1
1
/** Definitions for the sensitive result receiver query. */
2
2
3
3
import java
4
- import semmle.code.java.dataflow.TaintTracking2
4
+ import semmle.code.java.dataflow.TaintTracking
5
+ private import semmle.code.java.dataflow.TaintTracking2
5
6
import semmle.code.java.dataflow.FlowSources
6
7
import semmle.code.java.security.SensitiveActions
7
8
@@ -31,6 +32,25 @@ private predicate untrustedResultReceiverSend(DataFlow::Node src, ResultReceiver
31
32
UntrustedResultReceiverFlow:: flow ( src , DataFlow:: exprNode ( call .getReceiver ( ) ) )
32
33
}
33
34
35
+ deprecated private class SensitiveResultReceiverConf extends TaintTracking:: Configuration {
36
+ SensitiveResultReceiverConf ( ) { this = "SensitiveResultReceiverConf" }
37
+
38
+ override predicate isSource ( DataFlow:: Node node ) { node .asExpr ( ) instanceof SensitiveExpr }
39
+
40
+ override predicate isSink ( DataFlow:: Node node ) {
41
+ exists ( ResultReceiverSendCall call |
42
+ untrustedResultReceiverSend ( _, call ) and
43
+ node .asExpr ( ) = call .getSentData ( )
44
+ )
45
+ }
46
+
47
+ override predicate allowImplicitRead ( DataFlow:: Node node , DataFlow:: ContentSet c ) {
48
+ super .allowImplicitRead ( node , c )
49
+ or
50
+ this .isSink ( node )
51
+ }
52
+ }
53
+
34
54
module SensitiveResultReceiverConfig implements DataFlow:: ConfigSig {
35
55
predicate isSource ( DataFlow:: Node node ) { node .asExpr ( ) instanceof SensitiveExpr }
36
56
@@ -54,13 +74,8 @@ module SensitiveResultReceiverFlow = TaintTracking::Global<SensitiveResultReceiv
54
74
deprecated predicate sensitiveResultReceiver (
55
75
DataFlow:: PathNode src , DataFlow:: PathNode sink , DataFlow:: Node recSrc
56
76
) {
57
- exists (
58
- ResultReceiverSendCall call , SensitiveResultReceiverFlow:: PathNode srrSrc ,
59
- SensitiveResultReceiverFlow:: PathNode srrSink
60
- |
61
- src .getNode ( ) = srrSrc .getNode ( ) and sink .getNode ( ) = srrSink .getNode ( )
62
- |
63
- SensitiveResultReceiverFlow:: flowPath ( srrSrc , srrSink ) and
77
+ exists ( ResultReceiverSendCall call |
78
+ any ( SensitiveResultReceiverConf c ) .hasFlowPath ( src , sink ) and
64
79
sink .getNode ( ) .asExpr ( ) = call .getSentData ( ) and
65
80
untrustedResultReceiverSend ( recSrc , call )
66
81
)
0 commit comments