@@ -12,15 +12,20 @@ predicate taintFlowUpdate(DataFlow::ParameterNode p1, DataFlow::ParameterNode p2
12
12
exists ( DataFlow:: PostUpdateNode ret | localTaint ( p1 , ret ) | ret .getPreUpdateNode ( ) = p2 )
13
13
}
14
14
15
+ predicate summaryStep ( FlowSummaryNode src , FlowSummaryNode sink ) {
16
+ FlowSummaryImpl:: Private:: Steps:: summaryLocalStep ( src .getSummaryNode ( ) , sink .getSummaryNode ( ) ,
17
+ false ) or
18
+ FlowSummaryImpl:: Private:: Steps:: summaryReadStep ( src .getSummaryNode ( ) , _, sink .getSummaryNode ( ) ) or
19
+ FlowSummaryImpl:: Private:: Steps:: summaryStoreStep ( src .getSummaryNode ( ) , _, sink .getSummaryNode ( ) )
20
+ }
21
+
15
22
from DataFlow:: Node src , DataFlow:: Node sink
16
23
where
17
24
(
18
25
localAdditionalTaintStep ( src , sink ) or
19
26
FlowSummaryImpl:: Private:: Steps:: summaryThroughStepTaint ( src , sink , _)
20
27
) and
21
- not FlowSummaryImpl:: Private:: Steps:: summaryLocalStep ( src , sink , false ) and
22
- not FlowSummaryImpl:: Private:: Steps:: summaryReadStep ( src , _, sink ) and
23
- not FlowSummaryImpl:: Private:: Steps:: summaryStoreStep ( src , _, sink )
28
+ not summaryStep ( src , sink )
24
29
or
25
30
exists ( ArgumentNode arg , MethodAccess call , DataFlow:: ParameterNode p , int i |
26
31
src = arg and
0 commit comments