Add a superclass for credential nodes

egregius313 · egregius313 · commit ee6cb96d07bf · 2023-10-25T14:31:53.000-04:00
diff --git a/java/ql/lib/semmle/code/java/security/HardcodedCredentials.qll b/java/ql/lib/semmle/code/java/security/HardcodedCredentials.qll
@@ -58,12 +58,7 @@ abstract class CredentialsSink extends Expr {
  * credentials.
  */
 class CredentialsApiSink extends CredentialsSink {
-  CredentialsApiSink() {
-    this = any(PasswordParameter p).asExpr() or
-    this = any(UsernameParameter p).asExpr() or
-    this = any(CryptoKeyParameter p).asExpr() or
-    this = any(CredentialParameter p).asExpr()
-  }
+  CredentialsApiSink() { this = any(CredentialSinkNode csn).asExpr() }
 }
 
 /**
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveApi.qll b/java/ql/lib/semmle/code/java/security/SensitiveApi.qll
@@ -7,31 +7,29 @@ private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.dataflow.ExternalFlow
 
 /**
- * A node representing a password being passed to a method.
+ * A node which represents the use of a credential.
  */
-class PasswordParameter extends DataFlow::Node {
-  PasswordParameter() { sinkNode(this, "credential-password") }
-}
+abstract class CredentialSinkNode extends DataFlow::Node { }
 
 /**
- * A node representing a username being passed to a method.
+ * A node representing a password being passed to a method.
  */
-class UsernameParameter extends DataFlow::Node {
-  UsernameParameter() { sinkNode(this, "credential-username") }
+class PasswordSink extends CredentialSinkNode {
+  PasswordSink() { sinkNode(this, "credential-password") }
 }
 
 /**
- * A node representing a cryptographic key being passed to a method.
+ * A node representing a username being passed to a method.
  */
-class CryptoKeyParameter extends DataFlow::Node {
-  CryptoKeyParameter() { sinkNode(this, "crypto-parameter") }
+class UsernameSink extends CredentialSinkNode {
+  UsernameSink() { sinkNode(this, "credential-username") }
 }
 
 /**
- * A node representing a credential being passed to a method.
+ * A node representing a cryptographic key being passed to a method.
  */
-class CredentialParameter extends DataFlow::Node {
-  CredentialParameter() { sinkNode(this, "credential-other") }
+class CryptoKeySink extends CredentialSinkNode {
+  CryptoKeySink() { sinkNode(this, "crypto-parameter") }
 }
 
 /**
