Missing Flows in Backward Slicing. #17297
Comments
|
Hi @KylerKatz, thanks for your question. I did a quick test on the snippet below using your query and my first result was the path If I understand correctly you want to have the path all the way to a use of If that is the case then you need to inform the configuration you want the result of a method call to be considered tainted when one of its parameters is. This is not the default because it is not always true. import java.util.Properties;
// Stub for javax.mail.Session
class Session {
public static Session getDefaultInstance(Properties props, Object auth) {
return new Session();
}
}
// Stub for javax.mail.internet.MimeMessage
class MimeMessage {
public MimeMessage(Session session) {
// Stub constructor
}
public void setRecipient(Message.RecipientType type, InternetAddress address) {
// Stub method
}
public void setSubject(String subject) {
// Stub method
}
public void addHeader(String name, String value) {
// Stub method
}
}
// Stub for javax.mail.Message
class Message {
public static class RecipientType {
public static final RecipientType TO = new RecipientType();
}
}
// Stub for javax.mail.internet.InternetAddress
class InternetAddress {
public InternetAddress(String address) {
// Stub constructor
}
}
// Stub for javax.mail.Transport
class Transport {
public static void send(MimeMessage message) throws MessagingException {
// Stub method
}
}
// Stub for javax.mail.MessagingException
class MessagingException extends Exception {
public MessagingException(String message) {
super(message);
}
}
class BAD_EmailHeaderExposure {
public void sendEmailWithSensitiveHeader(String recipient, String sessionToken) {
Properties properties = System.getProperties();
properties.setProperty("mail.smtp.host", "smtp.internal.books.com");
Session session = Session.getDefaultInstance(properties, null);
try {
MimeMessage message = new MimeMessage(session);
message.setRecipient(Message.RecipientType.TO, new InternetAddress(recipient));
message.setSubject("Here is your session Info");
message.addHeader("X-Session-Token", sessionToken);
Transport.send(message);
} catch (MessagingException e) {
System.out.println("Failed to send email: " + e.getMessage());
}
}
}
public class Test {
}The following additional step can help with that: Let me know if this helps. |
|
This issue is stale because it has been open 14 days with no activity. Comment or remove the |
|
This issue was closed because it has been inactive for 7 days. |
Hello, I am using CodeQL to perform backward slicing. However, I am noticing that my query is currently missing some flows.
I have this example,
and I am using this query
Now if you take session for example,
There is no direct flow from properties to session. The closest I get is
We can see that properties gets passed to
Session.getDefaultInstance()however, I would like it to also show where properties comes from.The source in my query has expanded a bit in trying to get this to work, however, why is it not as simple as a variable for the source and a variable for the sink? I would appreciate any help with this. Thank you.
The text was updated successfully, but these errors were encountered: