File tree 3 files changed +49
-0
lines changed
java/ql/test/library-tests/dataflow/implicit-read
3 files changed +49
-0
lines changed Original file line number Diff line number Diff line change
1
+ public class A {
2
+ String field ;
3
+
4
+ static String source (String name ) {
5
+ return name ;
6
+ }
7
+
8
+ static void sink (Object o ) {}
9
+
10
+ static String step (Object o ) {
11
+ return "" ;
12
+ }
13
+
14
+ static Object getA () {
15
+ A a = new A ();
16
+ a .field = source ("source" );
17
+ return a ;
18
+ }
19
+
20
+ static void test () {
21
+ Object object = getA ();
22
+
23
+ sink (step (object )); // $ hasTaintFlow=source
24
+ sink (object ); // $ SPURIOUS: hasTaintFlow=source
25
+ sink (((A )object ).field ); // $ hasTaintFlow=source
26
+ }
27
+ }
Original file line number Diff line number Diff line change
1
+ import java
2
+ import TestUtilities.InlineFlowTest
3
+
4
+ module TestConfig implements DataFlow:: ConfigSig {
5
+ predicate isSource ( DataFlow:: Node source ) { DefaultFlowConfig:: isSource ( source ) }
6
+
7
+ predicate isSink ( DataFlow:: Node sink ) { DefaultFlowConfig:: isSink ( sink ) }
8
+
9
+ predicate isAdditionalFlowStep ( DataFlow:: Node node1 , DataFlow:: Node node2 ) {
10
+ exists ( MethodCall call |
11
+ call .getMethod ( ) .getName ( ) = "step" and
12
+ node1 .asExpr ( ) = call .getArgument ( 0 ) and
13
+ node2 .asExpr ( ) = call
14
+ )
15
+ }
16
+
17
+ predicate allowImplicitRead ( DataFlow:: Node node , DataFlow:: ContentSet content ) {
18
+ isAdditionalFlowStep ( node , _) and content instanceof DataFlow:: FieldContent
19
+ }
20
+ }
21
+
22
+ import TaintFlowTest< TestConfig >
You can’t perform that action at this time.
0 commit comments