Consider bulk-like data for argument accessors

Benjamin Muskalla · Benjamin Muskalla · commit e2bd792fc2ee · 2021-11-10T16:30:25.000+01:00
diff --git a/java/ql/src/utils/model-generator/CaptureSummaryModels.ql b/java/ql/src/utils/model-generator/CaptureSummaryModels.ql
@@ -228,10 +228,6 @@ predicate isRelevantType(Type t) {
   )
 }
 
-predicate isPrimitiveTypeUsedForBulkData(Type t) {
-  t.getName().regexpMatch("byte|char|Byte|Character")
-}
-
 from TargetAPI api, string flow
 where flow = captureFlow(api)
 select flow order by flow
diff --git a/java/ql/src/utils/model-generator/ModelGeneratorUtils.qll b/java/ql/src/utils/model-generator/ModelGeneratorUtils.qll
@@ -102,10 +102,16 @@ private string typeAsModel(RefType type) {
 }
 
 string parameterAccess(Parameter p) {
-  if p.getType() instanceof Array
+  if
+    p.getType() instanceof Array and
+    not isPrimitiveTypeUsedForBulkData(p.getType().(Array).getElementType())
   then result = "ArrayElement of Argument[" + p.getPosition() + "]"
   else
     if p.getType() instanceof ContainerType
     then result = "Element of Argument[" + p.getPosition() + "]"
     else result = "Argument[" + p.getPosition() + "]"
 }
+
+predicate isPrimitiveTypeUsedForBulkData(Type t) {
+  t.getName().regexpMatch("byte|char|Byte|Character")
+}
diff --git a/java/ql/test/utils/model-generator/CaptureSummaryModels.expected b/java/ql/test/utils/model-generator/CaptureSummaryModels.expected
@@ -30,7 +30,8 @@
 | p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[1];ReturnValue;taint; |
 | p;ParamFlow;true;returnVarArgElement;(String[]);;ArrayElement of Argument[0];ReturnValue;taint; |
 | p;ParamFlow;true;returnsInput;(String);;Argument[0];ReturnValue;taint; |
-| p;ParamFlow;true;writeChunked;(byte[],OutputStream);;ArrayElement of Argument[0];Argument[1];taint; |
+| p;ParamFlow;true;writeChunked;(byte[],OutputStream);;Argument[0];Argument[1];taint; |
+| p;ParamFlow;true;writeChunked;(char[],OutputStream);;Argument[0];Argument[1];taint; |
 | p;Pojo;false;fillIn;(List);;Argument[-1];Element of Argument[0];taint; |
 | p;Pojo;false;getBoxedBytes;();;Argument[-1];ReturnValue;taint; |
 | p;Pojo;false;getBoxedChars;();;Argument[-1];ReturnValue;taint; |
diff --git a/java/ql/test/utils/model-generator/p/ParamFlow.java b/java/ql/test/utils/model-generator/p/ParamFlow.java
@@ -51,6 +51,11 @@ public void writeChunked(byte[] data, OutputStream output)
             throws IOException {
         output.write(data, 0, data.length);
     }
+    
+    public void writeChunked(char[] data, OutputStream output)
+            throws IOException {
+        output.write(String.valueOf(data).getBytes(), 0, data.length);
+    }
 
     public void addTo(String data, List<String> target) {
         target.add(data);

Original file line number	Diff line number	Diff line change
`@@ -228,10 +228,6 @@ predicate isRelevantType(Type t) {`
`228`	`228`	`)`
`229`	`229`	`}`
`230`	`230`
`231`		`-predicate isPrimitiveTypeUsedForBulkData(Type t) {`
`232`		`- t.getName().regexpMatch("byte\|char\|Byte\|Character")`
`233`		`-}`
`234`		`-`
`235`	`231`	`from TargetAPI api, string flow`
`236`	`232`	`where flow = captureFlow(api)`
`237`	`233`	`select flow order by flow`