codeql
codeql copied to clipboard
Java: Improve dispatch through TypeFlow of effectively private calls.
This improves TypeFlow to account for more argument-parameter pairs. Previously this was restricted to private callables, as we need to ensure that a proper closed-world assumption applies, since we're doing a universal flow calculation, but this can be extended to all callables that aren't implicitly public.
Improved TypeFlow means improved virtual dispatch, which ought to translate to more precise data flow.
The 24 removed results in OWASP were indeed FPs, so that's a nice improvement.