Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Java: allow MaD barriers#21055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Draft
owen-mc wants to merge5 commits intogithub:main
base:main
Choose a base branch
Loading
fromowen-mc:java/allow-mad-barriers

Conversation

@owen-mc
Copy link
Contributor

@owen-mcowen-mc commentedDec 16, 2025
edited
Loading

This PR adds classes so users can add query-specific sanitizers using data extensions ("models-as-data", or MaD), using the query id as thekind string to determine which queries it applies to. Note that inthe PR where existing sanitizers were converted to MaD the extension points were all using existing sink kinds as thekind string. I think it's fine for both to exist.

To do: add more classes so that sanitizers can be added for more existing sink kinds and apply wherever the corresponding sinks would apply.

Note that the first commit was done using copilot (prompt in commit message).

This was implemented by Gemini 3 using the following prompt.In the commit with the hash10c5a47 the go language library was updated. I want you to do the same for the java language library. Here are the steps to follow:- Find all .ql files in the java folder which are not in java/ql/src/experimental which contain the string "@kind path-problem".- Note the query id, as specified by the "@id" metadata at the top of the .ql file. It should have this format: "java/sql-injection".- These are path queries, so the second and third arguments in the select statement should have type "XFlow::PathNode"s for some module "XFlow" that is defined as something like "TaintTracking::Global<XFlowConfig>". Find the definition of the data flow config ("XFlowConfig" in my example code), which should be a module which implements `DataFlow::ConfigSig`.- If the module does not already define it, add a predicate like the following:`predicate isBarrier(DataFlow::Node node) { barrierNode(node, "Z") }` where "Z" should be the query id from earlier.- If the module already defines that predicate, add `or barrierNode(node, "Z")` to the end of the predicate body, where "Z" should be the query id.
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.frameworks.android.Intent
import semmle.code.java.security.SensitiveActions
privateimport semmle.code.java.dataflow.ExternalFlow

Check warning

Code scanning / CodeQL

Redundant import Warning

Redundant import, the module is already imported inside
semmle.code.java.dataflow.FlowSinks
Loading
.
/** Provides a taint-tracking configuration to reason about externally controlled format string vulnerabilities. */

import java
privateimport semmle.code.java.dataflow.ExternalFlow

Check warning

Code scanning / CodeQL

Redundant import Warning

Redundant import, the module is already imported inside
semmle.code.java.dataflow.FlowSinks
Loading
.
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.security.GroovyInjection
privateimport semmle.code.java.dataflow.ExternalFlow

Check warning

Code scanning / CodeQL

Redundant import Warning

Redundant import, the module is already imported inside
semmle.code.java.security.GroovyInjection
Loading
.
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.SensitiveActions
privateimport semmle.code.java.dataflow.ExternalFlow

Check warning

Code scanning / CodeQL

Redundant import Warning

Redundant import, the module is already imported inside
semmle.code.java.dataflow.FlowSinks
Loading
.
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.controlflow.Guards
import semmle.code.java.security.SecurityTests
privateimport semmle.code.java.dataflow.ExternalFlow

Check warning

Code scanning / CodeQL

Redundant import Warning

Redundant import, the module is already imported inside
semmle.code.java.dataflow.FlowSinks
Loading
.
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

Copilot code reviewCopilotAwaiting requested review from CopilotCopilot will automatically review once the pull request is marked ready for review

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@owen-mc

[8]ページ先頭

©2009-2025 Movatter.jp