Java: ContainerFlow: RValue -> Expr

aibaars · aibaars · commit 24c6e506aa29 · 2020-07-09T12:20:48.000+02:00
While most flow for a qualifierToArgumentStep goes through a variable use this is not always the case. Therefore it is best to remove the restriction to RValue to allow taint steps to use postupdate nodes. See also: ba86dea
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll b/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll
@@ -180,7 +180,7 @@ private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {
   tracked = sink.getQualifier()
 }
 
-private predicate qualifierToArgumentStep(Expr tracked, RValue sink) {
+private predicate qualifierToArgumentStep(Expr tracked, Expr sink) {
   exists(MethodAccess ma, CollectionMethod method |
     method = ma.getMethod() and
     (

Original file line number	Diff line number	Diff line change
`@@ -180,7 +180,7 @@ private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {`
`180`	`180`	`tracked = sink.getQualifier()`
`181`	`181`	`}`
`182`	`182`
`183`		`-private predicate qualifierToArgumentStep(Expr tracked, RValue sink) {`
	`183`	`+private predicate qualifierToArgumentStep(Expr tracked, Expr sink) {`
`184`	`184`	`exists(MethodAccess ma, CollectionMethod method \|`
`185`	`185`	`method = ma.getMethod() and`
`186`	`186`	`(`