hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move more predicates into configuration

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-11-15 13:04:23 +01:00
parent b84c03672d
commit 412bd32f45
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/src/utils/model-generator/CaptureSummaryModels.ql
View File

@@ -47,7 +47,11 @@ class FieldToReturnConfig extends TaintTracking::Configuration {
source instanceof DataFlow::InstanceParameterNode
}
override predicate isSink(DataFlow::Node sink) { sink instanceof ReturnNodeExt }
override predicate isSink(DataFlow::Node sink) {
sink instanceof ReturnNodeExt and
not sink.(ReturnNode).asExpr().(ThisAccess).isOwnInstanceAccess() and
not exists(captureQualifierFlow(sink.asExpr().getEnclosingCallable()))
}
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(DataFlow::Content f |
@@ -97,11 +101,7 @@ string captureFieldFlow(TargetAPI api) {
config.hasFlow(_, returnNodeExt) and
returnNodeExt.getEnclosingCallable() = api and
not api.getDeclaringType() instanceof EnumType and
isRelevantType(returnNodeExt.getType()) and
not (
returnNodeExt.getKind() instanceof ValueReturnKind and
exists(captureQualifierFlow(api))
)
isRelevantType(returnNodeExt.getType())
|
result = asTaintModel(api, "Argument[-1]", asOutput(api, returnNodeExt))
)