Java: Refactor CaptureSinkModels into language specific and generic part.

michaelnebel · michaelnebel · commit fb2a7dfb486c · 2022-03-29T11:07:57.000+02:00
diff --git a/java/ql/src/utils/model-generator/CaptureSinkModels.ql b/java/ql/src/utils/model-generator/CaptureSinkModels.ql
@@ -4,51 +4,8 @@
  * @id java/utils/model-generator/sink-models
  */
 
-import java
-private import semmle.code.java.dataflow.TaintTracking
-private import semmle.code.java.dataflow.ExternalFlow
 private import ModelGeneratorUtils
-
-class PropagateToSinkConfiguration extends TaintTracking::Configuration {
-  PropagateToSinkConfiguration() { this = "parameters or fields flowing into sinks" }
-
-  override predicate isSource(DataFlow::Node source) {
-    (source.asExpr().(FieldAccess).isOwnFieldAccess() or source instanceof DataFlow::ParameterNode) and
-    source.getEnclosingCallable().isPublic() and
-    exists(RefType t |
-      t = source.getEnclosingCallable().getDeclaringType().getAnAncestor() and
-      not t instanceof TypeObject and
-      t.isPublic()
-    ) and
-    isRelevantForModels(source.getEnclosingCallable())
-  }
-
-  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) }
-
-  override DataFlow::FlowFeature getAFeature() {
-    result instanceof DataFlow::FeatureHasSourceCallContext
-  }
-}
-
-string asInputArgument(DataFlow::Node source) {
-  exists(int pos |
-    source.(DataFlow::ParameterNode).isParameterOf(_, pos) and
-    result = "Argument[" + pos + "]"
-  )
-  or
-  source.asExpr() instanceof FieldAccess and
-  result = "Argument[-1]"
-}
-
-string captureSink(TargetApi api) {
-  exists(DataFlow::Node src, DataFlow::Node sink, PropagateToSinkConfiguration config, string kind |
-    config.hasFlow(src, sink) and
-    sinkNode(sink, kind) and
-    api = src.getEnclosingCallable() and
-    not kind = "logging" and
-    result = asSinkModel(api, asInputArgument(src), kind)
-  )
-}
+private import CaptureSinkModels
 
 from TargetApi api, string sink
 where sink = captureSink(api)
diff --git a/java/ql/src/utils/model-generator/CaptureSinkModels.qll b/java/ql/src/utils/model-generator/CaptureSinkModels.qll
@@ -0,0 +1,21 @@
+private import CaptureSinkModelsSpecific
+
+class PropagateToSinkConfiguration extends PropagateToSinkConfigurationSpecific {
+  PropagateToSinkConfiguration() { this = "parameters or fields flowing into sinks" }
+
+  override predicate isSink(DataFlow::Node sink) { sinkNode(sink, _) }
+
+  override DataFlow::FlowFeature getAFeature() {
+    result instanceof DataFlow::FeatureHasSourceCallContext
+  }
+}
+
+string captureSink(TargetApi api) {
+  exists(DataFlow::Node src, DataFlow::Node sink, PropagateToSinkConfiguration config, string kind |
+    config.hasFlow(src, sink) and
+    sinkNode(sink, kind) and
+    api = src.getEnclosingCallable() and
+    not kind = "logging" and
+    result = asSinkModel(api, asInputArgument(src), kind)
+  )
+}
diff --git a/java/ql/src/utils/model-generator/CaptureSinkModelsSpecific.qll b/java/ql/src/utils/model-generator/CaptureSinkModelsSpecific.qll
@@ -0,0 +1,29 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.ExternalFlow
+import ModelGeneratorUtils
+
+class PropagateToSinkConfigurationSpecific extends TaintTracking::Configuration {
+  PropagateToSinkConfigurationSpecific() { this = "parameters or fields flowing into sinks" }
+
+  override predicate isSource(DataFlow::Node source) {
+    (source.asExpr().(FieldAccess).isOwnFieldAccess() or source instanceof DataFlow::ParameterNode) and
+    source.getEnclosingCallable().isPublic() and
+    exists(RefType t |
+      t = source.getEnclosingCallable().getDeclaringType().getAnAncestor() and
+      not t instanceof TypeObject and
+      t.isPublic()
+    ) and
+    isRelevantForModels(source.getEnclosingCallable())
+  }
+}
+
+string asInputArgument(DataFlow::Node source) {
+  exists(int pos |
+    source.(DataFlow::ParameterNode).isParameterOf(_, pos) and
+    result = "Argument[" + pos + "]"
+  )
+  or
+  source.asExpr() instanceof FieldAccess and
+  result = "Argument[-1]"
+}
