[DIFF-INFORMED] Java: UntrustedDataToExternalAPI

d10c · d10c · commit dbcb1fb36f8e · 2025-07-17T10:55:49.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.ql#L20
diff --git a/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll b/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
@@ -101,6 +101,10 @@ module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() {
+    any() // Simple use in UntrustedDataToExternalAPI.ql; also used through ExternalApiUsedWithUntrustedData in ExternalAPIsUsedWithUntrustedData.ql
+  }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -101,6 +101,10 @@ module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {`
`101`	`101`	`predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }`
`102`	`102`
`103`	`103`	`predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }`
	`104`	`+`
	`105`	`+ predicate observeDiffInformedIncrementalMode() {`
	`106`	`+ any() // Simple use in UntrustedDataToExternalAPI.ql; also used through ExternalApiUsedWithUntrustedData in ExternalAPIsUsedWithUntrustedData.ql`
	`107`	`+ }`
`104`	`108`	`}`
`105`	`109`
`106`	`110`	`/**`