@@ -3459,6 +3459,16 @@ private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
3459
3459
ap instanceof AccessPathNil and
3460
3460
if hasSinkCallCtx ( config )
3461
3461
then
3462
+ // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
3463
+ // is exactly what we need to check. This also implies
3464
+ // `sc instanceof SummaryCtxNone`.
3465
+ // For `FeatureEqualSourceSinkCallContext` the initial call context was
3466
+ // set to `CallContextSomeCall` and jumps are disallowed, so
3467
+ // `cc instanceof CallContextNoCall` never holds. On the other hand,
3468
+ // in this case there's never any need to enter a call except to identify
3469
+ // a summary, so the condition in `pathIntoCallable` enforces this, which
3470
+ // means that `sc instanceof SummaryCtxNone` holds if and only if we are
3471
+ // in the call context of the source.
3462
3472
sc instanceof SummaryCtxNone or
3463
3473
cc instanceof CallContextNoCall
3464
3474
else any ( )
@@ -3664,6 +3674,9 @@ private predicate pathIntoCallable(
3664
3674
or
3665
3675
not exists ( TSummaryCtxSome ( p , ap ) ) and
3666
3676
sc = TSummaryCtxNone ( ) and
3677
+ // When the call contexts of source and sink needs to match then there's
3678
+ // never any reason to enter a callable except to find a summary. See also
3679
+ // the comment in `PathNodeMid::isAtSink`.
3667
3680
not config .getAFeature ( ) instanceof FeatureEqualSourceSinkCallContext
3668
3681
)
3669
3682
|
0 commit comments