hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Model std::string front, back and push_back.

Browse Source
This commit is contained in:
Geoffrey White
2020-09-04 09:36:32 +01:00
parent 6e734a894f
commit 018b0a5abf
5 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
View File

@@ -1,6 +1,6 @@
/**
* Provides implementation classes modeling `std::string` and other
* instantiations of`std::basic_string`. See `semmle.code.cpp.models.Models`
* instantiations of `std::basic_string`. See `semmle.code.cpp.models.Models`
* for usage information.
*/
@@ -82,6 +82,32 @@ class StdStringData extends TaintFunction {
}
}
/**
* The `std::string` function `push_back`.
*/
class StdStringPush extends TaintFunction {
StdStringPush() { this.hasQualifiedName("std", "basic_string", "push_back") }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from parameter to qualifier
input.isParameterDeref(0) and
output.isQualifierObject()
}
}
/**
* The `std::string` functions `front` and `back`.
*/
class StdStringFrontBack extends TaintFunction {
StdStringFrontBack() { this.hasQualifiedName("std", "basic_string", ["front", "back"]) }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from object to returned reference
input.isQualifierObject() and
output.isReturnValueDeref()
}
}
/**
* The `std::string` function `operator+`.
*/

5
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -1243,16 +1243,21 @@
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:514:2:514:2 | a | |
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:515:7:515:7 | a | |
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:516:7:516:7 | a | |
| string.cpp:512:7:512:7 | a | string.cpp:512:9:512:13 | call to front | TAINT |
| string.cpp:512:7:512:7 | ref arg a | string.cpp:513:7:513:7 | a | |
| string.cpp:512:7:512:7 | ref arg a | string.cpp:514:2:514:2 | a | |
| string.cpp:512:7:512:7 | ref arg a | string.cpp:515:7:515:7 | a | |
| string.cpp:512:7:512:7 | ref arg a | string.cpp:516:7:516:7 | a | |
| string.cpp:513:7:513:7 | a | string.cpp:513:9:513:12 | call to back | TAINT |
| string.cpp:513:7:513:7 | ref arg a | string.cpp:514:2:514:2 | a | |
| string.cpp:513:7:513:7 | ref arg a | string.cpp:515:7:515:7 | a | |
| string.cpp:513:7:513:7 | ref arg a | string.cpp:516:7:516:7 | a | |
| string.cpp:514:2:514:2 | ref arg a | string.cpp:515:7:515:7 | a | |
| string.cpp:514:2:514:2 | ref arg a | string.cpp:516:7:516:7 | a | |
| string.cpp:514:14:514:28 | call to source | string.cpp:514:2:514:2 | ref arg a | TAINT |
| string.cpp:515:7:515:7 | a | string.cpp:515:9:515:13 | call to front | TAINT |
| string.cpp:515:7:515:7 | ref arg a | string.cpp:516:7:516:7 | a | |
| string.cpp:516:7:516:7 | a | string.cpp:516:9:516:12 | call to back | TAINT |
| string.cpp:521:17:521:20 | aa | string.cpp:521:17:521:21 | call to basic_string | TAINT |
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:528:9:528:9 | a | |
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:532:8:532:8 | a | |

4
cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
View File

@@ -512,8 +512,8 @@ void test_string_front_back() {
sink(a.front());
sink(a.back());
a.push_back(ns_char::source());
sink(a.front());
sink(a.back()); // tainted [NOT DETECTED]
sink(a.front()); // [FALSE POSITIVE]
sink(a.back()); // tainted
}
void test_string_return_assign() {

2
cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
View File

@@ -141,6 +141,8 @@
| string.cpp:491:8:491:9 | s6 | string.cpp:482:18:482:23 | call to source |
| string.cpp:504:7:504:8 | s2 | string.cpp:497:14:497:19 | call to source |
| string.cpp:506:7:506:8 | s4 | string.cpp:497:14:497:19 | call to source |
| string.cpp:515:9:515:13 | call to front | string.cpp:514:14:514:28 | call to source |
| string.cpp:516:9:516:12 | call to back | string.cpp:514:14:514:28 | call to source |
| string.cpp:529:11:529:11 | call to operator+= | string.cpp:529:20:529:25 | call to source |
| string.cpp:530:21:530:21 | call to operator+= | string.cpp:530:24:530:29 | call to source |
| string.cpp:531:25:531:25 | call to operator+= | string.cpp:531:15:531:20 | call to source |

2
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -151,6 +151,8 @@
| string.cpp:491:8:491:9 | string.cpp:482:18:482:23 | AST only |
| string.cpp:504:7:504:8 | string.cpp:497:14:497:19 | AST only |
| string.cpp:506:7:506:8 | string.cpp:497:14:497:19 | AST only |
| string.cpp:515:9:515:13 | string.cpp:514:14:514:28 | AST only |
| string.cpp:516:9:516:12 | string.cpp:514:14:514:28 | AST only |
| string.cpp:529:11:529:11 | string.cpp:529:20:529:25 | AST only |
| string.cpp:530:21:530:21 | string.cpp:530:24:530:29 | AST only |
| string.cpp:531:25:531:25 | string.cpp:531:15:531:20 | AST only |