Resolve ambiguous method access

This commit is contained in:
luchua-bc
2021-02-23 15:18:07 +00:00
parent 2f17943abc
commit 56e3b301e9
2 changed files with 5 additions and 3 deletions

View File

@@ -24,7 +24,9 @@ class SensitiveInfoExpr extends Expr {
}
/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
private predicate isGetServletMethod(Method m) { isServletMethod(m) and m.getName() = "doGet" }
private predicate isGetServletMethod(Method m) {
isServletRequestMethod(m) and m.getName() = "doGet"
}
/** The `doGet` method of `HttpServlet`. */
class DoGetServletMethod extends Method {
@@ -63,7 +65,7 @@ class SensitiveGetQueryConfiguration extends TaintTracking::Configuration {
/** Holds if the node is in a servlet method other than `doGet`. */
override predicate isSanitizer(DataFlow::Node node) {
isServletMethod(node.getEnclosingCallable()) and
isServletRequestMethod(node.getEnclosingCallable()) and
not isGetServletMethod(node.getEnclosingCallable())
}
}

View File

@@ -324,7 +324,7 @@ class ServletWebXMLListenerType extends RefType {
}
/** Holds if `m` is a request handler method (for example `doGet` or `doPost`). */
predicate isServletMethod(Method m) {
predicate isServletRequestMethod(Method m) {
m.getDeclaringType() instanceof ServletClass and
m.getNumberOfParameters() = 2 and
m.getParameter(0).getType() instanceof ServletRequest and