@@ -41,21 +41,18 @@ private module Printing implements PrintingSig {
41
41
42
42
module ModelPrinting = PrintingImpl< Printing > ;
43
43
44
- /**
45
- * Holds if `c` is a relevant content kind, where the underlying type is relevant.
46
- */
47
- private predicate isRelevantTypeInContent ( DataFlow:: Content c ) {
48
- isRelevantType ( getUnderlyingContentType ( c ) )
49
- }
50
-
51
44
/**
52
45
* Holds if data can flow from `node1` to `node2` either via a read or a write of an intermediate field `f`.
53
46
*/
54
47
private predicate isRelevantTaintStep ( DataFlow:: Node node1 , DataFlow:: Node node2 ) {
55
48
exists ( DataFlow:: Content f |
56
49
DataFlowPrivate:: readStep ( node1 , f , node2 ) and
57
- // Partially restrict the content types used for intermediate steps.
58
- ( not exists ( getUnderlyingContentType ( f ) ) or isRelevantTypeInContent ( f ) )
50
+ if f instanceof DataFlow:: FieldContent
51
+ then isRelevantType ( f .( DataFlow:: FieldContent ) .getField ( ) .getType ( ) )
52
+ else
53
+ if f instanceof DataFlow:: SyntheticFieldContent
54
+ then isRelevantType ( f .( DataFlow:: SyntheticFieldContent ) .getField ( ) .getType ( ) )
55
+ else any ( )
59
56
)
60
57
or
61
58
exists ( DataFlow:: Content f | DataFlowPrivate:: storeStep ( node1 , f , node2 ) |
@@ -64,11 +61,12 @@ private predicate isRelevantTaintStep(DataFlow::Node node1, DataFlow::Node node2
64
61
}
65
62
66
63
/**
67
- * Holds if content `c` is either a field, a synthetic field or language specific
68
- * content of a relevant type or a container like content.
64
+ * Holds if content `c` is either a field or synthetic field of a relevant type
65
+ * or a container like content.
69
66
*/
70
67
private predicate isRelevantContent ( DataFlow:: Content c ) {
71
- isRelevantTypeInContent ( c ) or
68
+ isRelevantType ( c .( DataFlow:: FieldContent ) .getField ( ) .getType ( ) ) or
69
+ isRelevantType ( c .( DataFlow:: SyntheticFieldContent ) .getField ( ) .getType ( ) ) or
72
70
DataFlowPrivate:: containerContent ( c )
73
71
}
74
72
@@ -260,10 +258,6 @@ module PropagateToSinkConfig implements DataFlow::ConfigSig {
260
258
predicate isBarrier ( DataFlow:: Node node ) { sinkModelSanitizer ( node ) }
261
259
262
260
DataFlow:: FlowFeature getAFeature ( ) { result instanceof DataFlow:: FeatureHasSourceCallContext }
263
-
264
- predicate isAdditionalFlowStep ( DataFlow:: Node node1 , DataFlow:: Node node2 ) {
265
- isRelevantTaintStep ( node1 , node2 )
266
- }
267
261
}
268
262
269
263
private module PropagateToSink = TaintTracking:: Global< PropagateToSinkConfig > ;
0 commit comments