Java: Rename to EnvReadMethod

intrigus · intrigus · commit 5c1e746c96be · 2021-01-11T13:42:08.000+01:00
diff --git a/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql b/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
@@ -129,7 +129,7 @@ private class FlagToGuardFlow extends DataFlow::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof Guard }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    exists(MethodAccess ma | ma.getMethod() = any(EnvTaintedMethod m) |
+    exists(MethodAccess ma | ma.getMethod() = any(EnvReadMethod m) |
       ma = node2.asExpr() and ma.getAnArgument() = node1.asExpr()
     )
     or
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -226,7 +226,7 @@ class EnvInput extends LocalUserInput {
     )
     or
     // Results from various specific methods.
-    this.asExpr().(MethodAccess).getMethod() instanceof EnvTaintedMethod
+    this.asExpr().(MethodAccess).getMethod() instanceof EnvReadMethod
     or
     // Access to `System.in`.
     exists(Field f | this.asExpr() = f.getAnAccess() | f instanceof SystemIn)
@@ -292,9 +292,9 @@ private class SpringWebRequestGetMethod extends Method {
   }
 }
 
-/** Models methods that are tainted by the environment of the user, such as `System.getProperty` or `System.getenv()`. */
-class EnvTaintedMethod extends Method {
-  EnvTaintedMethod() {
+/** A method that reads from the environment, such as `System.getProperty` or `System.getenv`. */
+class EnvReadMethod extends Method {
+  EnvReadMethod() {
     this instanceof MethodSystemGetenv or
     this instanceof PropertiesGetPropertyMethod or
     this instanceof MethodSystemGetProperty

Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ private class FlagToGuardFlow extends DataFlow::Configuration {`
`129`	`129`	`override predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof Guard }`
`130`	`130`
`131`	`131`	`override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {`
`132`		`- exists(MethodAccess ma \| ma.getMethod() = any(EnvTaintedMethod m) \|`
	`132`	`+ exists(MethodAccess ma \| ma.getMethod() = any(EnvReadMethod m) \|`
`133`	`133`	`ma = node2.asExpr() and ma.getAnArgument() = node1.asExpr()`
`134`	`134`	`)`
`135`	`135`	`or`