mirror of
https://github.com/github/codeql.git
synced 2026-07-20 10:48:17 +02:00
C#: Address review comment
- Flow from expressions with a value is excluded.
This commit is contained in:
@@ -35,7 +35,9 @@ Expr uncheckedWrite(Callable callable, Field f) {
|
||||
result.getEnclosingCallable() = callable and
|
||||
not callable.calls*(checkedWrite(f, _, _).getEnclosingCallable()) and
|
||||
// Exclude object creations because they were not deserialized
|
||||
not exists(ObjectCreation src | DataFlow::localExprFlow(src, result))
|
||||
not exists(Expr src | DataFlow::localExprFlow(src, result) |
|
||||
src instanceof ObjectCreation or src.hasValue()
|
||||
)
|
||||
}
|
||||
|
||||
from BinarySerializableType t, Field f, IfStmt check, Expr write, Expr unsafeWrite
|
||||
|
||||
Reference in New Issue
Block a user