Skip to content

Commit 998c221

Browse files
committed
fix: revert changes
1 parent 6862086 commit 998c221

File tree

2 files changed

+20
-32
lines changed

2 files changed

+20
-32
lines changed

java/src/security/CWE-078/CommandInjectionRuntimeExec.ql

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,21 +20,15 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2020

2121
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2222

23-
from
24-
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
25-
Flow2::PathNode sinkTaint, MethodCall call
23+
module FlowGraph =
24+
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
25+
26+
import FlowGraph::PathGraph
27+
28+
from FlowGraph::PathNode source, FlowGraph::PathNode sink
2629
where
27-
call.getMethod() instanceof RuntimeExecMethod and
28-
(
29-
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
30-
Flow::flowPath(sourceExec, sinkExec) and
31-
sinkExec.getNode().asExpr() = call.getArgument(0)
32-
) and
33-
(
34-
// it is tainted by untrusted user input
35-
Flow2::flowPath(sourceTaint, sinkTaint) and
36-
sinkTaint.getNode().asExpr() = call.getAnArgument()
37-
)
38-
select sinkExec, sourceExec, sinkExec,
30+
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
31+
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
32+
select sink, source, sink,
3933
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
40-
sourceTaint, sourceTaint.toString(), sourceExec.getNode(), sourceExec.toString()
34+
source, source.toString(), source.getNode(), source.toString()

java/src/security/CWE-078/CommandInjectionRuntimeExecLocal.ql

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,15 @@ module Flow = TaintTracking::Global<RuntimeExec::RuntimeExecConfiguration>;
2121

2222
module Flow2 = TaintTracking::Global<ExecTaint::ExecTaintConfiguration>;
2323

24-
from
25-
Flow::PathNode sourceExec, Flow::PathNode sinkExec, Flow2::PathNode sourceTaint,
26-
Flow2::PathNode sinkTaint, MethodCall call
24+
module FlowGraph =
25+
DataFlow::MergePathGraph<Flow::PathNode, Flow2::PathNode, Flow::PathGraph, Flow2::PathGraph>;
26+
27+
import FlowGraph::PathGraph
28+
29+
from FlowGraph::PathNode source, FlowGraph::PathNode sink
2730
where
28-
call.getMethod() instanceof RuntimeExecMethod and
29-
(
30-
// this is a command-accepting call to exec, e.g. exec("/bin/sh", ...)
31-
Flow::flowPath(sourceExec, sinkExec) and
32-
sinkExec.getNode().asExpr() = call.getArgument(0)
33-
) and
34-
(
35-
// it is tainted by untrusted user input
36-
Flow2::flowPath(sourceTaint, sinkTaint) and
37-
sinkTaint.getNode().asExpr() = call.getAnArgument()
38-
)
39-
select sinkExec, sourceExec, sinkExec,
31+
Flow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
32+
Flow2::flowPath(source.asPathNode2(), sink.asPathNode2())
33+
select sink, source, sink,
4034
"Call to dangerous java.lang.Runtime.exec() with command '$@' with arg from untrusted input '$@'",
41-
sourceTaint, sourceTaint.toString(), sourceExec.getNode(), sourceExec.toString()
35+
source, source.toString(), source.getNode(), source.toString()

0 commit comments

Comments
 (0)