github
diff --git a/‎java/ql/src/semmle/code/java/security/ControlledString.qll‎
Lines changed: 21 additions & 16 deletions b/‎java/ql/src/semmle/code/java/security/ControlledString.qll‎
Lines changed: 21 additions & 16 deletions
@@ -21,15 +21,15 @@ private predicate boxedToString(Method method) {
  * it is better to use a prepared query than to just put single quotes around the string.
  */
 predicate endsInQuote(Expr expr) {
-  exists(string str | str = expr.(StringLiteral).getRepresentedString() |
-    str.matches("%'")) or
-  exists(Variable var | expr = var.getAnAccess() | endsInQuote(var.getAnAssignedValue())) or
+  exists(string str | str = expr.(StringLiteral).getRepresentedString() | str.matches("%'"))
+  or
+  exists(Variable var | expr = var.getAnAccess() | endsInQuote(var.getAnAssignedValue()))
+  or
   endsInQuote(expr.(AddExpr).getRightOperand())
 }
 
 /** The given expression is controlled if the other expression is controlled. */
-private
-predicate controlledStringProp(Expr src, Expr dest) {
+private predicate controlledStringProp(Expr src, Expr dest) {
   // Propagation through variables.
   exists(Variable var | var.getAnAccess() = dest | src = var.getAnAssignedValue())
   or
@@ -54,17 +54,15 @@ predicate controlledStringProp(Expr src, Expr dest) {
 }
 
 /** Expressions that have a small number of inflows from `controlledStringProp`. */
-private
-predicate modestControlledStringInflow(Expr dest) {
+private predicate modestControlledStringInflow(Expr dest) {
   strictcount(Expr src | controlledStringProp(src, dest)) < 10
 }
 
 /**
  * A limited version of `controlledStringProp` that ignores destinations that are written a
  * very high number of times.
  */
-private
-predicate controlledStringLimitedProp(Expr src, Expr dest) {
+private predicate controlledStringLimitedProp(Expr src, Expr dest) {
   controlledStringProp(src, dest) and
   modestControlledStringInflow(dest)
 }
@@ -76,17 +74,24 @@ predicate controlledStringLimitedProp(Expr src, Expr dest) {
 cached
 predicate controlledString(Expr expr) {
   (
-    expr instanceof StringLiteral or
-    expr instanceof NullLiteral or
-    expr.(VarAccess).getVariable() instanceof EnumConstant or
-    expr.getType() instanceof PrimitiveType or
-    expr.getType() instanceof BoxedType or
+    expr instanceof StringLiteral
+    or
+    expr instanceof NullLiteral
+    or
+    expr.(VarAccess).getVariable() instanceof EnumConstant
+    or
+    expr.getType() instanceof PrimitiveType
+    or
+    expr.getType() instanceof BoxedType
+    or
     exists(Method method | method = expr.(MethodAccess).getMethod() |
       method instanceof ClassNameMethod or
       method instanceof ClassSimpleNameMethod or
       boxedToString(method)
-    ) or
-    exists(ValidatedVariable var | var.getAnAccess() = expr) or
+    )
+    or
+    exists(ValidatedVariable var | var.getAnAccess() = expr)
+    or
     forex(Expr other | controlledStringLimitedProp(other, expr) | controlledString(other))
   ) and
   not expr instanceof TypeAccess