Java: Change RemoteUserInput to private instead of removing.

aschackmull · aschackmull · commit 88e075936572 · 2020-11-30T13:40:53.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -204,6 +204,13 @@ private class BeanValidationSource extends RemoteFlowSource {
 /** Class for `tainted` user input. */
 abstract class UserInput extends DataFlow::Node { }
 
+/**
+ * Input that may be controlled by a remote user.
+ */
+private class RemoteUserInput extends UserInput {
+  RemoteUserInput() { this instanceof RemoteFlowSource }
+}
+
 /** A node with input that may be controlled by a local user. */
 abstract class LocalUserInput extends UserInput { }
 
