@@ -56,8 +56,7 @@ module XerialSnappy {
56
56
*/
57
57
private class InputStreamAdditionalTaintStep extends DecompressionBomb:: AdditionalStep {
58
58
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
59
- exists ( Call call |
60
- // Constructors
59
+ exists ( ConstructorCall call |
61
60
call .getCallee ( ) .getDeclaringType ( ) instanceof TypeInputStream and
62
61
call .getArgument ( 0 ) = n1 .asExpr ( ) and
63
62
call = n2 .asExpr ( )
@@ -153,8 +152,7 @@ module ApacheCommons {
153
152
private class CompressorsAndArchiversAdditionalTaintStep extends DecompressionBomb:: AdditionalStep
154
153
{
155
154
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
156
- exists ( Call call |
157
- // Constructors
155
+ exists ( ConstructorCall call |
158
156
call .getCallee ( ) .getDeclaringType ( ) instanceof TypeCompressors and
159
157
call .getArgument ( 0 ) = n1 .asExpr ( ) and
160
158
call = n2 .asExpr ( )
@@ -207,8 +205,7 @@ module ApacheCommons {
207
205
private class CompressorsAndArchiversAdditionalTaintStep extends DecompressionBomb:: AdditionalStep
208
206
{
209
207
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
210
- exists ( Call call |
211
- // Constructors
208
+ exists ( ConstructorCall call |
212
209
call .getCallee ( ) .getDeclaringType ( ) instanceof TypeArchivers and
213
210
call .getArgument ( 0 ) = n1 .asExpr ( ) and
214
211
call = n2 .asExpr ( )
@@ -247,8 +244,7 @@ module ApacheCommons {
247
244
private class CompressorsAndArchiversAdditionalTaintStep extends DecompressionBomb:: AdditionalStep
248
245
{
249
246
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
250
- exists ( Call call |
251
- // Constructors
247
+ exists ( MethodCall call |
252
248
(
253
249
call .getCallee ( ) .getDeclaringType ( ) instanceof TypeCompressors
254
250
or
@@ -309,8 +305,7 @@ module Zip4j {
309
305
private class CompressorsAndArchiversAdditionalTaintStep extends DecompressionBomb:: AdditionalStep
310
306
{
311
307
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
312
- exists ( Call call |
313
- // Constructors
308
+ exists ( ConstructorCall call |
314
309
call .getCallee ( ) .getDeclaringType ( ) instanceof TypeZipInputStream and
315
310
call .getArgument ( 0 ) = n1 .asExpr ( ) and
316
311
call = n2 .asExpr ( )
0 commit comments