hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4515 from geoffw0/modelchanges1

Browse Source 
C++: Changes to models library.
This commit is contained in:
Jonas Jensen
2020-10-29 11:21:56 +01:00
committed by GitHub
parent 64dcfbd7fc c8783b5ea3
commit 0af62b8431
3 changed files with 10 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
View File

@@ -5,32 +5,9 @@ import semmle.code.cpp.models.interfaces.SideEffect
class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
PureStrFunction() {
exists(string name |
hasGlobalOrStdName(name) and
(
name = "atof" or
name = "atoi" or
name = "atol" or
name = "atoll" or
name = "strcasestr" or
name = "strchnul" or
name = "strchr" or
name = "strchrnul" or
name = "strstr" or
name = "strpbrk" or
name = "strcmp" or
name = "strcspn" or
name = "strncmp" or
name = "strrchr" or
name = "strspn" or
name = "strtod" or
name = "strtof" or
name = "strtol" or
name = "strtoll" or
name = "strtoq" or
name = "strtoul"
)
)
hasGlobalOrStdName(["atof", "atoi", "atol", "atoll", "strcasestr", "strchnul", "strchr",
"strchrnul", "strstr", "strpbrk", "strcmp", "strcspn", "strncmp", "strrchr", "strspn",
"strtod", "strtof", "strtol", "strtoll", "strtoq", "strtoul"])
}
override predicate hasArrayInput(int bufParam) {
@@ -81,22 +58,9 @@ class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideE
class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
StrLenFunction() {
exists(string name |
hasGlobalOrStdName(name) and
(
name = "strlen" or
name = "strnlen" or
name = "wcslen"
)
or
hasGlobalName(name) and
(
name = "_mbslen" or
name = "_mbslen_l" or
name = "_mbstrlen" or
name = "_mbstrlen_l"
)
)
hasGlobalOrStdName(["strlen", "strnlen", "wcslen"])
or
hasGlobalName(["_mbslen", "_mbslen_l", "_mbstrlen", "_mbstrlen_l"])
}
override predicate hasArrayInput(int bufParam) {
@@ -126,15 +90,7 @@ class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
}
class PureFunction extends TaintFunction, SideEffectFunction {
PureFunction() {
exists(string name |
hasGlobalOrStdName(name) and
(
name = "abs" or
name = "labs"
)
)
}
PureFunction() { hasGlobalOrStdName(["abs", "labs"]) }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
exists(ParameterIndex i |

2
cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
View File

@@ -17,7 +17,7 @@ class MakeUniqueOrShared extends TaintFunction {
// Exclude the specializations of `std::make_shared` and `std::make_unique` that allocate arrays
// since these just take a size argument, which we don't want to propagate taint through.
not this.isArray() and
input.isParameter(_) and
input.isParameter([0 .. getNumberOfParameters() - 1]) and
output.isReturnValue()
}

4
cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
View File

@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.Taint
/**
* Additional model for `std::pair` constructors.
*/
class StdPairConstructor extends Constructor, TaintFunction {
private class StdPairConstructor extends Constructor, TaintFunction {
StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
/**
@@ -34,7 +34,7 @@ class StdPairConstructor extends Constructor, TaintFunction {
/**
* The standard pair `swap` function.
*/
class StdPairSwap extends TaintFunction {
private class StdPairSwap extends TaintFunction {
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {