Skip to content

Commit 19a6b78

Browse files
committed
Remove reference to PathCreation
ZipSlip no longer needs to make this exclusion, since PathCreation arguments are no longer path-injection sinks
1 parent 2a14640 commit 19a6b78

File tree

1 file changed

+1
-24
lines changed

1 file changed

+1
-24
lines changed

java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -41,28 +41,5 @@ module ZipSlipFlow = TaintTracking::Global<ZipSlipConfig>;
4141
* A sink that represents a file creation, such as a file write, copy or move operation.
4242
*/
4343
private class FileCreationSink extends DataFlow::Node {
44-
FileCreationSink() {
45-
sinkNode(this, "path-injection") and
46-
not isPathCreation(this)
47-
}
48-
}
49-
50-
/**
51-
* Holds if `sink` is a path creation node that doesn't imply a read/write filesystem operation.
52-
* This is to avoid creating new spurious alerts, since `PathCreation` sinks weren't
53-
* previously part of this query.
54-
*/
55-
private predicate isPathCreation(DataFlow::Node sink) {
56-
exists(PathCreation pc |
57-
pc.getAnInput() = sink.asExpr()
58-
or
59-
pc.getAnInput().(Argument).isVararg() and sink.(DataFlow::ImplicitVarargsArray).getCall() = pc
60-
|
61-
// exclude actual read/write operations included in `PathCreation`
62-
not pc.(Call)
63-
.getCallee()
64-
.getDeclaringType()
65-
.hasQualifiedName("java.io",
66-
["FileInputStream", "FileOutputStream", "FileReader", "FileWriter"])
67-
)
44+
FileCreationSink() { sinkNode(this, "path-injection") }
6845
}

0 commit comments

Comments
 (0)