Java: TaintTrackingUtil.qll ObjectInputStream.read% taint is faulty
Open
question
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
`TraintTrackingUtil.qll` currently models that all `ObjectInputStream` read% methods preserve tainted data:
https://github.com/github/codeql/blob/cb527cae738e59d8b601c0f51302cd6247ff31ca/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll#L323-L324
As pointed out in https://github.com/github/codeql/pull/4582#discussion_r515676147, this logic is likely faulty because `read(byte[], int, int)` returns the number of read bytes which therefore should not represent tainted data.
Contributor guide
Assessment
This issue has not been assessed yet.