Skip to content

Commit

Permalink
Java: adjust CommandLineQuery locations
Browse files Browse the repository at this point in the history
It turns out these locations need to be precise.
  • Loading branch information
jbj committed Jan 27, 2025
1 parent eacc600 commit 89c747b
Showing 1 changed file with 8 additions and 5 deletions.
13 changes: 8 additions & 5 deletions java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
Original file line number Diff line number Diff line change
Expand Up @@ -59,12 +59,15 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
any(CommandInjectionAdditionalTaintStep s).step(n1, n2)
}

// It's valid to use diff-informed data flow for this configuration because
// the location of the selected element in the query is contained inside the
// location of the sink. The query, as a predicate, is used negated in
// another query, but that's only to prevent overlapping results between two
// queries.
// The query, as a predicate, is used negated in another query, but that's
// only to prevent overlapping results between two queries.
predicate observeDiffInformedIncrementalMode() { any() }

// All queries use the argument as the primary location and do not use the
// sink as an associated location.
Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(Expr argument | argumentToExec(argument, sink) | result = argument.getLocation())
}
}

/**
Expand Down

0 comments on commit 89c747b

Please sign in to comment.