@@ -2,7 +2,14 @@ import java
2
2
import semmle.code.java.Serializability
3
3
import semmle.code.java.dataflow.DataFlow
4
4
import semmle.code.java.dataflow.DataFlow5
5
- private import semmle.code.java.dataflow.ExternalFlow
5
+
6
+ /** The method `parseAs` in `com.google.api.client.http.HttpResponse`. */
7
+ private class ParseAsMethod extends Method {
8
+ ParseAsMethod ( ) {
9
+ this .getDeclaringType ( ) .hasQualifiedName ( "com.google.api.client.http" , "HttpResponse" ) and
10
+ this .hasName ( "parseAs" )
11
+ }
12
+ }
6
13
7
14
private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5:: Configuration {
8
15
TypeLiteralToParseAsFlowConfiguration ( ) {
@@ -11,17 +18,16 @@ private class TypeLiteralToParseAsFlowConfiguration extends DataFlow5::Configura
11
18
12
19
override predicate isSource ( DataFlow:: Node source ) { source .asExpr ( ) instanceof TypeLiteral }
13
20
14
- override predicate isSink ( DataFlow:: Node sink ) { sinkNode ( sink , "google-parse-as" ) }
21
+ override predicate isSink ( DataFlow:: Node sink ) {
22
+ exists ( MethodAccess ma |
23
+ ma .getAnArgument ( ) = sink .asExpr ( ) and
24
+ ma .getMethod ( ) instanceof ParseAsMethod
25
+ )
26
+ }
15
27
16
28
TypeLiteral getSourceWithFlowToParseAs ( ) { hasFlow ( DataFlow:: exprNode ( result ) , _) }
17
29
}
18
30
19
- private class ParseAsSinkModel extends SinkModelCsv {
20
- override predicate row ( string row ) {
21
- row = [ "com.google.api.client.http;HttpResponse;false;parseAs;;;Argument;google-parse-as" ]
22
- }
23
- }
24
-
25
31
/** A field that is deserialized by `HttpResponse.parseAs`. */
26
32
class HttpResponseParseAsDeserializableField extends DeserializableField {
27
33
HttpResponseParseAsDeserializableField ( ) {
0 commit comments