Java: make inputStreamWrapper only act on constructors from outside of source

atorralba · atorralba · commit 549fa7e288fd · 2023-05-12T17:47:56.000+02:00
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -255,6 +255,7 @@ private class BulkData extends RefType {
  * status of its argument.
  */
 private predicate inputStreamWrapper(Constructor c, int argi) {
+  not c.fromSource() and
   c.getParameterType(argi) instanceof BulkData and
   c.getDeclaringType().getASourceSupertype+().hasQualifiedName("java.io", "InputStream")
 }

Original file line number	Diff line number	Diff line change
`@@ -255,6 +255,7 @@ private class BulkData extends RefType {`
`255`	`255`	`* status of its argument.`
`256`	`256`	`*/`
`257`	`257`	`private predicate inputStreamWrapper(Constructor c, int argi) {`
	`258`	`+ not c.fromSource() and`
`258`	`259`	`c.getParameterType(argi) instanceof BulkData and`
`259`	`260`	`c.getDeclaringType().getASourceSupertype+().hasQualifiedName("java.io", "InputStream")`
`260`	`261`	`}`