From f7437422c190ccf2bcd4d960aa3ffc2cc73838bc Mon Sep 17 00:00:00 2001 From: Timo Mueller Date: Tue, 4 May 2021 15:51:40 +0200 Subject: [PATCH] InstanceOf check instead of comparing classnames --- .../CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql index 9bd1712a3d7..b9be4f07cee 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql +++ b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql @@ -57,8 +57,8 @@ class MapToPutCredentialstypeConfiguration extends DataFlow2::Configuration { put.getKey().toString() = "RMIConnectorServer.CREDENTIALS_FILTER_PATTERN" // This can probably be solved more nicely | put.getQualifier() = qualifier and - put.getMethod().(MapMethod).getReceiverKeyType().getName() = "String" and - put.getMethod().(MapMethod).getReceiverValueType().getName() = "Object" + put.getMethod().(MapMethod).getReceiverKeyType() instanceof TypeString and + put.getMethod().(MapMethod).getReceiverValueType() instanceof TypeObject ) } }