Java: add Vector::copyInto, BlockingQueue::drainTo

aibaars · aibaars · commit 441bf98ce70d · 2020-07-07T20:35:02.000+02:00
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll b/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll
@@ -181,9 +181,10 @@ private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {
 
 private predicate qualifierToArgumentStep(Expr tracked, RValue sink) {
   exists(MethodAccess ma |
-    ma.getMethod().(CollectionMethod).hasName("toArray") and
+    // java.util.Vector, java.util.concurrent.BlockingQueue, java.util.Collection
+    ma.getMethod().(CollectionMethod).hasName(["copyInto", "drainTo", "toArray"]) and
     tracked = ma.getQualifier() and
-    sink = ma.getArgument(1)
+    sink = ma.getArgument(0)
   )
 }
 

Original file line number	Diff line number	Diff line change
`@@ -181,9 +181,10 @@ private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {`
`181`	`181`
`182`	`182`	`private predicate qualifierToArgumentStep(Expr tracked, RValue sink) {`
`183`	`183`	`exists(MethodAccess ma \|`
`184`		`- ma.getMethod().(CollectionMethod).hasName("toArray") and`
	`184`	`+ // java.util.Vector, java.util.concurrent.BlockingQueue, java.util.Collection`
	`185`	`+ ma.getMethod().(CollectionMethod).hasName(["copyInto", "drainTo", "toArray"]) and`
`185`	`186`	`tracked = ma.getQualifier() and`
`186`		`- sink = ma.getArgument(1)`
	`187`	`+ sink = ma.getArgument(0)`
`187`	`188`	`)`
`188`	`189`	`}`
`189`	`190`