github / github/codeql

General issue

Aberta
#4,843 4 comentários 0 reações 0 responsáveis Ver no GitHub
question Stale
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

**Dataflow Bug: codeql javascript Dataflow break with normal parameter (like function a({data1,data2,data3})) pass**

Hello Cool Codeql Guys, i have found a bug when i use dataflow to analyse my javascript with taintpath.

my taintpath query code is normal code just like this:
`
from RiskTaint cfg, PathNode source, PathNode sink
`
`
where cfg.hasFlowPath(source, sink)
`
`
select sink.getNode(), source, sink, "risk funcation call with user-controlled input."
`
however , when i try to analyse the test code is like this:
`
function func_a(param_a){
`
`
local_a=param_a.aaa
`
`
... ...
`
`
const { var_a } = await var_b.method_c({local_a,var_c}) // line a: not correctly get the taint path
`
`
//const { var_a } = await var_b.method_c(local_a,var_c) // line b: correctly get the taint path
`
`
... ...
`
`
}
`
when i use line a to build the query database and analyse taint path , i can't get the taint path from param_a to local_a which was an argument of var_b.method_c,then i try to change line a to line b and it works,so i think it may be the dataflow bug in codeql javascript.

Thks a lot for dealing with my issue,i think codeql is a really really great cool artwork !!!

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.