@@ -12,11 +12,14 @@ import semmle.code.java.dataflow.internal.DataFlowPrivate
1212import semmle.code.java.dataflow.InstanceAccess
1313import ModelGeneratorUtils
1414
15- string captureFlow ( TargetApi api ) {
16- result = captureQualifierFlow ( api ) or
17- result = captureThroughFlow ( api )
15+ predicate isOwnInstanceAccess ( ReturnStmt rtn ) { rtn .getResult ( ) .( ThisAccess ) .isOwnInstanceAccess ( ) }
16+
17+ predicate isOwnInstanceAccessNode ( ReturnNode node ) {
18+ node .asExpr ( ) .( ThisAccess ) .isOwnInstanceAccess ( )
1819}
1920
21+ string qualifierString ( ) { result = "Argument[-1]" }
22+
2023/**
2124 * Capture fluent APIs that return `this`.
2225 * Example of a fluent API:
@@ -29,12 +32,12 @@ string captureFlow(TargetApi api) {
2932 * }
3033 * ```
3134 */
32- string captureQualifierFlow ( TargetApi api ) {
35+ private string captureQualifierFlow ( TargetApi api ) {
3336 exists ( ReturnStmt rtn |
3437 rtn .getEnclosingCallable ( ) = api and
35- rtn . getResult ( ) . ( ThisAccess ) . isOwnInstanceAccess ( )
38+ isOwnInstanceAccess ( rtn )
3639 ) and
37- result = asValueModel ( api , "Argument[-1]" , "ReturnValue" )
40+ result = asValueModel ( api , qualifierString ( ) , "ReturnValue" )
3841}
3942
4043class TaintRead extends DataFlow:: FlowState {
@@ -56,7 +59,7 @@ class ThroughFlowConfig extends TaintTracking::Configuration {
5659
5760 override predicate isSink ( DataFlow:: Node sink , DataFlow:: FlowState state ) {
5861 sink instanceof ReturnNodeExt and
59- not sink . ( ReturnNode ) . asExpr ( ) . ( ThisAccess ) . isOwnInstanceAccess ( ) and
62+ not isOwnInstanceAccessNode ( sink ) and
6063 not exists ( captureQualifierFlow ( sink .asExpr ( ) .getEnclosingCallable ( ) ) ) and
6164 ( state instanceof TaintRead or state instanceof TaintStore )
6265 }
@@ -145,7 +148,7 @@ class ThroughFlowConfig extends TaintTracking::Configuration {
145148 * Captured Model:
146149 * `p;Foo;true;addToList;;Argument[0];Argument[1];taint`
147150 */
148- string captureThroughFlow ( TargetApi api ) {
151+ private string captureThroughFlow ( TargetApi api ) {
149152 exists (
150153 ThroughFlowConfig config , DataFlow:: ParameterNode p , ReturnNodeExt returnNodeExt , string input ,
151154 string output
@@ -159,6 +162,11 @@ string captureThroughFlow(TargetApi api) {
159162 )
160163}
161164
165+ private string captureFlow ( TargetApi api ) {
166+ result = captureQualifierFlow ( api ) or
167+ result = captureThroughFlow ( api )
168+ }
169+
162170from TargetApi api , string flow
163171where flow = captureFlow ( api )
164172select flow order by flow
0 commit comments