From 075a83c9871ce9a3cb8cc67e2d813d08bebf37c9 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Tue, 28 Feb 2023 15:05:29 +0000 Subject: [PATCH] Stage stats before on 'ExecTainted.ql' before: ``` 1 10 1 Fwd 609968 1398 -1 94 769936 ExecTaintConfiguration 2 15 1 Rev 239464 774 -1 52 320663 ExecTaintConfiguration 3 20 2 Fwd 205794 511 650 39 18576546 ExecTaintConfiguration 4 25 2 Rev 161966 351 428 39 13639502 ExecTaintConfiguration 5 30 3 Fwd 31889 322 791 39 5982574 ExecTaintConfiguration 6 35 3 Rev 30068 303 661 39 4181421 ExecTaintConfiguration 7 40 4 Fwd 24031 232 1432 39 14725618 ExecTaintConfiguration 8 45 4 Rev 21506 219 907 39 5962780 ExecTaintConfiguration 9 50 5 Fwd 20149 204 1527 38 8350094 ExecTaintConfiguration 10 55 5 Rev 20102 204 1472 38 7515307 ExecTaintConfiguration 11 60 6 Fwd 19950 200 904 33 9673369 ExecTaintConfiguration 12 65 6 Rev 18431 200 901 33 7030957 ExecTaintConfiguration ``` Stage stats after: ``` 1 10 1 Fwd 368610 699 -1 65 445199 ExecTaintConfiguration 2 15 1 Rev 112848 336 -1 23 150522 ExecTaintConfiguration 3 20 2 Fwd 91528 219 270 22 4120713 ExecTaintConfiguration 4 25 2 Rev 66017 141 159 22 2657398 ExecTaintConfiguration 5 30 3 Fwd 12161 119 208 22 792468 ExecTaintConfiguration 6 35 3 Rev 11640 111 167 22 569193 ExecTaintConfiguration 7 40 4 Fwd 11423 109 331 22 1203871 ExecTaintConfiguration 8 45 4 Rev 10851 107 323 22 904017 ExecTaintConfiguration 9 50 5 Fwd 10694 107 763 22 2428404 ExecTaintConfiguration 10 55 5 Rev 10332 104 735 22 2355698 ExecTaintConfiguration 11 60 6 Fwd 10302 104 729 22 5772762 ExecTaintConfiguration 12 65 6 Rev 9482 102 725 22 4020951 ExecTaintConfiguration ``` --- cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql index 01dc143a042..53d534a50ad 100644 --- a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql +++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql @@ -85,6 +85,12 @@ predicate isSinkImpl(DataFlow::Node sink, Expr command, string callChain) { shellCommand(command, callChain) } +predicate isSanitizerImpl(DataFlow::Node node) { + node.asExpr().getUnspecifiedType() instanceof IntegralType + or + node.asExpr().getUnspecifiedType() instanceof FloatingPointType +} + /** * A `TaintTracking` configuration that's used to find the relevant `ExecState`s for a * given sink. This avoids a cartesian product between all sinks and all `ExecState`s in @@ -99,6 +105,8 @@ class ExecStateConfiguration extends TaintTracking2::Configuration { override predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _, _) } + override predicate isSanitizer(DataFlow::Node node) { isSanitizerImpl(node) } + override predicate isSanitizerOut(DataFlow::Node node) { isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers } @@ -126,14 +134,7 @@ class ExecTaintConfiguration extends TaintTracking::Configuration { state2.(ExecState).getOutgoingNode() = node2 } - override predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { - ( - node.asInstruction().getResultType() instanceof IntegralType - or - node.asInstruction().getResultType() instanceof FloatingPointType - ) and - state instanceof ConcatState - } + override predicate isSanitizer(DataFlow::Node node) { isSanitizerImpl(node) } override predicate isSanitizerOut(DataFlow::Node node) { isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers