], failover connection to [{}]", env.get(Context.PROVIDER_URL), this.ldapURI.toString());
```
In this case, `password` is a source variable. While `LOG.error` is a sink. However, by having it flow into `env`, it now marks any use of the object as a detection eventough this case has nothing to do with `password`. Is there any way to reduce cases like this?

Thank you

贡献指南

打开贡献指南

调研方向

Start with the Java dataflow behavior described in the example, especially the flow from `password` into `env` and later reads from that object. Determine how object-level flow is modeled and define a focused regression case where unrelated `env` values do not reach the logging sink.

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。