Java codeql requires Precise data-flow for collections and Field-sensitive data-flow analysis capabilities
Ouverte
question
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
Like this issus:https://github.com/github/codeql/pull/3366
Java codeql engine cannot model data flow through collections precisely. Example:
```
class Demo
{
private static final String PSFS = "1111";
void M1(source)
{
Obj obj = new Obj();
obj.setA(source);
obj.setB(PSFS);
Sink(obj.getA()); // vul
Sink(obj.getB()); // not vul
}
}
```
codeql marked obj is tainted,not obj.A
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.