Fix bug in sink detection

Benjamin Muskalla · Benjamin Muskalla · commit 2b2ac82fb7a7 · 2021-11-10T16:30:20.000+01:00
diff --git a/java/ql/src/utils/model-generator/CaptureSinkModels.ql b/java/ql/src/utils/model-generator/CaptureSinkModels.ql
@@ -28,7 +28,7 @@ class PropagateToSinkConfiguration extends TaintTracking::Configuration {
 string asInputArgument(Expr source) {
   result = "Argument[" + source.(Argument).getPosition() + "]"
   or
-  result = source.(VarAccess).getVariable().toString()
+  result = "Argument[" + source.(VarAccess).getVariable().(Parameter).getPosition() + "]"
 }
 
 string captureSink(Callable api) {
diff --git a/java/ql/test/utils/model-generator/CaptureSinkModels.expected b/java/ql/test/utils/model-generator/CaptureSinkModels.expected
@@ -1,3 +1,3 @@
 | p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];create-file; |
-| p;Sinks;true;readUrl;(URL,Charset);;url;open-url; |
-| p;Sources;true;readUrl;(URL);;url;open-url; |
+| p;Sinks;true;readUrl;(URL,Charset);;Argument[0];open-url; |
+| p;Sources;true;readUrl;(URL);;Argument[0];open-url; |

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ class PropagateToSinkConfiguration extends TaintTracking::Configuration {`
`28`	`28`	`string asInputArgument(Expr source) {`
`29`	`29`	`result = "Argument[" + source.(Argument).getPosition() + "]"`
`30`	`30`	`or`
`31`		`- result = source.(VarAccess).getVariable().toString()`
	`31`	`+ result = "Argument[" + source.(VarAccess).getVariable().(Parameter).getPosition() + "]"`
`32`	`32`	`}`
`33`	`33`
`34`	`34`	`string captureSink(Callable api) {`