Skip to content

Commit 1497fba

Browse files
committed
Remove the isAdditionalTaintStep predicate
1 parent e7cd6c9 commit 1497fba

File tree

1 file changed

+0
-10
lines changed

1 file changed

+0
-10
lines changed

java/ql/src/experimental/Security/CWE/CWE-094/JythonInjection.ql

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -102,16 +102,6 @@ class CodeInjectionConfiguration extends TaintTracking::Configuration {
102102
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
103103

104104
override predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
105-
106-
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
107-
// @RequestBody MyQueryObj query; interpreter.exec(query.getInterpreterCode());
108-
exists(MethodAccess ma |
109-
ma.getMethod().getDeclaringType().getASubtype*() instanceof SpringUntrustedDataType and
110-
not ma.getMethod().getDeclaringType() instanceof TypeObject and
111-
ma.getQualifier() = node1.asExpr() and
112-
ma = node2.asExpr()
113-
)
114-
}
115105
}
116106

117107
from DataFlow::PathNode source, DataFlow::PathNode sink, CodeInjectionConfiguration conf

0 commit comments

Comments
 (0)