Skip to content

Commit dca24de

Browse files
committed
Add UUID and Date to the list of types in the SimpleTypeSanitizer class
1 parent 3c8b093 commit dca24de

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

java/ql/lib/semmle/code/java/security/Sanitizers.qll

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@ import java
44
private import semmle.code.java.dataflow.DataFlow
55

66
/**
7-
* A node whose type is a simple type unlikely to carry taint, such as primitives or their boxed counterparts.
7+
* A node whose type is a simple type unlikely to carry taint, such as primitives and their boxed counterparts,
8+
* `java.util.UUID` and `java.util.Date`.
89
*/
910
class SimpleTypeSanitizer extends DataFlow::Node {
1011
SimpleTypeSanitizer() {
1112
this.getType() instanceof PrimitiveType or
1213
this.getType() instanceof BoxedType or
13-
this.getType() instanceof NumberType
14+
this.getType() instanceof NumberType or
15+
this.getType().(RefType).hasQualifiedName("java.util", "UUID") or
16+
this.getType().(RefType).hasQualifiedName("java.util", "Date")
1417
}
1518
}

0 commit comments

Comments
 (0)