Diff-informed queries: phase 3 (non-trivial locations) #19957
Conversation
ff3a4b9 to
95fe462
Compare
| @@ -3,6 +3,7 @@ | |||
| private import codeql.actions.dataflow.ExternalFlow | |||
| private import codeql.actions.security.ArtifactPoisoningQuery | |||
| private import codeql.actions.security.UntrustedCheckoutQuery | |||
| private import codeql.actions.security.ControlChecks | |||
Check warning
Code scanning / CodeQL
Redundant import Warning
aff62c2 to
6d0ae3a
Compare
| @@ -0,0 +1 @@ | |||
| experimental/Security/CWE-208/TimingAttackAgainstHash/TimingAttackAgainstHash.ql | |||
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning test
c871f5e to
276c7f0
Compare
| result = source.getLocation() | ||
| or | ||
| exists(DataFlow::Node node | result = node.getLocation() | | ||
| sensitiveAssignment(node, _, _) | ||
| or | ||
| hardcodedPrivateKey(node, _) | ||
| ) |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
| result = sink.getLocation() | ||
| or | ||
| exists(DataFlow::Node node | result = node.getLocation() | | ||
| sensitiveAssignment(_, node, _) | ||
| or | ||
| hardcodedPrivateKey(node, _) | ||
| ) |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
cb2db2f to
c70036d
Compare
| exists(QueryInjectionSink query, Expr uncontrolled | | ||
| result = [query.getLocation(), uncontrolled.getLocation()] and | ||
| builtFromUncontrolledConcat(query.asExpr(), uncontrolled) | ||
| ) | ||
| or | ||
| result = sink.getLocation() |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
| result = source.getLocation() | ||
| or | ||
| result = any(MethodCallInsecureFileCreation m).getLocation() |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
| unsafeTrust instanceof RabbitMQEnableHostnameVerificationNotSet | ||
| or | ||
| sink.asExpr() = unsafeTrust |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
c70036d to
08c4cc2
Compare
| call.getArgument(1).getValue().toInt() != 0 and | ||
| call.getArgument(2) instanceof NullValue | ||
| or | ||
| sink.asExpr() = call.getArgument(2) |
Check warning
Code scanning / CodeQL
Var only used in one side of disjunct. Warning
08c4cc2 to
857b583
Compare
That said, the test is useless; to get a result, I need a comparison against remote input.
857b583 to
3e3e856
Compare
This PR enables diff-informed mode on queries that select a location other than dataflow source or sink.
I start with automatically generated stubs and then handle each TODO item in its own commit.