hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactoring and simplification

Browse Source 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
This commit is contained in:
Edward Minnix III
2022-12-31 14:13:22 -05:00
committed by Ed Minnix
parent 9ef319f659
commit 1d345c6101
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsPermitsContentAccess.ql
View File

@@ -25,7 +25,6 @@ private class TypeWebViewOrSubclass extends RefType {
*/
private class PrivateGetterMethodAccess extends MethodAccess {
PrivateGetterMethodAccess() {
this instanceof MethodAccess and
this.getMethod() instanceof GetterMethod and
this.getMethod().isPrivate()
}
@@ -34,7 +33,7 @@ private class PrivateGetterMethodAccess extends MethodAccess {
/** A source for `android.webkit.WebView` objects. */
class WebViewSource extends DataFlow::Node {
WebViewSource() {
this.getType().(RefType) instanceof TypeWebViewOrSubclass and
this.getType() instanceof TypeWebViewOrSubclass and
// To reduce duplicate results, we only consider WebView objects from
// constructor and method calls, or method accesses which are cast to WebView.
(
@@ -56,7 +55,7 @@ class WebSettingsDisallowContentAccessSink extends DataFlow::Node {
exists(MethodAccess ma |
ma.getQualifier() = this.asExpr() and
ma.getMethod() instanceof AllowContentAccessMethod and
ma.getArgument(0).(BooleanLiteral).getBooleanValue() = false
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = false
)
}
}
@@ -64,8 +63,7 @@ class WebSettingsDisallowContentAccessSink extends DataFlow::Node {
class WebViewDisallowContentAccessConfiguration extends TaintTracking::Configuration {
WebViewDisallowContentAccessConfiguration() { this = "WebViewDisallowContentAccessConfiguration" }
override predicate isSource(DataFlow::Node node, DataFlow::FlowState state) {
state instanceof DataFlow::FlowStateEmpty and
override predicate isSource(DataFlow::Node node) {
node instanceof WebViewSource
}