Java: TaintTrackingUtil.qll ObjectInputStream.read% taint is faulty
Offen
question
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
`TraintTrackingUtil.qll` currently models that all `ObjectInputStream` read% methods preserve tainted data:
https://github.com/github/codeql/blob/cb527cae738e59d8b601c0f51302cd6247ff31ca/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll#L323-L324
As pointed out in https://github.com/github/codeql/pull/4582#discussion_r515676147, this logic is likely faulty because `read(byte[], int, int)` returns the number of read bytes which therefore should not represent tainted data.
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.