diff --git a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll index 543bc5d3f44..dfbf957f18c 100644 --- a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll +++ b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll @@ -116,6 +116,22 @@ private predicate step(TypeFlowNode n1, TypeFlowNode n2) { n2.asSsa().(BaseSsaUpdate).getDefiningExpr().(VariableAssign).getSource() = n1.asExpr() or n2.asSsa().(BaseSsaImplicitInit).captures(n1.asSsa()) + or + exists(PatternCase pc, LocalVariableDeclExpr patternVar | + patternVar = pc.getPattern().asBindingPattern() and + n2.asSsa().(BaseSsaUpdate).getDefiningExpr() = patternVar and + ( + pc.getSwitch().getExpr() = n1.asExpr() + or + pc.getSwitchExpr().getExpr() = n1.asExpr() + ) + ) + or + exists(InstanceOfExpr ioe, LocalVariableDeclExpr patternVar | + patternVar = ioe.getPattern().asBindingPattern() and + n2.asSsa().(BaseSsaUpdate).getDefiningExpr() = patternVar and + ioe.getExpr() = n1.asExpr() + ) } /** diff --git a/java/ql/lib/semmle/code/java/dispatch/DispatchFlow.qll b/java/ql/lib/semmle/code/java/dispatch/DispatchFlow.qll index 82bda033bc6..ae7ef09275a 100644 --- a/java/ql/lib/semmle/code/java/dispatch/DispatchFlow.qll +++ b/java/ql/lib/semmle/code/java/dispatch/DispatchFlow.qll @@ -167,6 +167,20 @@ private module TypeTrackingSteps { def.(BaseSsaUpdate).getDefiningExpr().(VariableAssign).getSource() = n1.asExpr() or def.(BaseSsaImplicitInit).isParameterDefinition(n1.asParameter()) + or + exists(PatternCase pc | + pc.getPattern().asBindingPattern() = def.(BaseSsaUpdate).getDefiningExpr() and + ( + pc.getSwitch().getExpr() = n1.asExpr() + or + pc.getSwitchExpr().getExpr() = n1.asExpr() + ) + ) + or + exists(InstanceOfExpr ioe | + ioe.getPattern().asBindingPattern() = def.(BaseSsaUpdate).getDefiningExpr() and + ioe.getExpr() = n1.asExpr() + ) | v.getAnUltimateDefinition() = def and v.getAUse() = n2.asExpr() diff --git a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll index b06e9a2097f..446885252f6 100644 --- a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll +++ b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll @@ -89,6 +89,11 @@ private predicate step(Node n1, Node n2) { pc.getSwitchExpr().getExpr() = n1.asExpr() ) ) + or + exists(InstanceOfExpr ioe | + ioe.getPattern().asBindingPattern() = def.(BaseSsaUpdate).getDefiningExpr() and + ioe.getExpr() = n1.asExpr() + ) | v.getAnUltimateDefinition() = def and v.getAUse() = n2.asExpr()