Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature request: cross function query and taint tracking #74

Open
huntcve opened this issue Oct 25, 2022 · 0 comments
Open

Feature request: cross function query and taint tracking #74

huntcve opened this issue Oct 25, 2022 · 0 comments

Comments

@huntcve
Copy link

huntcve commented Oct 25, 2022

Hi,
This is amazing tool! I have been able to find dozens of valid bugs in our production code with weggli for code review. It is very effective for simple pattern query.
There is a major issue: weggli doesn't support cross function query and data tainting, which is very basic requirement for complex pattern search. For example:
func1(int v)
{
in b = v;
func2(b);
}

func2(int v)
{
memcpy(,,v);
}
in above code, if func1 is the attack surface, there is no way to track data flow, i.e., do data tainting, to track the value to the final memcpy. Simply query memcpy wont help since too many false positives. Not sure if tree-sitter supports this since data tracking usually needs to build the code, or is there any solution to partially support this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant