diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll b/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll index 51cf0dcd2c3..f40b028ba6d 100644 --- a/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll +++ b/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll @@ -272,6 +272,8 @@ private class PropagateToSinkConfiguration extends TaintTracking::Configuration override predicate isSink(DataFlow::Node sink) { ExternalFlow::sinkNode(sink, _) } + override predicate isSanitizer(DataFlow::Node node) { sinkModelSanitizer(node) } + override DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext } diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll b/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll index 461148bf5eb..18366b1a5d6 100644 --- a/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll +++ b/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll @@ -175,6 +175,8 @@ private predicate isRelevantMemberAccess(DataFlow::Node node) { ) } +predicate sinkModelSanitizer(DataFlow::Node node) { none() } + /** * Holds if `source` is an api entrypoint relevant for creating sink models. */ diff --git a/java/ql/src/utils/model-generator/internal/CaptureModels.qll b/java/ql/src/utils/model-generator/internal/CaptureModels.qll index 51cf0dcd2c3..f40b028ba6d 100644 --- a/java/ql/src/utils/model-generator/internal/CaptureModels.qll +++ b/java/ql/src/utils/model-generator/internal/CaptureModels.qll @@ -272,6 +272,8 @@ private class PropagateToSinkConfiguration extends TaintTracking::Configuration override predicate isSink(DataFlow::Node sink) { ExternalFlow::sinkNode(sink, _) } + override predicate isSanitizer(DataFlow::Node node) { sinkModelSanitizer(node) } + override DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext } diff --git a/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll b/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll index 9aed8ddf2ba..64516fbaded 100644 --- a/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll +++ b/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll @@ -7,6 +7,7 @@ private import semmle.code.java.dataflow.internal.DataFlowNodes private import semmle.code.java.dataflow.internal.DataFlowPrivate private import semmle.code.java.dataflow.internal.ContainerFlow as ContainerFlow private import semmle.code.java.dataflow.DataFlow as Df +private import semmle.code.java.dataflow.SSA as Ssa private import semmle.code.java.dataflow.TaintTracking as Tt import semmle.code.java.dataflow.ExternalFlow as ExternalFlow import semmle.code.java.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon @@ -224,6 +225,14 @@ predicate isOwnInstanceAccessNode(ReturnNode node) { node.asExpr().(J::ThisAccess).isOwnInstanceAccess() } +predicate sinkModelSanitizer(DataFlow::Node node) { + // exclude variable capture jump steps + exists(Ssa::SsaImplicitInit closure | + closure.captures(_) and + node.asExpr() = closure.getAFirstUse() + ) +} + /** * Holds if `source` is an api entrypoint relevant for creating sink models. */