Java: TaintTrackingUtil.qll ObjectInputStream.read% taint is faulty
未關閉
question
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
`TraintTrackingUtil.qll` currently models that all `ObjectInputStream` read% methods preserve tainted data:
https://github.com/github/codeql/blob/cb527cae738e59d8b601c0f51302cd6247ff31ca/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll#L323-L324
As pointed out in https://github.com/github/codeql/pull/4582#discussion_r515676147, this logic is likely faulty because `read(byte[], int, int)` returns the number of read bytes which therefore should not represent tainted data.
貢獻指南
評估
這個 Issue 還沒有評估資料。