Improve handling of the 'author' word as an exception

java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.java

@@ -129,6 +129,27 @@ class ConditionalBypassTest {
 		}
 	}
 
+	public static void test8(String user, String password) {
+		Cookie adminCookie = getCookies()[0];
+		{
+			// BAD: login may not happen
+			if (adminCookie.getValue() == "false") // $ hasConditionalBypassTest
+				authorize(user, password);
+			else {
+				// do something else
+				doIt();
+			}
+		}
+		{
+			// obtainAuthor is not sensitive, so this is safe
+			if (adminCookie.getValue() == "false")
+				obtainAuthor();
+			else {
+				doIt();
+			}
+		}
+	}
+
 	public static void login(String user, String password) {
 		// login
 	}
@@ -137,6 +158,14 @@ class ConditionalBypassTest {
 		// login
 	}
 
+	public static void authorize(String user, String password) {
+		// login
+	}
+
+	public static String obtainAuthor() {
+		return "";
+	}
+
 	public static Cookie[] getCookies() {
 		// get cookies from a servlet
 		return new Cookie[0];