mirror of
https://github.com/github/codeql.git
synced 2026-04-26 01:05:15 +02:00
Mass-rename MethodAccess -> MethodCall
This commit is contained in:
@@ -11,7 +11,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Method m
|
||||
from MethodCall ma, Method m
|
||||
where
|
||||
m = ma.getMethod() and
|
||||
m instanceof CloneMethod and
|
||||
|
||||
@@ -24,7 +24,7 @@ predicate remoteVarAccess(RefType source, RefType target, VarAccess va) {
|
||||
source != target
|
||||
}
|
||||
|
||||
predicate remoteFunAccess(RefType source, RefType target, MethodAccess fc) {
|
||||
predicate remoteFunAccess(RefType source, RefType target, MethodCall fc) {
|
||||
fc.getEnclosingCallable().getDeclaringType() = source and
|
||||
fc.getMethod().getDeclaringType() = target and
|
||||
source != target
|
||||
@@ -41,7 +41,7 @@ predicate variableDependencyCount(RefType source, RefType target, int res) {
|
||||
|
||||
predicate functionDependencyCount(RefType source, RefType target, int res) {
|
||||
candidateTypePair(source, target) and
|
||||
res = count(MethodAccess fc | remoteFunAccess(source, target, fc))
|
||||
res = count(MethodCall fc | remoteFunAccess(source, target, fc))
|
||||
}
|
||||
|
||||
predicate dependencyCount(RefType source, RefType target, int res) {
|
||||
|
||||
@@ -21,7 +21,7 @@ predicate nontrivialLogicalOperator(BinaryExpr e) {
|
||||
|
||||
Expr getSimpleParent(Expr e) {
|
||||
result = e.getParent() and
|
||||
not result instanceof MethodAccess
|
||||
not result instanceof MethodCall
|
||||
}
|
||||
|
||||
from Expr e
|
||||
|
||||
@@ -117,7 +117,7 @@ class SpringBeanFactory extends ClassOrInterface {
|
||||
* Get a bean constructed by a call to this bean factory.
|
||||
*/
|
||||
SpringBean getAConstructedBean() {
|
||||
exists(Method getBean, MethodAccess call |
|
||||
exists(Method getBean, MethodCall call |
|
||||
getBean.hasName("getBean") and
|
||||
call.getMethod() = getBean and
|
||||
getBean.getDeclaringType() = this
|
||||
|
||||
@@ -15,7 +15,7 @@ import java
|
||||
|
||||
predicate complicatedBranch(Stmt branch) {
|
||||
any(ConditionalExpr ce).getParent*() = branch or
|
||||
count(MethodAccess a | a.getParent*() = branch) > 1
|
||||
count(MethodCall a | a.getParent*() = branch) > 1
|
||||
}
|
||||
|
||||
predicate complicatedCondition(Expr cond) {
|
||||
|
||||
@@ -25,7 +25,7 @@ predicate usefulUpcast(CastingExpr e) {
|
||||
other.getName() = target.getName() and
|
||||
other.getSourceDeclaration() != target.getSourceDeclaration()
|
||||
|
|
||||
c.(MethodAccess).getReceiverType().inherits(other.(Method)) or
|
||||
c.(MethodCall).getReceiverType().inherits(other.(Method)) or
|
||||
other = target.(Constructor).getDeclaringType().getAConstructor()
|
||||
)
|
||||
)
|
||||
@@ -48,7 +48,7 @@ predicate usefulUpcast(CastingExpr e) {
|
||||
not e.getExpr().getType().(RefType).inherits(fa.getField())
|
||||
)
|
||||
or
|
||||
exists(MethodAccess ma, Method m |
|
||||
exists(MethodCall ma, Method m |
|
||||
e = ma.getQualifier() and
|
||||
m = ma.getMethod() and
|
||||
(m.isStatic() or m.isPrivate())
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
import java
|
||||
import semmle.code.java.security.RandomQuery
|
||||
|
||||
from MethodAccess ma, Method abs, Method nextIntOrLong, RandomDataSource nma
|
||||
from MethodCall ma, Method abs, Method nextIntOrLong, RandomDataSource nma
|
||||
where
|
||||
ma.getMethod() = abs and
|
||||
abs.hasName("abs") and
|
||||
|
||||
@@ -17,8 +17,8 @@ import semmle.code.java.Collections
|
||||
predicate isDefinitelyPositive(Expr e) {
|
||||
isDefinitelyPositive(e) or
|
||||
e.(IntegerLiteral).getIntValue() >= 0 or
|
||||
e.(MethodAccess).getMethod() instanceof CollectionSizeMethod or
|
||||
e.(MethodAccess).getMethod() instanceof StringLengthMethod or
|
||||
e.(MethodCall).getMethod() instanceof CollectionSizeMethod or
|
||||
e.(MethodCall).getMethod() instanceof StringLengthMethod or
|
||||
e.(FieldAccess).getField() instanceof ArrayLengthField
|
||||
}
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ class ContainerMutator extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
class ContainerMutation extends MethodAccess {
|
||||
class ContainerMutation extends MethodCall {
|
||||
ContainerMutation() {
|
||||
this instanceof CollectionMutation or
|
||||
this instanceof MapMutation
|
||||
|
||||
@@ -95,7 +95,7 @@ predicate containerAccess(string package, string type, int p, string signature,
|
||||
i = 0
|
||||
}
|
||||
|
||||
class MismatchedContainerAccess extends MethodAccess {
|
||||
class MismatchedContainerAccess extends MethodCall {
|
||||
MismatchedContainerAccess() {
|
||||
exists(string package, string type, int i |
|
||||
containerAccess(package, type, _, this.getCallee().getSignature(), i)
|
||||
|
||||
@@ -13,10 +13,10 @@
|
||||
|
||||
import java
|
||||
|
||||
class SpecialCollectionCreation extends MethodAccess {
|
||||
class SpecialCollectionCreation extends MethodCall {
|
||||
SpecialCollectionCreation() {
|
||||
exists(Method m, RefType rt |
|
||||
m = this.(MethodAccess).getCallee() and rt = m.getDeclaringType()
|
||||
m = this.(MethodCall).getCallee() and rt = m.getDeclaringType()
|
||||
|
|
||||
rt.hasQualifiedName("java.util", "Arrays") and m.hasName("asList")
|
||||
or
|
||||
@@ -46,7 +46,7 @@ predicate containsSpecialCollection(Expr e, SpecialCollectionCreation origin) {
|
||||
}
|
||||
|
||||
predicate iterOfSpecialCollection(Expr e, SpecialCollectionCreation origin) {
|
||||
exists(MethodAccess ma | ma = e |
|
||||
exists(MethodCall ma | ma = e |
|
||||
containsSpecialCollection(ma.getQualifier(), origin) and
|
||||
ma.getCallee().hasName("iterator")
|
||||
)
|
||||
@@ -67,7 +67,7 @@ predicate iterOfSpecialCollection(Expr e, SpecialCollectionCreation origin) {
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess remove, SpecialCollectionCreation scc
|
||||
from MethodCall remove, SpecialCollectionCreation scc
|
||||
where
|
||||
remove.getCallee().hasName("remove") and
|
||||
iterOfSpecialCollection(remove.getQualifier(), scc)
|
||||
|
||||
@@ -32,12 +32,12 @@ where
|
||||
v instanceof LocalVariableDecl and exists(ReturnStmt ret | ret.getResult() = va)
|
||||
or
|
||||
// ...or a call to a query method on `v`.
|
||||
exists(MethodAccess ma | va = ma.getQualifier() |
|
||||
exists(MethodCall ma | va = ma.getQualifier() |
|
||||
ma.getMethod() instanceof ContainerQueryMethod
|
||||
)
|
||||
) and
|
||||
// There is at least one call to a query method.
|
||||
exists(MethodAccess ma | v.getAnAccess() = ma.getQualifier() |
|
||||
exists(MethodCall ma | v.getAnAccess() = ma.getQualifier() |
|
||||
ma.getMethod() instanceof ContainerQueryMethod
|
||||
) and
|
||||
// Also, any value that `v` is initialized to is a fresh container,
|
||||
|
||||
@@ -65,7 +65,7 @@ predicate containerModification(string package, string type, int p, string signa
|
||||
i = 0
|
||||
}
|
||||
|
||||
class MismatchedContainerModification extends MethodAccess {
|
||||
class MismatchedContainerModification extends MethodCall {
|
||||
MismatchedContainerModification() {
|
||||
exists(string package, string type, int i |
|
||||
containerModification(package, type, _, this.getCallee().getSignature(), i)
|
||||
|
||||
@@ -46,7 +46,7 @@ predicate checksReferenceEquality(EqualsMethod em) {
|
||||
// Check whether `em` delegates to another method checking reference equality.
|
||||
// More precisely, we check whether the body of `em` is of the form `return super.equals(o);`,
|
||||
// where `o` is the (only) parameter of `em`, and the invoked method is a reference equality check.
|
||||
exists(SuperMethodAccess sup |
|
||||
exists(SuperMethodCall sup |
|
||||
sup = em.getBody().(SingletonBlock).getStmt().(ReturnStmt).getResult() and
|
||||
sup.getArgument(0) = em.getParameter(0).getAnAccess() and
|
||||
checksReferenceEquality(sup.getCallee())
|
||||
|
||||
@@ -13,7 +13,7 @@ class RefiningEquals extends EqualsMethod {
|
||||
// For each return statement `ret` in this method, ...
|
||||
forall(ReturnStmt ret | ret.getEnclosingCallable() = this |
|
||||
// ... there is a `super` access that ...
|
||||
exists(MethodAccess sup, SuperAccess qual |
|
||||
exists(MethodCall sup, SuperAccess qual |
|
||||
// ... is of the form `super.something`, but not `A.super.something` ...
|
||||
qual = sup.getQualifier() and
|
||||
not exists(qual.getQualifier()) and
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Array recvtype, Method m
|
||||
from MethodCall ma, Array recvtype, Method m
|
||||
where
|
||||
recvtype = ma.getQualifier().getType() and
|
||||
m = ma.getMethod() and
|
||||
|
||||
@@ -38,7 +38,7 @@ predicate usedInHash(RefType t, Expr e) {
|
||||
exists(RefType s |
|
||||
s.getName().matches("%Hash%") and not s.getSourceDeclaration().getName() = "IdentityHashMap"
|
||||
|
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getQualifier().getType() = s and
|
||||
ma.getArgument(0).getType() = t and
|
||||
e = ma and
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
import java
|
||||
|
||||
/** A call to an `equals` method. */
|
||||
class EqualsCall extends MethodAccess {
|
||||
class EqualsCall extends MethodCall {
|
||||
EqualsCall() { this.getMethod() instanceof EqualsMethod }
|
||||
|
||||
/**
|
||||
@@ -22,7 +22,7 @@ class EqualsCall extends MethodAccess {
|
||||
*/
|
||||
predicate whitelisted() {
|
||||
// Allow tests and assertions to verify that `equals` methods return `false`.
|
||||
this.getParent*().(MethodAccess).getMethod().getName().matches("assert%") or
|
||||
this.getParent*().(MethodCall).getMethod().getName().matches("assert%") or
|
||||
this.getEnclosingStmt() instanceof AssertStmt
|
||||
}
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ predicate hasTypeTest(Variable v) {
|
||||
or
|
||||
any(ClassExpr c).getExpr() = v.getAnAccess()
|
||||
or
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getMethod().getName() = "getClass" and
|
||||
ma.getQualifier() = v.getAnAccess()
|
||||
)
|
||||
@@ -71,7 +71,7 @@ where
|
||||
not hasTypeTest(p) and
|
||||
// If the parameter is passed to a method for which we don't have the source
|
||||
// we assume it's ok
|
||||
not exists(MethodAccess ma |
|
||||
not exists(MethodCall ma |
|
||||
not exists(ma.getMethod().getBody()) and
|
||||
ma.getAnArgument() = p.getAnAccess()
|
||||
)
|
||||
|
||||
@@ -30,7 +30,7 @@ class ReferenceEqualityTestOnObject extends ReferenceEqualityTest {
|
||||
|
||||
from ReferenceEqualityTestOnObject scw
|
||||
where
|
||||
not exists(Variable left, Variable right, MethodAccess equals |
|
||||
not exists(Variable left, Variable right, MethodCall equals |
|
||||
left = scw.getLeftOperand().(VarAccess).getVariable() and
|
||||
right = scw.getRightOperand().(VarAccess).getVariable() and
|
||||
scw.getEnclosingCallable() = equals.getEnclosingCallable() and
|
||||
|
||||
@@ -21,7 +21,7 @@ class StringValue extends Expr {
|
||||
exists(Method intern |
|
||||
intern.getDeclaringType() instanceof TypeString and
|
||||
intern.hasName("intern") and
|
||||
this.(MethodAccess).getMethod() = intern
|
||||
this.(MethodCall).getMethod() = intern
|
||||
)
|
||||
or
|
||||
// Ternary conditional operator.
|
||||
@@ -35,7 +35,7 @@ class StringValue extends Expr {
|
||||
variableValuesInterned(this.(VarAccess).getVariable())
|
||||
or
|
||||
// Method accesses whose results are all interned.
|
||||
forex(ReturnStmt rs | rs.getEnclosingCallable() = this.(MethodAccess).getMethod() |
|
||||
forex(ReturnStmt rs | rs.getEnclosingCallable() = this.(MethodCall).getMethod() |
|
||||
rs.getResult().(StringValue).isInterned()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -23,8 +23,8 @@ class SleepMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
class SleepMethodAccess extends MethodAccess {
|
||||
SleepMethodAccess() { this.getMethod() instanceof SleepMethod }
|
||||
class SleepMethodCall extends MethodCall {
|
||||
SleepMethodCall() { this.getMethod() instanceof SleepMethod }
|
||||
}
|
||||
|
||||
class WaitMethod extends Method {
|
||||
@@ -48,7 +48,7 @@ class CommunicationMethod extends Method {
|
||||
predicate callsCommunicationMethod(Method source) {
|
||||
source instanceof CommunicationMethod
|
||||
or
|
||||
exists(MethodAccess a, Method overridingMethod, Method target |
|
||||
exists(MethodCall a, Method overridingMethod, Method target |
|
||||
callsCommunicationMethod(overridingMethod) and
|
||||
overridingMethod.overridesOrInstantiates*(target) and
|
||||
target = a.getMethod() and
|
||||
@@ -57,13 +57,13 @@ predicate callsCommunicationMethod(Method source) {
|
||||
}
|
||||
|
||||
class DangerStmt extends Stmt {
|
||||
DangerStmt() { exists(SleepMethodAccess sleep | sleep.getEnclosingStmt() = this) }
|
||||
DangerStmt() { exists(SleepMethodCall sleep | sleep.getEnclosingStmt() = this) }
|
||||
}
|
||||
|
||||
from WhileStmt s, DangerStmt d
|
||||
where
|
||||
d.getEnclosingStmt+() = s and
|
||||
not exists(MethodAccess call | callsCommunicationMethod(call.getMethod()) |
|
||||
not exists(MethodCall call | callsCommunicationMethod(call.getMethod()) |
|
||||
call.getEnclosingStmt().getEnclosingStmt*() = s
|
||||
)
|
||||
select d, "Prefer wait/notify or java.util.concurrent to communicate between threads."
|
||||
|
||||
@@ -26,7 +26,7 @@ class ConditionInterface extends Interface {
|
||||
ConditionInterface() { this.hasQualifiedName("java.util.concurrent.locks", "Condition") }
|
||||
}
|
||||
|
||||
from MethodAccess ma, ConditionInterface condition
|
||||
from MethodCall ma, ConditionInterface condition
|
||||
where
|
||||
ma.getMethod() instanceof WaitMethod and
|
||||
ma.getQualifier().getType().(RefType).hasSupertype*(condition)
|
||||
|
||||
@@ -22,7 +22,7 @@ class RunMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
from MethodAccess m, RunMethod run
|
||||
from MethodCall m, RunMethod run
|
||||
where
|
||||
m.getMethod() = run and
|
||||
not m.getEnclosingCallable() instanceof RunMethod
|
||||
|
||||
@@ -19,7 +19,7 @@ where
|
||||
(f.isPublic() or f.isProtected()) and
|
||||
dateFormat.hasQualifiedName("java.text", "DateFormat") and
|
||||
f.getType().(RefType).hasSupertype*(dateFormat) and
|
||||
exists(MethodAccess m | m.getQualifier().(VarAccess).getVariable() = f)
|
||||
exists(MethodCall m | m.getQualifier().(VarAccess).getVariable() = f)
|
||||
select f,
|
||||
"Found static field of type " + f.getType().getName() + " in " + f.getDeclaringType().getName() +
|
||||
"."
|
||||
|
||||
@@ -24,8 +24,8 @@ predicate whitelistedMethod(Method m) {
|
||||
|
||||
class SideEffect extends Expr {
|
||||
SideEffect() {
|
||||
this instanceof MethodAccess and
|
||||
not whitelistedMethod(this.(MethodAccess).getMethod())
|
||||
this instanceof MethodCall and
|
||||
not whitelistedMethod(this.(MethodCall).getMethod())
|
||||
or
|
||||
this.(Assignment).getDest() instanceof FieldAccess
|
||||
}
|
||||
|
||||
@@ -23,14 +23,14 @@ predicate withinInitializer(Expr e) {
|
||||
e.getEnclosingCallable() instanceof Constructor
|
||||
}
|
||||
|
||||
predicate locallySynchronized(MethodAccess ma) {
|
||||
predicate locallySynchronized(MethodCall ma) {
|
||||
ma.getEnclosingStmt().getEnclosingStmt+() instanceof SynchronizedStmt
|
||||
}
|
||||
|
||||
predicate hasUnsynchronizedCall(Method m) {
|
||||
m.isPublic() and not m.isSynchronized()
|
||||
or
|
||||
exists(MethodAccess ma, Method caller |
|
||||
exists(MethodCall ma, Method caller |
|
||||
ma.getMethod() = m and caller = ma.getEnclosingCallable()
|
||||
|
|
||||
hasUnsynchronizedCall(caller) and
|
||||
|
||||
@@ -61,12 +61,12 @@ class ValidSynchStmt extends Stmt {
|
||||
exists(TryStmt try, LockObjectField lockField |
|
||||
this = try.getBlock() and
|
||||
lockField.getType().(RefType).hasQualifiedName("java.util.concurrent.locks", "ReentrantLock") and
|
||||
exists(MethodAccess lockAction |
|
||||
exists(MethodCall lockAction |
|
||||
lockAction.getQualifier() = lockField.getAnAccess() and
|
||||
lockAction.getMethod().getName() = "lock" and
|
||||
dominates(lockAction, this)
|
||||
) and
|
||||
exists(MethodAccess unlockAction |
|
||||
exists(MethodCall unlockAction |
|
||||
unlockAction.getQualifier() = lockField.getAnAccess() and
|
||||
unlockAction.getMethod().getName() = "unlock" and
|
||||
postDominates(unlockAction, this)
|
||||
|
||||
@@ -20,7 +20,7 @@ import java
|
||||
* `super.m(x, y, z)`, possibly wrapped in one or more casts and/or parentheses.
|
||||
*/
|
||||
predicate delegatingSuperCall(Expr e, Method target) {
|
||||
exists(MethodAccess call | call = e |
|
||||
exists(MethodCall call | call = e |
|
||||
call.getQualifier() instanceof SuperAccess and
|
||||
call.getCallee() = target and
|
||||
forall(Expr arg | arg = call.getAnArgument() | arg instanceof VarAccess)
|
||||
|
||||
@@ -14,15 +14,15 @@
|
||||
|
||||
import java
|
||||
|
||||
class InvokeInterfaceOrVirtualMethodAccess extends MethodAccess {
|
||||
InvokeInterfaceOrVirtualMethodAccess() {
|
||||
class InvokeInterfaceOrVirtualMethodCall extends MethodCall {
|
||||
InvokeInterfaceOrVirtualMethodCall() {
|
||||
this.getMethod().getDeclaringType() instanceof Interface or
|
||||
not this.hasQualifier() or
|
||||
not this.getQualifier() instanceof SuperAccess
|
||||
}
|
||||
}
|
||||
|
||||
from InvokeInterfaceOrVirtualMethodAccess ma, Method m
|
||||
from InvokeInterfaceOrVirtualMethodCall ma, Method m
|
||||
where
|
||||
ma.getMethod() = m and
|
||||
m.hasName("notify") and
|
||||
|
||||
@@ -48,7 +48,7 @@ private predicate synchronizedCallable(Callable c) {
|
||||
c.isSynchronized()
|
||||
or
|
||||
c.isPrivate() and
|
||||
forall(MethodAccess parent | parent.getCallee() = c |
|
||||
forall(MethodCall parent | parent.getCallee() = c |
|
||||
synchronizedThisAccess(parent, c.getDeclaringType())
|
||||
)
|
||||
}
|
||||
@@ -60,7 +60,7 @@ private predicate synchronizedCallable(Callable c) {
|
||||
* example, if the method call is `MyClass.wait()`, then the predicate
|
||||
* holds if there is an enclosing synchronization on `MyClass.this`.
|
||||
*/
|
||||
private predicate synchronizedThisAccess(MethodAccess ma, Type thisType) {
|
||||
private predicate synchronizedThisAccess(MethodCall ma, Type thisType) {
|
||||
// Are we inside a synchronized method?
|
||||
exists(Callable c |
|
||||
c = ma.getEnclosingCallable() and
|
||||
@@ -90,11 +90,11 @@ predicate synchronizedVarAccess(VarAccess x) {
|
||||
}
|
||||
|
||||
/**
|
||||
* This predicate holds if the `MethodAccess` is a qualified call,
|
||||
* This predicate holds if the `MethodCall` is a qualified call,
|
||||
* such as `this.wait()`, and it is not inside a synchronized statement
|
||||
* or method.
|
||||
*/
|
||||
private predicate unsynchronizedExplicitThisAccess(MethodAccess ma) {
|
||||
private predicate unsynchronizedExplicitThisAccess(MethodCall ma) {
|
||||
exists(ThisAccess x |
|
||||
x = ma.getQualifier() and
|
||||
not synchronizedThisAccess(ma, x.getType())
|
||||
@@ -102,27 +102,27 @@ private predicate unsynchronizedExplicitThisAccess(MethodAccess ma) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the `MethodAccess` is an unqualified call,
|
||||
* Holds if the `MethodCall` is an unqualified call,
|
||||
* such as `wait()`, and it is not inside a synchronized statement
|
||||
* or method.
|
||||
*/
|
||||
private predicate unsynchronizedImplicitThisAccess(MethodAccess ma) {
|
||||
private predicate unsynchronizedImplicitThisAccess(MethodCall ma) {
|
||||
not ma.hasQualifier() and
|
||||
not synchronizedThisAccess(ma, ma.getEnclosingCallable().getDeclaringType())
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the `MethodAccess` is on a variable,
|
||||
* Holds if the `MethodCall` is on a variable,
|
||||
* such as `x.wait()`, and it is not inside a synchronized statement.
|
||||
*/
|
||||
private predicate unsynchronizedVarAccess(MethodAccess ma) {
|
||||
private predicate unsynchronizedVarAccess(MethodCall ma) {
|
||||
exists(VarAccess x |
|
||||
x = ma.getQualifier() and
|
||||
not synchronizedVarAccess(x)
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess ma, Method m
|
||||
from MethodCall ma, Method m
|
||||
where
|
||||
m = ma.getMethod() and
|
||||
m instanceof MethodRequiresSynch and
|
||||
|
||||
@@ -20,10 +20,10 @@ class PriorityMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
class PriorityMethodAccess extends MethodAccess {
|
||||
PriorityMethodAccess() { this.getMethod() instanceof PriorityMethod }
|
||||
class PriorityMethodCall extends MethodCall {
|
||||
PriorityMethodCall() { this.getMethod() instanceof PriorityMethod }
|
||||
}
|
||||
|
||||
from PriorityMethodAccess ma
|
||||
from PriorityMethodCall ma
|
||||
where ma.getCompilationUnit().fromSource()
|
||||
select ma, "Avoid using thread priorities. The effect is unpredictable and not portable."
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Method sleep
|
||||
from MethodCall ma, Method sleep
|
||||
where
|
||||
ma.getMethod() = sleep and
|
||||
sleep.hasName("sleep") and
|
||||
|
||||
@@ -26,7 +26,7 @@ private predicate cannotBeExtended(RefType t) {
|
||||
not exists(RefType sub | sub != t | sub.getAnAncestor() = t)
|
||||
}
|
||||
|
||||
from MethodAccess m, Constructor c, Class clazz
|
||||
from MethodCall m, Constructor c, Class clazz
|
||||
where
|
||||
m.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Thread") and
|
||||
m.getMethod().getName() = "start" and
|
||||
|
||||
@@ -39,22 +39,22 @@ class LockType extends RefType {
|
||||
result.hasName("isHeldByCurrentThread")
|
||||
}
|
||||
|
||||
MethodAccess getLockAccess() {
|
||||
MethodCall getLockAccess() {
|
||||
result.getMethod() = this.getLockMethod() and
|
||||
// Not part of a Mockito verification call
|
||||
not result instanceof MockitoVerifiedMethodAccess
|
||||
not result instanceof MockitoVerifiedMethodCall
|
||||
}
|
||||
|
||||
MethodAccess getUnlockAccess() {
|
||||
MethodCall getUnlockAccess() {
|
||||
result.getMethod() = this.getUnlockMethod() and
|
||||
// Not part of a Mockito verification call
|
||||
not result instanceof MockitoVerifiedMethodAccess
|
||||
not result instanceof MockitoVerifiedMethodCall
|
||||
}
|
||||
|
||||
MethodAccess getIsHeldByCurrentThreadAccess() {
|
||||
MethodCall getIsHeldByCurrentThreadAccess() {
|
||||
result.getMethod() = this.getIsHeldByCurrentThreadMethod() and
|
||||
// Not part of a Mockito verification call
|
||||
not result instanceof MockitoVerifiedMethodAccess
|
||||
not result instanceof MockitoVerifiedMethodCall
|
||||
}
|
||||
}
|
||||
|
||||
@@ -147,7 +147,7 @@ predicate blockIsLocked(LockType t, BasicBlock src, BasicBlock b, int locks) {
|
||||
)
|
||||
}
|
||||
|
||||
from Callable c, LockType t, BasicBlock src, BasicBlock exit, MethodAccess lock
|
||||
from Callable c, LockType t, BasicBlock src, BasicBlock exit, MethodCall lock
|
||||
where
|
||||
// Restrict results to those methods that actually attempt to unlock.
|
||||
t.getUnlockAccess().getEnclosingCallable() = c and
|
||||
|
||||
@@ -20,7 +20,7 @@ class WaitMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
from MethodAccess ma
|
||||
from MethodCall ma
|
||||
where
|
||||
ma.getMethod() instanceof WaitMethod and
|
||||
not ma.getEnclosingStmt().getEnclosingStmt*() instanceof LoopStmt
|
||||
|
||||
@@ -21,7 +21,7 @@ class Synched extends Stmt {
|
||||
}
|
||||
}
|
||||
|
||||
from MethodAccess ma, SynchronizedStmt synch
|
||||
from MethodCall ma, SynchronizedStmt synch
|
||||
where
|
||||
ma.getMethod().hasName("wait") and
|
||||
ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Object") and
|
||||
|
||||
@@ -20,11 +20,11 @@ class YieldMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
class YieldMethodAccess extends MethodAccess {
|
||||
YieldMethodAccess() { this.getMethod() instanceof YieldMethod }
|
||||
class YieldMethodCall extends MethodCall {
|
||||
YieldMethodCall() { this.getMethod() instanceof YieldMethod }
|
||||
}
|
||||
|
||||
from YieldMethodAccess yield
|
||||
from YieldMethodCall yield
|
||||
where yield.getCompilationUnit().fromSource()
|
||||
select yield,
|
||||
"Do not use Thread.yield(). It is non-portable and will most likely not have the desired effect."
|
||||
|
||||
@@ -31,7 +31,7 @@ where
|
||||
exists(Method original | adapter = original.getDeclaringType() | m.getName() = original.getName()) and
|
||||
not exists(Method overridden | adapter = overridden.getDeclaringType() | m.overrides(overridden)) and
|
||||
// The method is not used for any other purpose.
|
||||
not exists(MethodAccess ma | ma.getMethod() = m)
|
||||
not exists(MethodCall ma | ma.getMethod() = m)
|
||||
select m,
|
||||
"Method " + m.getName() + " attempts to override a method in " + adapter.getName() +
|
||||
", but does not have the same argument types. " + m.getName() +
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Method m, MainMethod main
|
||||
from MethodCall ma, Method m, MainMethod main
|
||||
where
|
||||
ma.getQualifier().getType().getCompilationUnit().getPackage().getName().matches("javax.swing%") and
|
||||
(
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Method changecase
|
||||
from MethodCall ma, Method changecase
|
||||
where
|
||||
(
|
||||
changecase.hasName("toUpperCase") or
|
||||
|
||||
@@ -27,7 +27,7 @@ private FieldRead nonFinalFieldRead(Callable m, Field f) {
|
||||
not f.isFinal()
|
||||
}
|
||||
|
||||
private MethodAccess unqualifiedCallToNonAbstractMethod(Constructor c, Method m) {
|
||||
private MethodCall unqualifiedCallToNonAbstractMethod(Constructor c, Method m) {
|
||||
result.getEnclosingCallable() = c and
|
||||
(
|
||||
not exists(result.getQualifier()) or
|
||||
@@ -38,7 +38,7 @@ private MethodAccess unqualifiedCallToNonAbstractMethod(Constructor c, Method m)
|
||||
}
|
||||
|
||||
from
|
||||
Constructor c, MethodAccess ma, Method m, Method n, Field f, FieldRead fa, Constructor d,
|
||||
Constructor c, MethodCall ma, Method m, Method n, Field f, FieldRead fa, Constructor d,
|
||||
FieldWrite fw
|
||||
where
|
||||
// Method access in a constructor
|
||||
|
||||
@@ -27,21 +27,21 @@ class ArrayLengthRead extends FieldRead, SizeOfContainer {
|
||||
}
|
||||
|
||||
/** An access to `String.length()`. */
|
||||
class StringLengthRead extends MethodAccess, SizeOfContainer {
|
||||
class StringLengthRead extends MethodCall, SizeOfContainer {
|
||||
StringLengthRead() { this.getMethod() instanceof StringLengthMethod }
|
||||
|
||||
override string getContainerKind() { result = "a string" }
|
||||
}
|
||||
|
||||
/** An access to `Collection.size()`. */
|
||||
class CollectionSizeCall extends MethodAccess, SizeOfContainer {
|
||||
class CollectionSizeCall extends MethodCall, SizeOfContainer {
|
||||
CollectionSizeCall() { this.getMethod() instanceof CollectionSizeMethod }
|
||||
|
||||
override string getContainerKind() { result = "a collection" }
|
||||
}
|
||||
|
||||
/** An access to `Map.size()`. */
|
||||
class MapSizeCall extends MethodAccess, SizeOfContainer {
|
||||
class MapSizeCall extends MethodCall, SizeOfContainer {
|
||||
MapSizeCall() { this.getMethod() instanceof MapSizeMethod }
|
||||
|
||||
override string getContainerKind() { result = "a map" }
|
||||
|
||||
@@ -18,7 +18,7 @@ import java
|
||||
class DangerousExpression extends Expr {
|
||||
DangerousExpression() {
|
||||
exists(Expr e | this = e.getParent*() |
|
||||
e instanceof MethodAccess or
|
||||
e instanceof MethodCall or
|
||||
e instanceof ArrayAccess or
|
||||
exists(e.(FieldAccess).getQualifier())
|
||||
)
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess c, Method m, ParameterizedClass p, AnnotationType t
|
||||
from MethodCall c, Method m, ParameterizedClass p, AnnotationType t
|
||||
where
|
||||
c.getMethod() = m and
|
||||
m.hasName("isAnnotationPresent") and
|
||||
|
||||
@@ -42,8 +42,8 @@ private predicate closeableType(RefType t) {
|
||||
* An access to a method on a type in the 'java.sql` package that creates a closeable object in the `java.sql` package.
|
||||
* For example, `PreparedStatement.executeQuery()` or `Connection.prepareStatement(String)`.
|
||||
*/
|
||||
class SqlResourceOpeningMethodAccess extends MethodAccess {
|
||||
SqlResourceOpeningMethodAccess() {
|
||||
class SqlResourceOpeningMethodCall extends MethodCall {
|
||||
SqlResourceOpeningMethodCall() {
|
||||
exists(Method m | this.getMethod() = m |
|
||||
m.getDeclaringType().hasQualifiedName("java.sql", _) and
|
||||
m.getReturnType().(RefType).hasQualifiedName("java.sql", _) and
|
||||
@@ -60,7 +60,7 @@ class SqlResourceOpeningMethodAccess extends MethodAccess {
|
||||
class CloseableInitExpr extends Expr {
|
||||
CloseableInitExpr() {
|
||||
this instanceof ClassInstanceExpr or
|
||||
this instanceof SqlResourceOpeningMethodAccess
|
||||
this instanceof SqlResourceOpeningMethodCall
|
||||
}
|
||||
}
|
||||
|
||||
@@ -86,7 +86,7 @@ private predicate closeableInit(Expr e, Expr parent) {
|
||||
)
|
||||
)
|
||||
or
|
||||
exists(SqlResourceOpeningMethodAccess ma | ma = e and parent = e)
|
||||
exists(SqlResourceOpeningMethodCall ma | ma = e and parent = e)
|
||||
or
|
||||
exists(LocalVariableDecl v, Expr f | e = v.getAnAccess() and flowsInto(f, v) |
|
||||
closeableInit(f, parent)
|
||||
@@ -218,7 +218,7 @@ private predicate closeCalled(Variable v) {
|
||||
exists(TryStmt try | try.getAResourceVariable() = v)
|
||||
or
|
||||
// Otherwise, there should be an explicit call to a method whose name contains "close".
|
||||
exists(MethodAccess e |
|
||||
exists(MethodCall e |
|
||||
v = getCloseableVariable(_) or v instanceof Parameter or v instanceof LocalVariableDecl
|
||||
|
|
||||
e.getMethod().getName().toLowerCase().matches("%close%") and
|
||||
@@ -263,7 +263,7 @@ private predicate closedResource(CloseableInitExpr cie) {
|
||||
}
|
||||
|
||||
private predicate immediatelyClosed(ClassInstanceExpr cie) {
|
||||
exists(MethodAccess ma | ma.getQualifier() = cie | ma.getMethod().hasName("close"))
|
||||
exists(MethodCall ma | ma.getQualifier() = cie | ma.getMethod().hasName("close"))
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -305,10 +305,10 @@ predicate noNeedToClose(CloseableInitExpr cie) {
|
||||
flowsInto(sqlStmt, v) and
|
||||
closedResource(sqlStmt) and
|
||||
cie.getType() instanceof TypeResultSet and
|
||||
cie.(SqlResourceOpeningMethodAccess).getQualifier() = v.getAnAccess()
|
||||
cie.(SqlResourceOpeningMethodCall).getQualifier() = v.getAnAccess()
|
||||
)
|
||||
or
|
||||
exists(MethodAccess ma | cie.(ClassInstanceExpr).getAnArgument() = ma |
|
||||
exists(MethodCall ma | cie.(ClassInstanceExpr).getAnArgument() = ma |
|
||||
ma.getMethod() instanceof ServletResponseGetOutputStreamMethod or
|
||||
ma.getMethod() instanceof ServletResponseGetWriterMethod or
|
||||
ma.getMethod() instanceof ServletRequestGetBodyMethod
|
||||
|
||||
@@ -35,8 +35,8 @@ private predicate nonChainingReturn(Method m, ReturnStmt ret) {
|
||||
ret.getResult().getType() != m.getDeclaringType()
|
||||
or
|
||||
// A method call to the wrong method is returned.
|
||||
ret.getResult() instanceof MethodAccess and
|
||||
exists(MethodAccess delegateCall, Method delegate |
|
||||
ret.getResult() instanceof MethodCall and
|
||||
exists(MethodCall delegateCall, Method delegate |
|
||||
delegateCall = ret.getResult() and
|
||||
delegate = delegateCall.getMethod()
|
||||
|
|
||||
@@ -47,7 +47,7 @@ private predicate nonChainingReturn(Method m, ReturnStmt ret) {
|
||||
not hasDescendant(m.getReturnType(), delegate.getReturnType())
|
||||
or
|
||||
// A method on the wrong object is called.
|
||||
not delegateCall.isOwnMethodAccess()
|
||||
not delegateCall.isOwnMethodCall()
|
||||
or
|
||||
nonChaining(delegate)
|
||||
)
|
||||
@@ -55,6 +55,6 @@ private predicate nonChainingReturn(Method m, ReturnStmt ret) {
|
||||
// Something else is returned.
|
||||
not (
|
||||
ret.getResult() instanceof ThisAccess or
|
||||
ret.getResult() instanceof MethodAccess
|
||||
ret.getResult() instanceof MethodCall
|
||||
)
|
||||
}
|
||||
|
||||
@@ -33,7 +33,7 @@ predicate exclude(Method m) {
|
||||
* - is different from `callToCheck`, and
|
||||
* - is not a call to an excluded method.
|
||||
*/
|
||||
predicate checkExpr(MethodAccess callToCheck, MethodAccess otherCall, string operation, Variable v) {
|
||||
predicate checkExpr(MethodCall callToCheck, MethodCall otherCall, string operation, Variable v) {
|
||||
not exclude(otherCall.getMethod()) and
|
||||
v.getAnAssignedValue() = callToCheck and
|
||||
otherCall != callToCheck and
|
||||
@@ -47,7 +47,7 @@ predicate checkExpr(MethodAccess callToCheck, MethodAccess otherCall, string ope
|
||||
/**
|
||||
* Holds if `operation` is implicitly called on `v`, and `v` is assigned the result of `callToCheck`.
|
||||
*/
|
||||
predicate implicitCheckExpr(MethodAccess callToCheck, string operation, Variable v) {
|
||||
predicate implicitCheckExpr(MethodCall callToCheck, string operation, Variable v) {
|
||||
exists(TryStmt try, LocalVariableDeclExpr decl |
|
||||
try.getAResourceDecl().getAVariable() = decl and
|
||||
decl.getVariable() = v and
|
||||
@@ -62,7 +62,7 @@ predicate implicitCheckExpr(MethodAccess callToCheck, string operation, Variable
|
||||
Expr getChainedAccess(Variable v) {
|
||||
result = v.getAnAccess()
|
||||
or
|
||||
exists(MethodAccess chainedAccess | chainedAccess.getQualifier() = getChainedAccess(v) |
|
||||
exists(MethodCall chainedAccess | chainedAccess.getQualifier() = getChainedAccess(v) |
|
||||
designedForChaining(chainedAccess.getMethod()) and result = chainedAccess
|
||||
)
|
||||
}
|
||||
@@ -70,7 +70,7 @@ Expr getChainedAccess(Variable v) {
|
||||
/**
|
||||
* The result of `ma` and a call to a method named `operation` are both assigned to the same variable.
|
||||
*/
|
||||
predicate checkedFunctionCall(MethodAccess ma, string operation) {
|
||||
predicate checkedFunctionCall(MethodCall ma, string operation) {
|
||||
relevantFunctionCall(ma, _) and
|
||||
exists(Variable v | not v instanceof Field |
|
||||
v.getAnAssignedValue() = ma and
|
||||
@@ -81,24 +81,24 @@ predicate checkedFunctionCall(MethodAccess ma, string operation) {
|
||||
/**
|
||||
* The method access `ma` is a call to `m` where the result is assigned.
|
||||
*/
|
||||
predicate relevantFunctionCall(MethodAccess ma, Method m) {
|
||||
predicate relevantFunctionCall(MethodCall ma, Method m) {
|
||||
ma.getMethod() = m and
|
||||
exists(Variable v | v.getAnAssignedValue() = ma) and
|
||||
not okToIgnore(ma)
|
||||
}
|
||||
|
||||
predicate okToIgnore(MethodAccess ma) { not ma.getCompilationUnit().fromSource() }
|
||||
predicate okToIgnore(MethodCall ma) { not ma.getCompilationUnit().fromSource() }
|
||||
|
||||
predicate functionStats(Method m, string operation, int used, int total, int percentage) {
|
||||
m.getReturnType() instanceof RefType and
|
||||
// Calls to `m` where we also perform `operation`.
|
||||
used = strictcount(MethodAccess ma | checkedFunctionCall(ma, operation) and m = ma.getMethod()) and
|
||||
used = strictcount(MethodCall ma | checkedFunctionCall(ma, operation) and m = ma.getMethod()) and
|
||||
// Calls to `m`.
|
||||
total = strictcount(MethodAccess ma | relevantFunctionCall(ma, m)) and
|
||||
total = strictcount(MethodCall ma | relevantFunctionCall(ma, m)) and
|
||||
percentage = used * 100 / total
|
||||
}
|
||||
|
||||
from MethodAccess unchecked, Method m, string operation, int percent
|
||||
from MethodCall unchecked, Method m, string operation, int percent
|
||||
where
|
||||
relevantFunctionCall(unchecked, m) and
|
||||
not checkedFunctionCall(unchecked, operation) and
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
import java
|
||||
import Chaining
|
||||
|
||||
predicate checkedMethodCall(MethodAccess ma) {
|
||||
predicate checkedMethodCall(MethodCall ma) {
|
||||
relevantMethodCall(ma, _) and
|
||||
not ma instanceof ValueDiscardingExpr
|
||||
}
|
||||
@@ -73,31 +73,31 @@ predicate isMustBeQualifierMockingMethod(Method m) {
|
||||
m.hasName("verify")
|
||||
}
|
||||
|
||||
predicate relevantMethodCall(MethodAccess ma, Method m) {
|
||||
predicate relevantMethodCall(MethodCall ma, Method m) {
|
||||
// For "return value ignored", all method calls are relevant.
|
||||
not ma.getFile().isKotlinSourceFile() and
|
||||
ma.getMethod() = m and
|
||||
not m.getReturnType().hasName("void") and
|
||||
(not isMockingMethod(m) or isMustBeQualifierMockingMethod(m)) and
|
||||
not isMockingMethod(ma.getQualifier().(MethodAccess).getMethod())
|
||||
not isMockingMethod(ma.getQualifier().(MethodCall).getMethod())
|
||||
}
|
||||
|
||||
predicate methodStats(Method m, int used, int total, int percentage) {
|
||||
used = strictcount(MethodAccess ma | checkedMethodCall(ma) and m = ma.getMethod()) and
|
||||
total = strictcount(MethodAccess ma | relevantMethodCall(ma, m)) and
|
||||
used = strictcount(MethodCall ma | checkedMethodCall(ma) and m = ma.getMethod()) and
|
||||
total = strictcount(MethodCall ma | relevantMethodCall(ma, m)) and
|
||||
percentage = used * 100 / total
|
||||
}
|
||||
|
||||
int chainedUses(Method m) {
|
||||
result =
|
||||
count(MethodAccess ma, MethodAccess qual |
|
||||
count(MethodCall ma, MethodCall qual |
|
||||
ma.getMethod() = m and
|
||||
ma.getQualifier() = qual and
|
||||
qual.getMethod() = m
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess unchecked, Method m, int percent, int total
|
||||
from MethodCall unchecked, Method m, int percent, int total
|
||||
where
|
||||
relevantMethodCall(unchecked, m) and
|
||||
not checkedMethodCall(unchecked) and
|
||||
|
||||
@@ -78,7 +78,7 @@ where
|
||||
ssa.getCfgNode().(Expr).getParent*() = loop.(ForStmt).getAnInit()
|
||||
) and
|
||||
// And `cond` does not use method calls, field reads, or array reads.
|
||||
not exists(MethodAccess ma | ma.getParent*() = cond) and
|
||||
not exists(MethodCall ma | ma.getParent*() = cond) and
|
||||
not exists(FieldRead fa |
|
||||
// Ignore if field is final
|
||||
not fa.getField().isFinal() and
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess mc
|
||||
from MethodCall mc
|
||||
where
|
||||
mc.getQualifier().getType() instanceof TypeString and
|
||||
mc.getMethod().hasName("equals") and
|
||||
|
||||
@@ -14,25 +14,25 @@ import java
|
||||
/** A local variable that is initialized using a key-set iterator. */
|
||||
class KeySetIterator extends LocalVariableDecl {
|
||||
KeySetIterator() {
|
||||
exists(LocalVariableDeclExpr lvde, MethodAccess init |
|
||||
exists(LocalVariableDeclExpr lvde, MethodCall init |
|
||||
lvde.getVariable() = this and
|
||||
lvde.getInit() = init and
|
||||
init.getMethod().hasName("iterator") and
|
||||
init.getQualifier().(MethodAccess).getMethod().hasName("keySet")
|
||||
init.getQualifier().(MethodCall).getMethod().hasName("keySet")
|
||||
)
|
||||
}
|
||||
|
||||
LocalVariableDecl getBase() {
|
||||
exists(LocalVariableDeclExpr lvde, MethodAccess init |
|
||||
exists(LocalVariableDeclExpr lvde, MethodCall init |
|
||||
lvde.getVariable() = this and
|
||||
lvde.getInit() = init and
|
||||
init.getQualifier().(MethodAccess).getQualifier().(VarAccess).getVariable() = result
|
||||
init.getQualifier().(MethodCall).getQualifier().(VarAccess).getVariable() = result
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
predicate isKeyNext(Expr e, KeySetIterator it) {
|
||||
exists(MethodAccess ma | ma = e |
|
||||
exists(MethodCall ma | ma = e |
|
||||
ma.getMethod().hasName("next") and
|
||||
ma.getQualifier().(VarAccess).getVariable() = it
|
||||
)
|
||||
@@ -56,7 +56,7 @@ class Key extends LocalVariableDecl {
|
||||
}
|
||||
}
|
||||
|
||||
from MethodAccess ma, Method get
|
||||
from MethodCall ma, Method get
|
||||
where
|
||||
ma.getMethod() = get and
|
||||
get.hasName("get") and
|
||||
|
||||
@@ -34,7 +34,7 @@ where
|
||||
) and
|
||||
// If that method doesn't call write itself, then we don't have a problem.
|
||||
// This is the case is some dummy implementations.
|
||||
exists(MethodAccess ma | ma.getEnclosingCallable() = m | ma.getMethod().getName() = "write")
|
||||
exists(MethodCall ma | ma.getEnclosingCallable() = m | ma.getMethod().getName() = "write")
|
||||
select c,
|
||||
"This class extends 'java.io.OutputStream' and implements $@, but does not override 'write(byte[],int,int)'.",
|
||||
m, m.getName()
|
||||
|
||||
@@ -74,7 +74,7 @@ RefType enclosingInstanceAccess(Expr expr) {
|
||||
not inherits(enclosing, fa.getVariable())
|
||||
)
|
||||
or
|
||||
exists(MethodAccess ma | ma = expr |
|
||||
exists(MethodCall ma | ma = expr |
|
||||
result = ma.getMethod().getDeclaringType() and
|
||||
not exists(ma.getQualifier()) and
|
||||
not ma.getMethod().isStatic() and
|
||||
|
||||
@@ -12,5 +12,5 @@
|
||||
|
||||
import semmle.code.java.security.PartialPathTraversal
|
||||
|
||||
from PartialPathTraversalMethodAccess ma
|
||||
from PartialPathTraversalMethodCall ma
|
||||
select ma, "Partial Path Traversal Vulnerability due to insufficient guard against path traversal."
|
||||
|
||||
@@ -13,6 +13,6 @@
|
||||
import java
|
||||
import semmle.code.java.frameworks.android.WebView
|
||||
|
||||
from MethodAccess ma
|
||||
from MethodCall ma
|
||||
where ma.getMethod() instanceof WebViewAddJavascriptInterfaceMethod
|
||||
select ma, "JavaScript interface to Java object added in Android WebView."
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
import java
|
||||
import semmle.code.java.frameworks.android.WebView
|
||||
|
||||
from MethodAccess ma
|
||||
from MethodCall ma
|
||||
where
|
||||
ma.getMethod() instanceof AllowJavaScriptMethod and
|
||||
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
|
||||
|
||||
@@ -24,8 +24,8 @@ private class TypeWebViewOrSubclass extends RefType {
|
||||
*
|
||||
* In Kotlin, member accesses are translated to getter methods.
|
||||
*/
|
||||
private class PrivateGetterMethodAccess extends MethodAccess {
|
||||
PrivateGetterMethodAccess() {
|
||||
private class PrivateGetterMethodCall extends MethodCall {
|
||||
PrivateGetterMethodCall() {
|
||||
this.getMethod() instanceof GetterMethod and
|
||||
this.getMethod().isPrivate()
|
||||
}
|
||||
@@ -39,11 +39,11 @@ class WebViewSource extends DataFlow::Node {
|
||||
// constructor and method calls, or method accesses which are cast to WebView.
|
||||
(
|
||||
this.asExpr() instanceof ClassInstanceExpr or
|
||||
this.asExpr() instanceof MethodAccess or
|
||||
this.asExpr().(CastExpr).getAChildExpr() instanceof MethodAccess
|
||||
this.asExpr() instanceof MethodCall or
|
||||
this.asExpr().(CastExpr).getAChildExpr() instanceof MethodCall
|
||||
) and
|
||||
// Avoid duplicate results from Kotlin member accesses.
|
||||
not this.asExpr() instanceof PrivateGetterMethodAccess
|
||||
not this.asExpr() instanceof PrivateGetterMethodCall
|
||||
}
|
||||
}
|
||||
|
||||
@@ -53,7 +53,7 @@ class WebViewSource extends DataFlow::Node {
|
||||
*/
|
||||
class WebSettingsDisallowContentAccessSink extends DataFlow::Node {
|
||||
WebSettingsDisallowContentAccessSink() {
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getQualifier() = this.asExpr() and
|
||||
ma.getMethod() instanceof AllowContentAccessMethod and
|
||||
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = false
|
||||
@@ -86,7 +86,7 @@ module WebViewDisallowContentAccessConfig implements DataFlow::StateConfigSig {
|
||||
state2 instanceof IsSettings and
|
||||
// settings = webView.getSettings()
|
||||
// ^node2 = ^node1
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma = node2.asExpr() and
|
||||
ma.getQualifier() = node1.asExpr() and
|
||||
ma.getMethod() instanceof WebViewGetSettingsMethod
|
||||
@@ -105,7 +105,7 @@ module WebViewDisallowContentAccessFlow =
|
||||
from Expr e
|
||||
where
|
||||
// explicit: setAllowContentAccess(true)
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma = e and
|
||||
ma.getMethod() instanceof AllowContentAccessMethod and
|
||||
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
import java
|
||||
import semmle.code.java.frameworks.android.WebView
|
||||
|
||||
from MethodAccess ma
|
||||
from MethodCall ma
|
||||
where
|
||||
ma.getMethod() instanceof CrossOriginAccessMethod and
|
||||
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
|
||||
|
||||
@@ -24,18 +24,18 @@ import semmle.code.java.security.TempDirLocalInformationDisclosureQuery
|
||||
* We achieve this by making inherently-insecure method invocations into an edge-less graph,
|
||||
* resulting in a zero-length paths.
|
||||
*/
|
||||
module InsecureMethodPathGraph implements DataFlow::PathGraphSig<MethodAccessInsecureFileCreation> {
|
||||
predicate edges(MethodAccessInsecureFileCreation n1, MethodAccessInsecureFileCreation n2) {
|
||||
module InsecureMethodPathGraph implements DataFlow::PathGraphSig<MethodCallInsecureFileCreation> {
|
||||
predicate edges(MethodCallInsecureFileCreation n1, MethodCallInsecureFileCreation n2) {
|
||||
none()
|
||||
}
|
||||
|
||||
predicate nodes(MethodAccessInsecureFileCreation n, string key, string val) {
|
||||
predicate nodes(MethodCallInsecureFileCreation n, string key, string val) {
|
||||
key = "semmle.label" and val = n.toString()
|
||||
}
|
||||
|
||||
predicate subpaths(
|
||||
MethodAccessInsecureFileCreation n1, MethodAccessInsecureFileCreation n2,
|
||||
MethodAccessInsecureFileCreation n3, MethodAccessInsecureFileCreation n4
|
||||
MethodCallInsecureFileCreation n1, MethodCallInsecureFileCreation n2,
|
||||
MethodCallInsecureFileCreation n3, MethodCallInsecureFileCreation n4
|
||||
) {
|
||||
none()
|
||||
}
|
||||
@@ -43,7 +43,7 @@ module InsecureMethodPathGraph implements DataFlow::PathGraphSig<MethodAccessIns
|
||||
|
||||
module Flow =
|
||||
DataFlow::MergePathGraph<TempDirSystemGetPropertyToCreate::PathNode,
|
||||
MethodAccessInsecureFileCreation, TempDirSystemGetPropertyToCreate::PathGraph,
|
||||
MethodCallInsecureFileCreation, TempDirSystemGetPropertyToCreate::PathGraph,
|
||||
InsecureMethodPathGraph>;
|
||||
|
||||
import Flow::PathGraph
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
import java
|
||||
import semmle.code.java.security.Mail
|
||||
|
||||
from MethodAccess ma
|
||||
from MethodCall ma
|
||||
where
|
||||
ma.getMethod() instanceof MailSessionGetInstanceMethod and
|
||||
isInsecureMailPropertyConfig(ma.getArgument(0).(VarAccess).getVariable())
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
import java
|
||||
import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery
|
||||
|
||||
from SensitiveSource data, LocalDatabaseOpenMethodAccess s, Expr input, Expr store
|
||||
from SensitiveSource data, LocalDatabaseOpenMethodCall s, Expr input, Expr store
|
||||
where
|
||||
input = s.getAnInput() and
|
||||
store = s.getAStore() and
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
import java
|
||||
import semmle.code.java.security.CleartextStorageSharedPrefsQuery
|
||||
|
||||
from SensitiveSource data, SharedPreferencesEditorMethodAccess s, Expr input, Expr store
|
||||
from SensitiveSource data, SharedPreferencesEditorMethodCall s, Expr input, Expr store
|
||||
where
|
||||
input = s.getAnInput() and
|
||||
store = s.getAStore() and
|
||||
|
||||
@@ -25,7 +25,7 @@ class Socket extends RefType {
|
||||
Socket() { this.getAnAncestor().hasQualifiedName("java.net", "Socket") }
|
||||
}
|
||||
|
||||
from MethodAccess m, Class c, string type
|
||||
from MethodCall m, Class c, string type
|
||||
where
|
||||
m.getQualifier().getType() = c and
|
||||
(
|
||||
|
||||
@@ -56,7 +56,7 @@ predicate methodInfo(Method m, RefType t, string name) {
|
||||
m.getName() = name
|
||||
}
|
||||
|
||||
predicate query(MethodAccess m, Method def, int paramNo, string message, Element evidence) {
|
||||
predicate query(MethodCall m, Method def, int paramNo, string message, Element evidence) {
|
||||
m.getMethod() = def and
|
||||
// Using a networking method.
|
||||
def.getDeclaringType() instanceof NetworkClass and
|
||||
@@ -76,6 +76,6 @@ predicate query(MethodAccess m, Method def, int paramNo, string message, Element
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess m, Method def, int param, string message, Element evidence
|
||||
from MethodCall m, Method def, int param, string message, Element evidence
|
||||
where query(m, def, param, message, evidence)
|
||||
select m, "Method " + message + ": use an SSL factory."
|
||||
|
||||
@@ -21,8 +21,8 @@ private class PredictableApacheRandomStringUtilsMethod extends Method {
|
||||
}
|
||||
}
|
||||
|
||||
private class PredictableApacheRandomStringUtilsMethodAccess extends MethodAccess {
|
||||
PredictableApacheRandomStringUtilsMethodAccess() {
|
||||
private class PredictableApacheRandomStringUtilsMethodCall extends MethodCall {
|
||||
PredictableApacheRandomStringUtilsMethodCall() {
|
||||
this.getMethod() instanceof PredictableApacheRandomStringUtilsMethod
|
||||
}
|
||||
}
|
||||
@@ -41,7 +41,7 @@ private class VulnerableJHipsterRandomUtilMethod extends Method {
|
||||
this.getReturnType() instanceof TypeString and
|
||||
exists(ReturnStmt s |
|
||||
s = this.getBody().(SingletonBlock).getStmt() and
|
||||
s.getResult() instanceof PredictableApacheRandomStringUtilsMethodAccess
|
||||
s.getResult() instanceof PredictableApacheRandomStringUtilsMethodCall
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -14,6 +14,6 @@
|
||||
import java
|
||||
import semmle.code.java.security.SpringCsrfProtection
|
||||
|
||||
from MethodAccess call
|
||||
from MethodCall call
|
||||
where disablesSpringCsrfProtection(call)
|
||||
select call, "CSRF vulnerability due to protection being disabled."
|
||||
|
||||
@@ -28,7 +28,7 @@ predicate commonSynchronization(Expr e1, Expr e2, Variable monitor) {
|
||||
/**
|
||||
* Holds if `m` is a call to a synchronized method on `receiver`.
|
||||
*/
|
||||
predicate synchCallOn(MethodAccess m, Variable receiver) {
|
||||
predicate synchCallOn(MethodCall m, Variable receiver) {
|
||||
m.getCallee() instanceof SynchronizedCallable and
|
||||
m.getQualifier() = receiver.getAnAccess()
|
||||
}
|
||||
@@ -98,7 +98,7 @@ predicate probablyNeverEscapes(LocalVariableDecl v) {
|
||||
}
|
||||
|
||||
// Loop conditions tend to be uninteresting, so are not included.
|
||||
from IfStmt check, MethodAccess call1, MethodAccess call2, Variable r
|
||||
from IfStmt check, MethodCall call1, MethodCall call2, Variable r
|
||||
where
|
||||
check.getCondition().getAChildExpr*() = call1 and
|
||||
// This can happen if there are loops, etc.
|
||||
|
||||
@@ -53,7 +53,7 @@ predicate controlledByAuth(Expr controlled, Expr condition) {
|
||||
exists(ConditionBlock b |
|
||||
condition = b.getCondition() and
|
||||
b.controls(controlled.getBasicBlock(), _) and
|
||||
condition.(MethodAccess).getMethod() instanceof AuthMethod
|
||||
condition.(MethodCall).getMethod() instanceof AuthMethod
|
||||
)
|
||||
}
|
||||
|
||||
@@ -71,7 +71,7 @@ predicate controlledByAuth(Expr controlled, Expr condition) {
|
||||
* no idea which ones were meant to be secure.
|
||||
*/
|
||||
|
||||
from MethodAccess connection, Expr condition
|
||||
from MethodCall connection, Expr condition
|
||||
where
|
||||
connection.getMethod() instanceof ConnectionMethod and
|
||||
controlledByAuth(connection, condition)
|
||||
|
||||
@@ -17,5 +17,5 @@ import UnsafeDeserializationFlow::PathGraph
|
||||
|
||||
from UnsafeDeserializationFlow::PathNode source, UnsafeDeserializationFlow::PathNode sink
|
||||
where UnsafeDeserializationFlow::flowPath(source, sink)
|
||||
select sink.getNode().(UnsafeDeserializationSink).getMethodAccess(), source, sink,
|
||||
select sink.getNode().(UnsafeDeserializationSink).getMethodCall(), source, sink,
|
||||
"Unsafe deserialization depends on a $@.", source.getNode(), "user-provided value"
|
||||
|
||||
@@ -15,7 +15,7 @@ import java
|
||||
import semmle.code.java.frameworks.Servlets
|
||||
import semmle.code.java.security.InsecureCookieQuery
|
||||
|
||||
from MethodAccess add
|
||||
from MethodCall add
|
||||
where
|
||||
add.getMethod() instanceof ResponseAddCookieMethod and
|
||||
not SecureCookieFlow::flowToExpr(add.getArgument(0))
|
||||
|
||||
@@ -15,7 +15,7 @@ import java
|
||||
|
||||
predicate dangerousMethod(string descriptor) { descriptor = "java.lang.Thread.stop" }
|
||||
|
||||
from MethodAccess call, Method target, string descriptor
|
||||
from MethodCall call, Method target, string descriptor
|
||||
where
|
||||
call.getCallee() = target and
|
||||
descriptor = target.getDeclaringType().getQualifiedName() + "." + target.getName() and
|
||||
|
||||
@@ -18,7 +18,7 @@ import semmle.code.java.security.ConditionalBypassQuery
|
||||
import ConditionalBypassFlow::PathGraph
|
||||
|
||||
from
|
||||
ConditionalBypassFlow::PathNode source, ConditionalBypassFlow::PathNode sink, MethodAccess m,
|
||||
ConditionalBypassFlow::PathNode source, ConditionalBypassFlow::PathNode sink, MethodCall m,
|
||||
Expr e
|
||||
where
|
||||
conditionControlsMethod(m, e) and
|
||||
|
||||
@@ -19,8 +19,8 @@ class LockVariable extends Variable {
|
||||
}
|
||||
|
||||
/** An access to method `lock` on this variable. */
|
||||
MethodAccess getLockAction() {
|
||||
exists(MethodAccess ma | ma.getQualifier() = this.getAnAccess() |
|
||||
MethodCall getLockAction() {
|
||||
exists(MethodCall ma | ma.getQualifier() = this.getAnAccess() |
|
||||
ma.getMethod().hasName("lock") and
|
||||
result = ma
|
||||
)
|
||||
@@ -35,7 +35,7 @@ class Synched extends Top {
|
||||
exists(Method m | m.isSynchronized() and not m.isStatic() |
|
||||
m = this
|
||||
or
|
||||
exists(MethodAccess ma, VarAccess qual | ma = this and qual = ma.getQualifier() |
|
||||
exists(MethodCall ma, VarAccess qual | ma = this and qual = ma.getQualifier() |
|
||||
ma.getMethod() = m
|
||||
)
|
||||
)
|
||||
@@ -47,7 +47,7 @@ class Synched extends Top {
|
||||
or
|
||||
result = this.(SynchronizedStmt).getAChild+()
|
||||
or
|
||||
exists(MethodAccess ma | ma = result |
|
||||
exists(MethodCall ma | ma = result |
|
||||
ma.getEnclosingStmt().getEnclosingStmt*() = this or ma.getEnclosingCallable() = this
|
||||
)
|
||||
}
|
||||
@@ -65,7 +65,7 @@ class Synched extends Top {
|
||||
*/
|
||||
RefType getLockType() {
|
||||
result = this.(Method).getDeclaringType().getSourceDeclaration() or
|
||||
result = this.(MethodAccess).getMethod().getDeclaringType().getSourceDeclaration()
|
||||
result = this.(MethodCall).getMethod().getDeclaringType().getSourceDeclaration()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -74,8 +74,8 @@ class Synched extends Top {
|
||||
* and then on another variable in `second`, but elsewhere, the lock order is reversed
|
||||
* by first obtaining a lock on the latter variable in `otherFirst`.
|
||||
*/
|
||||
predicate badReentrantLockOrder(MethodAccess first, MethodAccess second, MethodAccess otherFirst) {
|
||||
exists(LockVariable v1, LockVariable v2, MethodAccess otherSecond |
|
||||
predicate badReentrantLockOrder(MethodCall first, MethodCall second, MethodCall otherFirst) {
|
||||
exists(LockVariable v1, LockVariable v2, MethodCall otherSecond |
|
||||
first = v1.getLockAction() and
|
||||
otherSecond = v1.getLockAction() and
|
||||
second = v2.getLockAction() and
|
||||
@@ -113,7 +113,7 @@ predicate badSynchronizedStmtLockOrder(Expr outerExpr, Expr innerExpr, Expr othe
|
||||
* The method access `ma` to method `m` is qualified by an access to variable `vQual`
|
||||
* and has an access to variable `vArg` as the argument at index `i`.
|
||||
*/
|
||||
predicate qualifiedMethodAccess(MethodAccess ma, Method m, Variable vQual, int i, Variable vArg) {
|
||||
predicate qualifiedMethodCall(MethodCall ma, Method m, Variable vQual, int i, Variable vArg) {
|
||||
ma.getMethod() = m and
|
||||
ma.getQualifier().(VarAccess).getVariable() = vQual and
|
||||
ma.getArgument(i).(VarAccess).getVariable() = vArg
|
||||
@@ -123,7 +123,7 @@ predicate qualifiedMethodAccess(MethodAccess ma, Method m, Variable vQual, int i
|
||||
* Holds if the specified method accesses occur on different branches of the same conditional statement
|
||||
* inside an unsynchronized method.
|
||||
*/
|
||||
predicate inDifferentBranches(MethodAccess ma1, MethodAccess ma2) {
|
||||
predicate inDifferentBranches(MethodCall ma1, MethodCall ma2) {
|
||||
exists(IfStmt cond |
|
||||
ma1.getEnclosingStmt() = cond.getThen().getAChild*() and
|
||||
ma2.getEnclosingStmt() = cond.getElse().getAChild*() and
|
||||
@@ -132,7 +132,7 @@ predicate inDifferentBranches(MethodAccess ma1, MethodAccess ma2) {
|
||||
}
|
||||
|
||||
/** The method access `ma` occurs in method `runnable`, which is an implementation of `Runnable.run()`. */
|
||||
predicate inRunnable(MethodAccess ma, Method runnable) {
|
||||
predicate inRunnable(MethodCall ma, Method runnable) {
|
||||
runnable.getName() = "run" and
|
||||
runnable.getDeclaringType().getAStrictAncestor().hasQualifiedName("java.lang", "Runnable") and
|
||||
ma.getEnclosingCallable() = runnable
|
||||
@@ -142,7 +142,7 @@ predicate inRunnable(MethodAccess ma, Method runnable) {
|
||||
* Holds if the specified method accesses occur in different `Runnable.run()` methods,
|
||||
* indicating that they may be invoked by different threads.
|
||||
*/
|
||||
predicate inDifferentRunnables(MethodAccess ma1, MethodAccess ma2) {
|
||||
predicate inDifferentRunnables(MethodCall ma1, MethodCall ma2) {
|
||||
exists(Method runnable1, Method runnable2 |
|
||||
inRunnable(ma1, runnable1) and
|
||||
inRunnable(ma2, runnable2) and
|
||||
@@ -155,18 +155,18 @@ predicate inDifferentRunnables(MethodAccess ma1, MethodAccess ma2) {
|
||||
* in statement `inner` that is qualified by one of the parameters of `outer`, and there is
|
||||
* another access to `outer` that may cause locking to be performed in a different order.
|
||||
*/
|
||||
predicate badMethodAccessLockOrder(
|
||||
MethodAccess outerAccess, MethodAccess innerAccess, MethodAccess other
|
||||
predicate badMethodCallLockOrder(
|
||||
MethodCall outerAccess, MethodCall innerAccess, MethodCall other
|
||||
) {
|
||||
exists(Synched outer, Synched inner |
|
||||
inner = innerAccess and
|
||||
inner = outer.getInnerSynch() and
|
||||
inner.getLockType() = outer.getLockType() and
|
||||
exists(Parameter p, int i | outer.(Method).getAParameter() = p and p.getPosition() = i |
|
||||
inner.(MethodAccess).getQualifier().(VarAccess).getVariable() = p and
|
||||
exists(MethodAccess ma1, MethodAccess ma2, Variable v1, Variable v2 |
|
||||
qualifiedMethodAccess(ma1, outer, v1, i, v2) and
|
||||
qualifiedMethodAccess(ma2, outer, v2, i, v1) and
|
||||
inner.(MethodCall).getQualifier().(VarAccess).getVariable() = p and
|
||||
exists(MethodCall ma1, MethodCall ma2, Variable v1, Variable v2 |
|
||||
qualifiedMethodCall(ma1, outer, v1, i, v2) and
|
||||
qualifiedMethodCall(ma2, outer, v2, i, v1) and
|
||||
v1 != v2 and
|
||||
(
|
||||
inDifferentBranches(ma1, ma2) or
|
||||
@@ -183,7 +183,7 @@ from Expr first, Expr second, Expr other
|
||||
where
|
||||
badReentrantLockOrder(first, second, other) or
|
||||
badSynchronizedStmtLockOrder(first, second, other) or
|
||||
badMethodAccessLockOrder(first, second, other)
|
||||
badMethodCallLockOrder(first, second, other)
|
||||
select first,
|
||||
"Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock.",
|
||||
second, "here", other, "here"
|
||||
|
||||
@@ -42,7 +42,7 @@ class ZipOutputStream extends Class {
|
||||
}
|
||||
|
||||
from
|
||||
ZipOutputStream jos, MethodAccess putNextEntry, MethodAccess closeEntry, RValue putNextQualifier,
|
||||
ZipOutputStream jos, MethodCall putNextEntry, MethodCall closeEntry, RValue putNextQualifier,
|
||||
RValue closeQualifier
|
||||
where
|
||||
putNextEntry.getMethod() = jos.putNextEntry() and
|
||||
|
||||
@@ -91,7 +91,7 @@ predicate exprHasNoEffect(Expr e) {
|
||||
constructorHasEffect(c)
|
||||
)
|
||||
or
|
||||
exists(MethodAccess ma, Method m |
|
||||
exists(MethodCall ma, Method m |
|
||||
bad = ma and m = ma.getMethod().getAPossibleImplementation()
|
||||
|
|
||||
methodHasEffect(m) or not m.fromSource()
|
||||
@@ -107,7 +107,7 @@ private predicate inInitializer(Expr e) {
|
||||
private predicate constructorHasEffect(Constructor c) {
|
||||
// Only assign fields of the class - do not call methods,
|
||||
// create new objects or assign any other variables.
|
||||
exists(MethodAccess ma | ma.getEnclosingCallable() = c)
|
||||
exists(MethodCall ma | ma.getEnclosingCallable() = c)
|
||||
or
|
||||
exists(ClassInstanceExpr cie | cie.getEnclosingCallable() = c)
|
||||
or
|
||||
@@ -120,7 +120,7 @@ private predicate constructorHasEffect(Constructor c) {
|
||||
}
|
||||
|
||||
private predicate methodHasEffect(Method m) {
|
||||
exists(MethodAccess ma | ma.getEnclosingCallable() = m) or
|
||||
exists(MethodCall ma | ma.getEnclosingCallable() = m) or
|
||||
exists(Assignment a | a.getEnclosingCallable() = m) or
|
||||
exists(ClassInstanceExpr cie | cie.getEnclosingCallable() = m) or
|
||||
exists(ThrowStmt throw | throw.getEnclosingCallable() = m) or
|
||||
|
||||
@@ -27,7 +27,7 @@ predicate isClassOf(ParameterizedClass c, RefType t) {
|
||||
* Holds if field `f` is potentially accessed by an `AtomicReferenceFieldUpdater`.
|
||||
*/
|
||||
predicate subjectToAtomicReferenceFieldUpdater(Field f) {
|
||||
exists(Class arfu, Method newUpdater, MethodAccess c |
|
||||
exists(Class arfu, Method newUpdater, MethodCall c |
|
||||
arfu.hasQualifiedName("java.util.concurrent.atomic", "AtomicReferenceFieldUpdater") and
|
||||
newUpdater = arfu.getAMethod() and
|
||||
newUpdater.hasName("newUpdater") and
|
||||
@@ -42,7 +42,7 @@ predicate subjectToAtomicReferenceFieldUpdater(Field f) {
|
||||
* Holds if `f` is ever looked up reflectively.
|
||||
*/
|
||||
predicate lookedUpReflectively(Field f) {
|
||||
exists(MethodAccess getDeclaredField |
|
||||
exists(MethodCall getDeclaredField |
|
||||
isClassOf(getDeclaredField.getQualifier().getType(), f.getDeclaringType()) and
|
||||
getDeclaredField.getMethod().hasName("getDeclaredField") and
|
||||
getDeclaredField.getArgument(0).(StringLiteral).getValue() = f.getName()
|
||||
|
||||
@@ -19,8 +19,8 @@ Method forwarderCandidate(Method forwardee) {
|
||||
result != forwardee and
|
||||
result.getName() = forwardee.getName() and
|
||||
result.getDeclaringType() = forwardee.getDeclaringType() and
|
||||
forex(MethodAccess c | c.getMethod() = forwardee | c.getCaller() = result) and
|
||||
forall(MethodAccess c | c.getCaller() = result | c.getMethod() = forwardee)
|
||||
forex(MethodCall c | c.getMethod() = forwardee | c.getCaller() = result) and
|
||||
forall(MethodCall c | c.getCaller() = result | c.getMethod() = forwardee)
|
||||
}
|
||||
|
||||
from Method forwarder, Method forwardee
|
||||
@@ -29,10 +29,10 @@ where
|
||||
// Exclusions
|
||||
not ignored(forwarder) and
|
||||
not ignored(forwardee) and
|
||||
not exists(VirtualMethodAccess c |
|
||||
not exists(VirtualMethodCall c |
|
||||
c.getMethod() = forwardee and
|
||||
c.getCaller() = forwarder and
|
||||
c.(MethodAccess).hasQualifier()
|
||||
c.(MethodCall).hasQualifier()
|
||||
)
|
||||
select forwarder.getSourceDeclaration(),
|
||||
"This method is a forwarder for $@, which is not called independently - the methods can be merged.",
|
||||
|
||||
@@ -21,7 +21,7 @@ private predicate relevantTypeNames(string typeName, string message) {
|
||||
}
|
||||
|
||||
private Type getAThrownExceptionType(TryStmt t) {
|
||||
exists(MethodAccess ma, Exception e |
|
||||
exists(MethodCall ma, Exception e |
|
||||
t.getBlock() = ma.getEnclosingStmt().getEnclosingStmt*() and
|
||||
ma.getMethod().getAnException() = e and
|
||||
result = e.getType()
|
||||
|
||||
@@ -43,7 +43,7 @@ predicate unboundedQueue(RefType t) {
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess ma, SpecialMethod m
|
||||
from MethodCall ma, SpecialMethod m
|
||||
where
|
||||
ma instanceof ValueDiscardingExpr and
|
||||
m = ma.getMethod() and
|
||||
|
||||
@@ -71,7 +71,7 @@ predicate mayWriteToArray(Expr modified) {
|
||||
or
|
||||
// return __array__; ... method()[1] = 0
|
||||
exists(ReturnStmt rs | modified = rs.getResult() and relevantType(modified.getType()) |
|
||||
exists(Callable enclosing, MethodAccess ma |
|
||||
exists(Callable enclosing, MethodCall ma |
|
||||
enclosing = rs.getEnclosingCallable() and ma.getMethod().getSourceDeclaration() = enclosing
|
||||
|
|
||||
mayWriteToArray(ma)
|
||||
@@ -84,7 +84,7 @@ predicate writesToArray(Expr array) {
|
||||
(
|
||||
exists(Assignment a, ArrayAccess access | a.getDest() = access | access.getArray() = array)
|
||||
or
|
||||
exists(MethodAccess ma | ma.getQualifier() = array | modifyMethod(ma.getMethod()))
|
||||
exists(MethodCall ma | ma.getQualifier() = array | modifyMethod(ma.getMethod()))
|
||||
)
|
||||
}
|
||||
|
||||
@@ -99,7 +99,7 @@ VarAccess varPassedInto(Callable c, int i) {
|
||||
|
||||
predicate exposesByReturn(Callable c, Field f, Expr why, string whyText) {
|
||||
returnsArray(c, f) and
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getMethod().getSourceDeclaration() = c and ma.getCompilationUnit() != c.getCompilationUnit()
|
||||
|
|
||||
mayWriteToArray(ma) and
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from Class c, MethodAccess getResource, MethodAccess getClass
|
||||
from Class c, MethodCall getResource, MethodCall getClass
|
||||
where
|
||||
getResource.getNumArgument() = 1 and
|
||||
(
|
||||
@@ -20,7 +20,7 @@ where
|
||||
getResource.getMethod().hasName("getResourceAsStream")
|
||||
) and
|
||||
getResource.getQualifier() = getClass and
|
||||
getClass.isOwnMethodAccess() and
|
||||
getClass.isOwnMethodCall() and
|
||||
getClass.getNumArgument() = 0 and
|
||||
getClass.getMethod().hasName("getClass") and
|
||||
getResource.getEnclosingCallable().getDeclaringType() = c and
|
||||
|
||||
@@ -97,7 +97,7 @@ private predicate nonTrivialValue(string value, Literal literal, string context)
|
||||
not literalIsConstantInitializer(literal, _) and
|
||||
not literal.getParent*() instanceof ArrayInit and
|
||||
not literal.getParent+() instanceof Annotation and
|
||||
exists(MethodAccess ma | literal = ma.getAnArgument() and ma.getMethod().getName() = context)
|
||||
exists(MethodCall ma | literal = ma.getAnArgument() and ma.getMethod().getName() = context)
|
||||
}
|
||||
|
||||
private predicate valueOccurrenceCount(string value, int n, string context) {
|
||||
@@ -173,7 +173,7 @@ private predicate relevantType(RefType t, string value, Package p) {
|
||||
|
||||
private predicate fieldUsedInContext(Field constField, string context) {
|
||||
literalIsConstantInitializer(_, constField) and
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
constField.getAnAccess() = ma.getAnArgument() and
|
||||
ma.getMethod().getName() = context
|
||||
)
|
||||
@@ -282,5 +282,5 @@ private predicate excludedLiteral(Literal lit) {
|
||||
// Remove test cases
|
||||
lit.getEnclosingCallable().getDeclaringType() instanceof TestClass
|
||||
or
|
||||
exists(MethodAccess ma | lit = ma.getAnArgument() | ma.getMethod() instanceof TestMethod)
|
||||
exists(MethodCall ma | lit = ma.getAnArgument() | ma.getMethod() instanceof TestMethod)
|
||||
}
|
||||
|
||||
@@ -37,13 +37,13 @@ predicate trivialContext(Literal e) {
|
||||
or
|
||||
e.getParent() instanceof AssignAddExpr
|
||||
or
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getMethod().getName() = "append" and
|
||||
(e = ma.getAnArgument() or e = ma.getQualifier())
|
||||
)
|
||||
or
|
||||
// Standard property in a call to `System.getProperty()`.
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getMethod().getName() = "getProperty" and
|
||||
e = ma.getAnArgument() and
|
||||
ma.getMethod().getDeclaringType() instanceof TypeSystem and
|
||||
|
||||
@@ -23,7 +23,7 @@ RefType nestedSupertypePlus(RefType t) {
|
||||
* A call (without a qualifier) in a nested type
|
||||
* to an inherited method with the specified `signature`.
|
||||
*/
|
||||
predicate callToInheritedMethod(RefType lexicalScope, MethodAccess ma, string signature) {
|
||||
predicate callToInheritedMethod(RefType lexicalScope, MethodCall ma, string signature) {
|
||||
not ma.getMethod().isStatic() and
|
||||
not ma.hasQualifier() and
|
||||
ma.getEnclosingCallable().getDeclaringType() = lexicalScope and
|
||||
@@ -46,7 +46,7 @@ Method methodInEnclosingType(NestedType nested, string signature) {
|
||||
)
|
||||
}
|
||||
|
||||
from MethodAccess ma, Method m, NestedType nt, string signature
|
||||
from MethodCall ma, Method m, NestedType nt, string signature
|
||||
where
|
||||
callToInheritedMethod(nt, ma, signature) and
|
||||
m = methodInEnclosingType(nt, signature) and
|
||||
|
||||
@@ -115,13 +115,13 @@ private predicate confusinglyOverloaded(Method m, Method n) {
|
||||
not exists(Method target | delegate*(m, target) and delegate*(n, target))
|
||||
}
|
||||
|
||||
private predicate wrappedAccess(Expr e, MethodAccess ma) {
|
||||
private predicate wrappedAccess(Expr e, MethodCall ma) {
|
||||
e = ma or
|
||||
wrappedAccess(e.(CastingExpr).getExpr(), ma)
|
||||
}
|
||||
|
||||
private predicate delegate(Method caller, Method callee) {
|
||||
exists(MethodAccess ma | ma.getMethod() = callee |
|
||||
exists(MethodCall ma | ma.getMethod() = callee |
|
||||
exists(Stmt stmt | stmt = caller.getBody().(SingletonBlock).getStmt() |
|
||||
wrappedAccess(stmt.(ExprStmt).getExpr(), ma) or
|
||||
wrappedAccess(stmt.(ReturnStmt).getResult(), ma)
|
||||
|
||||
@@ -57,7 +57,7 @@ predicate assignmentToShadowingLocal(LocalVariableDecl d, Field f) {
|
||||
ff.getSourceDeclaration() = f
|
||||
)
|
||||
or
|
||||
exists(MethodAccess get, Method getter | get = assignedValue and getter = get.getMethod() |
|
||||
exists(MethodCall get, Method getter | get = assignedValue and getter = get.getMethod() |
|
||||
getterFor(getter, f)
|
||||
)
|
||||
)
|
||||
@@ -66,7 +66,7 @@ predicate assignmentToShadowingLocal(LocalVariableDecl d, Field f) {
|
||||
predicate assignmentFromShadowingLocal(LocalVariableDecl d, Field f) {
|
||||
shadows(d, _, _, _) and
|
||||
exists(VarAccess access | access = d.getAnAccess() |
|
||||
exists(MethodAccess set, Expr arg, Method setter |
|
||||
exists(MethodCall set, Expr arg, Method setter |
|
||||
access = getARelevantChild(arg) and
|
||||
arg = set.getAnArgument() and
|
||||
setter = set.getMethod() and
|
||||
@@ -82,7 +82,7 @@ predicate assignmentFromShadowingLocal(LocalVariableDecl d, Field f) {
|
||||
}
|
||||
|
||||
private Expr getARelevantChild(Expr parent) {
|
||||
exists(MethodAccess ma | parent = ma.getAnArgument() and result = parent)
|
||||
exists(MethodCall ma | parent = ma.getAnArgument() and result = parent)
|
||||
or
|
||||
exists(Variable v | parent = v.getAnAccess() and result = parent)
|
||||
or
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, Method runfinalizers, Class c
|
||||
from MethodCall ma, Method runfinalizers, Class c
|
||||
where
|
||||
ma.getMethod() = runfinalizers and
|
||||
runfinalizers.hasName("runFinalizersOnExit") and
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess ma, ToStringMethod tostring
|
||||
from MethodCall ma, ToStringMethod tostring
|
||||
where
|
||||
tostring.getDeclaringType() instanceof TypeString and
|
||||
ma.getMethod() = tostring
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from Method m, MethodAccess sysexitCall, Method sysexit, Class system
|
||||
from Method m, MethodCall sysexitCall, Method sysexit, Class system
|
||||
where
|
||||
sysexitCall = m.getACallSite(sysexit) and
|
||||
(sysexit.hasName("exit") or sysexit.hasName("halt")) and
|
||||
|
||||
@@ -14,7 +14,7 @@ import java
|
||||
import semmle.code.java.StringFormat
|
||||
|
||||
predicate explicitToStringCall(Expr e) {
|
||||
exists(MethodAccess ma |
|
||||
exists(MethodCall ma |
|
||||
ma.getMethod() instanceof ToStringMethod and
|
||||
e = ma.getQualifier()
|
||||
)
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess mc, Method m
|
||||
from MethodCall mc, Method m
|
||||
where
|
||||
(
|
||||
m.getDeclaringType().hasQualifiedName("java.lang", "Runtime") or
|
||||
|
||||
@@ -12,11 +12,11 @@
|
||||
|
||||
import java
|
||||
|
||||
from MethodAccess m
|
||||
from MethodCall m
|
||||
where
|
||||
m.getMethod().hasName("next") and
|
||||
m.getMethod().getNumberOfParameters() = 0 and
|
||||
m.isOwnMethodAccess() and
|
||||
m.isOwnMethodCall() and
|
||||
exists(Interface i, Method hasNext |
|
||||
i.getSourceDeclaration().hasQualifiedName("java.util", "Iterator") and
|
||||
m.getEnclosingCallable() = hasNext and
|
||||
|
||||
@@ -16,7 +16,7 @@ import semmle.code.java.StringFormat
|
||||
* Holds if `e` is an argument of `Arrays.toString(..)`.
|
||||
*/
|
||||
predicate arraysToStringArgument(Expr e) {
|
||||
exists(MethodAccess ma, Method m |
|
||||
exists(MethodCall ma, Method m |
|
||||
ma.getAnArgument() = e and
|
||||
ma.getMethod() = m and
|
||||
m.getDeclaringType().hasQualifiedName("java.util", "Arrays") and
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
import java
|
||||
|
||||
predicate varArgsMethod(Method method, Array varargsType, int arity) {
|
||||
exists(MethodAccess access |
|
||||
exists(MethodCall access |
|
||||
access.getMethod() = method and
|
||||
arity = method.getNumberOfParameters() and
|
||||
not access.getNumArgument() = arity and
|
||||
@@ -36,7 +36,7 @@ predicate equivalent(Array declared, Array used) {
|
||||
declared.getDimension() = used.getDimension()
|
||||
}
|
||||
|
||||
from Method target, MethodAccess access, Array declaredType, Array usedType, int params
|
||||
from Method target, MethodCall access, Array declaredType, Array usedType, int params
|
||||
where
|
||||
varArgsMethod(target, declaredType, params) and
|
||||
target = access.getMethod() and
|
||||
|
||||
@@ -40,7 +40,7 @@ class TypeEndpointRequest extends Class {
|
||||
}
|
||||
|
||||
/** A call to `EndpointRequest.toAnyEndpoint` method. */
|
||||
class ToAnyEndpointCall extends MethodAccess {
|
||||
class ToAnyEndpointCall extends MethodCall {
|
||||
ToAnyEndpointCall() {
|
||||
this.getMethod().hasName("toAnyEndpoint") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeEndpointRequest
|
||||
@@ -50,7 +50,7 @@ class ToAnyEndpointCall extends MethodAccess {
|
||||
/**
|
||||
* A call to `HttpSecurity.requestMatcher` method with argument `RequestMatcher.toAnyEndpoint()`.
|
||||
*/
|
||||
class RequestMatcherCall extends MethodAccess {
|
||||
class RequestMatcherCall extends MethodCall {
|
||||
RequestMatcherCall() {
|
||||
this.getMethod().hasName("requestMatcher") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
|
||||
@@ -62,7 +62,7 @@ class RequestMatcherCall extends MethodAccess {
|
||||
* A call to `HttpSecurity.requestMatchers` method with lambda argument
|
||||
* `RequestMatcher.toAnyEndpoint()`.
|
||||
*/
|
||||
class RequestMatchersCall extends MethodAccess {
|
||||
class RequestMatchersCall extends MethodCall {
|
||||
RequestMatchersCall() {
|
||||
this.getMethod().hasName("requestMatchers") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity and
|
||||
@@ -71,7 +71,7 @@ class RequestMatchersCall extends MethodAccess {
|
||||
}
|
||||
|
||||
/** A call to `HttpSecurity.authorizeRequests` method. */
|
||||
class AuthorizeRequestsCall extends MethodAccess {
|
||||
class AuthorizeRequestsCall extends MethodCall {
|
||||
AuthorizeRequestsCall() {
|
||||
this.getMethod().hasName("authorizeRequests") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeHttpSecurity
|
||||
@@ -79,7 +79,7 @@ class AuthorizeRequestsCall extends MethodAccess {
|
||||
}
|
||||
|
||||
/** A call to `AuthorizedUrl.permitAll` method. */
|
||||
class PermitAllCall extends MethodAccess {
|
||||
class PermitAllCall extends MethodCall {
|
||||
PermitAllCall() {
|
||||
this.getMethod().hasName("permitAll") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeAuthorizedUrl
|
||||
@@ -135,7 +135,7 @@ class PermitAllCall extends MethodAccess {
|
||||
}
|
||||
|
||||
/** A call to `AbstractRequestMatcherRegistry.anyRequest` method. */
|
||||
class AnyRequestCall extends MethodAccess {
|
||||
class AnyRequestCall extends MethodCall {
|
||||
AnyRequestCall() {
|
||||
this.getMethod().hasName("anyRequest") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeAbstractRequestMatcherRegistry
|
||||
@@ -146,7 +146,7 @@ class AnyRequestCall extends MethodAccess {
|
||||
* A call to `AbstractRequestMatcherRegistry.requestMatchers` method with an argument
|
||||
* `RequestMatcher.toAnyEndpoint()`.
|
||||
*/
|
||||
class RegistryRequestMatchersCall extends MethodAccess {
|
||||
class RegistryRequestMatchersCall extends MethodCall {
|
||||
RegistryRequestMatchersCall() {
|
||||
this.getMethod().hasName("requestMatchers") and
|
||||
this.getMethod().getDeclaringType() instanceof TypeAbstractRequestMatcherRegistry and
|
||||
|
||||
@@ -36,7 +36,7 @@ module RemoteUrlToOpenStreamFlowConfig implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodAccess m |
|
||||
exists(MethodCall m |
|
||||
sink.asExpr() = m.getQualifier() and m.getMethod() instanceof UrlOpenStreamMethod
|
||||
)
|
||||
or
|
||||
@@ -55,7 +55,7 @@ module RemoteUrlToOpenStreamFlow = TaintTracking::Global<RemoteUrlToOpenStreamFl
|
||||
|
||||
from
|
||||
RemoteUrlToOpenStreamFlow::PathNode source, RemoteUrlToOpenStreamFlow::PathNode sink,
|
||||
MethodAccess call
|
||||
MethodCall call
|
||||
where
|
||||
sink.getNode().asExpr() = call.getQualifier() and
|
||||
RemoteUrlToOpenStreamFlow::flowPath(source, sink)
|
||||
|
||||
@@ -25,7 +25,7 @@ private class ActivateModels extends ActiveExperimentalModels {
|
||||
}
|
||||
|
||||
/** A complementary sanitizer that protects against path traversal using path normalization. */
|
||||
class PathNormalizeSanitizer extends MethodAccess {
|
||||
class PathNormalizeSanitizer extends MethodCall {
|
||||
PathNormalizeSanitizer() {
|
||||
exists(RefType t |
|
||||
t instanceof TypePath or
|
||||
|
||||
@@ -44,7 +44,7 @@ class SetRequestAttributeMethod extends Method {
|
||||
*/
|
||||
private class SetToGetAttributeStep extends AdditionalValueStep {
|
||||
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(MethodAccess gma, MethodAccess sma |
|
||||
exists(MethodCall gma, MethodCall sma |
|
||||
(
|
||||
gma.getMethod() instanceof GetSessionAttributeMethod and
|
||||
sma.getMethod() instanceof SetSessionAttributeMethod
|
||||
|
||||
@@ -9,7 +9,7 @@ module ExecCmdFlowConfig implements DataFlow::ConfigSig {
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodAccess call |
|
||||
exists(MethodCall call |
|
||||
call.getMethod() instanceof RuntimeExecMethod and
|
||||
sink.asExpr() = call.getArgument(0) and
|
||||
sink.asExpr().getType() instanceof Array
|
||||
@@ -34,7 +34,7 @@ module ExecUserFlowConfig implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) { source instanceof Source }
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodAccess call |
|
||||
exists(MethodCall call |
|
||||
call.getMethod() instanceof RuntimeExecMethod and
|
||||
sink.asExpr() = call.getArgument(_) and
|
||||
sink.asExpr().getType() instanceof Array
|
||||
@@ -74,7 +74,7 @@ class ArrayInitAtNonZeroIndex extends DataFlow::Node {
|
||||
// Stream.concat(Arrays.stream(array_1), Arrays.stream(array_2))
|
||||
class StreamConcatAtNonZeroIndex extends DataFlow::Node {
|
||||
StreamConcatAtNonZeroIndex() {
|
||||
exists(MethodAccess call, int index |
|
||||
exists(MethodCall call, int index |
|
||||
call.getMethod().getQualifiedName() = "java.util.stream.Stream.concat" and
|
||||
call.getArgument(index) = this.asExpr() and
|
||||
index != 0
|
||||
@@ -96,7 +96,7 @@ predicate callIsTaintedByUserInputAndDangerousCommand(
|
||||
ExecUserFlow::PathNode source, ExecUserFlow::PathNode sink, DataFlow::Node sourceCmd,
|
||||
DataFlow::Node sinkCmd
|
||||
) {
|
||||
exists(MethodAccess call |
|
||||
exists(MethodCall call |
|
||||
call.getMethod() instanceof RuntimeExecMethod and
|
||||
// this is a command-accepting call to exec, e.g. rt.exec(new String[]{"/bin/sh", ...})
|
||||
ExecCmdFlow::flow(sourceCmd, sinkCmd) and
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user