hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-17 21:14:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: refactor into canTargetDatabaseUpdateMethod

Browse Source
This commit is contained in:
Jami Cogswell
2025-01-08 18:37:57 -05:00
parent 8173fd01b8
commit 530a77e5a0
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/lib/semmle/code/java/security/CsrfUnprotectedRequestTypeQuery.qll
View File

@@ -183,16 +183,21 @@ module CallGraph {
[viableCallable(this.asCall()), this.asCall().getCallee()] = result.asMethod()
}
pragma[nomagic]
private predicate canTargetDatabaseUpdateMethod() {
exists(CallPathNode p |
p = this.getACallee() and
p.asMethod() instanceof DatabaseUpdateMethod
)
}
/** Gets a successor node of this `CallPathNode`, if any. */
CallPathNode getASuccessor() {
this.asMethod() = result.asCall().getEnclosingCallable()
or
result = this.getACallee() and
(
exists(CallPathNode p |
p = this.getACallee() and
p.asMethod() instanceof DatabaseUpdateMethod
)
this.canTargetDatabaseUpdateMethod()
implies
result.asMethod() instanceof DatabaseUpdateMethod
)