github / github/codeql

Java: static field access of unknown class breaks dataflow (build-mode=none)

Offen
#19,597 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

This is another issue we encountered when analysing databases created with `build-mode=none`.
It appears that dataflow graphs are broken when static fields are accessed on unknown classes.
Please take a look [codeql_issue2.zip](https://github.com/user-attachments/files/20458091/codeql_issue2.zip) for more information.

Here is the example java code:
```
// This import is from a dependency that is not resolved
import com.foo.mycompany.UnknownClass;

public class DataFlowNotConnected {
static class MyClass {
public static String staticField = "static";
}

private int run() {
// data source 1 should flow to sink e and f, but dataflow is broken by UnknownClass.staticField
int a = 1;
int b = a;

// static class field access from known class
String staticField1 = MyClass.staticField;

int c = b;
int d = c;

// static class field access from unknown class breaks dataflow
String staticField2 = UnknownClass.staticField;

int e = d;
int f = e;

return f;
}
}
```

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by reproducing the example from codeql_issue2.zip with build-mode=none, focusing on the Java dataflow graph around UnknownClass.staticField. Compare the graph with and without that static access; done means the flow from a through d remains connected to sinks e and f.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
java
Bereich
devtools, security
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.