@@ -20,21 +20,15 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
20
20
21
21
module Flow2 = TaintTracking:: Global< ExecTaint:: ExecTaintConfiguration > ;
22
22
23
- from
24
- Flow:: PathNode sourceExec , Flow:: PathNode sinkExec , Flow2:: PathNode sourceTaint ,
25
- Flow2:: PathNode sinkTaint , MethodCall call
23
+ module FlowGraph =
24
+ DataFlow:: MergePathGraph< Flow:: PathNode , Flow2:: PathNode , Flow:: PathGraph , Flow2:: PathGraph > ;
25
+
26
+ import FlowGraph:: PathGraph
27
+
28
+ from FlowGraph:: PathNode source , FlowGraph:: PathNode sink
26
29
where
27
- call .getMethod ( ) instanceof RuntimeExecMethod and
28
- (
29
- // this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
30
- Flow:: flowPath ( sourceExec , sinkExec ) and
31
- sinkExec .getNode ( ) .asExpr ( ) = call .getArgument ( 0 )
32
- ) and
33
- (
34
- // it is tainted by untrusted user input
35
- Flow2:: flowPath ( sourceTaint , sinkTaint ) and
36
- sinkTaint .getNode ( ) .asExpr ( ) = call .getAnArgument ( )
37
- )
38
- select sinkExec , sourceExec , sinkExec ,
30
+ Flow:: flowPath ( source .asPathNode1 ( ) , sink .asPathNode1 ( ) ) or
31
+ Flow2:: flowPath ( source .asPathNode2 ( ) , sink .asPathNode2 ( ) )
32
+ select sink , source , sink ,
39
33
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'" ,
40
- sourceTaint , sourceTaint .toString ( ) , sourceExec .getNode ( ) , sourceExec .toString ( )
34
+ source , source .toString ( ) , source .getNode ( ) , source .toString ( )
0 commit comments