mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-24 20:28:06 +02:00
18 lines
787 B
Markdown
18 lines
787 B
Markdown
# receiver_chain_taint_java — tainted receiver through no-arg chain
|
|||
|
|||
## Flow
|
|||
`System.getenv("INPUT")` is the source; `tainted.trim().toLowerCase()`
|
|||
is a chain of zero-arg builder-style methods on the tainted receiver;
|
|||
`Runtime.getRuntime().exec(result)` is the sink.
|
|||
|
|||
## Why this fixture exists
|
|||
Pins the receiver-fallback behaviour for zero-arg method calls on a
|
|||
tainted receiver. Neither `trim()` nor `toLowerCase()` takes arguments,
|
|||
so the engine's zero-arg receiver-seeding path in
|
|||
`inline_analyse_callee` / `collect_args_taint` is the only way the taint
|
|||
reaches `result`. The fixture guards against a regression if container
|
|||
or heap-aliasing changes accidentally disturb the receiver-only flow.
|
|||
|
|||
Expected finding: `taint-unsanitised-flow` from `System.getenv` to
|
|||
`Runtime.exec`.
|
