hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add missing java.nio.file.Files methods to FileReadWrite.qll

Browse Source
This commit is contained in:
Marcono1234
2020-06-26 23:56:01 +02:00
parent 163257a6c5
commit f8e474f89a
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
java/ql/src/semmle/code/java/security/FileReadWrite.qll
View File

@@ -9,9 +9,9 @@ private predicate fileRead(VarAccess fileAccess, Expr fileReadingExpr) {
cie = fileReadingExpr and cie = fileReadingExpr and
cie.getArgument(0) = fileAccess cie.getArgument(0) = fileAccess
| |
cie.getConstructedType().hasQualifiedName("java.io", "RandomAccessFile") or cie
cie.getConstructedType().hasQualifiedName("java.io", "FileReader") or .getConstructedType()
cie.getConstructedType().hasQualifiedName("java.io", "FileInputStream") .hasQualifiedName("java.io", ["RandomAccessFile", "FileReader", "FileInputStream"])
) )
or or
exists(MethodAccess ma, Method filesMethod | exists(MethodAccess ma, Method filesMethod |
@@ -22,13 +22,9 @@ private predicate fileRead(VarAccess fileAccess, Expr fileReadingExpr) {
// represented by the first argument. // represented by the first argument.
filesMethod.getDeclaringType().hasQualifiedName("java.nio.file", "Files") and filesMethod.getDeclaringType().hasQualifiedName("java.nio.file", "Files") and
fileAccess = ma.getArgument(0) and fileAccess = ma.getArgument(0) and
( filesMethod
filesMethod.hasName("readAllBytes") or .hasName(["readAllBytes", "readAllLines", "readString", "lines", "newBufferedReader",
filesMethod.hasName("readAllLines") or "newInputReader", "newByteChannel"])
filesMethod.hasName("newBufferedReader") or
filesMethod.hasName("newInputReader") or
filesMethod.hasName("newByteChannel")
)
) )
) )
or or