From 1838a7455a71ea7109e931bf9543f1893a163807 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Thu, 14 May 2020 16:17:03 +0200 Subject: [PATCH] Java: Add taint steps for String.formatted. --- .../semmle/code/java/dataflow/internal/TaintTrackingUtil.qll | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll index 0894e11bfaa..fd39199f06c 100644 --- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll +++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll @@ -296,6 +296,7 @@ private predicate taintPreservingQualifierToMethod(Method m) { ( m.getName() = "concat" or m.getName() = "endsWith" or + m.getName() = "formatted" or m.getName() = "getBytes" or m.getName() = "split" or m.getName() = "substring" or @@ -395,7 +396,7 @@ private predicate argToMethodStep(Expr tracked, MethodAccess sink) { */ private predicate taintPreservingArgumentToMethod(Method method) { method.getDeclaringType() instanceof TypeString and - (method.hasName("format") or method.hasName("join")) + (method.hasName("format") or method.hasName("formatted") or method.hasName("join")) } /**