hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Fix TC magic in SystemProperty.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2025-03-24 13:31:23 +01:00
parent 3c6db09039
commit dc0ca1ac18
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/lib/semmle/code/java/environment/SystemProperty.qll
View File

@@ -269,18 +269,24 @@ private MethodCall getSystemPropertyFromSpringProperties(string propertyName) {
* for final variables.
*/
private predicate localExprFlowPlusInitializers(Expr e1, Expr e2) {
e1 = e2 or
localFlowPlusInitializers(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
}
private predicate localFlowPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) =
fastTC(localFlowStepPlusInitializers/2)(pred, succ)
/**
* Holds if data can flow from `pred` to `succ` in zero or more
* local (intra-procedural) steps or via instance or static variable intializers
* Holds if data can flow from `pred` to `succ` in a
* local (intra-procedural) step or via instance or static variable intializers
* for final variables.
*/
private predicate localFlowPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) {
exists(Variable v | v.isFinal() and pred.asExpr() = v.getInitializer() |
DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), succ)
private predicate localFlowStepPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) {
exists(Variable v |
v.isFinal() and
pred.asExpr() = v.getInitializer() and
succ.asExpr() = v.getAnAccess()
)
or
DataFlow::localFlow(pred, succ)
DataFlow::localFlowStep(pred, succ)
}