stash

go/ql/src/experimental/frameworks/DecompressionBombs.qll

@@ -605,12 +605,7 @@ module DecompressionBombs {
         none()
       }
     }
-  }
 
-  /**
-   * Provides Decompression Sinks and additional taint steps for `github.com/klauspost/compress/s2` package
-   */
-  module KlauspostS2 {
     class TheSink extends Sink {
       TheSink() {
         exists(Method m |
@@ -621,6 +616,23 @@ module DecompressionBombs {
         )
       }
     }
+  }
+
+  /**
+   * Provides Decompression Sinks and additional taint steps for `github.com/klauspost/compress/s2` package
+   */
+  module KlauspostS2 {
+    class TheSink extends DataFlow::Node {
+      TheSink() {
+        exists(Method m |
+          m.getType()
+              .getUnderlyingType()
+              .hasQualifiedName("github.com/klauspost/compress/s2", "Reader")
+        |
+          this = m.getACall()
+        )
+      }
+    }
 
     class TheAdditionalTaintStep extends AdditionalTaintStep {
       TheAdditionalTaintStep() { this = "AdditionalTaintStep" }