File tree Expand file tree Collapse file tree 1 file changed +7
-8
lines changed
java/ql/src/experimental/Security/CWE/CWE-036 Expand file tree Collapse file tree 1 file changed +7
-8
lines changed Original file line number Diff line number Diff line change @@ -22,13 +22,6 @@ class URLConstructor extends ClassInstanceExpr {
2222 }
2323}
2424
25- class URLOpenStreamCsv extends SinkModelCsv {
26- override predicate row ( string row ) {
27- //"package;type;overrides;name;signature;ext;inputspec;kind",
28- row = "java.net;URL;true;openStream;();;Argument[-1];url-open-stream"
29- }
30- }
31-
3225class URLOpenStreamMethod extends Method {
3326 URLOpenStreamMethod ( ) {
3427 this .getDeclaringType ( ) instanceof TypeUrl and
@@ -41,7 +34,13 @@ class RemoteURLToOpenStreamFlowConfig extends TaintTracking::Configuration {
4134
4235 override predicate isSource ( DataFlow:: Node source ) { source instanceof RemoteFlowSource }
4336
44- override predicate isSink ( DataFlow:: Node sink ) { sinkNode ( sink , "url-open-stream" ) }
37+ override predicate isSink ( DataFlow:: Node sink ) {
38+ exists ( MethodAccess m |
39+ sink .asExpr ( ) = m .getQualifier ( ) and m .getMethod ( ) instanceof URLOpenStreamMethod
40+ )
41+ or
42+ sinkNode ( sink , "url-open-stream" )
43+ }
4544
4645 override predicate isAdditionalTaintStep ( DataFlow:: Node node1 , DataFlow:: Node node2 ) {
4746 exists ( URLConstructor u |
You can’t perform that action at this time.
0 commit comments