File tree Expand file tree Collapse file tree 1 file changed +1
-24
lines changed
java/ql/lib/semmle/code/java/security Expand file tree Collapse file tree 1 file changed +1
-24
lines changed Original file line number Diff line number Diff line change @@ -41,28 +41,5 @@ module ZipSlipFlow = TaintTracking::Global<ZipSlipConfig>;
41
41
* A sink that represents a file creation, such as a file write, copy or move operation.
42
42
*/
43
43
private class FileCreationSink extends DataFlow:: Node {
44
- FileCreationSink ( ) {
45
- sinkNode ( this , "path-injection" ) and
46
- not isPathCreation ( this )
47
- }
48
- }
49
-
50
- /**
51
- * Holds if `sink` is a path creation node that doesn't imply a read/write filesystem operation.
52
- * This is to avoid creating new spurious alerts, since `PathCreation` sinks weren't
53
- * previously part of this query.
54
- */
55
- private predicate isPathCreation ( DataFlow:: Node sink ) {
56
- exists ( PathCreation pc |
57
- pc .getAnInput ( ) = sink .asExpr ( )
58
- or
59
- pc .getAnInput ( ) .( Argument ) .isVararg ( ) and sink .( DataFlow:: ImplicitVarargsArray ) .getCall ( ) = pc
60
- |
61
- // exclude actual read/write operations included in `PathCreation`
62
- not pc .( Call )
63
- .getCallee ( )
64
- .getDeclaringType ( )
65
- .hasQualifiedName ( "java.io" ,
66
- [ "FileInputStream" , "FileOutputStream" , "FileReader" , "FileWriter" ] )
67
- )
44
+ FileCreationSink ( ) { sinkNode ( this , "path-injection" ) }
68
45
}
You can’t perform that action at this time.
0 commit comments