Merge pull request #13899 from egregius313/egregius313/random-nextbytes-typo-fix

Java: Fix typo in `StdlibRandomSource::getOutput`

Author: egregius313

java/ql/lib/change-notes/2023-08-07-randomdatasource-typo-fix.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed a typo in the `StdlibRandomSource` class in `RandomDataSource.qll`, which caused the class to improperly model calls to the `nextBytes` method. Queries relying on `StdlibRandomSource` may see an increase in results.

java/ql/lib/semmle/code/java/security/RandomDataSource.qll

@@ -103,7 +103,7 @@ class StdlibRandomSource extends RandomDataSource {
   }
 
   override Expr getOutput() {
-    if m.hasName("getBytes") then result = this.getArgument(0) else result = this
+    if m.hasName("nextBytes") then result = this.getArgument(0) else result = this
   }
 }