codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Java: Improve dispatch through TypeFlow of effectively private calls.

Open aschackmull opened this issue 1 year ago • 1 comments

This improves TypeFlow to account for more argument-parameter pairs. Previously this was restricted to private callables, as we need to ensure that a proper closed-world assumption applies, since we're doing a universal flow calculation, but this can be extended to all callables that aren't implicitly public.

Improved TypeFlow means improved virtual dispatch, which ought to translate to more precise data flow.

aschackmull avatar May 22 '24 13:05 aschackmull

The 24 removed results in OWASP were indeed FPs, so that's a nice improvement.

aschackmull avatar May 23 '24 08:05 aschackmull