diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll index d5ddd1c6969..3ed2c49e5c0 100644 --- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll +++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll @@ -292,22 +292,20 @@ module SemanticExprConfig { class Guard = IRGuards::IRGuardCondition; - predicate guard(Guard guard, BasicBlock block) { - block = guard.(IRGuards::IRGuardCondition).getBlock() - } + predicate guard(Guard guard, BasicBlock block) { block = guard.getBlock() } Expr getGuardAsExpr(Guard guard) { result = guard } predicate equalityGuard(Guard guard, Expr e1, Expr e2, boolean polarity) { - guard.(IRGuards::IRGuardCondition).comparesEq(e1.getAUse(), e2.getAUse(), 0, true, polarity) + guard.comparesEq(e1.getAUse(), e2.getAUse(), 0, true, polarity) } predicate guardDirectlyControlsBlock(Guard guard, BasicBlock controlled, boolean branch) { - guard.(IRGuards::IRGuardCondition).controls(controlled, branch) + guard.controls(controlled, branch) } predicate guardHasBranchEdge(Guard guard, BasicBlock bb1, BasicBlock bb2, boolean branch) { - guard.(IRGuards::IRGuardCondition).controlsEdge(bb1, bb2, branch) + guard.controlsEdge(bb1, bb2, branch) } Guard comparisonGuard(Expr e) { result = e } diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql b/cpp/ql/src/experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql index f86e82f2c97..026c279de7c 100644 --- a/cpp/ql/src/experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql +++ b/cpp/ql/src/experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql @@ -44,11 +44,8 @@ predicate conversionDoneLate(MulExpr mexp) { mexp.getEnclosingElement().(ComparisonOperation).hasOperands(mexp, e0) and e0.getType().getSize() = mexp.getConversion().getConversion().getType().getSize() or - e0.(FunctionCall) - .getTarget() - .getParameter(argumentPosition(e0.(FunctionCall), mexp, _)) - .getType() - .getSize() = mexp.getConversion().getConversion().getType().getSize() + e0.(FunctionCall).getTarget().getParameter(argumentPosition(e0, mexp, _)).getType().getSize() = + mexp.getConversion().getConversion().getType().getSize() ) ) } diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll b/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll index 5a3b4f63d9f..98bbd675660 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll @@ -299,7 +299,7 @@ Sign exprSign(Expr e) { exists(VarAccess access | access = e | not exists(SsaVariable v | getARead(v) = access) and ( - s = fieldSign(getField(access.(FieldAccess))) + s = fieldSign(getField(access)) or anySign(s) and not access instanceof FieldAccess )