Java: Explicitly tie ReturnNode to TargetApi before calling returnNodeAsOutput.

Author: michaelnebel

java/ql/src/utils/model-generator/CaptureSourceModels.ql

@@ -44,7 +44,8 @@ string captureSource(TargetAPI api) {
     config.hasFlow(source, sink) and
     sourceNode(source, kind) and
     api = source.getEnclosingCallable() and
-    result = asSourceModel(api, returnNodeAsOutput(api, sink), kind)
+    api = sink.getEnclosingCallable() and
+    result = asSourceModel(api, returnNodeAsOutput(sink), kind)
   )
 }
 

java/ql/src/utils/model-generator/CaptureSummaryModels.ql

@@ -153,7 +153,7 @@ string captureThroughFlow(TargetAPI api) {
     config.hasFlow(p, returnNodeExt) and
     returnNodeExt.getEnclosingCallable() = api and
     input = parameterNodeAsInput(p) and
-    output = returnNodeAsOutput(api, returnNodeExt) and
+    output = returnNodeAsOutput(returnNodeExt) and
     input != output and
     result = asTaintModel(api, input, output)
   )

java/ql/src/utils/model-generator/ModelGeneratorUtils.qll

@@ -165,13 +165,12 @@ string parameterNodeAsInput(DataFlow::ParameterNode p) {
   result = "Argument[-1]" and p instanceof DataFlow::InstanceParameterNode
 }
 
-bindingset[api]
-string returnNodeAsOutput(TargetAPI api, ReturnNodeExt node) {
+string returnNodeAsOutput(ReturnNodeExt node) {
   if node.getKind() instanceof ValueReturnKind
   then result = "ReturnValue"
   else
     exists(int pos | pos = node.getKind().(ParamUpdateReturnKind).getPosition() |
-      result = parameterAccess(api.getParameter(pos))
+      result = parameterAccess(node.getEnclosingCallable().getParameter(pos))
       or
       result = "Argument[-1]" and pos = -1
     )