@@ -2,55 +2,49 @@ import java
22import semmle.code.java.dataflow.TaintTracking
33import TestUtilities.InlineExpectationsTest
44
5- class TaintFlowConf extends TaintTracking :: Configuration {
6- TaintFlowConf ( ) { this = "qltest:frameworks:guava- taint" }
5+ module TaintFlowConfig implements DataFlow :: ConfigSig {
6+ predicate isSource ( DataFlow :: Node n ) { n . asExpr ( ) . ( MethodAccess ) . getMethod ( ) . hasName ( " taint") }
77
8- override predicate isSource ( DataFlow:: Node n ) {
9- n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" )
10- }
11-
12- override predicate isSink ( DataFlow:: Node n ) {
8+ predicate isSink ( DataFlow:: Node n ) {
139 exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
1410 }
1511}
1612
17- class ValueFlowConf extends DataFlow:: Configuration {
18- ValueFlowConf ( ) { this = "qltest:frameworks:guava-value" }
13+ module TaintFlow = TaintTracking:: Global< TaintFlowConfig > ;
1914
20- override predicate isSource ( DataFlow:: Node n ) {
21- n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" )
22- }
15+ module ValueFlowConfig implements DataFlow:: ConfigSig {
16+ predicate isSource ( DataFlow:: Node n ) { n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" ) }
2317
24- override predicate isSink ( DataFlow:: Node n ) {
18+ predicate isSink ( DataFlow:: Node n ) {
2519 exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
2620 }
2721
28- override int fieldFlowBranchLimit ( ) { result = 100 }
22+ int fieldFlowBranchLimit ( ) { result = 100 }
2923}
3024
25+ module ValueFlow = DataFlow:: Global< ValueFlowConfig > ;
26+
3127class HasFlowTest extends InlineExpectationsTest {
3228 HasFlowTest ( ) { this = "HasFlowTest" }
3329
3430 override string getARelevantTag ( ) { result = [ "numTaintFlow" , "numValueFlow" ] }
3531
3632 override predicate hasActualResult ( Location location , string element , string tag , string value ) {
3733 tag = "numTaintFlow" and
38- exists ( DataFlow:: Node src , DataFlow:: Node sink , TaintFlowConf tconf , int num |
39- tconf .hasFlow ( src , sink )
40- |
41- not any ( ValueFlowConf vconf ) .hasFlow ( src , sink ) and
34+ exists ( DataFlow:: Node src , DataFlow:: Node sink , int num | TaintFlow:: flow ( src , sink ) |
35+ not ValueFlow:: flow ( src , sink ) and
4236 value = num .toString ( ) and
4337 sink .getLocation ( ) = location and
4438 element = sink .toString ( ) and
45- num = strictcount ( DataFlow:: Node src2 | tconf . hasFlow ( src2 , sink ) )
39+ num = strictcount ( DataFlow:: Node src2 | TaintFlow :: flow ( src2 , sink ) )
4640 )
4741 or
4842 tag = "numValueFlow" and
49- exists ( DataFlow:: Node sink , ValueFlowConf vconf , int num | vconf . hasFlowTo ( sink ) |
43+ exists ( DataFlow:: Node sink , int num | ValueFlow :: flowTo ( sink ) |
5044 value = num .toString ( ) and
5145 sink .getLocation ( ) = location and
5246 element = sink .toString ( ) and
53- num = strictcount ( DataFlow:: Node src2 | vconf . hasFlow ( src2 , sink ) )
47+ num = strictcount ( DataFlow:: Node src2 | ValueFlow :: flow ( src2 , sink ) )
5448 )
5549 }
5650}
0 commit comments