Remove getUnderlyingExpr

atorralba · atorralba · commit f5e72e6e334f · 2022-05-04T10:53:30.000+02:00
diff --git a/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll b/java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll
@@ -67,14 +67,6 @@ private class WebViewRef extends Element {
   }
 }
 
-private Expr getUnderlyingExpr(Expr e) {
-  if e instanceof CastExpr or e instanceof UnaryExpr
-  then
-    result = getUnderlyingExpr(e.(CastExpr).getExpr()) or
-    result = getUnderlyingExpr(e.(UnaryExpr).getExpr())
-  else result = e
-}
-
 /**
  * Holds if a `WebViewLoadUrlMethod` is called on `webview`
  * with `urlArg` as its first argument.
@@ -84,19 +76,15 @@ private predicate webViewLoadUrl(Argument urlArg, DataFlow::Node webview) {
     loadUrl.getArgument(0) = urlArg and
     loadUrl.getMethod() instanceof WebViewLoadUrlMethod
   |
-    webview = DataFlow::exprNode(getUnderlyingExpr(loadUrl.getQualifier()))
-    or
     webview = DataFlow::getInstanceArgument(loadUrl)
     or
     // `webview` is received as a parameter of an event method in a custom `WebViewClient`,
     // so we need to find WebViews that use that specific `WebViewClient`.
     exists(WebViewClientEventMethod eventMethod, MethodAccess setWebClient |
       setWebClient.getMethod() instanceof WebViewSetWebViewClientMethod and
       setWebClient.getArgument(0).getType() = eventMethod.getDeclaringType() and
-      getUnderlyingExpr(loadUrl.getQualifier()) = eventMethod.getWebViewParameter().getAnAccess()
+      loadUrl.getQualifier() = eventMethod.getWebViewParameter().getAnAccess()
     |
-      webview = DataFlow::exprNode(getUnderlyingExpr(setWebClient.getQualifier()))
-      or
       webview = DataFlow::getInstanceArgument(setWebClient)
     )
   )

Original file line number	Diff line number	Diff line change
`@@ -67,14 +67,6 @@ private class WebViewRef extends Element {`
`67`	`67`	`}`
`68`	`68`	`}`
`69`	`69`
`70`		`-private Expr getUnderlyingExpr(Expr e) {`
`71`		`- if e instanceof CastExpr or e instanceof UnaryExpr`
`72`		`- then`
`73`		`- result = getUnderlyingExpr(e.(CastExpr).getExpr()) or`
`74`		`- result = getUnderlyingExpr(e.(UnaryExpr).getExpr())`
`75`		`- else result = e`
`76`		`-}`
`77`		`-`
`78`	`70`	`/**`
`79`	`71`	* Holds if a `WebViewLoadUrlMethod` is called on `webview`
`80`	`72`	* with `urlArg` as its first argument.
`@@ -84,19 +76,15 @@ private predicate webViewLoadUrl(Argument urlArg, DataFlow::Node webview) {`
`84`	`76`	`loadUrl.getArgument(0) = urlArg and`
`85`	`77`	`loadUrl.getMethod() instanceof WebViewLoadUrlMethod`
`86`	`78`	`\|`
`87`		`- webview = DataFlow::exprNode(getUnderlyingExpr(loadUrl.getQualifier()))`
`88`		`- or`
`89`	`79`	`webview = DataFlow::getInstanceArgument(loadUrl)`
`90`	`80`	`or`
`91`	`81`	// `webview` is received as a parameter of an event method in a custom `WebViewClient`,
`92`	`82`	// so we need to find WebViews that use that specific `WebViewClient`.
`93`	`83`	`exists(WebViewClientEventMethod eventMethod, MethodAccess setWebClient \|`
`94`	`84`	`setWebClient.getMethod() instanceof WebViewSetWebViewClientMethod and`
`95`	`85`	`setWebClient.getArgument(0).getType() = eventMethod.getDeclaringType() and`
`96`		`- getUnderlyingExpr(loadUrl.getQualifier()) = eventMethod.getWebViewParameter().getAnAccess()`
	`86`	`+ loadUrl.getQualifier() = eventMethod.getWebViewParameter().getAnAccess()`
`97`	`87`	`\|`
`98`		`- webview = DataFlow::exprNode(getUnderlyingExpr(setWebClient.getQualifier()))`
`99`		`- or`
`100`	`88`	`webview = DataFlow::getInstanceArgument(setWebClient)`
`101`	`89`	`)`
`102`	`90`	`)`