forked from github/codeql
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathflow.ql
More file actions
24 lines (20 loc) · 657 Bytes
/
Copy pathflow.ql
File metadata and controls
24 lines (20 loc) · 657 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import java
import semmle.code.java.dataflow.TaintTracking
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) {
src.asExpr().(VarAccess).getVariable().hasName("args")
or
src.asExpr().(MethodCall).getMethod().hasName("source")
}
predicate isSink(DataFlow::Node sink) {
sink.asExpr().(Argument).getCall() =
any(MethodCall ma |
ma.getMethod().hasName("exec") and
ma.getQualifier().(MethodCall).getMethod().hasName("getRuntime")
)
}
}
module Flow = TaintTracking::Global<Config>;
from DataFlow::Node src, DataFlow::Node sink
where Flow::flow(src, sink)
select src, sink