Java: Add taint step to flow through Spring tainted user data class

lcartey · lcartey · commit b51c1369c8cf · 2020-05-17T23:29:13.000+01:00
getters.
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -383,6 +383,10 @@ private predicate taintPreservingQualifierToMethod(Method m) {
   )
   or
   m instanceof StringReplaceMethod
+  or
+  exists(SpringUntrustedDataType dt |
+    m.(GetterMethod) = dt.getAMethod()
+  )
 }
 
 private class StringReplaceMethod extends Method {

Original file line number	Diff line number	Diff line change
`@@ -383,6 +383,10 @@ private predicate taintPreservingQualifierToMethod(Method m) {`
`383`	`383`	`)`
`384`	`384`	`or`
`385`	`385`	`m instanceof StringReplaceMethod`
	`386`	`+ or`
	`387`	`+ exists(SpringUntrustedDataType dt \|`
	`388`	`+ m.(GetterMethod) = dt.getAMethod()`
	`389`	`+ )`
`386`	`390`	`}`
`387`	`391`
`388`	`392`	`private class StringReplaceMethod extends Method {`