github / github/codeql

General issue

Offen
#4,843 4 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question Stale
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

**Dataflow Bug: codeql javascript Dataflow break with normal parameter (like function a({data1,data2,data3})) pass**

Hello Cool Codeql Guys, i have found a bug when i use dataflow to analyse my javascript with taintpath.

my taintpath query code is normal code just like this:
`
from RiskTaint cfg, PathNode source, PathNode sink
`
`
where cfg.hasFlowPath(source, sink)
`
`
select sink.getNode(), source, sink, "risk funcation call with user-controlled input."
`
however , when i try to analyse the test code is like this:
`
function func_a(param_a){
`
`
local_a=param_a.aaa
`
`
... ...
`
`
const { var_a } = await var_b.method_c({local_a,var_c}) // line a: not correctly get the taint path
`
`
//const { var_a } = await var_b.method_c(local_a,var_c) // line b: correctly get the taint path
`
`
... ...
`
`
}
`
when i use line a to build the query database and analyse taint path , i can't get the taint path from param_a to local_a which was an argument of var_b.method_c,then i try to change line a to line b and it works,so i think it may be the dataflow bug in codeql javascript.

Thks a lot for dealing with my issue,i think codeql is a really really great cool artwork !!!

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.