Use don't care expression

edvraa · edvraa · commit a4fd70aa3d4b · 2021-04-14T23:35:38.000+03:00
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql
@@ -19,10 +19,9 @@ where
   (
     sink instanceof InstanceMethodSink and
     not exists(
-      SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::PathNode safeCreation,
-      DataFlow::PathNode safeTypeUsage
+      SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::PathNode safeTypeUsage
     |
-      safeConstructorTracking.hasFlowPath(safeCreation, safeTypeUsage) and
+      safeConstructorTracking.hasFlowPath(_, safeTypeUsage) and
       safeTypeUsage.getNode().asExpr().getParent() = deserializeCall
     )
     or

Original file line number	Diff line number	Diff line change
`@@ -19,10 +19,9 @@ where`
`19`	`19`	`(`
`20`	`20`	`sink instanceof InstanceMethodSink and`
`21`	`21`	`not exists(`
`22`		`- SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::PathNode safeCreation,`
`23`		`- DataFlow::PathNode safeTypeUsage`
	`22`	`+ SafeConstructorTrackingConfig safeConstructorTracking, DataFlow::PathNode safeTypeUsage`
`24`	`23`	`\|`
`25`		`- safeConstructorTracking.hasFlowPath(safeCreation, safeTypeUsage) and`
	`24`	`+ safeConstructorTracking.hasFlowPath(_, safeTypeUsage) and`
`26`	`25`	`safeTypeUsage.getNode().asExpr().getParent() = deserializeCall`
`27`	`26`	`)`
`28`	`27`	`or`