Java/ImproperValidationOfArrayConstructionCodeSpecifiedQuery

d10c · d10c · commit 9eeeec336e44 · 2025-10-28T09:39:45.000+01:00
java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql
diff --git a/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
@@ -21,6 +21,8 @@ module BoundedFlowSourceConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     exists(ArrayCreationExpr arrayCreation, CheckableArrayAccess arrayAccess |
       result = [arrayCreation, arrayAccess.getIndexExpr()].getLocation() and
       arrayAccess.canThrowOutOfBoundsDueToEmptyArray(sink.asExpr(), arrayCreation)
