Restrict field access to corresponding type

Benjamin Muskalla · Benjamin Muskalla · commit a546b38ee049 · 2021-11-10T16:30:26.000+01:00
diff --git a/java/ql/src/utils/model-generator/CaptureSummaryModels.ql b/java/ql/src/utils/model-generator/CaptureSummaryModels.ql
@@ -96,8 +96,8 @@ class ParameterToFieldConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) {
     exists(FieldAssignment a |
       a.getSource() = sink.asExpr() and
-      a.getDest().(VarAccess).getVariable().getCompilationUnit() =
-        sink.getEnclosingCallable().getCompilationUnit()
+      a.getDest().(FieldAccess).getField().getDeclaringType() =
+        sink.getEnclosingCallable().getDeclaringType()
     )
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -96,8 +96,8 @@ class ParameterToFieldConfig extends TaintTracking::Configuration {`
`96`	`96`	`override predicate isSink(DataFlow::Node sink) {`
`97`	`97`	`exists(FieldAssignment a \|`
`98`	`98`	`a.getSource() = sink.asExpr() and`
`99`		`- a.getDest().(VarAccess).getVariable().getCompilationUnit() =`
`100`		`- sink.getEnclosingCallable().getCompilationUnit()`
	`99`	`+ a.getDest().(FieldAccess).getField().getDeclaringType() =`
	`100`	`+ sink.getEnclosingCallable().getDeclaringType()`
`101`	`101`	`)`
`102`	`102`	`}`
`103`	`103`	`}`