Fluent interface dataflow: support argument-output flow directly declared by the simpleLocalFlowStep relation

smowton · smowton · commit e6b1fe9b5fd6 · 2021-03-01T10:23:38.000Z
This means we will treat fluent interfaces that are modelled the same as those where we determine an argument flows to an output by inspection of the function body.
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
@@ -427,6 +427,14 @@ private module Cached {
       fromPre = fromNode.(PostUpdateNode).getPreUpdateNode() and
       toPre = toNode.(PostUpdateNode).getPreUpdateNode()
     |
+      exists(DataFlowCall c |
+        // Does the language-specific simpleLocalFlowStep already model flow
+        // from function input to output?
+        fromPre = getAnOutNode(c, _) and
+        toPre.(ArgumentNode).argumentOf(c, _) and
+        simpleLocalFlowStep(toPre.(ArgumentNode), fromPre)
+      )
+      or
       argumentValueFlowsThrough(toPre, TReadStepTypesNone(), fromPre)
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -427,6 +427,14 @@ private module Cached {`
`427`	`427`	`fromPre = fromNode.(PostUpdateNode).getPreUpdateNode() and`
`428`	`428`	`toPre = toNode.(PostUpdateNode).getPreUpdateNode()`
`429`	`429`	`\|`
	`430`	`+ exists(DataFlowCall c \|`
	`431`	`+ // Does the language-specific simpleLocalFlowStep already model flow`
	`432`	`+ // from function input to output?`
	`433`	`+ fromPre = getAnOutNode(c, _) and`
	`434`	`+ toPre.(ArgumentNode).argumentOf(c, _) and`
	`435`	`+ simpleLocalFlowStep(toPre.(ArgumentNode), fromPre)`
	`436`	`+ )`
	`437`	`+ or`
`430`	`438`	`argumentValueFlowsThrough(toPre, TReadStepTypesNone(), fromPre)`
`431`	`439`	`)`
`432`	`440`	`}`