Java: isPublic and fromSource check as this is already ensured by the TargetApi characteristic predicate.

michaelnebel · michaelnebel · commit f00837578b39 · 2022-03-29T11:07:56.000+02:00
diff --git a/java/ql/src/utils/model-generator/CaptureSourceModels.ql b/java/ql/src/utils/model-generator/CaptureSourceModels.ql
@@ -18,9 +18,7 @@ class FromSourceConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) {
     exists(TargetApi c |
       sink instanceof ReturnNodeExt and
-      sink.getEnclosingCallable() = c and
-      c.isPublic() and
-      c.fromSource()
+      sink.getEnclosingCallable() = c
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -18,9 +18,7 @@ class FromSourceConfiguration extends TaintTracking::Configuration {`
`18`	`18`	`override predicate isSink(DataFlow::Node sink) {`
`19`	`19`	`exists(TargetApi c \|`
`20`	`20`	`sink instanceof ReturnNodeExt and`
`21`		`- sink.getEnclosingCallable() = c and`
`22`		`- c.isPublic() and`
`23`		`- c.fromSource()`
	`21`	`+ sink.getEnclosingCallable() = c`
`24`	`22`	`)`
`25`	`23`	`}`
`26`	`24`