Model java.lang.Object.clone() better for access paths.

owen-mc · owen-mc · commit 3d1d491e6bfc · 2021-09-27T16:24:25.000+01:00
Model value flow for Element, MapKey and MapValue. This assumes
that clone() is a shallow copy.
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/ContainerFlow.qll b/java/ql/lib/semmle/code/java/dataflow/internal/ContainerFlow.qll
@@ -95,6 +95,9 @@ private class ContainerFlowSummaries extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
+        "java.lang;Object;true;clone;;;MapKey of Argument[-1];MapKey of ReturnValue;value",
+        "java.lang;Object;true;clone;;;MapValue of Argument[-1];MapValue of ReturnValue;value",
+        "java.lang;Object;true;clone;;;Element of Argument[-1];Element of ReturnValue;value",
         "java.util;Map$Entry;true;getKey;;;MapKey of Argument[-1];ReturnValue;value",
         "java.util;Map$Entry;true;getValue;;;MapValue of Argument[-1];ReturnValue;value",
         "java.util;Map$Entry;true;setValue;;;MapValue of Argument[-1];ReturnValue;value",
