Remove specified value step from additional taint step

luchua-bc · luchua-bc · commit 2b5982fd9d77 · 2022-02-14T15:42:54.000Z
diff --git a/java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-073/FilePathInjection.ql
@@ -28,10 +28,6 @@ class InjectFilePathConfig extends TaintTracking::Configuration {
     not sink instanceof NormalizedPathNode
   }
 
-  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-    any(AdditionalValueStep r).step(pred, succ)
-  }
-
   override predicate isSanitizer(DataFlow::Node node) {
     exists(Type t | t = node.getType() | t instanceof BoxedType or t instanceof PrimitiveType)
   }

Original file line number	Diff line number	Diff line change
`@@ -28,10 +28,6 @@ class InjectFilePathConfig extends TaintTracking::Configuration {`
`28`	`28`	`not sink instanceof NormalizedPathNode`
`29`	`29`	`}`
`30`	`30`
`31`		`- override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {`
`32`		`- any(AdditionalValueStep r).step(pred, succ)`
`33`		`- }`
`34`		`-`
`35`	`31`	`override predicate isSanitizer(DataFlow::Node node) {`
`36`	`32`	`exists(Type t \| t = node.getType() \| t instanceof BoxedType or t instanceof PrimitiveType)`
`37`	`33`	`}`