@@ -399,12 +399,10 @@ private class UnsafeTypeSink extends DataFlow::Node {
399
399
}
400
400
}
401
401
402
- private class UnsafeTypeAdditionalTaintStep extends Unit {
403
- predicate isAdditionalTaintStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
404
- resolveClassStep ( fromNode , toNode ) or
405
- looksLikeResolveClassStep ( fromNode , toNode ) or
406
- intentFlowsToParcel ( fromNode , toNode )
407
- }
402
+ private predicate isUnsafeTypeAdditionalTaintStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
403
+ resolveClassStep ( fromNode , toNode ) or
404
+ looksLikeResolveClassStep ( fromNode , toNode ) or
405
+ intentFlowsToParcel ( fromNode , toNode )
408
406
}
409
407
410
408
/**
@@ -427,7 +425,7 @@ deprecated class UnsafeTypeConfig extends TaintTracking2::Configuration {
427
425
* or at least looks like resolving a class.
428
426
*/
429
427
override predicate isAdditionalTaintStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
430
- any ( UnsafeTypeAdditionalTaintStep s ) . isAdditionalTaintStep ( fromNode , toNode )
428
+ isUnsafeTypeAdditionalTaintStep ( fromNode , toNode )
431
429
}
432
430
}
433
431
@@ -447,7 +445,7 @@ module UnsafeTypeConfig implements DataFlow::ConfigSig {
447
445
* or at least looks like resolving a class.
448
446
*/
449
447
predicate isAdditionalFlowStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
450
- any ( UnsafeTypeAdditionalTaintStep s ) . isAdditionalTaintStep ( fromNode , toNode )
448
+ isUnsafeTypeAdditionalTaintStep ( fromNode , toNode )
451
449
}
452
450
}
453
451
@@ -488,18 +486,18 @@ private module EnableJacksonDefaultTypingConfig implements DataFlow::ConfigSig {
488
486
module EnableJacksonDefaultTypingFlow = DataFlow:: Global< EnableJacksonDefaultTypingConfig > ;
489
487
490
488
/** Dataflow step that creates an `ObjectMapper` via a builder. */
491
- private class ObjectMapperBuilderAdditionalFlowStep extends Unit {
492
- predicate isAdditionalFlowStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
493
- exists ( MethodAccess ma , Method m | m = ma . getMethod ( ) |
494
- m . getDeclaringType ( ) instanceof MapperBuilder and
495
- m . getReturnType ( )
496
- . ( RefType )
497
- . hasQualifiedName ( "com.fasterxml.jackson.databind.json" ,
498
- [ "JsonMapper$Builder" , "JsonMapper" ] ) and
499
- fromNode . asExpr ( ) = ma . getQualifier ( ) and
500
- ma = toNode . asExpr ( )
501
- )
502
- }
489
+ private predicate isObjectMapperBuilderAdditionalFlowStep (
490
+ DataFlow:: Node fromNode , DataFlow:: Node toNode
491
+ ) {
492
+ exists ( MethodAccess ma , Method m | m = ma . getMethod ( ) |
493
+ m . getDeclaringType ( ) instanceof MapperBuilder and
494
+ m . getReturnType ( )
495
+ . ( RefType )
496
+ . hasQualifiedName ( "com.fasterxml.jackson.databind.json" ,
497
+ [ "JsonMapper$Builder" , "JsonMapper" ] ) and
498
+ fromNode . asExpr ( ) = ma . getQualifier ( ) and
499
+ ma = toNode . asExpr ( )
500
+ )
503
501
}
504
502
505
503
/**
@@ -524,7 +522,7 @@ deprecated class SafeObjectMapperConfig extends DataFlow2::Configuration {
524
522
* that configures or creates an `ObjectMapper` via a builder.
525
523
*/
526
524
override predicate isAdditionalFlowStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
527
- any ( ObjectMapperBuilderAdditionalFlowStep s ) . isAdditionalFlowStep ( fromNode , toNode )
525
+ isObjectMapperBuilderAdditionalFlowStep ( fromNode , toNode )
528
526
}
529
527
}
530
528
@@ -544,7 +542,7 @@ module SafeObjectMapperConfig implements DataFlow::ConfigSig {
544
542
* that configures or creates an `ObjectMapper` via a builder.
545
543
*/
546
544
predicate isAdditionalFlowStep ( DataFlow:: Node fromNode , DataFlow:: Node toNode ) {
547
- any ( ObjectMapperBuilderAdditionalFlowStep s ) . isAdditionalFlowStep ( fromNode , toNode )
545
+ isObjectMapperBuilderAdditionalFlowStep ( fromNode , toNode )
548
546
}
549
547
}
550
548
0 commit comments