hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Some renaming and re-factoring.

Browse Source
This commit is contained in:
Michael Nebel
2024-06-11 09:53:01 +02:00
parent dfaa40a1d2
commit 1c3ceacf04
1 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
View File

@@ -145,7 +145,7 @@ private class TaintStore extends TaintState, TTaintStore {
*
* This can be used to generate Flow summaries for APIs from parameter to return.
*/
module ThroughFlowConfig implements DataFlow::StateConfigSig {
module PropagateFlowConfig implements DataFlow::StateConfigSig {
class FlowState = TaintState;
predicate isSource(DataFlow::Node source, FlowState state) {
@@ -190,14 +190,14 @@ module ThroughFlowConfig implements DataFlow::StateConfigSig {
}
}
private module ThroughFlow = TaintTracking::GlobalWithState<ThroughFlowConfig>;
private module PropagateFlow = TaintTracking::GlobalWithState<PropagateFlowConfig>;
/**
* Gets the summary model(s) of `api`, if there is flow from parameters to return value or parameter.
*/
string captureThroughFlow(DataFlowTargetApi api) {
exists(DataFlow::ParameterNode p, ReturnNodeExt returnNodeExt, string input, string output |
ThroughFlow::flow(p, returnNodeExt) and
PropagateFlow::flow(p, returnNodeExt) and
returnNodeExt.(DataFlow::Node).getEnclosingCallable() = api and
input = parameterNodeAsInput(p) and
output = returnNodeExt.getOutput() and
@@ -213,8 +213,13 @@ string captureThroughFlow(DataFlowTargetApi api) {
* This can be used to generate Source summaries for an API, if the API expose an already known source
* via its return (then the API itself becomes a source).
*/
module FromSourceConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { ExternalFlow::sourceNode(source, _) }
module PropagateFromSourceConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
exists(string kind |
isRelevantSourceKind(kind) and
ExternalFlow::sourceNode(source, kind)
)
}
predicate isSink(DataFlow::Node sink) {
exists(DataFlowTargetApi c |
@@ -234,17 +239,16 @@ module FromSourceConfig implements DataFlow::ConfigSig {
}
}
private module FromSource = TaintTracking::Global<FromSourceConfig>;
private module PropagateFromSource = TaintTracking::Global<PropagateFromSourceConfig>;
/**
* Gets the source model(s) of `api`, if there is flow from an existing known source to the return of `api`.
*/
string captureSource(DataFlowTargetApi api) {
exists(DataFlow::Node source, ReturnNodeExt sink, string kind |
FromSource::flow(source, sink) and
PropagateFromSource::flow(source, sink) and
ExternalFlow::sourceNode(source, kind) and
api = sink.getEnclosingCallable() and
isRelevantSourceKind(kind) and
result = ModelPrinting::asSourceModel(api, sink.getOutput(), kind)
)
}
@@ -259,7 +263,9 @@ string captureSource(DataFlowTargetApi api) {
module PropagateToSinkConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { apiSource(source) }
predicate isSink(DataFlow::Node sink) { ExternalFlow::sinkNode(sink, _) }
predicate isSink(DataFlow::Node sink) {
exists(string kind | isRelevantSinkKind(kind) and ExternalFlow::sinkNode(sink, kind))
}
predicate isBarrier(DataFlow::Node node) {
exists(Type t | t = node.getType() and not isRelevantType(t))
@@ -284,7 +290,6 @@ string captureSink(DataFlowTargetApi api) {
PropagateToSink::flow(src, sink) and
ExternalFlow::sinkNode(sink, kind) and
api = src.getEnclosingCallable() and
isRelevantSinkKind(kind) and
result = ModelPrinting::asSinkModel(api, asInputArgument(src), kind)
)
}