@@ -2,55 +2,49 @@ import java
2
2
import semmle.code.java.dataflow.TaintTracking
3
3
import TestUtilities.InlineExpectationsTest
4
4
5
- class TaintFlowConf extends TaintTracking :: Configuration {
6
- TaintFlowConf ( ) { this = "qltest:frameworks:guava- taint" }
5
+ module TaintFlowConfig implements DataFlow :: ConfigSig {
6
+ predicate isSource ( DataFlow :: Node n ) { n . asExpr ( ) . ( MethodAccess ) . getMethod ( ) . hasName ( " taint") }
7
7
8
- override predicate isSource ( DataFlow:: Node n ) {
9
- n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" )
10
- }
11
-
12
- override predicate isSink ( DataFlow:: Node n ) {
8
+ predicate isSink ( DataFlow:: Node n ) {
13
9
exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
14
10
}
15
11
}
16
12
17
- class ValueFlowConf extends DataFlow:: Configuration {
18
- ValueFlowConf ( ) { this = "qltest:frameworks:guava-value" }
13
+ module TaintFlow = TaintTracking:: Global< TaintFlowConfig > ;
19
14
20
- override predicate isSource ( DataFlow:: Node n ) {
21
- n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" )
22
- }
15
+ module ValueFlowConfig implements DataFlow:: ConfigSig {
16
+ predicate isSource ( DataFlow:: Node n ) { n .asExpr ( ) .( MethodAccess ) .getMethod ( ) .hasName ( "taint" ) }
23
17
24
- override predicate isSink ( DataFlow:: Node n ) {
18
+ predicate isSink ( DataFlow:: Node n ) {
25
19
exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
26
20
}
27
21
28
- override int fieldFlowBranchLimit ( ) { result = 100 }
22
+ int fieldFlowBranchLimit ( ) { result = 100 }
29
23
}
30
24
25
+ module ValueFlow = DataFlow:: Global< ValueFlowConfig > ;
26
+
31
27
class HasFlowTest extends InlineExpectationsTest {
32
28
HasFlowTest ( ) { this = "HasFlowTest" }
33
29
34
30
override string getARelevantTag ( ) { result = [ "numTaintFlow" , "numValueFlow" ] }
35
31
36
32
override predicate hasActualResult ( Location location , string element , string tag , string value ) {
37
33
tag = "numTaintFlow" and
38
- exists ( DataFlow:: Node src , DataFlow:: Node sink , TaintFlowConf tconf , int num |
39
- tconf .hasFlow ( src , sink )
40
- |
41
- not any ( ValueFlowConf vconf ) .hasFlow ( src , sink ) and
34
+ exists ( DataFlow:: Node src , DataFlow:: Node sink , int num | TaintFlow:: flow ( src , sink ) |
35
+ not ValueFlow:: flow ( src , sink ) and
42
36
value = num .toString ( ) and
43
37
sink .getLocation ( ) = location and
44
38
element = sink .toString ( ) and
45
- num = strictcount ( DataFlow:: Node src2 | tconf . hasFlow ( src2 , sink ) )
39
+ num = strictcount ( DataFlow:: Node src2 | TaintFlow :: flow ( src2 , sink ) )
46
40
)
47
41
or
48
42
tag = "numValueFlow" and
49
- exists ( DataFlow:: Node sink , ValueFlowConf vconf , int num | vconf . hasFlowTo ( sink ) |
43
+ exists ( DataFlow:: Node sink , int num | ValueFlow :: flowTo ( sink ) |
50
44
value = num .toString ( ) and
51
45
sink .getLocation ( ) = location and
52
46
element = sink .toString ( ) and
53
- num = strictcount ( DataFlow:: Node src2 | vconf . hasFlow ( src2 , sink ) )
47
+ num = strictcount ( DataFlow:: Node src2 | ValueFlow :: flow ( src2 , sink ) )
54
48
)
55
49
}
56
50
}
0 commit comments