hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13091 from atorralba/atorralba/java/inputstreamwrapper-transitive

Browse Source 
Java: Make inputStreamWrapper consider supertypes transitively
This commit is contained in:
Tony Torralba
2023-05-23 13:28:17 +02:00
committed by GitHub
parent 8cef798a6f 183915410d
commit 6f012d51c0
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2023-05-22-inputstreamwrapper-transitive.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Dataflow analysis has a new flow step through constructors of transitive subtypes of `java.io.InputStream` that wrap an underlying data source. Previously, the step only existed for direct subtypes of `java.io.InputStream`.

3
java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -255,8 +255,9 @@ private class BulkData extends RefType {
* status of its argument.
*/
private predicate inputStreamWrapper(Constructor c, int argi) {
not c.fromSource() and
c.getParameterType(argi) instanceof BulkData and
c.getDeclaringType().getASourceSupertype().hasQualifiedName("java.io", "InputStream")
c.getDeclaringType().getASourceSupertype+().hasQualifiedName("java.io", "InputStream")
}
/** An object construction that preserves the data flow status of any of its arguments. */