Why can't SqlTainted.ql analyze header injection and cookie injection? java

[niuzhi]

@aschackmull
Thanks.
I checked the source and sink。
source：

Sink:

Why can't I check it out?
TaintTracking::Configuration code：

[aschackmull]

It appears that we're missing a taint step through URLDecoder.decode. Thanks for flagging this. I've added a PR to fix this here: #3081. In the meantime you can add the following additional step:

override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
  exists(MethodAccess ma, Method m |
    ma.getMethod() = m and m.getDeclaringType().hasQualifiedName("java.net", "URLDecoder") and
    m.getName() = "decode" and
    node1.asExpr() = ma.getArgument(0) and
    node2.asExpr() = ma
  )
}

In general you can debug missing steps by overriding the explorationLimit() predicate on configurations:

/**
   * Gets the exploration limit for `hasPartialFlow` measured in approximate
   * number of interprocedural steps.
   */
  int explorationLimit() { none() }

  /**
   * Holds if there is a partial data flow path from `source` to `node`. The
   * approximate distance between `node` and the closest source is `dist` and
   * is restricted to be less than or equal to `explorationLimit()`. This
   * predicate completely disregards sink definitions.
   *
   * This predicate is intended for dataflow exploration and debugging and may
   * perform poorly if the number of sources is too big and/or the exploration
   * limit is set too high without using barriers.
   *
   * This predicate is disabled (has no results) by default. Override
   * `explorationLimit()` with a suitable number to enable this predicate.
   *
   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
   */
  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
    partialFlow(source, node, this) and
    dist = node.getSourceDistance()
  }
}

[aschackmull]

Its use is documented in the qldoc sections I quoted. Basically, starting from a query you're developing with a configuration you'd like to debug, you then add override in explorationLimit() { result = 5 } (or some other suitable number, depending on your use case). With that in place you can use hasPartialFlow instead of hasFlow to see all the places your sources reach.

[niuzhi]

@aschackmull thanks.
I use explorationLimit function，why dist is zero? can you help me,thanks very much

[aschackmull]

Qldoc for explorationLimit says

Gets the exploration limit for hasPartialFlow measured in approximate number of interprocedural steps.

and qldoc for hasPartialFlow says

The approximate distance between node and the closest source is dist and is restricted to be less than or equal to explorationLimit().

I guess it could be a bit clearer, but as it says, dist is the distance to a source measured in approximate number of interprocedural steps, i.e. if everything is in the same method the dist is 0.

[niuzhi]

@aschackmull thanks
1.TaintTrackingUtil.qll not existsorg.apache.commons.codec.binary.Base64 method taint step，please add。

[aschackmull]

At a guess we might be missing the queryForLong method call as an sql sink. Checking with a simple query to see whether you can find the expected sinks without requiring flow is a good way to debug something like this:

from QueryInjectionSink sink
select sink

[niuzhi]

@aschackmull
I have solved it, thanks