Crypto: Fix missing output variable

2026-04-25 00:35:20 +02:00 · 2025-10-02 09:10:50 -04:00
parent c37b7c1389
commit b08533b322
1 changed files with 3 additions and 1 deletions
--- a/java/ql/lib/experimental/quantum/JCA.qll
+++ b/java/ql/lib/experimental/quantum/JCA.qll
@@ -1584,9 +1584,11 @@ module JCAModel {
  }

  class MacOperationCall extends Crypto::MacOperationInstance instanceof MethodCall {
+    Expr output;
+
    MacOperationCall() {
      super.getMethod().getDeclaringType().hasQualifiedName("javax.crypto", "Mac") and
-      exists(Expr output |
+      (
        super.getMethod().hasStringSignature(["doFinal()", "doFinal(byte[])"]) and this = output
        or
        super.getMethod().hasStringSignature("doFinal(byte[], int)") and