Java: Refactor path injection sinks #12886
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
2 times, most recently
from
bbfd7af
to
edca5a9
Compare
jcogs33
previously approved these changes
Apr 24, 2023
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
2 times, most recently
from
5ecb5c3
to
9e469c9
Compare
jcogs33
previously approved these changes
Apr 25, 2023
They were caused by missing an import during a conflict resolution after the rebase. It's been fixed in 5bcf687. |
Click to show differences in coveragejavaGenerated file changes for java
- Java Standard Library,``java.*``,10,733,237,79,,9,,,24
+ Java Standard Library,``java.*``,10,734,232,74,,9,,,24
- Totals,,308,18947,2551,331,16,128,33,1,407
+ Totals,,308,18948,2546,326,16,128,33,1,407
- java.nio,49,,36,,,,,,,,,5,,,,,,,,,,,,,,,43,,,,,,,,,1,,,,,,,,,,,,,,36,
+ java.nio,44,,37,,,,,,,,,5,,,,,,,,,,,,,,,38,,,,,,,,,1,,,,,,,,,,,,,,37, |
jcogs33
previously approved these changes
May 8, 2023
|
I added the models-as-data migration part to a new PR #13225. I'll repurpose this PR to be only about the sink refactor part (converting path creation sinks into summaries). For the time being, I'm going to leave this as a draft. |
atorralba
changed the title
Deprecate and stop using PathCreation Path creation sinks are now summaries
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
from
5bcf687
to
2967967
Compare
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
from
2967967
to
2a14640
Compare
ZipSlip no longer needs to make this exclusion, since PathCreation arguments are no longer path-injection sinks
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
2 times, most recently
from
f54c30b
to
8e105ec
Compare
atorralba
force-pushed
the
atorralba/java/path-injection-mad-sinks
branch
from
8e105ec
to
e2bf9ea
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Now we consider path creation methods as summaries instead of sinks, and actual sinks are now proper file read/write operations. This is because, many times, path-like objects (
FileorPath) are created as part of user input validation/sanitization logic, so raising an alert that early led to many FPs. Now we follow the flow path until the actual filesystem IO operation happens, which should help with precision significantly.Significant alert changes in the affected queries are expected after these changes.