remove wicket taintstep from TaintTrackingUtil

pwntester · pwntester · commit c28856d3dc93 · 2020-10-28T14:51:44.000+01:00
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -414,14 +414,6 @@ private predicate argToMethodStep(Expr tracked, MethodAccess sink) {
  * `arg`th argument is tainted.
  */
 private predicate taintPreservingArgumentToMethod(Method method, int arg) {
-  (
-    method.getDeclaringType().hasQualifiedName("org.apache.wicket.util.crypt", "Base64") and
-    (
-      method.getName().matches("decode%") and arg = 0 or
-      method.getName().matches("encode%") and arg = 0
-    )
-  )
-  or
   (
     method.getDeclaringType().hasQualifiedName("java.util", "Base64$Encoder") or
     method.getDeclaringType().hasQualifiedName("java.util", "Base64$Decoder") or
