@@ -68,22 +68,12 @@ module XerialSnappy {
68
68
override predicate step ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
69
69
exists ( Call call |
70
70
// Constructors
71
- call .getCallee ( ) .getDeclaringType ( ) = any ( TypeInputStream t ) and
71
+ call .getCallee ( ) .getDeclaringType ( ) instanceof TypeInputStream and
72
72
call .getArgument ( 0 ) = n1 .asExpr ( ) and
73
73
call = n2 .asExpr ( )
74
74
)
75
75
}
76
76
}
77
-
78
- class Sink extends DecompressionBomb:: Sink {
79
- Sink ( ) {
80
- this .asExpr ( ) = any ( ReadInputStreamCall r ) .getQualifier ( )
81
- or
82
- exists ( ConstructorCall call | call .getConstructedType ( ) instanceof TypeInputStream |
83
- this .asExpr ( ) = call .getArgument ( 0 )
84
- )
85
- }
86
- }
87
77
}
88
78
89
79
/**
@@ -117,7 +107,7 @@ module ApacheCommons {
117
107
/**
118
108
* The types that are responsible for specific compression format of `CompressorInputStream` Class
119
109
*/
120
- class TypeCompressors extends RefType {
110
+ class TypeCompressors extends DecompressionBomb :: BombTypeInputStream {
121
111
TypeCompressors ( ) {
122
112
this .getASupertype * ( )
123
113
.hasQualifiedName ( "org.apache.commons.compress.compressors.gzip" ,
@@ -166,16 +156,6 @@ module ApacheCommons {
166
156
this .getCallee ( ) .hasName ( [ "read" , "readNBytes" , "readAllBytes" ] )
167
157
}
168
158
}
169
-
170
- class Sink extends DecompressionBomb:: Sink {
171
- Sink ( ) {
172
- this .asExpr ( ) = any ( ReadInputStreamCall r ) .getQualifier ( )
173
- or
174
- exists ( ConstructorCall call | call .getConstructedType ( ) instanceof TypeCompressors |
175
- this .asExpr ( ) = call .getArgument ( 0 )
176
- )
177
- }
178
- }
179
159
}
180
160
181
161
/**
@@ -185,7 +165,7 @@ module ApacheCommons {
185
165
/**
186
166
* The types that are responsible for specific compression format of `ArchiveInputStream` Class
187
167
*/
188
- class TypeArchivers extends RefType {
168
+ class TypeArchivers extends DecompressionBomb :: BombTypeInputStream {
189
169
TypeArchivers ( ) {
190
170
this .getASupertype * ( )
191
171
.hasQualifiedName ( "org.apache.commons.compress.archivers.ar" , "ArArchiveInputStream" ) or
@@ -211,16 +191,6 @@ module ApacheCommons {
211
191
this .getCallee ( ) .hasName ( [ "read" , "readNBytes" , "readAllBytes" ] )
212
192
}
213
193
}
214
-
215
- class Sink extends DecompressionBomb:: Sink {
216
- Sink ( ) {
217
- this .asExpr ( ) = any ( ReadInputStreamCall r ) .getQualifier ( )
218
- or
219
- exists ( ConstructorCall call | call .getConstructedType ( ) instanceof TypeArchivers |
220
- this .asExpr ( ) = call .getArgument ( 0 )
221
- )
222
- }
223
- }
224
194
}
225
195
226
196
/**
@@ -230,7 +200,7 @@ module ApacheCommons {
230
200
/**
231
201
* A type that is responsible for `ArchiveInputStream` Class
232
202
*/
233
- class TypeArchivers extends RefType {
203
+ class TypeArchivers extends DecompressionBomb :: BombTypeInputStream {
234
204
TypeArchivers ( ) {
235
205
this .getASupertype * ( )
236
206
.hasQualifiedName ( "org.apache.commons.compress.archivers" , "ArchiveStreamFactory" )
@@ -260,9 +230,9 @@ module ApacheCommons {
260
230
exists ( Call call |
261
231
// Constructors
262
232
(
263
- call .getCallee ( ) .getDeclaringType ( ) = any ( TypeCompressors t )
233
+ call .getCallee ( ) .getDeclaringType ( ) instanceof TypeCompressors
264
234
or
265
- call .getCallee ( ) .getDeclaringType ( ) = any ( TypeArchivers t )
235
+ call .getCallee ( ) .getDeclaringType ( ) instanceof TypeArchivers
266
236
) and
267
237
call .getArgument ( 0 ) = n1 .asExpr ( ) and
268
238
call = n2 .asExpr ( )
@@ -283,19 +253,6 @@ module ApacheCommons {
283
253
this .getCallee ( ) .hasName ( [ "read" , "readNBytes" , "readAllBytes" ] )
284
254
}
285
255
}
286
-
287
- class Sink extends DecompressionBomb:: Sink {
288
- Sink ( ) {
289
- this .asExpr ( ) = any ( ReadInputStreamCall r ) .getQualifier ( )
290
- or
291
- exists ( ConstructorCall call |
292
- call .getConstructedType ( ) instanceof TypeCompressors or
293
- call .getConstructedType ( ) instanceof TypeArchivers
294
- |
295
- this .asExpr ( ) = call .getArgument ( 0 )
296
- )
297
- }
298
- }
299
256
}
300
257
}
301
258
@@ -358,16 +315,6 @@ module Zip {
358
315
}
359
316
}
360
317
361
- class ReadInputStreamSink extends DecompressionBomb:: Sink {
362
- ReadInputStreamSink ( ) {
363
- this .asExpr ( ) = any ( ReadInputStreamCall r ) .getQualifier ( )
364
- or
365
- exists ( ConstructorCall call | call .getConstructedType ( ) instanceof TypeInputStream |
366
- this .asExpr ( ) = call .getArgument ( 0 )
367
- )
368
- }
369
- }
370
-
371
318
/**
372
319
* A type that is responsible for `Inflater` Class
373
320
*/
0 commit comments