diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll index 3837643b1e8..42e730b41b4 100644 --- a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll +++ b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll @@ -32,31 +32,23 @@ class AdditionalTaintStep extends Unit { } /** - * A method that returns tainted data when one of its inputs (an argument or the qualifier) is tainted. + * A method that preserves taint. * - * Extend this class to add additional taint steps through a method that should - * apply to all taint configurations. + * Extend this class and override at least one of `returnsTaint` or `transfersTaint` + * to add additional taint steps through a method that should apply to all taint configurations. */ abstract class TaintPreservingMethod extends Method { /** * Holds if this method returns tainted data when `arg` tainted. * `arg` is a parameter index, or is -1 to indicate the qualifier. */ - abstract predicate returnsTaint(int arg); -} + predicate returnsTaint(int arg) { none() } -/** - * A method that transfers taint from one of its inputs (an argument or the qualifier) to another. - * - * Extend this class to add additional taint steps through a method that should - * apply to all taint configurations. - */ -abstract class TaintTransferringMethod extends Method { /** * Holds if this method writes tainted data to `sink` when `src` is tainted. * `src` and `sink` are parameter indices, or -1 to indicate the qualifier. */ - abstract predicate transfersTaint(int src, int sink); + predicate transfersTaint(int src, int sink) { none() } } private class StringTaintPreservingMethod extends TaintPreservingMethod { diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll index 94996f9c391..673f0f45e2c 100644 --- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll +++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll @@ -296,7 +296,7 @@ private predicate taintPreservingQualifierToArgument(Method m, int arg) { m.hasName("read") and arg = 0 or - m.(TaintTransferringMethod).transfersTaint(-1, arg) + m.(TaintPreservingMethod).transfersTaint(-1, arg) } /** Access to a method that passes taint from the qualifier. */ @@ -571,7 +571,7 @@ private predicate taintPreservingArgToArg(Method method, int input, int output) input = 0 and output = 2 or - method.(TaintTransferringMethod).transfersTaint(input, output) + method.(TaintPreservingMethod).transfersTaint(input, output) } /** @@ -610,7 +610,7 @@ private predicate taintPreservingArgumentToQualifier(Method method, int arg) { append.getDeclaringType().hasQualifiedName("java.io", "StringWriter") ) or - method.(TaintTransferringMethod).transfersTaint(arg, -1) + method.(TaintPreservingMethod).transfersTaint(arg, -1) } /** A comparison or equality test with a constant. */ @@ -734,7 +734,7 @@ private class TypeFormatter extends Class { TypeFormatter() { this.hasQualifiedName("java.util", "Formatter") } } -private class FormatterMethod extends TaintPreservingMethod, TaintTransferringMethod { +private class FormatterMethod extends TaintPreservingMethod { FormatterMethod() { getDeclaringType() instanceof TypeFormatter and hasName(["format", "out", "toString"]) diff --git a/java/ql/src/semmle/code/java/frameworks/android/SQLite.qll b/java/ql/src/semmle/code/java/frameworks/android/SQLite.qll index 49e38ec97e1..325db8ac679 100644 --- a/java/ql/src/semmle/code/java/frameworks/android/SQLite.qll +++ b/java/ql/src/semmle/code/java/frameworks/android/SQLite.qll @@ -256,7 +256,7 @@ private class QueryBuilderBuildMethod extends TaintPreservingMethod { override predicate returnsTaint(int arg) { argument = arg } } -private class QueryBuilderAppendMethod extends TaintTransferringMethod { +private class QueryBuilderAppendMethod extends TaintPreservingMethod { QueryBuilderAppendMethod() { this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and // setProjectionMap(Map columnMap) diff --git a/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll b/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll index 456158d18b6..c57c35d8bd8 100644 --- a/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll +++ b/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll @@ -28,7 +28,7 @@ abstract class JacksonSerializableType extends Type { } * A method used for serializing objects using Jackson. The final parameter is the object to be * serialized. */ -library class JacksonWriteValueMethod extends TaintPreservingMethod, TaintTransferringMethod { +library class JacksonWriteValueMethod extends TaintPreservingMethod { JacksonWriteValueMethod() { ( getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectWriter") or