Java/NumericCastTaintedQuery

d10c · d10c · commit 216393f747d8 · 2025-10-09T14:01:26.000+02:00
java/ql/src/Security/CWE/CWE-681/NumericCastTainted.ql
diff --git a/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll b/java/ql/lib/semmle/code/java/security/NumericCastTaintedQuery.qll
@@ -106,8 +106,9 @@ module NumericCastFlowConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(NumericNarrowingCastExpr cast |
-      cast.getExpr() = sink.asExpr() and
+    exists(NumericNarrowingCastExpr cast | cast.getExpr() = sink.asExpr() |
+      result = sink.getLocation()
+      or
       result = cast.getLocation()
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -106,8 +106,9 @@ module NumericCastFlowConfig implements DataFlow::ConfigSig {`
`106`	`106`	`predicate observeDiffInformedIncrementalMode() { any() }`
`107`	`107`
`108`	`108`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
`109`		`- exists(NumericNarrowingCastExpr cast \|`
`110`		`- cast.getExpr() = sink.asExpr() and`
	`109`	`+ exists(NumericNarrowingCastExpr cast \| cast.getExpr() = sink.asExpr() \|`
	`110`	`+ result = sink.getLocation()`
	`111`	`+ or`
`111`	`112`	`result = cast.getLocation()`
`112`	`113`	`)`
`113`	`114`	`}`