Why is this query not detecting this sink · github/securitylab · Discussion #864 · GitHub
Skip to content
Discussion options

akanksha1331
Nov 28, 2024

You must be logged in to vote
Answered by aibaars Nov 28, 2024

Have you tried debugging your query with the CodeQL: Quick evaluation feature? In the VScode IDE, select a piece of QL code you'd like to inspect, right-click and choose CodeQL: Quick evaluation.

First investigate the isSink predicate:

  • select the word MethodAccess in the editor and quick evaluate, this gives you a list of all method access in the code (possibly quite a lot)
  • select the fragment sessionUtils.getMethod().getDeclaringType().getName() = "Utils" in the editor and quick evaluate. This should give you all the accesses to methods defined in classes named "Utils"
  • carry on restricting things until no results are reported. Most likely the last restriction you included is somehow wro…
View full answer

Replies: 1 comment

Comment options

aibaars
Nov 28, 2024

You must be logged in to vote
0 replies
Answer selected by akanksha1331
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants
@akanksha1331 @aibaars