Skip to content

Commit

Permalink
Merge pull request #16550 from aschackmull/java/zipslip-number-sanitizer
Browse files Browse the repository at this point in the history
Java: Improve sanitizer for java/zipslip
  • Loading branch information
aschackmull authored May 22, 2024
2 parents 84e412f + 7828cb8 commit a078dcf
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 1 deletion.
6 changes: 5 additions & 1 deletion java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import semmle.code.java.security.PathSanitizer
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSources
private import semmle.code.java.security.PathCreation
private import semmle.code.java.security.Sanitizers

/**
* A method that returns the name of an archive entry.
Expand Down Expand Up @@ -39,7 +40,10 @@ module ZipSlipConfig implements DataFlow::ConfigSig {

predicate isSink(DataFlow::Node sink) { sink instanceof FileCreationSink }

predicate isBarrier(DataFlow::Node node) { node instanceof PathInjectionSanitizer }
predicate isBarrier(DataFlow::Node node) {
node instanceof SimpleTypeSanitizer or
node instanceof PathInjectionSanitizer
}
}

/** Tracks flow from archive entries to file creation. */
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The sanitizer of the query `java/zipslip` has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.

0 comments on commit a078dcf

Please sign in to comment.