Merge pull request #19260 from smowton/smowton/feature/sanitize-enum-types

Java: Add EnumType to SimpleTypeSanitizer

Author: smowton

java/ql/lib/change-notes/2025-04-09-enum-type-exclusion.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Enum-typed values are now assumed to be safe by most queries. This means that queries may return fewer results where an enum value is used in a sensitive context, e.g. pasted into a query string.

java/ql/lib/semmle/code/java/security/Sanitizers.qll

@@ -23,6 +23,7 @@ class SimpleTypeSanitizer extends DataFlow::Node {
     this.getType()
         .(RefType)
         .getASourceSupertype*()
-        .hasQualifiedName("java.time.temporal", "TemporalAccessor")
+        .hasQualifiedName("java.time.temporal", "TemporalAccessor") or
+    this.getType() instanceof EnumType
   }
 }