Skip to content

Commit 202d8e7

Browse files
GeekMasherGeekMasher
committed
feat(java): Update all MethodAccess predicate
1 parent 0e75a1a commit 202d8e7

21 files changed

+44
-47
lines changed

‎java/lib/ResearchMode.qll

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class FieldTaintStep extends TaintTracking::AdditionalTaintStep {
3838
class NotifyWaitTaintStep extends TaintTracking::AdditionalTaintStep {
3939
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
4040
exists(
41-
MethodAccess notify, RefType t, MethodAccess wait, SynchronizedStmt notifySync,
41+
MethodCall notify, RefType t, MethodCall wait, SynchronizedStmt notifySync,
4242
SynchronizedStmt waitSync
4343
|
4444
notify.getMethod().getName() = ["notify", "notifyAll"] and
@@ -65,7 +65,7 @@ class NotifyWaitTaintStep extends TaintTracking::AdditionalTaintStep {
6565
*/
6666
class ExceptionTaintStep extends TaintTracking::AdditionalTaintStep {
6767
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
68-
exists(Call call, TryStmt t, CatchClause c, MethodAccess gm |
68+
exists(Call call, TryStmt t, CatchClause c, MethodCall gm |
6969
call.getEnclosingStmt().getEnclosingStmt*() = t.getBlock() and
7070
t.getACatchClause() = c and
7171
(
@@ -85,7 +85,7 @@ class ExceptionTaintStep extends TaintTracking::AdditionalTaintStep {
8585
*/
8686
private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
8787
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
88-
exists(MethodAccess ma, Method m |
88+
exists(MethodCall ma, Method m |
8989
ma.getMethod() = m and
9090
m.getName().matches("get%") and
9191
m.getNumberOfParameters() = 0 and
@@ -97,7 +97,7 @@ private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
9797
/*
9898
* private class SetterTaintStep extends TaintTracking::AdditionalTaintStep {
9999
* override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
100-
* exists(MethodAccess ma, Method m |
100+
* exists(MethodCall ma, Method m |
101101
* ma.getMethod() = m and
102102
* m.getName().matches("set%") and
103103
* m.getNumberOfParameters() = 1 and
@@ -110,8 +110,8 @@ private class GetterTaintStep extends TaintTracking::AdditionalTaintStep {
110110
*
111111
* class GlobalSanitizer extends TaintTracking::Sanitizer {
112112
* override predicate sanitize(DataFlow::Node node) {
113-
* node.asExpr().(MethodAccess).getMethod().hasName("getInputStream") or
114-
* node.asExpr().(MethodAccess).getMethod().hasName("getHostName")
113+
* node.asExpr().(MethodCall).getMethod().hasName("getInputStream") or
114+
* node.asExpr().(MethodCall).getMethod().hasName("getHostName")
115115
* }
116116
* }
117117
*/

‎java/lib/applications/Dubbo.qll

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ module Dubbo {
2121

2222
class CodecSupportGetPayload extends TaintTracking::AdditionalTaintStep {
2323
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
24-
exists(MethodAccess ma |
24+
exists(MethodCall ma |
2525
ma.getMethod()
2626
.getDeclaringType()
2727
.hasQualifiedName("org.apache.dubbo.remoting.transport", "CodecSupport") and
@@ -34,7 +34,7 @@ module Dubbo {
3434

3535
class CodecSupportDeserialize extends TaintTracking::AdditionalTaintStep {
3636
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
37-
exists(MethodAccess ma |
37+
exists(MethodCall ma |
3838
ma.getMethod()
3939
.getDeclaringType()
4040
.hasQualifiedName("org.apache.dubbo.remoting.transport", "CodecSupport") and
@@ -58,7 +58,7 @@ module Dubbo {
5858

5959
class ChannelBuffer_ThisReturn_TaintStep extends TaintTracking::AdditionalTaintStep {
6060
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
61-
exists(MethodAccess ma |
61+
exists(MethodCall ma |
6262
ma.getMethod()
6363
.getDeclaringType()
6464
.getASourceSupertype*()
@@ -72,7 +72,7 @@ module Dubbo {
7272

7373
class ChannelBuffer_ThisArg1_TaintStep extends TaintTracking::AdditionalTaintStep {
7474
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
75-
exists(MethodAccess ma |
75+
exists(MethodCall ma |
7676
ma.getMethod()
7777
.getDeclaringType()
7878
.getASourceSupertype*()
@@ -86,7 +86,7 @@ module Dubbo {
8686

8787
class ChannelBuffer_ThisArg0_TaintStep extends TaintTracking::AdditionalTaintStep {
8888
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
89-
exists(MethodAccess ma |
89+
exists(MethodCall ma |
9090
ma.getMethod()
9191
.getDeclaringType()
9292
.getASourceSupertype*()
@@ -100,7 +100,7 @@ module Dubbo {
100100

101101
class ChannelBuffer_ArgThis1_TaintStep extends TaintTracking::AdditionalTaintStep {
102102
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
103-
exists(MethodAccess ma |
103+
exists(MethodCall ma |
104104
ma.getMethod()
105105
.getDeclaringType()
106106
.getASourceSupertype*()
@@ -114,7 +114,7 @@ module Dubbo {
114114

115115
class ChannelBuffer_ArgThis0_TaintStep extends TaintTracking::AdditionalTaintStep {
116116
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
117-
exists(MethodAccess ma |
117+
exists(MethodCall ma |
118118
ma.getMethod()
119119
.getDeclaringType()
120120
.getASourceSupertype*()

‎java/lib/frameworks/GoogleGuavaCache.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ module GuavaCache {
3838
*/
3939
class LoadCacheItemTaintStep extends TaintTracking::AdditionalTaintStep {
4040
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
41-
exists(MethodAccess ma1, MethodAccess ma2, VarAccess va |
41+
exists(MethodCall ma1, MethodCall ma2, VarAccess va |
4242
ma1.getMethod() instanceof GetFromCacheMethod and
4343
ma2.getMethod() instanceof BuildCacheLoaderMethod and
4444
exists(Method m |

‎java/lib/frameworks/Protobuf.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import semmle.code.java.dataflow.FlowSources
33
module Protobuf {
44
class ProtoToCoreTaintStep extends TaintTracking::AdditionalTaintStep {
55
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
6-
exists(MethodAccess ma |
6+
exists(MethodCall ma |
77
ma.getMethod().getName().matches("toCore%") and
88
n2.asExpr() = ma and
99
n1.asExpr() = ma.getArgument(0)
@@ -13,7 +13,7 @@ module Protobuf {
1313

1414
class ByteStringThisReturnTaintStep extends TaintTracking::AdditionalTaintStep {
1515
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
16-
exists(MethodAccess ma |
16+
exists(MethodCall ma |
1717
//ma.getMethod().getName().matches(["toByteArray", "toString", "toStringUtf8", "substring", "concat", "asReadOnlyByteBuffer", "asReadOnlyByteBufferList"]) and
1818
ma.getMethod().getName().matches("toByteArray") and
1919
ma.getMethod()
@@ -29,7 +29,7 @@ module Protobuf {
2929

3030
class ByteStringArgReturnTaintStep extends TaintTracking::AdditionalTaintStep {
3131
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
32-
exists(MethodAccess ma |
32+
exists(MethodCall ma |
3333
ma.getMethod().getName().matches(["readFrom", "copyFrom", "concat"]) and
3434
ma.getMethod()
3535
.getDeclaringType()
@@ -44,7 +44,7 @@ module Protobuf {
4444

4545
class RemoteSource extends RemoteFlowSource {
4646
RemoteSource() {
47-
exists(MethodAccess ma, Method m |
47+
exists(MethodCall ma, Method m |
4848
ma.getMethod() = m and
4949
m.getName().matches("get%") and
5050
m.getDeclaringType()

‎java/lib/ghsl/BeanManipulation.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ class SetPropertyMethod extends Method {
4040

4141
class BeanManipulationSink extends DataFlow::ExprNode {
4242
BeanManipulationSink() {
43-
exists(MethodAccess ma |
43+
exists(MethodCall ma |
4444
ma.getMethod() instanceof SetPropertyMethod and
4545
this.getExpr() = ma.getAnArgument()
4646
)

‎java/lib/ghsl/Encoding.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ module Base64 {
1111
// codeql/java/ql/lib/semmle/code/java/security/HardcodedCredentialsApiCallQuery.qll
1212
class Encoders extends Base64::Encoding {
1313
Encoders() {
14-
exists(MethodAccess ma |
14+
exists(MethodCall ma |
1515
ma.getMethod()
1616
.hasQualifiedName([
1717
"java.util", "cn.hutool.core.codec", "org.apache.shiro.codec",
@@ -29,7 +29,7 @@ module Base64 {
2929

3030
class Decoders extends Base64::Decoding {
3131
Decoders() {
32-
exists(MethodAccess ma |
32+
exists(MethodCall ma |
3333
ma.getMethod()
3434
.hasQualifiedName([
3535
"java.util", "cn.hutool.core.codec", "org.apache.shiro.codec",

‎java/lib/ghsl/LocalSources.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import semmle.code.java.dataflow.FlowSources
33

44
class FileReadAccess extends LocalUserInput {
55
FileReadAccess() {
6-
exists(MethodAccess ma |
6+
exists(MethodCall ma |
77
// https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html#getResourceAsStream-java.lang.String-
88
(
99
ma.getMethod().hasQualifiedName("java.lang", "Class", "getResourceAsStream") or

‎java/lib/ghsl/Logging.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ abstract class LoggingMethodsSinks extends DataFlow::Node { }
88
// TODO: Use the exists libs in CodeQL to extend this
99
class PrintMethods extends LoggingMethodsSinks {
1010
PrintMethods() {
11-
exists(MethodAccess ma |
11+
exists(MethodCall ma |
1212
ma.getMethod().getDeclaringType().hasQualifiedName("java.io", _) and
1313
(
1414
ma.getMethod().hasName("println") or
@@ -50,7 +50,7 @@ class Log4jLoggerType extends LoggerType {
5050

5151
class LoggingMethods extends LoggingMethodsSinks {
5252
LoggingMethods() {
53-
exists(MethodAccess ma |
53+
exists(MethodCall ma |
5454
ma.getMethod().getDeclaringType() instanceof LoggerType and
5555
(
5656
ma.getMethod().hasName("debug") or

‎java/lib/ghsl/SensitiveInformation.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ abstract class SensitiveInformationSources extends DataFlow::Node { }
77

88
class HttpSession extends SensitiveInformationSources {
99
HttpSession() {
10-
exists(MethodAccess ma |
10+
exists(MethodCall ma |
1111
// https://docs.oracle.com/javaee/5/api/javax/servlet/http/HttpSession.html
1212
// Assumption: Nothing from the Session object should be logged
1313
ma.getMethod().getDeclaringType().hasQualifiedName("javax.servlet.http", "HttpSession") and
@@ -18,7 +18,7 @@ class HttpSession extends SensitiveInformationSources {
1818

1919
class Properties extends SensitiveInformationSources {
2020
Properties() {
21-
exists(MethodAccess ma |
21+
exists(MethodCall ma |
2222
ma.getMethod().hasName("getProperty") and
2323
this.asExpr() = ma
2424
)

‎java/src/CVEs/CVE-2022-22965.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ private module Spring4ShellConfig implements DataFlow::ConfigSig {
3232
predicate isBarrier(DataFlow::Node n) {
3333
n.getLocation().getFile().getRelativePath().matches(["%test%", "%mock%"])
3434
or
35-
exists(MethodAccess ma |
35+
exists(MethodCall ma |
3636
ma.getMethod().hasName("toString") and DataFlow::getInstanceArgument(ma) = n
3737
)
3838
}

‎java/src/CVEs/CVE-2022-33980.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ private module ACCInjectionConfig implements DataFlow::ConfigSig {
1616
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1717

1818
predicate isSink(DataFlow::Node sink) {
19-
exists(MethodAccess ma, Method m | ma.getMethod() = m and ma.getAnArgument() = sink.asExpr() |
19+
exists(MethodCall ma, Method m | ma.getMethod() = m and ma.getAnArgument() = sink.asExpr() |
2020
m.getName() = ["addProperty", "setProperty"] and
2121
m.getDeclaringType()
2222
.getASourceSupertype*()

‎java/src/CVEs/CVE-2022-42889.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ private module ACTInjectionConfig implements DataFlow::ConfigSig {
1616
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1717

1818
predicate isSink(DataFlow::Node sink) {
19-
exists(MethodAccess ma, Method m | ma.getMethod() = m and ma.getAnArgument() = sink.asExpr() |
19+
exists(MethodCall ma, Method m | ma.getMethod() = m and ma.getAnArgument() = sink.asExpr() |
2020
m.getName() = "replace" and
2121
m.getDeclaringType()
2222
.getASourceSupertype*()

‎java/src/audit/CWE-079/XSSJSPLenient.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class XSSConfig extends TaintTracking::Configuration {
3939
class ServletRequestSource extends RemoteFlowSource {
4040
ServletRequestSource() {
4141
exists(Method m |
42-
this.asExpr().(MethodAccess).getMethod() = m and
42+
this.asExpr().(MethodCall).getMethod() = m and
4343
m.getDeclaringType().getAnAncestor*().getQualifiedName() = "javax.servlet.ServletRequest"
4444
)
4545
}
@@ -50,7 +50,7 @@ class ServletRequestSource extends RemoteFlowSource {
5050
// Additional taint step: If an object is tainted, so are its methods' return values
5151
class TaintedObjectMA extends XssAdditionalTaintStep {
5252
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
53-
node1.asExpr() = node2.asExpr().(MethodAccess).getQualifier()
53+
node1.asExpr() = node2.asExpr().(MethodCall).getQualifier()
5454
}
5555
}
5656

@@ -115,7 +115,7 @@ class JSPTaintStep extends XssAdditionalTaintStep {
115115
}
116116
}
117117

118-
MethodAccess methodCallOn(string methodName, Variable v) {
118+
MethodCall methodCallOn(string methodName, Variable v) {
119119
result.getQualifier() = v.getAnAccess() and result.getCallee().getName() = methodName
120120
}
121121

‎java/src/security/CWE-078/CommandInjectionRuntimeExecLocal.ql

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,8 @@ class LocalSource extends Source {
1919
}
2020

2121
from
22-
DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf,
23-
MethodAccess call, DataFlow::Node sourceCmd, DataFlow::Node sinkCmd,
24-
ExecTaintConfiguration confCmd
22+
DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf, MethodCall call,
23+
DataFlow::Node sourceCmd, DataFlow::Node sinkCmd, ExecTaintConfiguration confCmd
2524
where
2625
call.getMethod() instanceof RuntimeExecMethod and
2726
// this is a command-accepting call to exec, e.g. rt.exec(new String[]{"/bin/sh", ...})

‎java/src/security/CWE-078/CommandInjectionRuntimeExecTest.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ class DataSource extends Source {
1919
}
2020

2121
from
22-
DataFlow::Node source, DataFlow::Node sink, ExecTaintConfiguration2 conf, MethodAccess call,
22+
DataFlow::Node source, DataFlow::Node sink, ExecTaintConfiguration2 conf, MethodCall call,
2323
int index, DataFlow::Node sourceCmd, DataFlow::Node sinkCmd, ExecTaintConfiguration confCmd
2424
where
2525
call.getMethod() instanceof RuntimeExecMethod and

‎java/src/security/CWE-078/CommandInjectionRuntimeExecTestPath.ql

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,8 @@ class DataSource extends Source {
2020
}
2121

2222
from
23-
DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf,
24-
MethodAccess call, DataFlow::Node sourceCmd, DataFlow::Node sinkCmd,
25-
ExecTaintConfiguration confCmd
23+
DataFlow::PathNode source, DataFlow::PathNode sink, ExecTaintConfiguration2 conf, MethodCall call,
24+
DataFlow::Node sourceCmd, DataFlow::Node sinkCmd, ExecTaintConfiguration confCmd
2625
where
2726
call.getMethod() instanceof RuntimeExecMethod and
2827
// this is a command-accepting call to exec, e.g. rt.exec(new String[]{"/bin/sh", ...})

‎java/src/security/CWE-094/GroovyCodeInjection.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ class ParseClassMethod extends Method {
3737

3838
class GroovyCodeInjectionSink extends DataFlow::ExprNode {
3939
GroovyCodeInjectionSink() {
40-
exists(MethodAccess ma |
40+
exists(MethodCall ma |
4141
ma.getMethod() instanceof ParseClassMethod and
4242
this.getExpr() = ma.getArgument(0)
4343
)

‎java/src/security/CWE-094/RhinoScriptInjection.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class CompileScriptMethod extends Method {
3939

4040
class RhinoInjectionSink extends DataFlow::ExprNode {
4141
RhinoInjectionSink() {
42-
exists(MethodAccess ma |
42+
exists(MethodCall ma |
4343
(ma.getMethod() instanceof CompileMethod or ma.getMethod() instanceof EvaluateMethod) and
4444
this.getExpr() = ma.getArgument(1)
4545
or

‎java/src/security/CWE-094/RubyScriptInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import RubyScriptInjectionFlow::PathGraph
1616

1717
class BSFSink extends DataFlow::ExprNode {
1818
BSFSink() {
19-
exists(MethodAccess ma, Method m | ma.getMethod() = m |
19+
exists(MethodCall ma, Method m | ma.getMethod() = m |
2020
m.getName() = ["exec", "eval", "compileScript", "compileExpr", "compileApply"] and
2121
m.getDeclaringType().hasQualifiedName("org.apache.bsf", "BSFManager") and
2222
this.getExpr() = ma.getAnArgument()
@@ -26,7 +26,7 @@ class BSFSink extends DataFlow::ExprNode {
2626

2727
class JRubySink extends DataFlow::ExprNode {
2828
JRubySink() {
29-
exists(MethodAccess ma, Method m | ma.getMethod() = m |
29+
exists(MethodCall ma, Method m | ma.getMethod() = m |
3030
m.getName() = ["runScriptlet", "parse"] and
3131
m.getDeclaringType().hasQualifiedName("org.jruby.embed", "ScriptingContainer") and
3232
this.getExpr() = ma.getAnArgument()

‎java/src/security/CWE-326/Base64Encryption.ql

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import ghsl.SensitiveInformation
2121

2222
class Base64Sinks extends DataFlow::Node {
2323
Base64Sinks() {
24-
exists(MethodAccess ma |
24+
exists(MethodCall ma |
2525
ma.getMethod().getDeclaringType().hasQualifiedName("java.util", "Base64$Encoder") and
2626
this.asExpr() = ma
2727
)
@@ -46,4 +46,3 @@ from Base64EncryptionFlow::PathNode source, Base64EncryptionFlow::PathNode sink
4646
where Base64EncryptionFlow::flowPath(source, sink) //using flowPath instead of hasFlowPath
4747
select sink.getNode(), source, sink, "Sensitive data is being 'encrypted' with Base64 Encoding: $@",
4848
source.getNode(), "user-provided value"
49-

‎java/src/security/CWE-338/WeakPRNG.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ abstract class RandomNumberGeneratorSinks extends DataFlow::Node { }
2121

2222
class MathRandom extends RandomNumberGeneratorSinks {
2323
MathRandom() {
24-
exists(MethodAccess ma |
24+
exists(MethodCall ma |
2525
ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Math") and
2626
ma.getMethod().getName() = "random" and
2727
this.asExpr() = ma
@@ -31,7 +31,7 @@ class MathRandom extends RandomNumberGeneratorSinks {
3131

3232
class RandomUtils extends RandomNumberGeneratorSinks {
3333
RandomUtils() {
34-
exists(MethodAccess ma |
34+
exists(MethodCall ma |
3535
ma.getMethod().getDeclaringType().hasQualifiedName("java.util", "Random") and
3636
(
3737
ma.getMethod().getName() = "next" or

0 commit comments

Comments
 (0)