Skip to content

Commit 915a19f

Browse files
committed
Improve naming; eliminate some harmless extra results
Adding `src != valueSource` should have no effect as the introduced edge would already exist, but could reduce workload downstream.
1 parent 516122a commit 915a19f

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,19 @@ private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::No
7171
* `a` is tainted after `f` completes, and vice versa.
7272
*/
7373
private predicate composedValueAndTaintModelStep(ArgumentNode src, DataFlow::Node sink) {
74-
exists(Call call, ArgumentNode valueSource, DataFlow::PostUpdateNode valueSourcePun |
74+
exists(Call call, ArgumentNode valueSource, DataFlow::PostUpdateNode valueSourcePost |
7575
src.argumentOf(call, _) and
7676
valueSource.argumentOf(call, _) and
77-
valueSourcePun.getPreUpdateNode() = valueSource and
77+
src != valueSource and
78+
valueSourcePost.getPreUpdateNode() = valueSource and
7879
DataFlow::localFlowStep(valueSource, DataFlow::exprNode(call)) and
7980
(
8081
// in-x -value-> out-y and in-z -taint-> out-y ==> in-z -taint-> in-x
8182
localAdditionalBasicTaintStep(src, DataFlow::exprNode(call)) and
82-
sink = valueSourcePun
83+
sink = valueSourcePost
8384
or
8485
// in-x -value-> out-y and in-z -taint-> in-x ==> in-z -taint-> out-y
85-
localAdditionalBasicTaintStep(src, valueSourcePun) and
86+
localAdditionalBasicTaintStep(src, valueSourcePost) and
8687
sink = DataFlow::exprNode(call)
8788
)
8889
)

0 commit comments

Comments
 (0)