Simplify api coverage detection

Fixes a bug that doesn't take super types into account
when computing the usage of a specific API.
This commit is contained in:
Benjamin Muskalla
2021-08-02 15:45:30 +02:00
parent 3365634259
commit 8595ae71f7

View File

@@ -2,34 +2,25 @@ import java
private import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.ExternalFlow
// TODO Is this heuristic too broad?
predicate isInterestingAPI(Callable call) {
call.getNumberOfParameters() > 0 and
not (
call.getReturnType() instanceof VoidType or
call.getReturnType() instanceof PrimitiveType or
call.getReturnType() instanceof BoxedType
)
}
// TODO [bm] Fails to detect Collection flow yet (e.g. Map#put)
string supportKind(Callable api) {
if api instanceof TaintPreservingCallable
then result = "taint-preserving"
else
if
summaryModel(api.getCompilationUnit().getPackage().toString(),
api.getDeclaringType().toString(), _, api.getName(), _, _, _, _, _)
if summaryModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _, _)
then result = "summary"
else
if
sinkModel(api.getCompilationUnit().getPackage().toString(),
api.getDeclaringType().toString(), _, api.getName(), _, _, _, _)
if sinkModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _)
then result = "sink"
else
if
sourceModel(api.getCompilationUnit().getPackage().toString(),
api.getDeclaringType().toString(), _, api.getName(), _, _, _, _)
if sourceModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _)
then result = "source"
else result = "?"
}
private string packageName(Callable api) {
result = api.getCompilationUnit().getPackage().toString()
}
private string typeName(Callable api) {
result = api.getDeclaringType().getAnAncestor().getSourceDeclaration().toString()
}