diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll index 21bc3b54ff7..5c2dbb30084 100644 --- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll +++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @@ -943,13 +943,8 @@ private module Stage2 { bindingset[call, c, outercc] private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() } - bindingset[call, c] - private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) { any() } - - bindingset[innercc, inner, call] - private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) { - any() - } + bindingset[call, c, innercc] + private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() } bindingset[node, cc, config] private LocalCc getLocalCc(NodeEx node, Cc cc, Configuration config) { any() } @@ -1122,8 +1117,7 @@ private module Stage2 { fwdFlow(ret, innercc, argAp, ap, config) and flowOutOfCall(call, ret, out, allowsFieldFlow, config) and inner = ret.getEnclosingCallable() and - checkCallContextReturn(innercc, inner, call) and - ccOut = getCallContextReturn(inner, call) + ccOut = getCallContextReturn(inner, call, innercc) | ap instanceof ApNil or allowsFieldFlow = true ) @@ -1615,13 +1609,8 @@ private module Stage3 { bindingset[call, c, outercc] private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() } - bindingset[call, c] - private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) { any() } - - bindingset[innercc, inner, call] - private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) { - any() - } + bindingset[call, c, innercc] + private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() } bindingset[node, cc, config] private LocalCc getLocalCc(NodeEx node, Cc cc, Configuration config) { any() } @@ -1816,8 +1805,7 @@ private module Stage3 { fwdFlow(ret, innercc, argAp, ap, config) and flowOutOfCall(call, ret, out, allowsFieldFlow, config) and inner = ret.getEnclosingCallable() and - checkCallContextReturn(innercc, inner, call) and - ccOut = getCallContextReturn(inner, call) + ccOut = getCallContextReturn(inner, call, innercc) | ap instanceof ApNil or allowsFieldFlow = true ) @@ -2364,20 +2352,16 @@ private module Stage4 { bindingset[call, c, outercc] private CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { - c = resolveCall(call, outercc) and + checkCallContextCall(outercc, call, c) and if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall() } - bindingset[call, c] - private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call) { + bindingset[call, c, innercc] + private CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { + checkCallContextReturn(innercc, c, call) and if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone() } - bindingset[innercc, inner, call] - private predicate checkCallContextReturn(Cc innercc, DataFlowCallable inner, DataFlowCall call) { - resolveReturn(innercc, inner, call) - } - bindingset[node, cc, config] private LocalCc getLocalCc(NodeEx node, Cc cc, Configuration config) { localFlowEntry(node, config) and @@ -2579,8 +2563,7 @@ private module Stage4 { fwdFlow(ret, innercc, argAp, ap, config) and flowOutOfCall(call, ret, out, allowsFieldFlow, config) and inner = ret.getEnclosingCallable() and - checkCallContextReturn(innercc, inner, call) and - ccOut = getCallContextReturn(inner, call) + ccOut = getCallContextReturn(inner, call, innercc) | ap instanceof ApNil or allowsFieldFlow = true ) diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll index eaed77326c7..e16a8185d72 100644 --- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll +++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @@ -1117,6 +1117,16 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) { result = getReturnPosition0(ret, ret.getKind()) } +bindingset[innercc, inner, call] +predicate checkCallContextReturn(CallContext innercc, DataFlowCallable inner, DataFlowCall call) { + resolveReturn(innercc, inner, call) +} + +bindingset[cc, call, calltarget] +predicate checkCallContextCall(CallContext cc, DataFlowCall call, DataFlowCallable calltarget) { + calltarget = resolveCall(call, cc) +} + bindingset[cc, callable] predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) { cc instanceof CallContextAny and callable = viableCallableExt(call)