mirror of
https://github.com/github/codeql.git
synced 2026-04-26 01:05:15 +02:00
Merge pull request #12916 from jcogs33/jcogs33/revamp-java-sink-kinds
Java: revamp MaD sink kinds
This commit is contained in:
@@ -8,7 +8,7 @@ import semmle.code.java.frameworks.android.Intent
|
||||
|
||||
/** A sink representing methods creating a file in Android. */
|
||||
class AndroidFileSink extends DataFlow::Node {
|
||||
AndroidFileSink() { sinkNode(this, "create-file") }
|
||||
AndroidFileSink() { sinkNode(this, "path-injection") }
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -89,7 +89,7 @@ class GetVirtualFileChildMethod extends Method {
|
||||
/** An argument to `getResource()` or `getResourceAsStream()`. */
|
||||
private class GetResourceSink extends UnsafeUrlForwardSink {
|
||||
GetResourceSink() {
|
||||
sinkNode(this, "open-url")
|
||||
sinkNode(this, "request-forgery")
|
||||
or
|
||||
sinkNode(this, "get-resource")
|
||||
or
|
||||
|
||||
@@ -250,9 +250,9 @@ string asInputArgumentSpecific(DataFlow::Node source) {
|
||||
*/
|
||||
bindingset[kind]
|
||||
predicate isRelevantSinkKind(string kind) {
|
||||
not kind = "logging" and
|
||||
not kind = "log-injection" and
|
||||
not kind.matches("regex-use%") and
|
||||
not kind = "write-file"
|
||||
not kind = "file-content-store"
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user