we don't need ConstructorCall for ZipFile anymore since we have a more accurate sink for this

2026-04-25 00:35:20 +02:00 · 2024-07-28 12:12:07 +02:00
parent cc752113af
commit 0593eaad52
1 changed files with 0 additions and 5 deletions
--- a/java/ql/src/experimental/semmle/code/java/security/DecompressionBomb.qll
+++ b/java/ql/src/experimental/semmle/code/java/security/DecompressionBomb.qll
@@ -378,11 +378,6 @@ module Zip {
        call.getCallee().hasName("getInputStream") and
        call.getQualifier() = this.asExpr()
      )
-      or
-      exists(ConstructorCall call |
-        call.getConstructedType() instanceof TypeZipFile and
-        call.getAnArgument() = this.asExpr()
-      )
    }
  }