hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source
This commit is contained in:
Chris Smowton
2021-08-03 14:15:39 +01:00
committed by GitHub
parent 7f556de8a0
commit 3bf41491b3
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/src/semmle/code/java/frameworks/JaxWS.qll
View File

@@ -308,11 +308,9 @@ class JaxRSProducesAnnotation extends JaxRSAnnotation {
* Gets a declared content type that can be produced by this resource. * Gets a declared content type that can be produced by this resource.
*/ */
Expr getADeclaredContentTypeExpr() { Expr getADeclaredContentTypeExpr() {
( result = this.getAValue() and not result instanceof ArrayInit
result = this.getAValue() and not result instanceof ArrayInit or
or result = this.getAValue().(ArrayInit).getAnInit()
result = this.getAValue().(ArrayInit).getAnInit()
)
} }
} }
@@ -823,7 +821,7 @@ private predicate isXssSafeContentTypeExpr(Expr e) { isXssSafeContentType(getCon
* This could be an instance of `Response.ResponseBuilder`, `Variant`, `Variant.VariantListBuilder` or * This could be an instance of `Response.ResponseBuilder`, `Variant`, `Variant.VariantListBuilder` or
* a `List<Variant>`. * a `List<Variant>`.
* *
* This routine is used to search forwards for response entities set after the content-type is configured. * This predicate is used to search forwards for response entities set after the content-type is configured.
* It does not need to consider cases where the entity is set in the same call, or the entity has already * It does not need to consider cases where the entity is set in the same call, or the entity has already
* been set: these are handled by simple sanitization below. * been set: these are handled by simple sanitization below.
*/ */
@@ -882,7 +880,7 @@ private DataFlow::Node getABuilderWithExplicitContentType(Expr contentType) {
) )
or or
// Recursive case: ordinary local dataflow // Recursive case: ordinary local dataflow
DataFlow::localFlow(getABuilderWithExplicitContentType(contentType), result) DataFlow::localFlowStep(getABuilderWithExplicitContentType(contentType), result)
} }
private DataFlow::Node getASanitizedBuilder() { private DataFlow::Node getASanitizedBuilder() {