Skip to content

Java: make more queries diff-informed with getASelectedLocation #18340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jan 22, 2025
7 changes: 7 additions & 0 deletions java/ql/lib/semmle/code/java/security/CommandLineQuery.qll
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,13 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
any(CommandInjectionAdditionalTaintStep s).step(n1, n2)
}

// It's valid to use diff-informed data flow for this configuration because
// the location of the selected element in the query is contained inside the
// location of the sink. The query, as a predicate, is used negated in
Copy link
Contributor

@asgerf asgerf Jan 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does containment in another location actually guarantee anything, given that alert-filtering only looks at the start line?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I had misunderstood how this works. I'm working on a follow-up PR to make this configuration exact.

// another query, but that's only to prevent overlapping results between two
// queries.
predicate observeDiffInformedIncrementalMode() { any() }
}

/**
Expand Down