Update java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

atorralba · aschackmull · atorralba · commit e2022f467cdb · 2021-12-15T13:00:16.000+01:00
Co-authored-by: Anders Schack-Mulligen &lt;aschackmull@users.noreply.github.com&gt;
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -596,12 +596,13 @@ private MethodAccess callReturningSameType(Expr ref) {
 }
 
 private SrcRefType entrypointType() {
-  result =
-    pragma[only_bind_out](any(RemoteFlowSource s | s instanceof DataFlow::ExplicitParameterNode))
-        .getType()
-        .(RefType)
-        .getASubtype*()
-        .getSourceDeclaration() or
+  exists(RemoteFlowSource s, RefType t |
+    s instanceof DataFlow::ExplicitParameterNode and
+    t = pragma[only_bind_out](s).getType() and
+    not t instanceof TypeObject and
+    result = t.getASubtype*().getSourceDeclaration()
+  )
+  or
   result = entrypointType().getAField().getType().(RefType).getSourceDeclaration()
 }
 
