Skip to content

Commit 938f46b

Browse files
committed
Java: Remove superfluous clone models.
1 parent dc64a08 commit 938f46b

File tree

3 files changed

+7
-7
lines changed

3 files changed

+7
-7
lines changed

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -316,9 +316,6 @@ private predicate qualifierToMethodStep(Expr tracked, MethodCall sink, string mo
316316
* Methods that return tainted data when called on tainted data.
317317
*/
318318
private predicate taintPreservingQualifierToMethod(Method m, string model) {
319-
model = "" and
320-
m instanceof CloneMethod
321-
or
322319
model = "%StringWriter" and
323320
m.getDeclaringType().getQualifiedName().matches("%StringWriter") and
324321
(

java/ql/lib/semmle/code/java/frameworks/Jndi.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,12 @@ class MethodLdapNameAddAll extends Method {
4444
}
4545
}
4646

47-
/** A method with the name `clone` declared in `javax.naming.ldap.LdapName`. */
48-
class MethodLdapNameClone extends Method {
47+
/**
48+
* DEPRECATED: No longer needed as clone steps are handled uniformly.
49+
*
50+
* A method with the name `clone` declared in `javax.naming.ldap.LdapName`.
51+
*/
52+
deprecated class MethodLdapNameClone extends Method {
4953
MethodLdapNameClone() {
5054
this.getDeclaringType() instanceof TypeLdapName and
5155
this.hasName("clone")

java/ql/lib/semmle/code/java/security/LdapInjection.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ private predicate ldapNameAddAllStep(DataFlow::ExprNode n1, DataFlow::ExprNode n
6262

6363
/**
6464
* Holds if `n1` to `n2` is a dataflow step that converts between `LdapName` and `LdapName` or
65-
* `String`, i.e. `taintedLdapName.clone()`, `taintedLdapName.getAll()`,
65+
* `String`, i.e. `taintedLdapName.getAll()`,
6666
* `taintedLdapName.getRdns()` or `taintedLdapName.toString()`.
6767
*/
6868
private predicate ldapNameGetCloneStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
@@ -71,7 +71,6 @@ private predicate ldapNameGetCloneStep(DataFlow::ExprNode n1, DataFlow::ExprNode
7171
n2.asExpr() = ma and
7272
ma.getMethod() = m
7373
|
74-
m instanceof MethodLdapNameClone or
7574
m instanceof MethodLdapNameGetAll or
7675
m instanceof MethodLdapNameGetRdns or
7776
m instanceof MethodLdapNameToString

0 commit comments

Comments
 (0)