Merge pull request #13769 from atorralba/atorralba/java/avoid-inputstream-low-confidence-dispatch

Java: Avoid low-confidence dispatch to InputStream methods
2026-03-04 22:56:47 +01:00 · 2023-07-21 10:42:34 +02:00
parent b21580b71f 238cb26624
commit 3d515b18df
3 changed files with 8 additions and 0 deletions
--- a/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll
+++ b/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll
@@ -102,6 +102,8 @@ private module Dispatch {
    or
    t instanceof Interface and not t.fromSource()
    or
+    t.hasQualifiedName("java.io", "InputStream")
+    or
    t.hasQualifiedName("java.io", "Serializable")
    or
    t.hasQualifiedName("java.lang", "Iterable")