Make the additional flow step abstract

atorralba · atorralba · commit b586f3ec9c6c · 2021-08-04T12:11:17.000+02:00
diff --git a/java/ql/src/semmle/code/java/security/JWT.qll b/java/ql/src/semmle/code/java/security/JWT.qll
@@ -46,9 +46,18 @@ class JwtParserWithInsecureParseSink extends DataFlow::Node {
   MethodAccess getParseMethodAccess() { result = insecureParseMa }
 }
 
-/** A set of additional taint steps to consider when taint tracking JWT related data flows. */
-class JwtParserWithInsecureParseAdditionalTaintStep extends Unit {
-  predicate step(DataFlow::Node node1, DataFlow::Node node2) {
+/**
+ * A unit class for adding additional flow steps.
+ *
+ * Extend this class to add additional flow steps that should apply to the `SigningToInsecureMethodAccessDataFlow`.
+ */
+class JwtParserWithInsecureParseAdditionalFlowStep extends Unit {
+  abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
+}
+
+/** A set of additional flow steps to consider when working with JWT parsing related data flows. */
+private class DefaultJwtParserWithInsecureParseAdditionalFlowStep extends JwtParserWithInsecureParseAdditionalFlowStep {
+  override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
     jwtParserStep(node1.asExpr(), node2.asExpr())
   }
 }
diff --git a/java/ql/src/semmle/code/java/security/MissingJWTSignatureCheckQuery.qll b/java/ql/src/semmle/code/java/security/MissingJWTSignatureCheckQuery.qll
@@ -50,6 +50,6 @@ private class SigningToInsecureMethodAccessDataFlow extends DataFlow::Configurat
   override predicate isSink(DataFlow::Node sink) { sink instanceof JwtParserWithInsecureParseSink }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    any(JwtParserWithInsecureParseAdditionalTaintStep c).step(node1, node2)
+    any(JwtParserWithInsecureParseAdditionalFlowStep c).step(node1, node2)
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -50,6 +50,6 @@ private class SigningToInsecureMethodAccessDataFlow extends DataFlow::Configurat`
`50`	`50`	`override predicate isSink(DataFlow::Node sink) { sink instanceof JwtParserWithInsecureParseSink }`
`51`	`51`
`52`	`52`	`override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {`
`53`		`- any(JwtParserWithInsecureParseAdditionalTaintStep c).step(node1, node2)`
	`53`	`+ any(JwtParserWithInsecureParseAdditionalFlowStep c).step(node1, node2)`
`54`	`54`	`}`
`55`	`55`	`}`