Skip to content

Commit 6e4e1e5

Browse files
committed
Refactor NFEAndroidDoS
1 parent 94768f4 commit 6e4e1e5

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,17 @@ import java
1717
import semmle.code.java.frameworks.android.Intent
1818
import semmle.code.java.dataflow.FlowSources
1919
import semmle.code.java.NumberFormatException
20-
import DataFlow::PathGraph
20+
import NfeLocalDoSFlow::PathGraph
2121

2222
/**
2323
* Taint configuration tracking flow from untrusted inputs to number conversion calls in exported Android compononents.
2424
*/
25-
class NfeLocalDoSConfiguration extends TaintTracking::Configuration {
26-
NfeLocalDoSConfiguration() { this = "NFELocalDoSConfiguration" }
27-
25+
module NfeLocalDoSConfig implements DataFlow::ConfigSig {
2826
/** Holds if source is a remote flow source */
29-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
27+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
3028

3129
/** Holds if NFE is thrown but not caught */
32-
override predicate isSink(DataFlow::Node sink) {
30+
predicate isSink(DataFlow::Node sink) {
3331
exists(Expr e |
3432
e.getEnclosingCallable().getDeclaringType().(ExportableAndroidComponent).isExported() and
3533
throwsNfe(e) and
@@ -42,8 +40,10 @@ class NfeLocalDoSConfiguration extends TaintTracking::Configuration {
4240
}
4341
}
4442

45-
from DataFlow::PathNode source, DataFlow::PathNode sink, NfeLocalDoSConfiguration conf
46-
where conf.hasFlowPath(source, sink)
43+
module NfeLocalDoSFlow = TaintTracking::Global<NfeLocalDoSConfig>;
44+
45+
from NfeLocalDoSFlow::PathNode source, NfeLocalDoSFlow::PathNode sink
46+
where NfeLocalDoSFlow::flowPath(source, sink)
4747
select sink.getNode(), source, sink,
4848
"Uncaught NumberFormatException in an exported Android component due to $@.", source.getNode(),
4949
"user-provided value"

0 commit comments

Comments
 (0)