Jave: Use force local to make parsing local after global regex finding.

This commit is contained in:
Alex Eyers-Taylor
2025-08-21 19:48:21 +01:00
parent c2c4778d46
commit 59a9c8dff6
3 changed files with 7 additions and 3 deletions

View File

@@ -170,12 +170,15 @@ private module RegexFlow = DataFlow::Global<RegexFlowConfig>;
* As an optimisation, only regexes containing an infinite repitition quatifier (`+`, `*`, or `{x,}`)
* and therefore may be relevant for ReDoS queries are considered.
*/
predicate usedAsRegex(StringLiteral regex, string mode, boolean match_full_string) {
predicate usedAsRegexG(StringLiteral regex, string mode, boolean match_full_string) {
RegexFlow::flow(DataFlow::exprNode(regex), _) and
mode = "None" and // TODO: proper mode detection
mode = "None" and // TODO: proper mode detection
(if matchesFullString(regex) then match_full_string = true else match_full_string = false)
}
overlay[local]
predicate usedAsRegex(StringLiteral regex, string mode, boolean match_full_string) = forceLocal(usedAsRegexG/3)(regex, mode, match_full_string)
/**
* Holds if `regex` is used as a regular expression that is matched against a full string,
* as though it was implicitly surrounded by ^ and $.

View File

@@ -1,5 +1,5 @@
/** Provides a class hierarchy corresponding to a parse tree of regular expressions. */
overlay[local?]
overlay[local]
module;
private import semmle.code.java.regex.regex as RE // importing under a namescape to avoid naming conflict for `Top`.

View File

@@ -936,6 +936,7 @@ abstract class RegexString extends StringLiteral {
}
/** A string literal used as a regular expression */
overlay[local]
class Regex extends RegexString {
boolean matches_full_string;