diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll index 3a09ca2cec1..24eb933bb1c 100644 --- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll +++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll @@ -274,7 +274,7 @@ private predicate summaryModelCsv(string row) { "java.io;File;false;toURI;;;Argument[-1];ReturnValue;taint", "java.io;File;false;toPath;;;Argument[-1];ReturnValue;taint", "java.nio.file;Path;false;toFile;;;Argument[-1];ReturnValue;taint", - "java.io;Reader;true;readLine;;;Argument[-1];ReturnValue;taint", + "java.io;BufferedReader;true;readLine;;;Argument[-1];ReturnValue;taint", "java.io;Reader;true;read;();;Argument[-1];ReturnValue;taint", // arg to return "java.util;Base64$Encoder;false;encode;(byte[]);;Argument[0];ReturnValue;taint", @@ -285,8 +285,12 @@ private predicate summaryModelCsv(string row) { "java.util;Base64$Decoder;false;decode;(ByteBuffer);;Argument[0];ReturnValue;taint", "java.util;Base64$Decoder;false;decode;(String);;Argument[0];ReturnValue;taint", "java.util;Base64$Decoder;false;wrap;(InputStream);;Argument[0];ReturnValue;taint", - "org.apache.commons.codec;Encoder;true;encode;;;Argument[0];ReturnValue;taint", - "org.apache.commons.codec;Decoder;true;decode;;;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;Encoder;true;encode;(Object);;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;Decoder;true;decode;(Object);;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;BinaryEncoder;true;encode;(byte[]);;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;BinaryDecoder;true;decode;(byte[]);;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;StringEncoder;true;encode;(String);;Argument[0];ReturnValue;taint", + "org.apache.commons.codec;StringDecoder;true;decode;(String);;Argument[0];ReturnValue;taint", "org.apache.commons.io;IOUtils;false;buffer;;;Argument[0];ReturnValue;taint", "org.apache.commons.io;IOUtils;false;readLines;;;Argument[0];ReturnValue;taint", "org.apache.commons.io;IOUtils;false;readFully;(InputStream,int);;Argument[0];ReturnValue;taint",