Refactor HttpsUrlsQuery.qll

Author: egregius313

java/ql/lib/semmle/code/java/security/HttpsUrlsQuery.qll

@@ -6,9 +6,11 @@ import semmle.code.java.frameworks.Networking
 import semmle.code.java.security.HttpsUrls
 
 /**
+ * DEPRECATED: Use `HttpsStringToUrlOpenMethodFlow` instead.
+ *
  * A taint tracking configuration for HTTP connections.
  */
-class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
+deprecated class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
   HttpStringToUrlOpenMethodFlowConfig() { this = "HttpStringToUrlOpenMethodFlowConfig" }
 
   override predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HttpStringLiteral }
@@ -23,3 +25,25 @@ class HttpStringToUrlOpenMethodFlowConfig extends TaintTracking::Configuration {
     node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
   }
 }
+
+/**
+ * A taint tracking configuration for HTTP connections.
+ */
+private module HttpStringToUrlOpenMethodFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node src) { src.asExpr() instanceof HttpStringLiteral }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof UrlOpenSink }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    any(HttpUrlsAdditionalTaintStep c).step(node1, node2)
+  }
+
+  predicate isBarrier(DataFlow::Node node) {
+    node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
+  }
+}
+
+/**
+ * Detect taint flow of HTTP connections.
+ */
+module HttpStringToUrlOpenMethodFlow = TaintTracking::Global<HttpStringToUrlOpenMethodFlowConfig>;

java/ql/src/Security/CWE/CWE-319/HttpsUrls.ql

@@ -12,9 +12,9 @@
 
 import java
 import semmle.code.java.security.HttpsUrlsQuery
-import DataFlow::PathGraph
+import HttpStringToUrlOpenMethodFlow::PathGraph
 
-from DataFlow::PathNode source, DataFlow::PathNode sink
-where any(HttpStringToUrlOpenMethodFlowConfig c).hasFlowPath(source, sink)
+from HttpStringToUrlOpenMethodFlow::PathNode source, HttpStringToUrlOpenMethodFlow::PathNode sink
+where HttpStringToUrlOpenMethodFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "URL may have been constructed with HTTP protocol, using $@.",
   source.getNode(), "this HTTP URL"