Merge pull request #12916 from jcogs33/jcogs33/revamp-java-sink-kinds

Java: revamp MaD sink kinds
This commit is contained in:
Jami
2023-06-01 12:48:30 -04:00
committed by GitHub
162 changed files with 1962 additions and 1930 deletions

View File

@@ -8,7 +8,7 @@ import semmle.code.java.frameworks.android.Intent
/** A sink representing methods creating a file in Android. */
class AndroidFileSink extends DataFlow::Node {
AndroidFileSink() { sinkNode(this, "create-file") }
AndroidFileSink() { sinkNode(this, "path-injection") }
}
/**

View File

@@ -89,7 +89,7 @@ class GetVirtualFileChildMethod extends Method {
/** An argument to `getResource()` or `getResourceAsStream()`. */
private class GetResourceSink extends UnsafeUrlForwardSink {
GetResourceSink() {
sinkNode(this, "open-url")
sinkNode(this, "request-forgery")
or
sinkNode(this, "get-resource")
or

View File

@@ -250,9 +250,9 @@ string asInputArgumentSpecific(DataFlow::Node source) {
*/
bindingset[kind]
predicate isRelevantSinkKind(string kind) {
not kind = "logging" and
not kind = "log-injection" and
not kind.matches("regex-use%") and
not kind = "write-file"
not kind = "file-content-store"
}
/**