Dataflow: Extend taint tracking interface with flow states#8401
Merged
jketema merged 4 commits intogithub:mainfrom Mar 14, 2022
Merged
Dataflow: Extend taint tracking interface with flow states#8401jketema merged 4 commits intogithub:mainfrom
jketema merged 4 commits intogithub:mainfrom
Conversation
MathiasVP
reviewed
Mar 11, 2022
Contributor
MathiasVP
left a comment
MathiasVP
left a comment
There was a problem hiding this comment.
The interface changes LGTM! I'll let @github/codeql-python and @github/codeql-java weigh in on the changes to the configurations used in the queries. I hope we can incorporate these changes even though they're potentially breaking changes. I doubt a lot of people outside the CodeQL team has started to use flow state the feature.
Contributor
|
The Java changes LGTM 👍 As the author of the Java query using flow states, this is what I would've liked to find in the taint tracking library when I used it 😄 |
atorralba
reviewed
Mar 14, 2022
atorralba
reviewed
Mar 14, 2022
atorralba
approved these changes
Mar 14, 2022
MathiasVP
approved these changes
Mar 14, 2022
owen-mc
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The flow state extension had to not been propagated to taint analysis, which lead to (a) a weird documentation mix and (b) having to use
isBarrierandisAdditionalFlowStepin places where the user would expectisSanitizerandisAdditionalTaintStep. This PR fixes this.I had to fix two Python libraries, a Java library and a Java query, which makes me somewhat worried this change comes a bit too late. Some advice on that would be useful. One solution would be to not mark
isBarrierandisAdditionalFlowStepas final.