Fixed wrong match for symbolic constant

Timo Mueller · Timo Mueller · commit 72ef4983dbf4 · 2021-06-25T16:11:37.000+02:00
diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql
@@ -59,7 +59,7 @@ class SafeFlow extends DataFlow::Configuration {
           .(FieldAccess)
           .getField()
           .hasQualifiedName("javax.management.remote.rmi", "RMIConnectorServer",
-            ["CREDENTIAL_TYPES", "CREDENTIALS_FILTER_PATTERN", "SERIAL_FILTER_PATTERN"])
+            ["CREDENTIAL_TYPES", "CREDENTIALS_FILTER_PATTERN"])
     |
       put.getQualifier() = qualifier and
       put.getMethod().(MapMethod).getReceiverKeyType() instanceof TypeString and

Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,7 @@ class SafeFlow extends DataFlow::Configuration {`
`59`	`59`	`.(FieldAccess)`
`60`	`60`	`.getField()`
`61`	`61`	`.hasQualifiedName("javax.management.remote.rmi", "RMIConnectorServer",`
`62`		`- ["CREDENTIAL_TYPES", "CREDENTIALS_FILTER_PATTERN", "SERIAL_FILTER_PATTERN"])`
	`62`	`+ ["CREDENTIAL_TYPES", "CREDENTIALS_FILTER_PATTERN"])`
`63`	`63`	`\|`
`64`	`64`	`put.getQualifier() = qualifier and`
`65`	`65`	`put.getMethod().(MapMethod).getReceiverKeyType() instanceof TypeString and`