Add type for java.net.URL

p- · p- · commit e81d3ce0b407 · 2020-02-23T12:35:03.000+01:00
diff --git a/java/ql/src/Security/CWE/CWE-036/OpenStream.ql b/java/ql/src/Security/CWE/CWE-036/OpenStream.ql
@@ -12,7 +12,7 @@ import semmle.code.java.dataflow.FlowSources
 import DataFlow::PathGraph
 
 class URLConstructor extends ClassInstanceExpr {
-  URLConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URL" }
+  URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }
 
   Expr stringArg() {
     // Query only in URL's that were constructed by calling the single parameter string constructor.
@@ -26,7 +26,7 @@ class URLConstructor extends ClassInstanceExpr {
 
 class URLOpenStreamMethod extends Method {
   URLOpenStreamMethod() {
-    this.getDeclaringType().getQualifiedName() = "java.net.URL" and
+    this.getDeclaringType() instanceof TypeUrl and
     this.getName() = "openStream"
   }
 }
diff --git a/java/ql/src/semmle/code/java/frameworks/Networking.qll b/java/ql/src/semmle/code/java/frameworks/Networking.qll
@@ -12,6 +12,10 @@ class TypeSocket extends RefType {
   TypeSocket() { hasQualifiedName("java.net", "Socket") }
 }
 
+class TypeUrl extends RefType {
+  TypeUrl() { hasQualifiedName("java.net", "URL") }
+}
+
 class URLConnectionGetInputStreamMethod extends Method {
   URLConnectionGetInputStreamMethod() {
     getDeclaringType() instanceof TypeUrlConnection and

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ import semmle.code.java.dataflow.FlowSources`
`12`	`12`	`import DataFlow::PathGraph`
`13`	`13`
`14`	`14`	`class URLConstructor extends ClassInstanceExpr {`
`15`		`- URLConstructor() { this.getConstructor().getDeclaringType().getQualifiedName() = "java.net.URL" }`
	`15`	`+ URLConstructor() { this.getConstructor().getDeclaringType() instanceof TypeUrl }`
`16`	`16`
`17`	`17`	`Expr stringArg() {`
`18`	`18`	`// Query only in URL's that were constructed by calling the single parameter string constructor.`
`@@ -26,7 +26,7 @@ class URLConstructor extends ClassInstanceExpr {`
`26`	`26`
`27`	`27`	`class URLOpenStreamMethod extends Method {`
`28`	`28`	`URLOpenStreamMethod() {`
`29`		`- this.getDeclaringType().getQualifiedName() = "java.net.URL" and`
	`29`	`+ this.getDeclaringType() instanceof TypeUrl and`
`30`	`30`	`this.getName() = "openStream"`
`31`	`31`	`}`
`32`	`32`	`}`