Fix containerStoreStep

Update some comments as well, and change a variable name
This commit is contained in:
Owen Mansel-Chan
2021-10-23 21:11:37 +01:00
parent be6501d8e4
commit 038f951e9f
3 changed files with 19 additions and 17 deletions

View File

@@ -7,18 +7,19 @@ private import DataFlowUtil
/**
* Holds if the step from `node1` to `node2` stores a value in a slice or array.
* This covers array assignments and initializers as well as implicit array
* creations for varargs.
* Thus, `node2` references an object with a content `c` that contains the value
* of `node1`. This covers array assignments and initializers as well as
* implicit array creations for varargs.
*/
predicate containerStoreStep(Node node1, Node node2, Content c) {
c instanceof ArrayContent and
(
// currently there is no database information about variadic functions
(
node1.getType() instanceof ArrayType or
node1.getType() instanceof SliceType
node2.getType() instanceof ArrayType or
node2.getType() instanceof SliceType
) and
exists(Write w | w.writesElement(node1, _, node2))
exists(Write w | w.writesElement(node2, _, node1))
)
or
c instanceof CollectionContent and
@@ -35,8 +36,9 @@ predicate containerStoreStep(Node node1, Node node2, Content c) {
/**
* Holds if the step from `node1` to `node2` reads a value from a slice or array.
* This covers ordinary array reads as well as array iteration through enhanced
* `for` statements.
* Thus, `node1` references an object with a content `c` whose value ends up in
* `node2`. This covers ordinary array reads as well as array iteration through
* enhanced `for` statements.
*/
predicate containerReadStep(Node node1, Node node2, Content c) {
c instanceof ArrayContent and

View File

@@ -106,7 +106,7 @@ predicate jumpStep(Node n1, Node n2) {
/**
* Holds if data can flow from `node1` to `node2` via an assignment to `c`.
* Thus, `node2` references an object with a field `f` that contains the
* Thus, `node2` references an object with a content `x` that contains the
* value of `node1`.
*/
predicate storeStep(Node node1, Content c, PostUpdateNode node2) {
@@ -131,23 +131,23 @@ predicate storeStep(Node node1, Content c, PostUpdateNode node2) {
}
/**
* Holds if data can flow from `node1` to `node2` via a read of `f`.
* Thus, `node1` references an object with a field `f` whose value ends up in
* Holds if data can flow from `node1` to `node2` via a read of `c`.
* Thus, `node1` references an object with a content `c` whose value ends up in
* `node2`.
*/
predicate readStep(Node node1, Content f, Node node2) {
predicate readStep(Node node1, Content c, Node node2) {
node1 = node2.(PointerDereferenceNode).getOperand() and
f = any(DataFlow::PointerContent pc | pc.getPointerType() = node1.getType())
c = any(DataFlow::PointerContent pc | pc.getPointerType() = node1.getType())
or
exists(FieldReadNode read |
node2 = read and
node1 = read.getBase() and
f = any(DataFlow::FieldContent fc | fc.getField() = read.getField())
c = any(DataFlow::FieldContent fc | fc.getField() = read.getField())
)
or
FlowSummaryImpl::Private::Steps::summaryReadStep(node1, f, node2)
FlowSummaryImpl::Private::Steps::summaryReadStep(node1, c, node2)
or
containerReadStep(node1, node2, f)
containerReadStep(node1, node2, c)
}
/**

View File

@@ -17,10 +17,10 @@ func functionWithVarArgsOfStructsParameter(s ...A) {
func main() {
stringSlice := []string{source()}
sink(stringSlice[0]) // $ taintflow MISSING: dataflow
sink(stringSlice[0]) // $ taintflow dataflow
arrayOfStructs := []A{{f: source()}}
sink(arrayOfStructs[0].f) // $ MISSING: taintflow dataflow
sink(arrayOfStructs[0].f) // $ taintflow dataflow
a := A{f: source()}
functionWithVarArgsOfStructsParameter(a)