From 88eb0231c1569042acc3c51a3a69f7bf8606a0bf Mon Sep 17 00:00:00 2001 From: Ed Minnix Date: Mon, 3 Apr 2023 14:08:06 -0400 Subject: [PATCH] Refactor taintedString.ql test --- .../CWE-089/semmle/examples/taintedString.ql | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.ql b/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.ql index 145fd8f2028..d2cafc8e67d 100644 --- a/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.ql +++ b/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.ql @@ -1,16 +1,16 @@ import semmle.code.java.dataflow.FlowSources -class Conf extends TaintTracking::Configuration { - Conf() { this = "qltest:cwe-089:taintedString" } +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { source instanceof UserInput } - override predicate isSource(DataFlow::Node source) { source instanceof UserInput } - - override predicate isSink(DataFlow::Node sink) { any() } + predicate isSink(DataFlow::Node sink) { any() } } -from Conf conf, Expr tainted, Method method +module Flow = TaintTracking::Global; + +from Expr tainted, Method method where - conf.hasFlowToExpr(tainted) and + Flow::flowToExpr(tainted) and tainted.getEnclosingCallable() = method and tainted.getFile().getStem() = ["Test", "Validation"] select method, tainted.getLocation().getStartLine() - method.getLocation().getStartLine(), tainted