From 49fcb19050f7164b7a924ea63995cbf267274f32 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Wed, 12 Aug 2020 08:24:22 +0200 Subject: [PATCH] Java: Add exec sinks with array arguments. --- java/ql/src/Security/CWE/CWE-078/ExecTainted.ql | 2 +- java/ql/src/Security/CWE/CWE-078/ExecTaintedLocal.ql | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql index 353df33afed4..7b191e762410 100644 --- a/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql +++ b/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql @@ -17,7 +17,7 @@ import semmle.code.java.security.ExternalProcess import ExecCommon import DataFlow::PathGraph -from DataFlow::PathNode source, DataFlow::PathNode sink, StringArgumentToExec execArg +from DataFlow::PathNode source, DataFlow::PathNode sink, ArgumentToExec execArg where execTainted(source, sink, execArg) select execArg, source, sink, "$@ flows to here and is used in a command.", source.getNode(), "User-provided value" diff --git a/java/ql/src/Security/CWE/CWE-078/ExecTaintedLocal.ql b/java/ql/src/Security/CWE/CWE-078/ExecTaintedLocal.ql index d809f1bb5dd0..814330f31afa 100644 --- a/java/ql/src/Security/CWE/CWE-078/ExecTaintedLocal.ql +++ b/java/ql/src/Security/CWE/CWE-078/ExecTaintedLocal.ql @@ -29,7 +29,7 @@ class LocalUserInputToArgumentToExecFlowConfig extends TaintTracking::Configurat } from - DataFlow::PathNode source, DataFlow::PathNode sink, StringArgumentToExec execArg, + DataFlow::PathNode source, DataFlow::PathNode sink, ArgumentToExec execArg, LocalUserInputToArgumentToExecFlowConfig conf where conf.hasFlowPath(source, sink) and sink.getNode().asExpr() = execArg select execArg, source, sink, "$@ flows to here and is used in a command.", source.getNode(),