hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Invert the xml logic to be consistent with the dataflow logic

Browse Source
This commit is contained in:
Joe Farebrother
2022-11-08 16:33:42 +00:00
parent 6d465aaf52
commit 7ae41ff165
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll
View File

@@ -117,20 +117,19 @@ private string getInputSensitiveInfoRegex() {
]
}
/** Holds if input using the given input type (as written in XML) may be stored in the keyboard cache. */
/** Holds if input using the given input type (as written in XML) is not stored in the keyboard cache. */
bindingset[ty]
private predicate inputTypeCached(string ty) {
ty.matches("%text%") and
not ty.regexpMatch("(?i).*(nosuggestions|password).*")
private predicate inputTypeNotCached(string ty) {
not ty.matches("%text%")
or
ty.regexpMatch("(?i).*(nosuggestions|password).*")
}
/** Gets an input field whose contents may be sensitive and may be stored in the keyboard cache. */
AndroidEditableXmlElement getASensitiveCachedInput() {
result.getId().regexpMatch(getInputSensitiveInfoRegex()) and
(
inputTypeCached(result.getInputType())
or
not exists(result.getInputType()) and
not inputTypeNotCached(result.getInputType()) and
not exists(GoodInputTypeConf conf, DataFlow::Node src, DataFlow::Node sink |
conf.hasFlow(src, sink) and
sink.asExpr() = setInputTypeForId(result.getId())