diff --git a/java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll b/java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll index cd8ccdf6758..86779a4a911 100644 --- a/java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll +++ b/java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll @@ -118,7 +118,7 @@ private module UntrustedUrlConfig implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node node) { node instanceof MissingPinningSink } } -private module UntrustedUrlFlow = TaintTracking::Make; +private module UntrustedUrlFlow = TaintTracking::Global; /** Holds if `node` is a network communication call for which certificate pinning is not implemented. */ predicate missingPinning(DataFlow::Node node, string domain) { @@ -128,7 +128,7 @@ predicate missingPinning(DataFlow::Node node, string domain) { not trustedDomain(_) and domain = "" or exists(DataFlow::Node src | - UntrustedUrlFlow::hasFlow(src, node) and + UntrustedUrlFlow::flow(src, node) and domain = getDomain(src.asExpr()) ) ) diff --git a/java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll b/java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll index cc5d6a6004b..87fd5003afb 100644 --- a/java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll +++ b/java/ql/lib/semmle/code/java/security/AndroidIntentRedirectionQuery.qll @@ -42,14 +42,14 @@ module IntentRedirectionConfig implements DataFlow::ConfigSig { } /** Tracks the flow of tainted Intents being used to start Android components. */ -module IntentRedirectionFlow = TaintTracking::Make; +module IntentRedirectionFlow = TaintTracking::Global; /** * A sanitizer for sinks that receive the original incoming Intent, * since its component cannot be arbitrarily set. */ private class OriginalIntentSanitizer extends IntentRedirectionSanitizer { - OriginalIntentSanitizer() { SameIntentBeingRelaunchedFlow::hasFlowTo(this) } + OriginalIntentSanitizer() { SameIntentBeingRelaunchedFlow::flowTo(this) } } /** @@ -77,14 +77,14 @@ private module SameIntentBeingRelaunchedConfig implements DataFlow::ConfigSig { } } -private module SameIntentBeingRelaunchedFlow = DataFlow::Make; +private module SameIntentBeingRelaunchedFlow = DataFlow::Global; /** An `Intent` with a tainted component. */ private class IntentWithTaintedComponent extends DataFlow::Node { IntentWithTaintedComponent() { exists(IntentSetComponent setExpr | setExpr.getQualifier() = this.asExpr() and - TaintedIntentComponentFlow::hasFlowTo(DataFlow::exprNode(setExpr.getSink())) + TaintedIntentComponentFlow::flowTo(DataFlow::exprNode(setExpr.getSink())) ) } } @@ -100,7 +100,7 @@ private module TaintedIntentComponentConfig implements DataFlow::ConfigSig { } } -private module TaintedIntentComponentFlow = TaintTracking::Make; +private module TaintedIntentComponentFlow = TaintTracking::Global; /** A call to a method that changes the component of an `Intent`. */ private class IntentSetComponent extends MethodAccess { diff --git a/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll index 3f362c42bba..db59c5c5291 100644 --- a/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll +++ b/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll @@ -27,12 +27,12 @@ private module VerifiedIntentConfig implements DataFlow::ConfigSig { } } -private module VerifiedIntentFlow = DataFlow::Make; +private module VerifiedIntentFlow = DataFlow::Global; /** An `onReceive` method that doesn't verify the action of the intent it receives. */ private class UnverifiedOnReceiveMethod extends OnReceiveMethod { UnverifiedOnReceiveMethod() { - not VerifiedIntentFlow::hasFlow(DataFlow::parameterNode(this.getIntentParameter()), _) + not VerifiedIntentFlow::flow(DataFlow::parameterNode(this.getIntentParameter()), _) } } diff --git a/java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll b/java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll index ad4c480e7ad..2a41d2da08c 100644 --- a/java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll +++ b/java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll @@ -106,7 +106,7 @@ private module GoodInputTypeConfig implements DataFlow::ConfigSig { } } -private module GoodInputTypeFlow = DataFlow::Make; +private module GoodInputTypeFlow = DataFlow::Global; /** Gets a regex indicating that an input field may contain sensitive data. */ private string getInputSensitiveInfoRegex() { @@ -131,7 +131,7 @@ AndroidEditableXmlElement getASensitiveCachedInput() { ( not inputTypeNotCached(result.getInputType()) and not exists(DataFlow::Node sink | - GoodInputTypeFlow::hasFlowTo(sink) and + GoodInputTypeFlow::flowTo(sink) and sink.asExpr() = setInputTypeForId(result.getId()) ) ) diff --git a/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll b/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll index 9a713ff7dfc..267bfd6bf39 100644 --- a/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll +++ b/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll @@ -37,4 +37,4 @@ module FetchUntrustedResourceConfig implements DataFlow::ConfigSig { /** * Detects taint flow from untrusted inputs to a resource fetching call. */ -module FetchUntrustedResourceFlow = TaintTracking::Make; +module FetchUntrustedResourceFlow = TaintTracking::Global; diff --git a/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll b/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll index daeb0790121..d5aaf92f412 100644 --- a/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll +++ b/java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll @@ -67,4 +67,4 @@ module WebviewDebugEnabledConfig implements DataFlow::ConfigSig { /** * Tracks instances of `setWebContentDebuggingEnabled` with `true` values. */ -module WebviewDebugEnabledFlow = DataFlow::Make; +module WebviewDebugEnabledFlow = DataFlow::Global; diff --git a/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql b/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql index cafa616e2d1..c34a40358d9 100644 --- a/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql +++ b/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql @@ -15,5 +15,5 @@ import semmle.code.java.security.WebviewDebuggingEnabledQuery import WebviewDebugEnabledFlow::PathGraph from WebviewDebugEnabledFlow::PathNode source, WebviewDebugEnabledFlow::PathNode sink -where WebviewDebugEnabledFlow::hasFlowPath(source, sink) +where WebviewDebugEnabledFlow::flowPath(source, sink) select sink, source, sink, "Webview debugging is enabled." diff --git a/java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql b/java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql index c397bf74b93..6cdcab9d4cc 100644 --- a/java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql +++ b/java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql @@ -17,6 +17,6 @@ import semmle.code.java.security.UnsafeAndroidAccessQuery import FetchUntrustedResourceFlow::PathGraph from FetchUntrustedResourceFlow::PathNode source, FetchUntrustedResourceFlow::PathNode sink -where FetchUntrustedResourceFlow::hasFlowPath(source, sink) +where FetchUntrustedResourceFlow::flowPath(source, sink) select sink.getNode(), source, sink, "Unsafe resource fetching in Android WebView due to $@.", source.getNode(), sink.getNode().(UrlResourceSink).getSinkType() diff --git a/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql b/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql index c00915f7172..5fac8c7ecc1 100644 --- a/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql +++ b/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql @@ -18,7 +18,7 @@ import semmle.code.java.security.AndroidIntentRedirectionQuery import IntentRedirectionFlow::PathGraph from IntentRedirectionFlow::PathNode source, IntentRedirectionFlow::PathNode sink -where IntentRedirectionFlow::hasFlowPath(source, sink) +where IntentRedirectionFlow::flowPath(source, sink) select sink.getNode(), source, sink, "Arbitrary Android activities or services can be started from a $@.", source.getNode(), "user-provided value" diff --git a/java/ql/test/query-tests/security/CWE-489/webview-debugging/WebviewDebuggingEnabled.ql b/java/ql/test/query-tests/security/CWE-489/webview-debugging/WebviewDebuggingEnabled.ql index 20c38ea52ee..5bd19fb5b9e 100644 --- a/java/ql/test/query-tests/security/CWE-489/webview-debugging/WebviewDebuggingEnabled.ql +++ b/java/ql/test/query-tests/security/CWE-489/webview-debugging/WebviewDebuggingEnabled.ql @@ -6,6 +6,6 @@ class HasFlowTest extends InlineFlowTest { override predicate hasTaintFlow(DataFlow::Node src, DataFlow::Node sink) { none() } override predicate hasValueFlow(DataFlow::Node src, DataFlow::Node sink) { - WebviewDebugEnabledFlow::hasFlow(src, sink) + WebviewDebugEnabledFlow::flow(src, sink) } } diff --git a/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql b/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql index 158c00e5566..4da1ca7fd5f 100644 --- a/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql +++ b/java/ql/test/query-tests/security/CWE-749/UnsafeAndroidAccessTest.ql @@ -9,7 +9,7 @@ class UnsafeAndroidAccessTest extends InlineExpectationsTest { override predicate hasActualResult(Location location, string element, string tag, string value) { tag = "hasUnsafeAndroidAccess" and - exists(DataFlow::Node sink | FetchUntrustedResourceFlow::hasFlowTo(sink) | + exists(DataFlow::Node sink | FetchUntrustedResourceFlow::flowTo(sink) | sink.getLocation() = location and element = sink.toString() and value = "" diff --git a/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql b/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql index 02e69d025ff..7b74855caa5 100644 --- a/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql +++ b/java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql @@ -9,7 +9,7 @@ class HasAndroidIntentRedirectionTest extends InlineExpectationsTest { override predicate hasActualResult(Location location, string element, string tag, string value) { tag = "hasAndroidIntentRedirection" and - exists(DataFlow::Node sink | IntentRedirectionFlow::hasFlowTo(sink) | + exists(DataFlow::Node sink | IntentRedirectionFlow::flowTo(sink) | sink.getLocation() = location and element = sink.toString() and value = ""