Java: Refactor more dataflow queries to the new API #12476
Conversation
aschackmull
added
the
no-change-note-required
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // Note this message has no "$@" placeholder, so the "system temp directory" template parameter below is not used. | ||
| message = | ||
| "Local information disclosure vulnerability due to use of " + | ||
| source.getNode().asExpr().(MethodAccessInsecureFileCreation).getFileSystemEntityType() + | ||
| " readable by other local users." | ||
| source.asPathNode2().getFileSystemEntityType() + " readable by other local users." |
Check warning
Code scanning / CodeQL
QL-for-QL encountered an internal consistency error
There was a problem hiding this comment.
This seems to be a problem of QL-for-QL not being able to resolve the concrete type of PathNode2, right?
There was a problem hiding this comment.
That sounds plausible.
aschackmull
force-pushed
the
java/refactor-dataflow-queries-2
branch
from
2b3fdfa to
d694a5a
Compare
|
Query result changes in dca looks good: the new results are precisely the expected ones - they were lost when the API changed and the queries used the compatibility wrapper. The lost result for |
aschackmull
force-pushed
the
java/refactor-dataflow-queries-2
branch
from
d694a5a to
7c0e89f
Compare
|
Looks plausible to me. |
| @@ -193,6 +192,8 @@ abstract class MethodAccessInsecureFileCreation extends MethodAccess { | |||
| * Gets the type of entity created (e.g. `file`, `directory`, ...). | |||
| */ | |||
| abstract string getFileSystemEntityType(); | |||
|
|
|||
| DataFlow::Node getNode() { result.asExpr() = this } | |||
There was a problem hiding this comment.
Is this needed because MethodAccessInsecureFileCreation is used as the type parameter of PathGraphSig? I suppose we can't make MethodAccessInsecureFileCreation implement PathNodeSig in some way to enforce that, can we?
| // Note this message has no "$@" placeholder, so the "system temp directory" template parameter below is not used. | ||
| message = | ||
| "Local information disclosure vulnerability due to use of " + | ||
| source.getNode().asExpr().(MethodAccessInsecureFileCreation).getFileSystemEntityType() + | ||
| " readable by other local users." | ||
| source.asPathNode2().getFileSystemEntityType() + " readable by other local users." |
There was a problem hiding this comment.
This seems to be a problem of QL-for-QL not being able to resolve the concrete type of PathNode2, right?
This builds on top of #12475.(Now rebased post merge).This refactors the remaining Java queries that showed result differences in the API refactor PR in order to restore the lost results.