[DIFF-INFORMED] Java: ExternallyControlledFormatString

d10c · d10c · commit b6ef25aa003b · 2025-07-16T17:33:46.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql#L24
diff --git a/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringQuery.qll b/java/ql/lib/semmle/code/java/security/ExternallyControlledFormatStringQuery.qll
@@ -25,6 +25,12 @@ module ExternallyControlledFormatStringConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    exists(StringFormat formatCall | result = formatCall.getFormatArgument().getLocation() |
+      sink.asExpr() = formatCall.getFormatArgument()
+    )
+  }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,12 @@ module ExternallyControlledFormatStringConfig implements DataFlow::ConfigSig {`
`25`	`25`	`}`
`26`	`26`
`27`	`27`	`predicate observeDiffInformedIncrementalMode() { any() }`
	`28`	`+`
	`29`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`30`	`+ exists(StringFormat formatCall \| result = formatCall.getFormatArgument().getLocation() \|`
	`31`	`+ sink.asExpr() = formatCall.getFormatArgument()`
	`32`	`+ )`
	`33`	`+ }`
`28`	`34`	`}`
`29`	`35`
`30`	`36`	`/**`