Java: exclude parameterless static methods from DataFlowTargetApi and from ExternalApi
#11717
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
December 15, 2022 13:34
jcogs33
changed the title
DataFlowTargetApi and from ExternalApiDataFlowTargetApi and from ExternalApi
|
Ah, right, such methods can definitely be sources - they just can't have flow through. |
@aschackmull Should I close this PR then? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR excludes parameterless static methods from consideration for MaD models, based on a suggestion from @aschackmull. The exclusion is added to the
isRelevantForModelspredicate forDataFlowTargetApi.The exclusion is also added to the
isUninterestingpredicate forExternalApi.Consideration
I was going to make this change for C# as well, but I noticed that there seem to be some parameterless static C# methods that should be modeled as sources based on the
Telemetry/SupportedExternalSourcestest cases (namely,System#Console.ReadLine()andSystem#Console.Read()), so I removed C# from the PR. Let me know if I should add C# back to the PR.Also, let me know if there would be any similar cases in Java where some parameterless static methods should in fact have models (I couldn't find any examples of this, but I might not have searched long enough).