Restrict addCookie to specific interface

2025-12-24 12:46:34 +01:00 · 2023-08-07 00:04:02 -04:00
parent dc3e4cd928
commit ba3c38c226
1 changed files with 3 additions and 1 deletions
--- a/java/ql/lib/semmle/code/java/security/WeakRandomnessQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/WeakRandomnessQuery.qll
@@ -57,7 +57,9 @@ abstract class WeakRandomnessSink extends DataFlow::Node { }
 private class CookieSink extends WeakRandomnessSink {
  CookieSink() {
    this.getType() instanceof TypeCookie and
-    exists(MethodAccess ma | ma.getMethod().hasName("addCookie") |
+    exists(MethodAccess ma |
+      ma.getMethod().hasQualifiedName("javax.servlet.http", "HttpServletResponse", "addCookie")
+    |
      ma.getArgument(0) = this.asExpr()
    )
  }