Skip to content
7 changes: 7 additions & 0 deletions java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,13 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
any(CommandInjectionAdditionalTaintStep s).step(n1, n2)
}

// It's valid to use diff-informed data flow for this configuration because
// the location of the selected element in the query is contained inside the
// location of the sink. The query, as a predicate, is used negated in
Copy link
Contributor

@asgerf asgerf Jan 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does containment in another location actually guarantee anything, given that alert-filtering only looks at the start line?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I had misunderstood how this works. I'm working on a follow-up PR to make this configuration exact.

// another query, but that's only to prevent overlapping results between two
// queries.
predicate observeDiffInformedIncrementalMode() { any() }
}

/**
Expand Down