Skip to content

Commit 55cd2a2

Browse files
GeekMasherGeekMasher
committed
feat(java): Update all MethodAccess predicate
1 parent 5a43951 commit 55cd2a2

21 files changed

+44
-47
lines changed

‎java/lib/ResearchMode.qll

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class FieldTaintStep extends TaintTracking::AdditionalTaintStep {
3838
class NotifyWaitTaintStep extends TaintTracking::AdditionalTaintStep {
3939
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
4040
exists(
41-
MethodAccess notify, RefType t, MethodAccess wait, SynchronizedStmt notifySync,
41+
MethodCall notify, RefType t, MethodCall wait, SynchronizedStmt notifySync,
4242
SynchronizedStmt waitSync
4343
|
4444
notify.getMethod().getName() = ["notify", "notifyAll"] and
@@ -65,7 +65,7 @@ class NotifyWaitTaintStep extends TaintTracking::AdditionalTaintStep {
6565
*/
6666
class ExceptionTaintStep extends TaintTracking::AdditionalTaintStep {
6767
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
68-
exists(Call call, TryStmt t, CatchClause c, MethodAccess gm |
68+
exists(Call call, TryStmt t, CatchClause c, MethodCall gm |
6969
call.getEnclosingStmt().getEnclosingStmt*() = t.getBlock() and
7070
t.getACatchClause() = c and
7171
(
@@ -85,7 +85,7 @@ class ExceptionTaintStep extends TaintTracking::AdditionalTaintStep {
8585
*/
8686
private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
8787
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
88-
exists(MethodAccess ma, Method m |
88+
exists(MethodCall ma, Method m |
8989
ma.getMethod() = m and
9090
m.getName().matches("get%") and
9191
m.getNumberOfParameters() = 0 and
@@ -97,7 +97,7 @@ private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
9797
/*
9898
* private class SetterTaintStep extends TaintTracking::AdditionalTaintStep {
9999
* override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
100-
* exists(MethodAccess ma, Method m |
100+
* exists(MethodCall ma, Method m |
101101
* ma.getMethod() = m and
102102
* m.getName().matches("set%") and
103103
* m.getNumberOfParameters() = 1 and
@@ -110,8 +110,8 @@ private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
110110
*
111111
* class GlobalSanitizer extends TaintTracking::Sanitizer {
112112
* override predicate sanitize(DataFlow::Node node) {
113-
* node.asExpr().(MethodAccess).getMethod().hasName("getInputStream") or
114-
* node.asExpr().(MethodAccess).getMethod().hasName("getHostName")
113+
* node.asExpr().(MethodCall).getMethod().hasName("getInputStream") or
114+
* node.asExpr().(MethodCall).getMethod().hasName("getHostName")
115115
* }
116116
* }
117117
*/

‎java/lib/applications/Dubbo.qll

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ module Dubbo {
2121

2222
class CodecSupportGetPayload extends TaintTracking::AdditionalTaintStep {
2323
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
24-
exists(MethodAccess ma |
24+
exists(MethodCall ma |
2525
ma.getMethod()
2626
.getDeclaringType()
2727
.hasQualifiedName("org.apache.dubbo.remoting.transport", "CodecSupport") and
@@ -34,7 +34,7 @@ module Dubbo {
3434

3535
class CodecSupportDeserialize extends TaintTracking::AdditionalTaintStep {
3636
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
37-
exists(MethodAccess ma |
37+
exists(MethodCall ma |
3838
ma.getMethod()
3939
.getDeclaringType()
4040
.hasQualifiedName("org.apache.dubbo.remoting.transport", "CodecSupport") and
@@ -58,7 +58,7 @@ module Dubbo {
5858

5959
class ChannelBuffer_ThisReturn_TaintStep extends TaintTracking::AdditionalTaintStep {
6060
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
61-
exists(MethodAccess ma |
61+
exists(MethodCall ma |
6262
ma.getMethod()
6363
.getDeclaringType()
6464
.getASourceSupertype*()
@@ -72,7 +72,7 @@ module Dubbo {
7272

7373
class ChannelBuffer_ThisArg1_TaintStep extends TaintTracking::AdditionalTaintStep {
7474
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
75-
exists(MethodAccess ma |
75+
exists(MethodCall ma |
7676
ma.getMethod()
7777
.getDeclaringType()
7878
.getASourceSupertype*()
@@ -86,7 +86,7 @@ module Dubbo {
8686

8787
class ChannelBuffer_ThisArg0_TaintStep extends TaintTracking::AdditionalTaintStep {
8888
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
89-
exists(MethodAccess ma |
89+
exists(MethodCall ma |
9090
ma.getMethod()
9191
.getDeclaringType()
9292
.getASourceSupertype*()
@@ -100,7 +100,7 @@ module Dubbo {
100100

101101
class ChannelBuffer_ArgThis1_TaintStep extends TaintTracking::AdditionalTaintStep {
102102
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
103-
exists(MethodAccess ma |
103+
exists(MethodCall ma |
104104
ma.getMethod()
105105
.getDeclaringType()
106106
.getASourceSupertype*()
@@ -114,7 +114,7 @@ module Dubbo {
114114

115115
class ChannelBuffer_ArgThis0_TaintStep extends TaintTracking::AdditionalTaintStep {
116116
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
117-
exists(MethodAccess ma |
117+
exists(MethodCall ma |
118118
ma.getMethod()
119119
.getDeclaringType()
120120
.getASourceSupertype*()

‎java/lib/frameworks/GoogleGuavaCache.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ module GuavaCache {
3838
*/
3939
class LoadCacheItemTaintStep extends TaintTracking::AdditionalTaintStep {
4040
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
41-
exists(MethodAccess ma1, MethodAccess ma2, VarAccess va |
41+
exists(MethodCall ma1, MethodCall ma2, VarAccess va |
4242
ma1.getMethod() instanceof GetFromCacheMethod and
4343
ma2.getMethod() instanceof BuildCacheLoaderMethod and
4444
exists(Method m |

‎java/lib/frameworks/Protobuf.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import semmle.code.java.dataflow.FlowSources
33
module Protobuf {
44
class ProtoToCoreTaintStep extends TaintTracking::AdditionalTaintStep {
55
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
6-
exists(MethodAccess ma |
6+
exists(MethodCall ma |
77
ma.getMethod().getName().matches("toCore%") and
88
n2.asExpr() = ma and
99
n1.asExpr() = ma.getArgument(0)
@@ -13,7 +13,7 @@ module Protobuf {
1313

1414
class ByteStringThisReturnTaintStep extends TaintTracking::AdditionalTaintStep {
1515
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
16-
exists(MethodAccess ma |
16+
exists(MethodCall ma |
1717
//ma.getMethod().getName().matches(["toByteArray", "toString", "toStringUtf8", "substring", "concat", "asReadOnlyByteBuffer", "asReadOnlyByteBufferList"]) and
1818
ma.getMethod().getName().matches("toByteArray") and
1919
ma.getMethod()
@@ -29,7 +29,7 @@ module Protobuf {
2929

3030
class ByteStringArgReturnTaintStep extends TaintTracking::AdditionalTaintStep {
3131
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
32-
exists(MethodAccess ma |
32+
exists(MethodCall ma |
3333
ma.getMethod().getName().matches(["readFrom", "copyFrom", "concat"]) and
3434
ma.getMethod()
3535
.getDeclaringType()
@@ -44,7 +44,7 @@ module Protobuf {
4444

4545
class RemoteSource extends RemoteFlowSource {
4646
RemoteSource() {
47-
exists(MethodAccess ma, Method m |
47+
exists(MethodCall ma, Method m |
4848
ma.getMethod() = m and
4949
m.getName().matches("get%") and
5050
m.getDeclaringType()

‎java/lib/ghsl/BeanManipulation.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ class SetPropertyMethod extends Method {
4040

4141
class BeanManipulationSink extends DataFlow::ExprNode {
4242
BeanManipulationSink() {
43-
exists(MethodAccess ma |
43+
exists(MethodCall ma |
4444
ma.getMethod() instanceof SetPropertyMethod and
4545
this.getExpr() = ma.getAnArgument()
4646
)

‎java/lib/ghsl/Encoding.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ module Base64 {
1111
// codeql/java/ql/lib/semmle/code/java/security/HardcodedCredentialsApiCallQuery.qll
1212
class Encoders extends Base64::Encoding {
1313
Encoders() {
14-
exists(MethodAccess ma |
14+
exists(MethodCall ma |
1515
ma.getMethod()
1616
.hasQualifiedName([
1717
"java.util", "cn.hutool.core.codec", "org.apache.shiro.codec",
@@ -29,7 +29,7 @@ module Base64 {
2929

3030
class Decoders extends Base64::Decoding {
3131
Decoders() {
32-
exists(MethodAccess ma |
32+
exists(MethodCall ma |
3333
ma.getMethod()
3434
.hasQualifiedName([
3535
"java.util", "cn.hutool.core.codec", "org.apache.shiro.codec",

‎java/lib/ghsl/LocalSources.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import semmle.code.java.dataflow.FlowSources
33

44
class FileReadAccess extends LocalUserInput {
55
FileReadAccess() {
6-
exists(MethodAccess ma |
6+
exists(MethodCall ma |
77
// https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html#getResourceAsStream-java.lang.String-
88
(
99
ma.getMethod().hasQualifiedName("java.lang", "Class", "getResourceAsStream") or

‎java/lib/ghsl/Logging.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ abstract class LoggingMethodsSinks extends DataFlow::Node { }
88
// TODO: Use the exists libs in CodeQL to extend this
99
class PrintMethods extends LoggingMethodsSinks {
1010
PrintMethods() {
11-
exists(MethodAccess ma |
11+
exists(MethodCall ma |
1212
ma.getMethod().getDeclaringType().hasQualifiedName("java.io", _) and
1313
(
1414
ma.getMethod().hasName("println") or
@@ -50,7 +50,7 @@ class Log4jLoggerType extends LoggerType {
5050

5151
class LoggingMethods extends LoggingMethodsSinks {
5252
LoggingMethods() {
53-
exists(MethodAccess ma |
53+
exists(MethodCall ma |
5454
ma.getMethod().getDeclaringType() instanceof LoggerType and
5555
(
5656
ma.getMethod().hasName("debug") or

‎java/lib/ghsl/SensitiveInformation.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ abstract class SensitiveInformationSources extends DataFlow::Node { }
77

88
class HttpSession extends SensitiveInformationSources {
99
HttpSession() {
10-
exists(MethodAccess ma |
10+
exists(MethodCall ma |
1111
// https://docs.oracle.com/javaee/5/api/javax/servlet/http/HttpSession.html
1212
// Assumption: Nothing from the Session object should be logged
1313
ma.getMethod().getDeclaringType().hasQualifiedName("javax.servlet.http", "HttpSession") and
@@ -18,7 +18,7 @@ class HttpSession extends SensitiveInformationSources {
1818

1919
class Properties extends SensitiveInformationSources {
2020
Properties() {
21-
exists(MethodAccess ma |
21+
exists(MethodCall ma |
2222
ma.getMethod().hasName("getProperty") and
2323
this.asExpr() = ma
2424
)

‎java/src/CVEs/CVE-2022-22965.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ private module Spring4ShellConfig implements DataFlow::ConfigSig {
3232
predicate isBarrier(DataFlow::Node n) {
3333
n.getLocation().getFile().getRelativePath().matches(["%test%", "%mock%"])
3434
or
35-
exists(MethodAccess ma |
35+
exists(MethodCall ma |
3636
ma.getMethod().hasName("toString") and DataFlow::getInstanceArgument(ma) = n
3737
)
3838
}

0 commit comments

Comments
 (0)