we don't need ConstructorCall for ZipFile anymore since we have a more accurate sink for this

am0o0 · am0o0 · commit 0593eaad52f4 · 2024-07-28T12:12:07.000+02:00
diff --git a/java/ql/src/experimental/semmle/code/java/security/DecompressionBomb.qll b/java/ql/src/experimental/semmle/code/java/security/DecompressionBomb.qll
@@ -378,11 +378,6 @@ module Zip {
         call.getCallee().hasName("getInputStream") and
         call.getQualifier() = this.asExpr()
       )
-      or
-      exists(ConstructorCall call |
-        call.getConstructedType() instanceof TypeZipFile and
-        call.getAnArgument() = this.asExpr()
-      )
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -378,11 +378,6 @@ module Zip {`
`378`	`378`	`call.getCallee().hasName("getInputStream") and`
`379`	`379`	`call.getQualifier() = this.asExpr()`
`380`	`380`	`)`
`381`		`- or`
`382`		`- exists(ConstructorCall call \|`
`383`		`- call.getConstructedType() instanceof TypeZipFile and`
`384`		`- call.getAnArgument() = this.asExpr()`
`385`		`- )`
`386`	`381`	`}`
`387`	`382`	`}`
`388`	`383`