Merge pull request github#12969 from atorralba/atorralba/java/fix-model-generator-sinks-instance-parameters

atorralba · web-flow · commit 51c08f131416 · 2023-05-02T10:10:59.000+02:00
Java: Fix sink model generator for instance parameters
diff --git a/java/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll b/java/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll
@@ -236,7 +236,7 @@ predicate apiSource(DataFlow::Node source) {
 string asInputArgumentSpecific(DataFlow::Node source) {
   exists(int pos |
     source.(DataFlow::ParameterNode).isParameterOf(_, pos) and
-    result = "Argument[" + pos + "]"
+    if pos >= 0 then result = "Argument[" + pos + "]" else result = qualifierString()
   )
   or
   source.asExpr() instanceof J::FieldAccess and

Original file line number	Diff line number	Diff line change
`@@ -236,7 +236,7 @@ predicate apiSource(DataFlow::Node source) {`
`236`	`236`	`string asInputArgumentSpecific(DataFlow::Node source) {`
`237`	`237`	`exists(int pos \|`
`238`	`238`	`source.(DataFlow::ParameterNode).isParameterOf(_, pos) and`
`239`		`- result = "Argument[" + pos + "]"`
	`239`	`+ if pos >= 0 then result = "Argument[" + pos + "]" else result = qualifierString()`
`240`	`240`	`)`
`241`	`241`	`or`
`242`	`242`	`source.asExpr() instanceof J::FieldAccess and`