github / github/codeql

General issue

Abierto
#4,843 4 comentarios 0 reacciones 0 asignados Ver en GitHub
question Stale
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Dataflow Bug: codeql javascript Dataflow break with normal parameter (like function a({data1,data2,data3})) pass**

Hello Cool Codeql Guys, i have found a bug when i use dataflow to analyse my javascript with taintpath.

my taintpath query code is normal code just like this:
`
from RiskTaint cfg, PathNode source, PathNode sink
`
`
where cfg.hasFlowPath(source, sink)
`
`
select sink.getNode(), source, sink, "risk funcation call with user-controlled input."
`
however , when i try to analyse the test code is like this:
`
function func_a(param_a){
`
`
local_a=param_a.aaa
`
`
... ...
`
`
const { var_a } = await var_b.method_c({local_a,var_c}) // line a: not correctly get the taint path
`
`
//const { var_a } = await var_b.method_c(local_a,var_c) // line b: correctly get the taint path
`
`
... ...
`
`
}
`
when i use line a to build the query database and analyse taint path , i can't get the taint path from param_a to local_a which was an argument of var_b.method_c,then i try to change line a to line b and it works,so i think it may be the dataflow bug in codeql javascript.

Thks a lot for dealing with my issue,i think codeql is a really really great cool artwork !!!

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.