Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions java/ql/lib/semmle/code/java/environment/SystemProperty.qll
Original file line number Diff line number Diff line change
Expand Up @@ -269,18 +269,24 @@ private MethodCall getSystemPropertyFromSpringProperties(string propertyName) {
* for final variables.
*/
private predicate localExprFlowPlusInitializers(Expr e1, Expr e2) {
e1 = e2 or
localFlowPlusInitializers(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
}

private predicate localFlowPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) =
fastTC(localFlowStepPlusInitializers/2)(pred, succ)

/**
* Holds if data can flow from `pred` to `succ` in zero or more
* local (intra-procedural) steps or via instance or static variable intializers
* Holds if data can flow from `pred` to `succ` in a
* local (intra-procedural) step or via instance or static variable intializers
* for final variables.
*/
private predicate localFlowPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) {
exists(Variable v | v.isFinal() and pred.asExpr() = v.getInitializer() |
DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), succ)
private predicate localFlowStepPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this rewrite semantics preserving? It looks like before it would calculate flow as

pred --initializer--> access --local--*> succ

and now it is

pred --initializer/local--*> succ

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, it's not 100% semantics preserving, but I think the tweaked version makes more sense: If we're doing local flow plus initialization of final fields, then it seems like a mistake to rule out local flow prior to the initialization, like e.g. a cast or something like that.

exists(Variable v |
v.isFinal() and
pred.asExpr() = v.getInitializer() and
succ.asExpr() = v.getAnAccess()
)
or
DataFlow::localFlow(pred, succ)
DataFlow::localFlowStep(pred, succ)
}
Loading