Update java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSourceLib.qll

haby0 · smowton · web-flow · commit b60bffaf83fb · 2021-04-20T19:31:59.000+08:00
Co-authored-by: Chris Smowton &lt;smowton@github.com&gt;
diff --git a/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSourceLib.qll b/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSourceLib.qll
@@ -102,8 +102,7 @@ private class PrintSink extends UseOfLessTrustedSink {
     exists(MethodAccess ma |
       ma.getMethod().getName() in ["print", "println"] and
       (
-        ma.getMethod().getDeclaringType().hasQualifiedName("java.io", "PrintWriter") or
-        ma.getMethod().getDeclaringType().hasQualifiedName("java.io", "PrintStream")
+        ma.getMethod().getDeclaringType().hasQualifiedName("java.io", ["PrintWriter", "PrintStream"])
       ) and
       ma.getAnArgument() = this.asExpr()
     )

Original file line number	Diff line number	Diff line change
`@@ -102,8 +102,7 @@ private class PrintSink extends UseOfLessTrustedSink {`
`102`	`102`	`exists(MethodAccess ma \|`
`103`	`103`	`ma.getMethod().getName() in ["print", "println"] and`
`104`	`104`	`(`
`105`		`- ma.getMethod().getDeclaringType().hasQualifiedName("java.io", "PrintWriter") or`
`106`		`- ma.getMethod().getDeclaringType().hasQualifiedName("java.io", "PrintStream")`
	`105`	`+ ma.getMethod().getDeclaringType().hasQualifiedName("java.io", ["PrintWriter", "PrintStream"])`
`107`	`106`	`) and`
`108`	`107`	`ma.getAnArgument() = this.asExpr()`
`109`	`108`	`)`