We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 8084449 commit 9e46ef3Copy full SHA for 9e46ef3
csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll
@@ -27,10 +27,12 @@ module UnsafeDeserialization {
27
abstract private class InstanceMethodSink extends Sink {
28
InstanceMethodSink() {
29
not exists(
30
- SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::Node safeTypeUsage
+ SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::Node safeTypeUsage,
31
+ MethodCall mc
32
|
33
safeConstructorTracking.hasFlow(_, safeTypeUsage) and
- safeTypeUsage.asExpr().getParent() = this.asExpr().getParent()
34
+ mc.getQualifier() = safeTypeUsage.asExpr() and
35
+ mc.getAnArgument() = this.asExpr()
36
)
37
}
38
0 commit comments