Java: TaintTrackingUtil.qll ObjectInputStream.read% taint is faulty
Aperta
question
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
`TraintTrackingUtil.qll` currently models that all `ObjectInputStream` read% methods preserve tainted data:
https://github.com/github/codeql/blob/cb527cae738e59d8b601c0f51302cd6247ff31ca/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll#L323-L324
As pointed out in https://github.com/github/codeql/pull/4582#discussion_r515676147, this logic is likely faulty because `read(byte[], int, int)` returns the number of read bytes which therefore should not represent tainted data.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.