Add localFlowPlusInitializers

github · smowton · Mar 18, 2022 · Feb 14, 2022 · Feb 14, 2022 · Feb 15, 2022
commit 2a6c4e93508d87d5004947ebefb8d3c06fffc6f0
@@ -38,7 +38,7 @@ private MethodAccess getSystemPropertyFromSystemGetProperties(string propertyNam
     result.getMethod() = getMethod
   ) and
   result.getArgument(0).(CompileTimeConstantExpr).getStringValue() = propertyName and
-  DataFlow::localExprFlow(any(MethodAccess m |
+  localExprFlowPlusInitializers(any(MethodAccess m |
       m.getMethod().getDeclaringType() instanceof TypeSystem and
       m.getMethod().hasName("getProperties")
     ), result.getQualifier())
@@ -248,3 +248,25 @@ private MethodAccess getSystemPropertyFromSpringProperties(string propertyName)
   ) and
   result.getArgument(0).(CompileTimeConstantExpr).getStringValue() = propertyName
 }
+
+/**
+ * Holds if data can flow from `e1` to `e2` in zero or more
+ * local (intra-procedural) steps or via local variable intializers
+ * for final variables.
+ */
+private predicate localExprFlowPlusInitializers(Expr e1, Expr e2) {
+  localFlowPlusInitializers(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in zero or more
+ * local (intra-procedural) steps or via local variable intializers
+ * for final variables.
+ */
+private predicate localFlowPlusInitializers(DataFlow::Node pred, DataFlow::Node succ) {
+  exists(Variable v | v.isFinal() and pred.asExpr() = v.getInitializer() |
+    DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), succ)
+  )
+  or
+  DataFlow::localFlow(pred, succ)
+}