Skip to content

Commit ba233ed

Browse files
committed
Java: Rearrange and refactor language specific content into standalone predicates.
1 parent 6259ecf commit ba233ed

File tree

1 file changed

+16
-8
lines changed

1 file changed

+16
-8
lines changed

java/ql/src/utils/model-generator/CaptureSummaryModels.ql

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,14 @@ import semmle.code.java.dataflow.internal.DataFlowPrivate
1212
import semmle.code.java.dataflow.InstanceAccess
1313
import ModelGeneratorUtils
1414

15-
string captureFlow(TargetApi api) {
16-
result = captureQualifierFlow(api) or
17-
result = captureThroughFlow(api)
15+
predicate isOwnInstanceAccess(ReturnStmt rtn) { rtn.getResult().(ThisAccess).isOwnInstanceAccess() }
16+
17+
predicate isOwnInstanceAccessNode(ReturnNode node) {
18+
node.asExpr().(ThisAccess).isOwnInstanceAccess()
1819
}
1920

21+
string qualifierString() { result = "Argument[-1]" }
22+
2023
/**
2124
* Capture fluent APIs that return `this`.
2225
* Example of a fluent API:
@@ -29,12 +32,12 @@ string captureFlow(TargetApi api) {
2932
* }
3033
* ```
3134
*/
32-
string captureQualifierFlow(TargetApi api) {
35+
private string captureQualifierFlow(TargetApi api) {
3336
exists(ReturnStmt rtn |
3437
rtn.getEnclosingCallable() = api and
35-
rtn.getResult().(ThisAccess).isOwnInstanceAccess()
38+
isOwnInstanceAccess(rtn)
3639
) and
37-
result = asValueModel(api, "Argument[-1]", "ReturnValue")
40+
result = asValueModel(api, qualifierString(), "ReturnValue")
3841
}
3942

4043
class TaintRead extends DataFlow::FlowState {
@@ -56,7 +59,7 @@ class ThroughFlowConfig extends TaintTracking::Configuration {
5659

5760
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
5861
sink instanceof ReturnNodeExt and
59-
not sink.(ReturnNode).asExpr().(ThisAccess).isOwnInstanceAccess() and
62+
not isOwnInstanceAccessNode(sink) and
6063
not exists(captureQualifierFlow(sink.asExpr().getEnclosingCallable())) and
6164
(state instanceof TaintRead or state instanceof TaintStore)
6265
}
@@ -145,7 +148,7 @@ class ThroughFlowConfig extends TaintTracking::Configuration {
145148
* Captured Model:
146149
* `p;Foo;true;addToList;;Argument[0];Argument[1];taint`
147150
*/
148-
string captureThroughFlow(TargetApi api) {
151+
private string captureThroughFlow(TargetApi api) {
149152
exists(
150153
ThroughFlowConfig config, DataFlow::ParameterNode p, ReturnNodeExt returnNodeExt, string input,
151154
string output
@@ -159,6 +162,11 @@ string captureThroughFlow(TargetApi api) {
159162
)
160163
}
161164

165+
private string captureFlow(TargetApi api) {
166+
result = captureQualifierFlow(api) or
167+
result = captureThroughFlow(api)
168+
}
169+
162170
from TargetApi api, string flow
163171
where flow = captureFlow(api)
164172
select flow order by flow

0 commit comments

Comments
 (0)