From b8b38e4bbe7e9c630b74965156df3c2d3eca93c9 Mon Sep 17 00:00:00 2001 From: Tony Torralba Date: Tue, 25 Jul 2023 15:37:41 +0200 Subject: [PATCH] Java: Allow flow out of FieldValueNodes for non-static fields --- .../code/java/dataflow/internal/DataFlowPrivate.qll | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll index 216523023d9..af698d10b6e 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll @@ -33,17 +33,17 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) { } /** - * Holds if data can flow from `node1` to `node2` through a static field. + * Holds if data can flow from `node1` to `node2` through a field. */ -private predicate staticFieldStep(Node node1, Node node2) { +private predicate fieldStep(Node node1, Node node2) { exists(Field f | + // Taint fields through assigned values only if they're static f.isStatic() and f.getAnAssignedValue() = node1.asExpr() and node2.(FieldValueNode).getField() = f ) or exists(Field f, FieldRead fr | - f.isStatic() and node1.(FieldValueNode).getField() = f and fr.getField() = f and fr = node2.asExpr() and @@ -72,11 +72,11 @@ private predicate variableCaptureStep(Node node1, ExprNode node2) { } /** - * Holds if data can flow from `node1` to `node2` through a static field or + * Holds if data can flow from `node1` to `node2` through a field or * variable capture. */ predicate jumpStep(Node node1, Node node2) { - staticFieldStep(node1, node2) + fieldStep(node1, node2) or variableCaptureStep(node1, node2) or