Java: fix InsecureAlgoProperty exclusion

github · Nov 1, 2024 · 8fbd6bf · 8fbd6bf
1 parent 3826ae1
commit 8fbd6bf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll b/java/ql/lib/semmle/code/java/security/MaybeBrokenCryptoAlgorithmQuery.qll
@@ -34,7 +34,7 @@ class InsecureAlgoLiteral extends InsecureAlgorithm, ShortStringLiteral {
       // Exclude results covered by `InsecureAlgoProperty`.
       // This removes duplicates when a string literal is a default value for the property,
       // such as "MD5" in the following: `props.getProperty("hashAlg2", "MD5")`.
-      not exists(InsecureAlgoProperty insecureAlgoProp | s = insecureAlgoProp.getStringValue())
+      not exists(InsecureAlgoProperty insecAlgoProp | this = insecAlgoProp.getAnArgument())
     )
   }