Update java/ql/src/semmle/code/java/security/OgnlInjection.qll

atorralba · aschackmull · web-flow · commit b20d53cfd4e9 · 2021-07-29T15:08:27.000+02:00
Co-authored-by: Anders Schack-Mulligen &lt;aschackmull@users.noreply.github.com&gt;
diff --git a/java/ql/src/semmle/code/java/security/OgnlInjection.qll b/java/ql/src/semmle/code/java/security/OgnlInjection.qll
@@ -107,7 +107,7 @@ private predicate getAccessorStep(DataFlow::Node n1, DataFlow::Node n2) {
 private predicate setExpressionStep(DataFlow::Node n1, DataFlow::Node n2) {
   exists(MethodAccess ma, Method m |
     n1.asExpr() = ma.getArgument(0) and
-    n2.asExpr() = ma.getQualifier() and
+    n2.(PostUpdateNode).getPreUpdateNode().asExpr() = ma.getQualifier() and
     ma.getMethod() = m and
     m.getDeclaringType().getASupertype*() instanceof TypeExpressionAccessor
   |

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ private predicate getAccessorStep(DataFlow::Node n1, DataFlow::Node n2) {`
`107`	`107`	`private predicate setExpressionStep(DataFlow::Node n1, DataFlow::Node n2) {`
`108`	`108`	`exists(MethodAccess ma, Method m \|`
`109`	`109`	`n1.asExpr() = ma.getArgument(0) and`
`110`		`- n2.asExpr() = ma.getQualifier() and`
	`110`	`+ n2.(PostUpdateNode).getPreUpdateNode().asExpr() = ma.getQualifier() and`
`111`	`111`	`ma.getMethod() = m and`
`112`	`112`	`m.getDeclaringType().getASupertype*() instanceof TypeExpressionAccessor`
`113`	`113`	`\|`