hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Tighten the criteria for when we disregard generated models.

Browse Source
This commit is contained in:
Michael Nebel
2024-08-27 11:43:47 +02:00
parent 021fd1450e
commit 8f734ad1b2
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
View File

@@ -45,7 +45,7 @@ private module DispatchImpl {
* The following heuristic is applied for finding the appropriate callable:
* 1. If an exact manual model exists, only dispatch to the summarized callable.
* 2. If a (non exact) manual model exists and/or if the source code is available, dispatch to both/either.
* 3. Only dispatch to a summarized callable (based on a generated model) if neither of the above apply.
* 3. Only dispatch to a summarized callable in case the static call target in not in source.
*/
DataFlowCallable viableCallable(DataFlowCall c) {
exists(Call call | call = c.asCall() |
@@ -53,11 +53,11 @@ private module DispatchImpl {
or
not (
// Only use summarized callables with generated summaries in case
// we are not able to dispatch to a source declaration.
// the static call target is not in the source code.
// Note that if applyGeneratedModel holds it implies that there doesn't
// exist a manual (exact) model.
exists(Callable callable | callable = sourceDispatch(call) |
callable.fromSource() and not callable.isStub()
// exist a manual model.
exists(Callable staticTarget | staticTarget = call.getCallee().getSourceDeclaration() |
staticTarget.fromSource() and not staticTarget.isStub()
) and
result.asSummarizedCallable().applyGeneratedModel()
) and