Java codeql requires Precise data-flow for collections and Field-sensitive data-flow analysis capabilities
Aperta
question
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
Like this issus:https://github.com/github/codeql/pull/3366
Java codeql engine cannot model data flow through collections precisely. Example:
```
class Demo
{
private static final String PSFS = "1111";
void M1(source)
{
Obj obj = new Obj();
obj.setA(source);
obj.setB(PSFS);
Sink(obj.getA()); // vul
Sink(obj.getB()); // not vul
}
}
```
codeql marked obj is tainted,not obj.A
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.