File tree Expand file tree Collapse file tree
go/ql/src/experimental/CWE-522-DecompressionBombs Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -49,11 +49,12 @@ module DecompressionBombsConfig implements DataFlow::StateConfigSig {
4949
5050 predicate isBarrier ( DataFlow:: Node node ) {
5151 // here I want to the CopyN return value be compared with < or > but I can't reach the tainted result
52- exists ( Function f | f .hasQualifiedName ( "io" , "CopyN" ) |
53- node = f .getACall ( ) .getArgument ( 1 ) and
54- TaintTracking:: localExprTaint ( f .getACall ( ) .getResult ( 0 ) .asExpr ( ) ,
55- // only >=, <=,>,<
56- any ( RelationalComparisonExpr rce ) .getAnOperand ( ) )
52+ exists ( Function f , DataFlow:: CallNode cn |
53+ f .hasQualifiedName ( "io" , "CopyN" ) and cn = f .getACall ( )
54+ |
55+ node = cn .getArgument ( 1 ) and
56+ TaintTracking:: localTaint ( cn .getResult ( 0 ) ,
57+ any ( DataFlow:: RelationalComparisonNode rcn ) .getAnOperand ( ) )
5758 )
5859 }
5960}
You can’t perform that action at this time.
0 commit comments