mirror of
https://github.com/github/codeql.git
synced 2026-04-20 14:34:04 +02:00
Merge branch 'main' into replace-ast-with-ir-use-usedataflow
This commit is contained in:
Mathias Vorreiter Pedersen
@@ -1,24 +0,0 @@
|
||||
---
|
||||
name: LGTM.com - false positive
|
||||
about: Tell us about an alert that shouldn't be reported
|
||||
title: LGTM.com - false positive
|
||||
labels: false-positive
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Description of the false positive**
|
||||
|
||||
<!-- Please explain briefly why you think it shouldn't be included. -->
|
||||
|
||||
**URL to the alert on the project page on LGTM.com**
|
||||
|
||||
<!--
|
||||
1. Open the project on LGTM.com.
|
||||
For example, https://lgtm.com/projects/g/pallets/click/.
|
||||
2. Switch to the `Alerts` tab. For example, https://lgtm.com/projects/g/pallets/click/alerts/.
|
||||
3. Scroll to the alert that you would like to report.
|
||||
4. Click on the right most icon `View this alert within the complete file`.
|
||||
5. A new browser tab opens. Copy and paste the page URL here.
|
||||
For example, https://lgtm.com/projects/g/pallets/click/snapshot/719fb7d8322b0767cdd1e5903ba3eb3233ba8dd5/files/click/_winconsole.py#xa08d213ab3289f87:1.
|
||||
-->
|
||||
36
.github/ISSUE_TEMPLATE/ql--false-positive.md
vendored
Normal file
36
.github/ISSUE_TEMPLATE/ql--false-positive.md
vendored
Normal file
@@ -0,0 +1,36 @@
|
||||
---
|
||||
name: CodeQL False positive
|
||||
about: Report CodeQL alerts that you think should not have been detected (not applicable, not exploitable, etc.)
|
||||
title: False positive
|
||||
labels: false-positive
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Description of the false positive**
|
||||
|
||||
<!-- Please explain briefly why you think it shouldn't be included. -->
|
||||
|
||||
**Code samples or links to source code**
|
||||
|
||||
<!--
|
||||
For open source code: file links with line numbers on GitHub, for example:
|
||||
https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js#L10
|
||||
|
||||
For closed source code: (redacted) code samples that illustrate the problem, for example:
|
||||
|
||||
```
|
||||
function execSh(command, options) {
|
||||
return cp.spawn(getShell(), ["-c", command], options) // <- command line injection
|
||||
};
|
||||
```
|
||||
-->
|
||||
|
||||
**URL to the alert on GitHub code scanning (optional)**
|
||||
|
||||
<!--
|
||||
1. Open the project on GitHub.com.
|
||||
2. Switch to the `Security` tab.
|
||||
3. Browse to the alert that you would like to report.
|
||||
4. Copy and paste the page URL here.
|
||||
-->
|
||||
20
.github/workflows/compile-queries.yml
vendored
20
.github/workflows/compile-queries.yml
vendored
@@ -26,7 +26,7 @@ jobs:
|
||||
if: ${{ github.event_name == 'pull_request' }}
|
||||
uses: actions/cache@v3
|
||||
with:
|
||||
path: '*/ql/src/.cache'
|
||||
path: '**/.cache'
|
||||
key: codeql-compile-pr-${{ github.sha }} # deliberately not using the `compile-compile-main` keys here.
|
||||
restore-keys: |
|
||||
codeql-compile-${{ github.base_ref }}-${{ env.merge-base }}
|
||||
@@ -36,7 +36,7 @@ jobs:
|
||||
if: ${{ github.event_name != 'pull_request' }}
|
||||
uses: actions/cache@v3
|
||||
with:
|
||||
path: '*/ql/src/.cache'
|
||||
path: '**/.cache'
|
||||
key: codeql-compile-${{ github.ref_name }}-${{ github.sha }} # just fill on main
|
||||
restore-keys: | # restore from another random commit, to speed up compilation.
|
||||
codeql-compile-${{ github.ref_name }}-
|
||||
@@ -51,9 +51,21 @@ jobs:
|
||||
# run with --check-only if running in a PR (github.sha != main)
|
||||
if : ${{ github.event_name == 'pull_request' }}
|
||||
shell: bash
|
||||
run: codeql query compile -j0 */ql/src --keep-going --warnings=error --check-only
|
||||
run: codeql query compile -j0 */ql/{src,examples} --keep-going --warnings=error --check-only
|
||||
- name: compile queries - full
|
||||
# do full compile if running on main - this populates the cache
|
||||
if : ${{ github.event_name != 'pull_request' }}
|
||||
shell: bash
|
||||
run: codeql query compile -j0 */ql/src --keep-going --warnings=error
|
||||
run: |
|
||||
# Move all the existing cache into another folder, so we only preserve the cache for the current queries.
|
||||
mkdir -p ${COMBINED_CACHE_DIR}
|
||||
rm -f */ql/{src,examples}/.cache/{lock,size} # -f to avoid errors if the cache is empty.
|
||||
# copy the contents of the .cache folders into the combined cache folder.
|
||||
cp -r */ql/{src,examples}/.cache/* ${COMBINED_CACHE_DIR}/ || : # ignore missing files
|
||||
# clean up the .cache folders
|
||||
rm -rf */ql/{src,examples}/.cache/*
|
||||
|
||||
# compile the queries
|
||||
codeql query compile -j0 */ql/{src,examples} --keep-going --warnings=error --compilation-cache ${COMBINED_CACHE_DIR}
|
||||
env:
|
||||
COMBINED_CACHE_DIR: ${{ github.workspace }}/compilation-dir
|
||||
5
.github/workflows/ql-for-ql-tests.yml
vendored
5
.github/workflows/ql-for-ql-tests.yml
vendored
@@ -47,8 +47,3 @@ jobs:
|
||||
find ql/ql/src "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
|
||||
env:
|
||||
CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
|
||||
- name: Check QL compilation
|
||||
run: |
|
||||
"${CODEQL}" query compile --check-only --threads=4 --warnings=error --search-path "${{ github.workspace }}/ql/extractor-pack" "ql/ql/src" "ql/ql/examples"
|
||||
env:
|
||||
CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
|
||||
|
||||
1
.github/workflows/ruby-build.yml
vendored
1
.github/workflows/ruby-build.yml
vendored
@@ -97,6 +97,7 @@ jobs:
|
||||
run: |
|
||||
codeql pack create ../shared/ssa --output target/packs
|
||||
codeql pack create ../misc/suite-helpers --output target/packs
|
||||
codeql pack create ../shared/regex --output target/packs
|
||||
codeql pack create ql/lib --output target/packs
|
||||
codeql pack create ql/src --output target/packs
|
||||
PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)
|
||||
|
||||
12
.github/workflows/ruby-qltest.yml
vendored
12
.github/workflows/ruby-qltest.yml
vendored
@@ -28,16 +28,6 @@ defaults:
|
||||
working-directory: ruby
|
||||
|
||||
jobs:
|
||||
qlcompile:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: ./.github/actions/fetch-codeql
|
||||
- name: Check QL compilation
|
||||
run: |
|
||||
codeql query compile --check-only --threads=0 --ram 5000 --warnings=error "ql/src" "ql/examples"
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
qlupgrade:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
@@ -69,6 +59,6 @@ jobs:
|
||||
- uses: ./ruby/actions/create-extractor-pack
|
||||
- name: Run QL tests
|
||||
run: |
|
||||
codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
|
||||
codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
|
||||
11
.github/workflows/swift.yml
vendored
11
.github/workflows/swift.yml
vendored
@@ -27,7 +27,7 @@ jobs:
|
||||
with:
|
||||
filters: |
|
||||
codegen:
|
||||
- 'github/workflows/swift.yml'
|
||||
- '.github/workflows/swift.yml'
|
||||
- "misc/bazel/**"
|
||||
- "*.bazel*"
|
||||
- 'swift/actions/setup-env/**'
|
||||
@@ -39,6 +39,7 @@ jobs:
|
||||
- 'swift/ql/lib/codeql/swift/elements/**'
|
||||
- 'swift/ql/lib/codeql/swift/generated/**'
|
||||
- 'swift/ql/test/extractor-tests/generated/**'
|
||||
- 'swift/ql/.generated.list'
|
||||
ql:
|
||||
- 'github/workflows/swift.yml'
|
||||
- 'swift/**/*.ql'
|
||||
@@ -111,4 +112,10 @@ jobs:
|
||||
- uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: swift-generated-cpp-files
|
||||
path: swift/generated-cpp-files/**
|
||||
path: generated-cpp-files/**
|
||||
database-upgrade-scripts:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: ./.github/actions/fetch-codeql
|
||||
- uses: ./swift/actions/database-upgrade-scripts
|
||||
|
||||
@@ -19,7 +19,7 @@ repos:
|
||||
rev: v1.6.0
|
||||
hooks:
|
||||
- id: autopep8
|
||||
files: ^swift/codegen/.*\.py
|
||||
files: ^swift/.*\.py
|
||||
|
||||
- repo: local
|
||||
hooks:
|
||||
@@ -44,7 +44,7 @@ repos:
|
||||
|
||||
- id: swift-codegen
|
||||
name: Run Swift checked in code generation
|
||||
files: ^swift/(codegen/|.*/generated/|ql/lib/(swift\.dbscheme$|codeql/swift/elements))
|
||||
files: ^swift/(schema.py$|codegen/|.*/generated/|ql/lib/(swift\.dbscheme$|codeql/swift/elements)|ql/\.generated.list)
|
||||
language: system
|
||||
entry: bazel run //swift/codegen -- --quiet
|
||||
pass_filenames: false
|
||||
|
||||
@@ -45,4 +45,4 @@ WORKSPACE.bazel @github/codeql-ci-reviewers
|
||||
/.github/workflows/js-ml-tests.yml @github/codeql-ml-powered-queries-reviewers
|
||||
/.github/workflows/ql-for-ql-* @github/codeql-ql-for-ql-reviewers
|
||||
/.github/workflows/ruby-* @github/codeql-ruby
|
||||
/.github/workflows/swift-* @github/codeql-c
|
||||
/.github/workflows/swift.yml @github/codeql-c
|
||||
|
||||
@@ -486,40 +486,6 @@
|
||||
"python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
|
||||
],
|
||||
"ReDoS Util Python/JS/Ruby/Java": [
|
||||
"javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll",
|
||||
"python/ql/lib/semmle/python/security/regexp/NfaUtils.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll",
|
||||
"java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll"
|
||||
],
|
||||
"ReDoS Exponential Python/JS/Ruby/Java": [
|
||||
"javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll",
|
||||
"python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll",
|
||||
"java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll"
|
||||
],
|
||||
"ReDoS Polynomial Python/JS/Ruby/Java": [
|
||||
"javascript/ql/lib/semmle/javascript/security/regexp/SuperlinearBackTracking.qll",
|
||||
"python/ql/lib/semmle/python/security/regexp/SuperlinearBackTracking.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/regexp/SuperlinearBackTracking.qll",
|
||||
"java/ql/lib/semmle/code/java/security/regexp/SuperlinearBackTracking.qll"
|
||||
],
|
||||
"RegexpMatching Python/JS/Ruby": [
|
||||
"javascript/ql/lib/semmle/javascript/security/regexp/RegexpMatching.qll",
|
||||
"python/ql/lib/semmle/python/security/regexp/RegexpMatching.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/regexp/RegexpMatching.qll"
|
||||
],
|
||||
"BadTagFilterQuery Python/JS/Ruby": [
|
||||
"javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll",
|
||||
"python/ql/lib/semmle/python/security/BadTagFilterQuery.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/BadTagFilterQuery.qll"
|
||||
],
|
||||
"OverlyLargeRange Python/JS/Ruby/Java": [
|
||||
"javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll",
|
||||
"python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll",
|
||||
"ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll",
|
||||
"java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll"
|
||||
],
|
||||
"CFG": [
|
||||
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll",
|
||||
"ruby/ql/lib/codeql/ruby/controlflow/internal/ControlFlowGraphImplShared.qll",
|
||||
|
||||
@@ -11,11 +11,12 @@
|
||||
<ItemGroup>
|
||||
<PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
|
||||
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
|
||||
<PackageReference Include="xunit" Version="2.4.1" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.1">
|
||||
<PackageReference Include="xunit" Version="2.4.2" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
|
||||
</PackageReference>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.Build" Version="16.11.0" />
|
||||
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
|
||||
6
cpp/ql/lib/change-notes/2022-11-14-deprecate-ast-gvn.md
Normal file
6
cpp/ql/lib/change-notes/2022-11-14-deprecate-ast-gvn.md
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
|
||||
|
||||
* Deprecated `semmle.code.cpp.valuenumbering.GlobalValueNumberingImpl`. Use `semmle.code.cpp.valuenumbering.GlobalValueNumbering`, which exposes the same API.
|
||||
4
cpp/ql/lib/change-notes/2022-11-17-deleted-deps.md
Normal file
4
cpp/ql/lib/change-notes/2022-11-17-deleted-deps.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Deleted the deprecated `getName` and `getShortName` predicates from the `Folder` class.
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -189,18 +189,6 @@ class Folder extends Container, @folder {
|
||||
* Gets the URL of this folder.
|
||||
*/
|
||||
deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
|
||||
|
||||
/**
|
||||
* DEPRECATED: use `getAbsolutePath` instead.
|
||||
* Gets the name of this folder.
|
||||
*/
|
||||
deprecated string getName() { folders(underlyingElement(this), result) }
|
||||
|
||||
/**
|
||||
* DEPRECATED: use `getBaseName` instead.
|
||||
* Gets the last part of the folder name.
|
||||
*/
|
||||
deprecated string getShortName() { result = this.getBaseName() }
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -1,4 +1,8 @@
|
||||
/**
|
||||
* DEPRECATED: This library has been replaced with a newer version which
|
||||
* provides better performance and precision. Use
|
||||
* `semmle.code.cpp.valuenumbering.GlobalValueNumbering` instead.
|
||||
*
|
||||
* Provides an implementation of Global Value Numbering.
|
||||
* See https://en.wikipedia.org/wiki/Global_value_numbering
|
||||
*
|
||||
@@ -221,7 +225,7 @@ private newtype GvnBase =
|
||||
* expression with this `GVN` and using its `toString` and `getLocation`
|
||||
* methods.
|
||||
*/
|
||||
class GVN extends GvnBase {
|
||||
deprecated class GVN extends GvnBase {
|
||||
GVN() { this instanceof GvnBase }
|
||||
|
||||
/** Gets an expression that has this GVN. */
|
||||
@@ -503,7 +507,7 @@ private predicate mk_Deref(GVN p, ControlFlowNode dominator, PointerDereferenceE
|
||||
|
||||
/** Gets the global value number of expression `e`. */
|
||||
cached
|
||||
GVN globalValueNumber(Expr e) {
|
||||
deprecated GVN globalValueNumber(Expr e) {
|
||||
exists(int val, Type t |
|
||||
mk_IntConst(val, t, e) and
|
||||
result = GVN_IntConst(val, t)
|
||||
|
||||
@@ -87,7 +87,7 @@ Top *identity(Top *top) {
|
||||
|
||||
void callIdentityFunctions(Top *top, Bottom *bottom) {
|
||||
identity(bottom)->isSink(source()); // $ MISSING: ast,ir
|
||||
identity(top)->isSink(source()); // now flow
|
||||
identity(top)->isSink(source()); // no flow
|
||||
}
|
||||
|
||||
using SinkFunctionType = void (*)(int);
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
WARNING: Type GVN has been deprecated and may be removed in future (ast_gvn.ql:4,6-9)
|
||||
| test.cpp:5:3:5:3 | x | 5:c3-c3 6:c3-c3 |
|
||||
| test.cpp:5:7:5:8 | p0 | 5:c7-c8 6:c7-c8 |
|
||||
| test.cpp:5:7:5:13 | ... + ... | 5:c7-c13 6:c7-c13 7:c7-c7 |
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (ast_uniqueness.ql:7,13-30)
|
||||
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (ast_uniqueness.ql:8,30-47)
|
||||
WARNING: Type GVN has been deprecated and may be removed in future (ast_uniqueness.ql:8,18-21)
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (diff_ir_expr.ql:8,29-51)
|
||||
| test.cpp:5:3:5:13 | ... = ... | test.cpp:5:3:5:13 | ... = ... | AST only |
|
||||
| test.cpp:6:3:6:13 | ... = ... | test.cpp:6:3:6:13 | ... = ... | AST only |
|
||||
| test.cpp:7:3:7:7 | ... = ... | test.cpp:7:3:7:7 | ... = ... | AST only |
|
||||
|
||||
@@ -6,17 +6,17 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="System.IO.FileSystem" Version="4.3.0"/>
|
||||
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0"/>
|
||||
<PackageReference Include="xunit" Version="2.4.1"/>
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
|
||||
<PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
|
||||
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
|
||||
<PackageReference Include="xunit" Version="2.4.2" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
|
||||
</PackageReference>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0"/>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Autobuild.CSharp\Semmle.Autobuild.CSharp.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Autobuild.Shared\Semmle.Autobuild.Shared.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Autobuild.CSharp\Semmle.Autobuild.CSharp.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Autobuild.Shared\Semmle.Autobuild.Shared.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -11,15 +11,15 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Folder Include="Properties\"/>
|
||||
<Folder Include="Properties\" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.Build" Version="16.11.0"/>
|
||||
<PackageReference Include="Newtonsoft.Json" Version="13.0.1"/>
|
||||
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
|
||||
<PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Autobuild.Shared\Semmle.Autobuild.Shared.csproj"/>
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Util\Semmle.Util.csproj" />
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Autobuild.Shared\Semmle.Autobuild.Shared.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -8,12 +8,12 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Folder Include="Properties\"/>
|
||||
<Folder Include="Properties\" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.Build" Version="16.11.0"/>
|
||||
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\..\extractor\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -1,4 +1,4 @@
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net6.0</TargetFramework>
|
||||
@@ -24,7 +24,7 @@
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.DiaSymReader" Version="1.3.0" />
|
||||
<PackageReference Include="Microsoft.DiaSymReader" Version="1.4.0" />
|
||||
<PackageReference Include="Microsoft.DiaSymReader.Native" Version="1.7.0" />
|
||||
<PackageReference Include="Microsoft.DiaSymReader.PortablePdb" Version="1.6.0"><IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
|
||||
@@ -12,17 +12,17 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Folder Include="Properties\"/>
|
||||
<Folder Include="Properties\" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.Build" Version="16.11.0"/>
|
||||
<PackageReference Include="Microsoft.Win32.Primitives" Version="4.3.0"/>
|
||||
<PackageReference Include="System.Net.Primitives" Version="4.3.1"/>
|
||||
<PackageReference Include="System.Security.Principal" Version="4.3.0"/>
|
||||
<PackageReference Include="System.Threading.ThreadPool" Version="4.3.0"/>
|
||||
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
|
||||
<PackageReference Include="Microsoft.Win32.Primitives" Version="4.3.0" />
|
||||
<PackageReference Include="System.Net.Primitives" Version="4.3.1" />
|
||||
<PackageReference Include="System.Security.Principal" Version="4.3.0" />
|
||||
<PackageReference Include="System.Threading.ThreadPool" Version="4.3.0" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -2,6 +2,7 @@ using Microsoft.CodeAnalysis;
|
||||
using Microsoft.CodeAnalysis.CSharp.Syntax;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text.RegularExpressions;
|
||||
|
||||
namespace Semmle.Extraction.CSharp.Entities
|
||||
{
|
||||
@@ -162,6 +163,13 @@ namespace Semmle.Extraction.CSharp.Entities
|
||||
operatorName = "false";
|
||||
break;
|
||||
default:
|
||||
var match = Regex.Match(methodName, "^op_Checked(.*)$");
|
||||
if (match.Success)
|
||||
{
|
||||
OperatorSymbol("op_" + match.Groups[1], out var uncheckedName);
|
||||
operatorName = "checked " + uncheckedName;
|
||||
break;
|
||||
}
|
||||
operatorName = methodName;
|
||||
success = false;
|
||||
break;
|
||||
|
||||
@@ -10,15 +10,15 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CIL\Semmle.Extraction.CIL.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction\Semmle.Extraction.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CIL\Semmle.Extraction.CIL.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Extraction\Semmle.Extraction.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Folder Include="Properties\"/>
|
||||
<Folder Include="Properties\" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.0.1"/>
|
||||
<PackageReference Include="Microsoft.Build" Version="16.11.0"/>
|
||||
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.4.0" />
|
||||
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -6,19 +6,19 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="System.IO.FileSystem" Version="4.3.0"/>
|
||||
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0"/>
|
||||
<PackageReference Include="xunit" Version="2.4.1"/>
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
|
||||
<PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
|
||||
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
|
||||
<PackageReference Include="xunit" Version="2.4.2" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
|
||||
</PackageReference>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0"/>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp.Standalone\Semmle.Extraction.CSharp.Standalone.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction\Semmle.Extraction.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp.Standalone\Semmle.Extraction.CSharp.Standalone.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Extraction.CSharp\Semmle.Extraction.CSharp.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Extraction\Semmle.Extraction.csproj" />
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -12,13 +12,13 @@
|
||||
<DefineConstants>TRACE;DEBUG;DEBUG_LABELS</DefineConstants>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.CodeAnalysis" Version="4.0.1"/>
|
||||
<PackageReference Include="Microsoft.CodeAnalysis" Version="4.4.0" />
|
||||
<PackageReference Include="GitInfo" Version="2.2.0">
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
</PackageReference>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -6,14 +6,14 @@
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<PackageReference Include="xunit" Version="2.4.1"/>
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
|
||||
<PackageReference Include="xunit" Version="2.4.2" />
|
||||
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
|
||||
</PackageReference>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0"/>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj"/>
|
||||
<ProjectReference Include="..\Semmle.Util\Semmle.Util.csproj" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -1,8 +1,9 @@
|
||||
import csharp
|
||||
import semmle.code.csharp.dataflow.internal.SsaImpl::Consistency as Consistency
|
||||
import semmle.code.csharp.dataflow.internal.SsaImpl as Impl
|
||||
import Impl::Consistency
|
||||
import Ssa
|
||||
|
||||
class MyRelevantDefinition extends Consistency::RelevantDefinition, Ssa::Definition {
|
||||
class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
@@ -10,13 +11,13 @@ class MyRelevantDefinition extends Consistency::RelevantDefinition, Ssa::Definit
|
||||
}
|
||||
}
|
||||
|
||||
query predicate nonUniqueDef = Consistency::nonUniqueDef/4;
|
||||
|
||||
query predicate readWithoutDef = Consistency::readWithoutDef/3;
|
||||
|
||||
query predicate deadDef = Consistency::deadDef/2;
|
||||
|
||||
query predicate notDominatedByDef = Consistency::notDominatedByDef/4;
|
||||
class MyRelevantDefinitionExt extends RelevantDefinitionExt, Impl::DefinitionExt {
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
|
||||
}
|
||||
}
|
||||
|
||||
query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
|
||||
// Local variables in C# must be initialized before every use, so uninitialized
|
||||
|
||||
@@ -8,10 +8,10 @@
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.11.0" />
|
||||
<PackageReference Include="NUnit" Version="3.13.2" />
|
||||
<PackageReference Include="NUnit3TestAdapter" Version="4.0.0" />
|
||||
<PackageReference Include="coverlet.collector" Version="3.1.0" />
|
||||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
|
||||
<PackageReference Include="NUnit" Version="3.13.3" />
|
||||
<PackageReference Include="NUnit3TestAdapter" Version="4.3.0" />
|
||||
<PackageReference Include="coverlet.collector" Version="3.2.0" />
|
||||
</ItemGroup>
|
||||
|
||||
</Project>
|
||||
|
||||
4
csharp/ql/lib/change-notes/2022-11-17-deleted-deps.md
Normal file
4
csharp/ql/lib/change-notes/2022-11-17-deleted-deps.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Deleted the deprecated `getNameWithoutBrackets` predicate from the `ValueOrRefType` class in `Type.qll`.
|
||||
@@ -56,13 +56,6 @@ private predicate isObjectClass(Class c) { c instanceof ObjectType }
|
||||
* Either a value type (`ValueType`) or a reference type (`RefType`).
|
||||
*/
|
||||
class ValueOrRefType extends DotNet::ValueOrRefType, Type, Attributable, @value_or_ref_type {
|
||||
/**
|
||||
* DEPRECATED: use `getUndecoratedName()` instead.
|
||||
*
|
||||
* Gets the name of this type without `<...>` brackets, in case it is a generic type.
|
||||
*/
|
||||
deprecated string getNameWithoutBrackets() { types(this, _, result) }
|
||||
|
||||
/**
|
||||
* Holds if this type has the qualified name `qualifier`.`name`.
|
||||
*
|
||||
|
||||
@@ -907,9 +907,13 @@ module TestOutput {
|
||||
|
||||
query predicate edges(RelevantNode pred, RelevantNode succ, string attr, string val) {
|
||||
attr = "semmle.label" and
|
||||
exists(SuccessorType t | succ = getASuccessor(pred, t) |
|
||||
if successorTypeIsSimple(t) then val = "" else val = t.toString()
|
||||
)
|
||||
val =
|
||||
strictconcat(SuccessorType t, string s |
|
||||
succ = getASuccessor(pred, t) and
|
||||
if successorTypeIsSimple(t) then s = "" else s = t.toString()
|
||||
|
|
||||
s, ", " order by s
|
||||
)
|
||||
or
|
||||
attr = "semmle.order" and
|
||||
val =
|
||||
|
||||
@@ -138,25 +138,6 @@ module Ssa {
|
||||
}
|
||||
}
|
||||
|
||||
private string getSplitString(Definition def) {
|
||||
exists(ControlFlow::BasicBlock bb, int i, ControlFlow::Node cfn |
|
||||
def.definesAt(_, bb, i) and
|
||||
result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
|
||||
|
|
||||
cfn = bb.getNode(i)
|
||||
or
|
||||
not exists(bb.getNode(i)) and
|
||||
cfn = bb.getFirstNode()
|
||||
)
|
||||
}
|
||||
|
||||
private string getToStringPrefix(Definition def) {
|
||||
result = "[" + getSplitString(def) + "] "
|
||||
or
|
||||
not exists(getSplitString(def)) and
|
||||
result = ""
|
||||
}
|
||||
|
||||
/**
|
||||
* A static single assignment (SSA) definition. Either an explicit variable
|
||||
* definition (`ExplicitDefinition`), an implicit variable definition
|
||||
@@ -521,8 +502,8 @@ module Ssa {
|
||||
|
||||
override string toString() {
|
||||
if this.getADefinition() instanceof AssignableDefinitions::ImplicitParameterDefinition
|
||||
then result = getToStringPrefix(this) + "SSA param(" + this.getSourceVariable() + ")"
|
||||
else result = getToStringPrefix(this) + "SSA def(" + this.getSourceVariable() + ")"
|
||||
then result = SsaImpl::getToStringPrefix(this) + "SSA param(" + this.getSourceVariable() + ")"
|
||||
else result = SsaImpl::getToStringPrefix(this) + "SSA def(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
override Location getLocation() { result = ad.getLocation() }
|
||||
@@ -570,8 +551,12 @@ module Ssa {
|
||||
|
||||
override string toString() {
|
||||
if this.getSourceVariable().getAssignable() instanceof LocalScopeVariable
|
||||
then result = getToStringPrefix(this) + "SSA capture def(" + this.getSourceVariable() + ")"
|
||||
else result = getToStringPrefix(this) + "SSA entry def(" + this.getSourceVariable() + ")"
|
||||
then
|
||||
result =
|
||||
SsaImpl::getToStringPrefix(this) + "SSA capture def(" + this.getSourceVariable() + ")"
|
||||
else
|
||||
result =
|
||||
SsaImpl::getToStringPrefix(this) + "SSA entry def(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
override Location getLocation() { result = this.getCallable().getLocation() }
|
||||
@@ -612,7 +597,7 @@ module Ssa {
|
||||
}
|
||||
|
||||
override string toString() {
|
||||
result = getToStringPrefix(this) + "SSA call def(" + this.getSourceVariable() + ")"
|
||||
result = SsaImpl::getToStringPrefix(this) + "SSA call def(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
override Location getLocation() { result = this.getCall().getLocation() }
|
||||
@@ -640,7 +625,8 @@ module Ssa {
|
||||
final Definition getQualifierDefinition() { result = q }
|
||||
|
||||
override string toString() {
|
||||
result = getToStringPrefix(this) + "SSA qualifier def(" + this.getSourceVariable() + ")"
|
||||
result =
|
||||
SsaImpl::getToStringPrefix(this) + "SSA qualifier def(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
override Location getLocation() { result = this.getQualifierDefinition().getLocation() }
|
||||
@@ -682,7 +668,7 @@ module Ssa {
|
||||
}
|
||||
|
||||
override string toString() {
|
||||
result = getToStringPrefix(this) + "SSA phi(" + this.getSourceVariable() + ")"
|
||||
result = SsaImpl::getToStringPrefix(this) + "SSA phi(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -147,6 +147,12 @@ abstract class Configuration extends string {
|
||||
*/
|
||||
FlowFeature getAFeature() { none() }
|
||||
|
||||
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sourceGrouping(Node source, string sourceGroup) { none() }
|
||||
|
||||
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
|
||||
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `source` to `sink` for this configuration.
|
||||
*/
|
||||
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
|
||||
* The corresponding paths are generated from the end-points and the graph
|
||||
* included in the module `PathGraph`.
|
||||
*/
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
|
||||
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from some source to `sink` for this configuration.
|
||||
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
|
||||
state = sink.getState() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
|
||||
exists(PathNodeImpl source |
|
||||
sourceGroup = source.getSourceGroup() and
|
||||
config = source.getConfiguration()
|
||||
)
|
||||
} or
|
||||
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
|
||||
exists(PathNodeSink sink |
|
||||
sinkGroup = sink.getSinkGroup() and
|
||||
config = sink.getConfiguration()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
)
|
||||
}
|
||||
|
||||
string getSourceGroup() {
|
||||
this.isSource() and
|
||||
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
|
||||
}
|
||||
|
||||
predicate isFlowSource() {
|
||||
this.isSource() and not exists(this.getSourceGroup())
|
||||
or
|
||||
this instanceof PathNodeSourceGroup
|
||||
}
|
||||
|
||||
predicate isFlowSink() {
|
||||
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
|
||||
this instanceof PathNodeSinkGroup
|
||||
}
|
||||
|
||||
private string ppAp() {
|
||||
this instanceof PathNodeSink and result = ""
|
||||
or
|
||||
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
|
||||
|
||||
/** Holds if `n` can reach a sink. */
|
||||
private predicate directReach(PathNodeImpl n) {
|
||||
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
|
||||
n instanceof PathNodeSink or
|
||||
n instanceof PathNodeSinkGroup or
|
||||
directReach(n.getANonHiddenSuccessor())
|
||||
}
|
||||
|
||||
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
|
||||
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
|
||||
|
||||
/** Holds if this node is a source. */
|
||||
final predicate isSource() { super.isSource() }
|
||||
|
||||
/** Holds if this node is a grouping of source nodes. */
|
||||
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
|
||||
|
||||
/** Holds if this node is a grouping of sink nodes. */
|
||||
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
|
||||
}
|
||||
|
||||
override predicate isSource() { sourceNode(node, state, config) }
|
||||
|
||||
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
|
||||
}
|
||||
|
||||
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
|
||||
string sourceGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() {
|
||||
result.getSourceGroup() = sourceGroup and
|
||||
result.getConfiguration() = config
|
||||
}
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sourceGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
|
||||
string sinkGroup;
|
||||
Configuration config;
|
||||
|
||||
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
|
||||
|
||||
override NodeEx getNodeEx() { none() }
|
||||
|
||||
override FlowState getState() { none() }
|
||||
|
||||
override Configuration getConfiguration() { result = config }
|
||||
|
||||
override PathNodeImpl getASuccessorImpl() { none() }
|
||||
|
||||
override predicate isSource() { none() }
|
||||
|
||||
override string toString() { result = sinkGroup }
|
||||
|
||||
override predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
private predicate pathNode(
|
||||
@@ -3495,6 +3594,15 @@ private module Subpaths {
|
||||
* Will only have results if `configuration` has non-empty sources and
|
||||
* sinks.
|
||||
*/
|
||||
private predicate hasFlowPath(
|
||||
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
|
||||
) {
|
||||
flowsource.isFlowSource() and
|
||||
flowsource.getConfiguration() = configuration and
|
||||
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
|
||||
flowsink.isFlowSink()
|
||||
}
|
||||
|
||||
private predicate flowsTo(
|
||||
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
|
||||
Configuration configuration
|
||||
|
||||
@@ -49,7 +49,23 @@ private module SsaInput implements SsaImplCommon::InputSig {
|
||||
}
|
||||
}
|
||||
|
||||
import SsaImplCommon::Make<SsaInput>
|
||||
private import SsaImplCommon::Make<SsaInput> as Impl
|
||||
|
||||
class Definition = Impl::Definition;
|
||||
|
||||
class WriteDefinition = Impl::WriteDefinition;
|
||||
|
||||
class UncertainWriteDefinition = Impl::UncertainWriteDefinition;
|
||||
|
||||
class PhiNode = Impl::PhiNode;
|
||||
|
||||
module Consistency = Impl::Consistency;
|
||||
|
||||
module ExposedForTestingOnly {
|
||||
predicate ssaDefReachesReadExt = Impl::ssaDefReachesReadExt/4;
|
||||
|
||||
predicate phiHasInputFromBlockExt = Impl::phiHasInputFromBlockExt/3;
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the `i`th node of basic block `bb` reads source variable `v`.
|
||||
@@ -1072,7 +1088,7 @@ private predicate adjacentDefRead(
|
||||
Definition def, SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2,
|
||||
SsaInput::SourceVariable v
|
||||
) {
|
||||
adjacentDefRead(def, bb1, i1, bb2, i2) and
|
||||
Impl::adjacentDefRead(def, bb1, i1, bb2, i2) and
|
||||
v = def.getSourceVariable()
|
||||
}
|
||||
|
||||
@@ -1088,7 +1104,7 @@ private predicate adjacentDefReachesRead(
|
||||
exists(SsaInput::BasicBlock bb3, int i3 |
|
||||
adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
|
||||
SsaInput::variableRead(bb3, i3, _, false) and
|
||||
adjacentDefRead(def, bb3, i3, bb2, i2)
|
||||
Impl::adjacentDefRead(def, bb3, i3, bb2, i2)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -1111,11 +1127,11 @@ private predicate adjacentDefReachesUncertainRead(
|
||||
/** Same as `lastRefRedef`, but skips uncertain reads. */
|
||||
pragma[nomagic]
|
||||
private predicate lastRefSkipUncertainReads(Definition def, SsaInput::BasicBlock bb, int i) {
|
||||
lastRef(def, bb, i) and
|
||||
Impl::lastRef(def, bb, i) and
|
||||
not SsaInput::variableRead(bb, i, def.getSourceVariable(), false)
|
||||
or
|
||||
exists(SsaInput::BasicBlock bb0, int i0 |
|
||||
lastRef(def, bb0, i0) and
|
||||
Impl::lastRef(def, bb0, i0) and
|
||||
adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
|
||||
)
|
||||
}
|
||||
@@ -1237,7 +1253,7 @@ private module Cached {
|
||||
v = def.getSourceVariable() and
|
||||
capturedReadIn(_, _, v, edef.getSourceVariable(), c, additionalCalls) and
|
||||
def = def0.getAnUltimateDefinition() and
|
||||
ssaDefReachesRead(_, def0, bb, i) and
|
||||
Impl::ssaDefReachesRead(_, def0, bb, i) and
|
||||
capturedReadIn(bb, i, v, _, _, _) and
|
||||
c = bb.getNode(i)
|
||||
)
|
||||
@@ -1264,18 +1280,18 @@ private module Cached {
|
||||
|
||||
cached
|
||||
predicate isLiveAtEndOfBlock(Definition def, ControlFlow::BasicBlock bb) {
|
||||
ssaDefReachesEndOfBlock(bb, def, _)
|
||||
Impl::ssaDefReachesEndOfBlock(bb, def, _)
|
||||
}
|
||||
|
||||
cached
|
||||
Definition phiHasInputFromBlock(PhiNode phi, ControlFlow::BasicBlock bb) {
|
||||
phiHasInputFromBlock(phi, result, bb)
|
||||
Definition phiHasInputFromBlock(Ssa::PhiNode phi, ControlFlow::BasicBlock bb) {
|
||||
Impl::phiHasInputFromBlock(phi, result, bb)
|
||||
}
|
||||
|
||||
cached
|
||||
AssignableRead getAReadAtNode(Definition def, ControlFlow::Node cfn) {
|
||||
exists(Ssa::SourceVariable v, ControlFlow::BasicBlock bb, int i |
|
||||
ssaDefReachesRead(v, def, bb, i) and
|
||||
Impl::ssaDefReachesRead(v, def, bb, i) and
|
||||
variableReadActual(bb, i, v) and
|
||||
cfn = bb.getNode(i) and
|
||||
result.getAControlFlowNode() = cfn
|
||||
@@ -1313,11 +1329,11 @@ private module Cached {
|
||||
/** Same as `lastRefRedef`, but skips uncertain reads. */
|
||||
cached
|
||||
predicate lastRefBeforeRedef(Definition def, ControlFlow::BasicBlock bb, int i, Definition next) {
|
||||
lastRefRedef(def, bb, i, next) and
|
||||
Impl::lastRefRedef(def, bb, i, next) and
|
||||
not SsaInput::variableRead(bb, i, def.getSourceVariable(), false)
|
||||
or
|
||||
exists(SsaInput::BasicBlock bb0, int i0 |
|
||||
lastRefRedef(def, bb0, i0, next) and
|
||||
Impl::lastRefRedef(def, bb0, i0, next) and
|
||||
adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
|
||||
)
|
||||
}
|
||||
@@ -1333,7 +1349,7 @@ private module Cached {
|
||||
|
||||
cached
|
||||
Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
|
||||
uncertainWriteDefinitionInput(def, result)
|
||||
Impl::uncertainWriteDefinitionInput(def, result)
|
||||
}
|
||||
|
||||
cached
|
||||
@@ -1343,10 +1359,57 @@ private module Cached {
|
||||
v = def.getSourceVariable() and
|
||||
p = v.getAssignable() and
|
||||
def = def0.getAnUltimateDefinition() and
|
||||
ssaDefReachesRead(_, def0, bb, i) and
|
||||
Impl::ssaDefReachesRead(_, def0, bb, i) and
|
||||
outRefExitRead(bb, i, v)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
import Cached
|
||||
|
||||
private string getSplitString(DefinitionExt def) {
|
||||
exists(ControlFlow::BasicBlock bb, int i, ControlFlow::Node cfn |
|
||||
def.definesAt(_, bb, i, _) and
|
||||
result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
|
||||
|
|
||||
cfn = bb.getNode(i)
|
||||
or
|
||||
not exists(bb.getNode(i)) and
|
||||
cfn = bb.getFirstNode()
|
||||
)
|
||||
}
|
||||
|
||||
string getToStringPrefix(DefinitionExt def) {
|
||||
result = "[" + getSplitString(def) + "] "
|
||||
or
|
||||
not exists(getSplitString(def)) and
|
||||
result = ""
|
||||
}
|
||||
|
||||
/**
|
||||
* An extended static single assignment (SSA) definition.
|
||||
*
|
||||
* This is either a normal SSA definition (`Definition`) or a
|
||||
* phi-read node (`PhiReadNode`).
|
||||
*
|
||||
* Only intended for internal use.
|
||||
*/
|
||||
class DefinitionExt extends Impl::DefinitionExt {
|
||||
override string toString() { result = this.(Ssa::Definition).toString() }
|
||||
|
||||
/** Gets the location of this definition. */
|
||||
Location getLocation() { result = this.(Ssa::Definition).getLocation() }
|
||||
}
|
||||
|
||||
/**
|
||||
* A phi-read node.
|
||||
*
|
||||
* Only intended for internal use.
|
||||
*/
|
||||
class PhiReadNode extends DefinitionExt, Impl::PhiReadNode {
|
||||
override string toString() {
|
||||
result = getToStringPrefix(this) + "SSA phi read(" + this.getSourceVariable() + ")"
|
||||
}
|
||||
|
||||
override Location getLocation() { result = this.getBasicBlock().getLocation() }
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
* @description Loading a .NET assembly based on a path constructed from user-controlled sources
|
||||
* may allow a malicious user to load code which modifies the program in unintended
|
||||
* ways.
|
||||
* @kind problem
|
||||
* @kind path-problem
|
||||
* @id cs/assembly-path-injection
|
||||
* @problem.severity error
|
||||
* @security-severity 8.2
|
||||
@@ -15,6 +15,7 @@
|
||||
import csharp
|
||||
import semmle.code.csharp.security.dataflow.flowsources.Remote
|
||||
import semmle.code.csharp.commons.Util
|
||||
import DataFlow::PathGraph
|
||||
|
||||
/**
|
||||
* A taint-tracking configuration for untrusted user input used to load a DLL.
|
||||
@@ -47,6 +48,7 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
|
||||
}
|
||||
}
|
||||
|
||||
from TaintTrackingConfiguration c, DataFlow::Node source, DataFlow::Node sink
|
||||
where c.hasFlow(source, sink)
|
||||
select sink, "This assembly path depends on a $@.", source, "user-provided value"
|
||||
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
|
||||
where c.hasFlowPath(source, sink)
|
||||
select sink.getNode(), source, sink, "This assembly path depends on a $@.", source,
|
||||
"user-provided value"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name Hard-coded encryption key
|
||||
* @description The .Key property or rgbKey parameter of a SymmetricAlgorithm should never be a hard-coded value.
|
||||
* @kind problem
|
||||
* @kind path-problem
|
||||
* @id cs/hardcoded-key
|
||||
* @problem.severity error
|
||||
* @security-severity 8.1
|
||||
@@ -15,6 +15,7 @@
|
||||
|
||||
import csharp
|
||||
import semmle.code.csharp.security.cryptography.EncryptionKeyDataFlowQuery
|
||||
import DataFlow::PathGraph
|
||||
|
||||
/**
|
||||
* The creation of a literal byte array.
|
||||
@@ -36,7 +37,13 @@ class StringLiteralSource extends KeySource {
|
||||
StringLiteralSource() { this.asExpr() instanceof StringLiteral }
|
||||
}
|
||||
|
||||
from SymmetricKeyTaintTrackingConfiguration keyFlow, KeySource src, SymmetricEncryptionKeySink sink
|
||||
where keyFlow.hasFlow(src, sink)
|
||||
select sink, "This hard-coded $@ is used in symmetric algorithm in " + sink.getDescription(), src,
|
||||
from
|
||||
SymmetricKeyTaintTrackingConfiguration keyFlow, DataFlow::PathNode source,
|
||||
DataFlow::PathNode sink, KeySource srcNode, SymmetricEncryptionKeySink sinkNode
|
||||
where
|
||||
keyFlow.hasFlowPath(source, sink) and
|
||||
source.getNode() = srcNode and
|
||||
sink.getNode() = sinkNode
|
||||
select sink.getNode(), source, sink,
|
||||
"This hard-coded $@ is used in symmetric algorithm in " + sinkNode.getDescription(), srcNode,
|
||||
"symmetric key"
|
||||
|
||||
@@ -2775,7 +2775,7 @@ Assert.cs:
|
||||
#-----| true -> access to parameter b2
|
||||
|
||||
# 140| [assertion failure] access to parameter b2
|
||||
#-----| false -> [assertion failure] access to parameter b3
|
||||
#-----| false, true -> [assertion failure] access to parameter b3
|
||||
|
||||
# 140| access to parameter b2
|
||||
#-----| false -> [assertion success] access to parameter b3
|
||||
@@ -4924,7 +4924,7 @@ ExitMethods.cs:
|
||||
#-----| -> ...;
|
||||
|
||||
# 22| call to method ErrorAlways
|
||||
#-----| exception(Exception) -> exit M3 (abnormal)
|
||||
#-----| exception(ArgumentException), exception(Exception) -> exit M3 (abnormal)
|
||||
|
||||
# 22| ...;
|
||||
#-----| -> true
|
||||
|
||||
@@ -5,7 +5,8 @@ AnonymousObjectCreation.cs:
|
||||
# 7| 1: [TypeMention] AnonObj
|
||||
# 7| 1: [AssignExpr] ... = ...
|
||||
# 7| 0: [FieldAccess] access to field l
|
||||
# 7| 1: [ObjectCreation] object creation of type List<AnonObj>
|
||||
# 7| 1: [CastExpr] (...) ...
|
||||
# 7| 1: [ObjectCreation] object creation of type List<AnonObj>
|
||||
# 9| 6: [Property] Prop1
|
||||
# 9| -1: [TypeMention] int
|
||||
# 9| 3: [Getter] get_Prop1
|
||||
@@ -21,13 +22,15 @@ AnonymousObjectCreation.cs:
|
||||
# 13| 0: [ExprStmt] ...;
|
||||
# 13| 0: [MethodCall] call to method M1
|
||||
# 13| -1: [ThisAccess] this access
|
||||
# 13| 0: [ObjectCreation] object creation of type AnonObj
|
||||
# 13| -1: [ObjectInitializer] { ..., ... }
|
||||
# 13| 0: [MemberInitializer] ... = ...
|
||||
# 13| 0: [PropertyCall] access to property Prop1
|
||||
# 13| 1: [IntLiteral] 1
|
||||
# 13| 0: [CastExpr] (...) ...
|
||||
# 13| 1: [ObjectCreation] object creation of type AnonObj
|
||||
# 13| -1: [ObjectInitializer] { ..., ... }
|
||||
# 13| 0: [MemberInitializer] ... = ...
|
||||
# 13| 0: [PropertyCall] access to property Prop1
|
||||
# 13| 1: [IntLiteral] 1
|
||||
# 14| 1: [ReturnStmt] return ...;
|
||||
# 14| 0: [ObjectCreation] object creation of type AnonObj
|
||||
# 14| 0: [CastExpr] (...) ...
|
||||
# 14| 1: [ObjectCreation] object creation of type AnonObj
|
||||
# 17| 8: [DelegateType] D
|
||||
#-----| 2: (Parameters)
|
||||
# 17| 0: [Parameter] x
|
||||
@@ -42,9 +45,10 @@ AnonymousObjectCreation.cs:
|
||||
# 21| -1: [TypeMention] D
|
||||
# 21| 4: [BlockStmt] {...}
|
||||
# 21| 0: [ReturnStmt] return ...;
|
||||
# 21| 0: [ExplicitDelegateCreation] delegate creation of type D
|
||||
# 21| 0: [ImplicitDelegateCreation] delegate creation of type D
|
||||
# 21| 0: [MethodAccess] access to method M2
|
||||
# 21| 0: [CastExpr] (...) ...
|
||||
# 21| 1: [ExplicitDelegateCreation] delegate creation of type D
|
||||
# 21| 0: [ImplicitDelegateCreation] delegate creation of type D
|
||||
# 21| 0: [MethodAccess] access to method M2
|
||||
# 23| 11: [Method] MethodAdd
|
||||
# 23| -1: [TypeMention] Void
|
||||
# 24| 4: [BlockStmt] {...}
|
||||
@@ -53,7 +57,8 @@ AnonymousObjectCreation.cs:
|
||||
# 25| -1: [TypeMention] List<int>
|
||||
# 25| 1: [TypeMention] int
|
||||
# 25| 0: [LocalVariableAccess] access to local variable list
|
||||
# 25| 1: [ObjectCreation] object creation of type List<Int32>
|
||||
# 25| 1: [CastExpr] (...) ...
|
||||
# 25| 1: [ObjectCreation] object creation of type List<Int32>
|
||||
BinaryPattern.cs:
|
||||
# 3| [Class] BinaryPattern
|
||||
# 5| 5: [Property] P1
|
||||
|
||||
@@ -1,4 +1,30 @@
|
||||
| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:80:30:80:31 | access to local variable x1 |
|
||||
| Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:63:16:63:28 | this access |
|
||||
| Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:63:16:63:16 | access to parameter i |
|
||||
| Test.cs:78:13:78:13 | x | Test.cs:90:9:97:9 | if (...) ... |
|
||||
phiReadNode
|
||||
| DefUse.cs:80:30:80:31 | SSA phi read(this.Field2) | DefUse.cs:63:9:63:14 | this.Field2 |
|
||||
| Fields.cs:63:16:63:28 | SSA phi read(this.LoopField) | Fields.cs:65:24:65:32 | this.LoopField |
|
||||
| Patterns.cs:20:9:38:9 | SSA phi read(o) | Patterns.cs:7:16:7:16 | o |
|
||||
| Properties.cs:63:16:63:16 | SSA phi read(this.LoopProp) | Properties.cs:65:24:65:31 | this.LoopProp |
|
||||
| Test.cs:25:16:25:16 | SSA phi read(x) | Test.cs:8:13:8:13 | x |
|
||||
| Test.cs:90:9:97:9 | SSA phi read(x) | Test.cs:78:13:78:13 | x |
|
||||
| Test.cs:99:9:99:15 | SSA phi read(x) | Test.cs:78:13:78:13 | x |
|
||||
phiReadNodeRead
|
||||
| DefUse.cs:80:30:80:31 | SSA phi read(this.Field2) | DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:80:37:80:42 | access to field Field2 |
|
||||
| Fields.cs:63:16:63:28 | SSA phi read(this.LoopField) | Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:65:24:65:32 | access to field LoopField |
|
||||
| Patterns.cs:20:9:38:9 | SSA phi read(o) | Patterns.cs:7:16:7:16 | o | Patterns.cs:20:17:20:17 | access to local variable o |
|
||||
| Properties.cs:63:16:63:16 | SSA phi read(this.LoopProp) | Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:65:24:65:31 | access to property LoopProp |
|
||||
| Test.cs:25:16:25:16 | SSA phi read(x) | Test.cs:8:13:8:13 | x | Test.cs:25:16:25:16 | access to local variable x |
|
||||
| Test.cs:90:9:97:9 | SSA phi read(x) | Test.cs:78:13:78:13 | x | Test.cs:92:17:92:17 | access to local variable x |
|
||||
| Test.cs:90:9:97:9 | SSA phi read(x) | Test.cs:78:13:78:13 | x | Test.cs:96:17:96:17 | access to local variable x |
|
||||
| Test.cs:99:9:99:15 | SSA phi read(x) | Test.cs:78:13:78:13 | x | Test.cs:99:13:99:13 | access to local variable x |
|
||||
| Test.cs:99:9:99:15 | SSA phi read(x) | Test.cs:78:13:78:13 | x | Test.cs:104:17:104:17 | access to local variable x |
|
||||
phiReadInput
|
||||
| DefUse.cs:80:30:80:31 | SSA phi read(this.Field2) | DefUse.cs:63:9:63:18 | SSA def(this.Field2) |
|
||||
| DefUse.cs:80:30:80:31 | SSA phi read(this.Field2) | DefUse.cs:80:30:80:31 | SSA phi read(this.Field2) |
|
||||
| Fields.cs:63:16:63:28 | SSA phi read(this.LoopField) | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) |
|
||||
| Fields.cs:63:16:63:28 | SSA phi read(this.LoopField) | Fields.cs:63:16:63:28 | SSA phi read(this.LoopField) |
|
||||
| Patterns.cs:20:9:38:9 | SSA phi read(o) | Patterns.cs:7:16:7:23 | SSA def(o) |
|
||||
| Properties.cs:63:16:63:16 | SSA phi read(this.LoopProp) | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) |
|
||||
| Properties.cs:63:16:63:16 | SSA phi read(this.LoopProp) | Properties.cs:63:16:63:16 | SSA phi read(this.LoopProp) |
|
||||
| Test.cs:25:16:25:16 | SSA phi read(x) | Test.cs:24:9:24:15 | SSA phi(x) |
|
||||
| Test.cs:25:16:25:16 | SSA phi read(x) | Test.cs:25:16:25:16 | SSA phi read(x) |
|
||||
| Test.cs:90:9:97:9 | SSA phi read(x) | Test.cs:78:13:78:17 | SSA def(x) |
|
||||
| Test.cs:99:9:99:15 | SSA phi read(x) | Test.cs:90:9:97:9 | SSA phi read(x) |
|
||||
|
||||
@@ -1,6 +1,17 @@
|
||||
import csharp
|
||||
import semmle.code.csharp.dataflow.internal.SsaImpl
|
||||
import ExposedForTestingOnly
|
||||
|
||||
from Ssa::SourceVariable v, ControlFlow::BasicBlock bb
|
||||
where phiReadExposedForTesting(bb, v)
|
||||
select v, bb
|
||||
query predicate phiReadNode(PhiReadNode phi, Ssa::SourceVariable v) { phi.getSourceVariable() = v }
|
||||
|
||||
query predicate phiReadNodeRead(PhiReadNode phi, Ssa::SourceVariable v, ControlFlow::Node read) {
|
||||
phi.getSourceVariable() = v and
|
||||
exists(ControlFlow::BasicBlock bb, int i |
|
||||
ssaDefReachesReadExt(v, phi, bb, i) and
|
||||
read = bb.getNode(i)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate phiReadInput(PhiReadNode phi, DefinitionExt inp) {
|
||||
phiHasInputFromBlockExt(phi, inp, _)
|
||||
}
|
||||
|
||||
@@ -95,7 +95,7 @@ class Test
|
||||
{
|
||||
use(x);
|
||||
}
|
||||
// no phi_use for `x`, because actual use exists in the block
|
||||
// phi_use for `x`, even though there is an actual use in the block
|
||||
use(x);
|
||||
|
||||
|
||||
|
||||
@@ -1 +1,11 @@
|
||||
| Test.cs:10:36:10:46 | access to local variable libraryName | This assembly path depends on a $@. | Test.cs:7:26:7:48 | access to property QueryString | user-provided value |
|
||||
edges
|
||||
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | Test.cs:7:26:7:63 | access to indexer : String |
|
||||
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | Test.cs:10:36:10:46 | access to local variable libraryName |
|
||||
| Test.cs:7:26:7:63 | access to indexer : String | Test.cs:10:36:10:46 | access to local variable libraryName |
|
||||
nodes
|
||||
| Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
|
||||
| Test.cs:7:26:7:63 | access to indexer : String | semmle.label | access to indexer : String |
|
||||
| Test.cs:10:36:10:46 | access to local variable libraryName | semmle.label | access to local variable libraryName |
|
||||
subpaths
|
||||
#select
|
||||
| Test.cs:10:36:10:46 | access to local variable libraryName | Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | Test.cs:10:36:10:46 | access to local variable libraryName | This assembly path depends on a $@. | Test.cs:7:26:7:48 | access to property QueryString : NameValueCollection | user-provided value |
|
||||
|
||||
@@ -1,7 +1,40 @@
|
||||
| HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password | This hard-coded $@ is used in symmetric algorithm in Decryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" | symmetric key |
|
||||
edges
|
||||
| HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d |
|
||||
| HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:36:37:36:37 | access to local variable d : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:41:50:41:50 | access to local variable c : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:50:35:50:35 | access to local variable c : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:28:39:28:116 | call to method GetBytes : Byte[] | HardcodedSymmetricEncryptionKey.cs:44:51:44:69 | access to local variable byteArrayFromString : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" : String | HardcodedSymmetricEncryptionKey.cs:28:39:28:116 | call to method GetBytes : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:36:37:36:37 | access to local variable d : Byte[] | HardcodedSymmetricEncryptionKey.cs:103:57:103:59 | key : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:41:50:41:50 | access to local variable c : Byte[] | HardcodedSymmetricEncryptionKey.cs:112:63:112:65 | key : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:44:51:44:69 | access to local variable byteArrayFromString : Byte[] | HardcodedSymmetricEncryptionKey.cs:112:63:112:65 | key : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:50:35:50:35 | access to local variable c : Byte[] | HardcodedSymmetricEncryptionKey.cs:59:64:59:71 | password : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:59:64:59:71 | password : Byte[] | HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password |
|
||||
| HardcodedSymmetricEncryptionKey.cs:103:57:103:59 | key : Byte[] | HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:112:63:112:65 | key : Byte[] | HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key |
|
||||
nodes
|
||||
| HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | semmle.label | array creation of type Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | semmle.label | array creation of type Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | semmle.label | array creation of type Byte[] : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:28:39:28:116 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" : String | semmle.label | "Hello, world: here is a very bad way to create a key" : String |
|
||||
| HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d | semmle.label | access to local variable d |
|
||||
| HardcodedSymmetricEncryptionKey.cs:36:37:36:37 | access to local variable d : Byte[] | semmle.label | access to local variable d : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:41:50:41:50 | access to local variable c : Byte[] | semmle.label | access to local variable c : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:44:51:44:69 | access to local variable byteArrayFromString : Byte[] | semmle.label | access to local variable byteArrayFromString : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:50:35:50:35 | access to local variable c : Byte[] | semmle.label | access to local variable c : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:59:64:59:71 | password : Byte[] | semmle.label | password : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password | semmle.label | access to parameter password |
|
||||
| HardcodedSymmetricEncryptionKey.cs:103:57:103:59 | key : Byte[] | semmle.label | key : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key | semmle.label | access to parameter key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:112:63:112:65 | key : Byte[] | semmle.label | key : Byte[] |
|
||||
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | semmle.label | access to parameter key |
|
||||
subpaths
|
||||
#select
|
||||
| HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:17:21:17:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:22:23:22:99 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:31:21:31:21 | access to local variable d | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:68:87:68:94 | access to parameter password | This hard-coded $@ is used in symmetric algorithm in Decryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:108:23:108:25 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Key property assignment | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] : Byte[] | HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:25:21:25:97 | array creation of type Byte[] | symmetric key |
|
||||
| HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" : String | HardcodedSymmetricEncryptionKey.cs:121:87:121:89 | access to parameter key | This hard-coded $@ is used in symmetric algorithm in Encryptor(rgbKey, IV) | HardcodedSymmetricEncryptionKey.cs:28:62:28:115 | "Hello, world: here is a very bad way to create a key" | symmetric key |
|
||||
|
||||
@@ -312,7 +312,7 @@ For more information, see "`Using CodeQL query packs in the CodeQL action <https
|
||||
Including query help for custom CodeQL queries in SARIF files
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
If you use the CodeQL CLI to to run code scanning analyses on third party CI/CD systems,
|
||||
If you use the CodeQL CLI to run code scanning analyses on third party CI/CD systems,
|
||||
you can include the query help for your custom queries in SARIF files generated during an analysis.
|
||||
After uploading the SARIF file to GitHub, the query help is shown in the code scanning UI for any
|
||||
alerts generated by the custom queries.
|
||||
|
||||
@@ -24,7 +24,7 @@
|
||||
JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [7]_"
|
||||
Python [8]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10",Not applicable,``.py``
|
||||
Ruby [9]_,"up to 3.1",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
|
||||
TypeScript [10]_,"2.6-4.8",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
|
||||
TypeScript [10]_,"2.6-4.9",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
|
||||
|
||||
.. container:: footnote-group
|
||||
|
||||
|
||||
@@ -176,7 +176,7 @@ private predicate foo(Expr e, Expr p) {
|
||||
1. Acronyms *should* use normal PascalCase/camelCase. However, two-letter acronyms should have both letters capitalized.
|
||||
1. Newtype predicate names *should* begin with `T`.
|
||||
1. Predicates that have a result *should* be named `get...`
|
||||
1. Predicates that can return multiple results *should* be named `getA...` or `getAn...`
|
||||
1. Predicates that can have multiple results *should* be named `getA...` or `getAn...`
|
||||
1. Predicates that don't have a result or parameters *should* be named `is...` or `has...`
|
||||
1. *Avoid* underscores in names.
|
||||
1. *Avoid* short or single-letter names for classes, predicates and fields.
|
||||
@@ -304,6 +304,7 @@ For more information about documenting the code that you contribute to this repo
|
||||
exists(Type arg | arg = this.getAChild() | arg instanceof TypeParameter)
|
||||
```
|
||||
|
||||
|
||||
```ql
|
||||
exists(Type qualifierType |
|
||||
this.hasNonExactQualifierType(qualifierType)
|
||||
|
||||
@@ -57,7 +57,7 @@ func (l *Labeler) GlobalID(key string) Label {
|
||||
label, exists := l.keyLabels[key]
|
||||
if !exists {
|
||||
id := l.nextID()
|
||||
fmt.Fprintf(l.tw.zip, "%s=@\"%s\"\n", id, escapeString(key))
|
||||
fmt.Fprintf(l.tw.wzip, "%s=@\"%s\"\n", id, escapeString(key))
|
||||
label = Label{id}
|
||||
l.keyLabels[key] = label
|
||||
}
|
||||
@@ -90,7 +90,7 @@ func (l *Labeler) LocalID(nd interface{}) Label {
|
||||
// FreshID creates a fresh label and returns it
|
||||
func (l *Labeler) FreshID() Label {
|
||||
id := l.nextID()
|
||||
fmt.Fprintf(l.tw.zip, "%s=*\n", id)
|
||||
fmt.Fprintf(l.tw.wzip, "%s=*\n", id)
|
||||
return Label{id}
|
||||
}
|
||||
|
||||
|
||||
@@ -19,7 +19,8 @@ import (
|
||||
// A Writer provides methods for writing data to a TRAP file
|
||||
type Writer struct {
|
||||
zip *gzip.Writer
|
||||
w *bufio.Writer
|
||||
wzip *bufio.Writer
|
||||
wfile *bufio.Writer
|
||||
file *os.File
|
||||
Labeler *Labeler
|
||||
path string
|
||||
@@ -54,11 +55,13 @@ func NewWriter(path string, pkg *packages.Package) (*Writer, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
bufioWriter := bufio.NewWriter(tmpFile)
|
||||
zipWriter := gzip.NewWriter(bufioWriter)
|
||||
bufioFileWriter := bufio.NewWriter(tmpFile)
|
||||
zipWriter := gzip.NewWriter(bufioFileWriter)
|
||||
bufioZipWriter := bufio.NewWriter(zipWriter)
|
||||
tw := &Writer{
|
||||
zipWriter,
|
||||
bufioWriter,
|
||||
bufioZipWriter,
|
||||
bufioFileWriter,
|
||||
tmpFile,
|
||||
nil,
|
||||
path,
|
||||
@@ -88,13 +91,19 @@ func trapFolder() (string, error) {
|
||||
|
||||
// Close the underlying file writer
|
||||
func (tw *Writer) Close() error {
|
||||
err := tw.zip.Close()
|
||||
err := tw.wzip.Flush()
|
||||
if err != nil {
|
||||
// throw away file close error
|
||||
tw.file.Close()
|
||||
return err
|
||||
}
|
||||
err = tw.zip.Close()
|
||||
if err != nil {
|
||||
// return zip-close error, but ignore file-close error
|
||||
tw.file.Close()
|
||||
return err
|
||||
}
|
||||
err = tw.w.Flush()
|
||||
err = tw.wfile.Flush()
|
||||
if err != nil {
|
||||
// throw away close error because write errors are likely to be more important
|
||||
tw.file.Close()
|
||||
@@ -145,24 +154,24 @@ func capStringLength(s string) string {
|
||||
|
||||
// Emit writes out a tuple of values for the given `table`
|
||||
func (tw *Writer) Emit(table string, values []interface{}) error {
|
||||
fmt.Fprintf(tw.zip, "%s(", table)
|
||||
fmt.Fprintf(tw.wzip, "%s(", table)
|
||||
for i, value := range values {
|
||||
if i > 0 {
|
||||
fmt.Fprint(tw.zip, ", ")
|
||||
fmt.Fprint(tw.wzip, ", ")
|
||||
}
|
||||
switch value := value.(type) {
|
||||
case Label:
|
||||
fmt.Fprint(tw.zip, value.id)
|
||||
fmt.Fprint(tw.wzip, value.id)
|
||||
case string:
|
||||
fmt.Fprintf(tw.zip, "\"%s\"", escapeString(capStringLength(value)))
|
||||
fmt.Fprintf(tw.wzip, "\"%s\"", escapeString(capStringLength(value)))
|
||||
case int:
|
||||
fmt.Fprintf(tw.zip, "%d", value)
|
||||
fmt.Fprintf(tw.wzip, "%d", value)
|
||||
case float64:
|
||||
fmt.Fprintf(tw.zip, "%e", value)
|
||||
fmt.Fprintf(tw.wzip, "%e", value)
|
||||
default:
|
||||
return errors.New("Cannot emit value")
|
||||
}
|
||||
}
|
||||
fmt.Fprintf(tw.zip, ")\n")
|
||||
fmt.Fprintf(tw.wzip, ")\n")
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
* @name Incomplete switch over enum
|
||||
* @description A switch statement of enum type should explicitly reference each
|
||||
* of the members of that enum.
|
||||
* @severity warning
|
||||
* @kind problem
|
||||
* @id go/examples/incomplete-switch
|
||||
*/
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: breaking
|
||||
---
|
||||
The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTracking::Configuration` has changed from `allowImplicitRead(DataFlow::Node node, DataFlow::Content c)` to `allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c)`.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The `BarrierGuard` class has been deprecated. Such barriers and sanitizers can now instead be created using the new `BarrierGuard` parameterized module.
|
||||
@@ -124,10 +124,17 @@ predicate sinkModel(string row) { any(SinkModelCsv s).row(row) }
|
||||
/** Holds if `row` is a summary model. */
|
||||
predicate summaryModel(string row) { any(SummaryModelCsv s).row(row) }
|
||||
|
||||
bindingset[input]
|
||||
private predicate getKind(string input, string kind, boolean generated) {
|
||||
input.splitAt(":", 0) = "generated" and kind = input.splitAt(":", 1) and generated = true
|
||||
or
|
||||
not input.matches("%:%") and kind = input and generated = false
|
||||
}
|
||||
|
||||
/** Holds if a source model exists for the given parameters. */
|
||||
predicate sourceModel(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext,
|
||||
string output, string kind
|
||||
string output, string kind, boolean generated
|
||||
) {
|
||||
exists(string row |
|
||||
sourceModel(row) and
|
||||
@@ -139,14 +146,14 @@ predicate sourceModel(
|
||||
row.splitAt(";", 4) = signature and
|
||||
row.splitAt(";", 5) = ext and
|
||||
row.splitAt(";", 6) = output and
|
||||
row.splitAt(";", 7) = kind
|
||||
exists(string k | row.splitAt(";", 7) = k and getKind(k, kind, generated))
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if a sink model exists for the given parameters. */
|
||||
predicate sinkModel(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext,
|
||||
string input, string kind
|
||||
string input, string kind, boolean generated
|
||||
) {
|
||||
exists(string row |
|
||||
sinkModel(row) and
|
||||
@@ -158,22 +165,22 @@ predicate sinkModel(
|
||||
row.splitAt(";", 4) = signature and
|
||||
row.splitAt(";", 5) = ext and
|
||||
row.splitAt(";", 6) = input and
|
||||
row.splitAt(";", 7) = kind
|
||||
exists(string k | row.splitAt(";", 7) = k and getKind(k, kind, generated))
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if a summary model exists for the given parameters. */
|
||||
predicate summaryModel(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext,
|
||||
string input, string output, string kind
|
||||
string input, string output, string kind, boolean generated
|
||||
) {
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, _)
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, generated, _)
|
||||
}
|
||||
|
||||
/** Holds if a summary model `row` exists for the given parameters. */
|
||||
predicate summaryModel(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext,
|
||||
string input, string output, string kind, string row
|
||||
string input, string output, string kind, boolean generated, string row
|
||||
) {
|
||||
summaryModel(row) and
|
||||
row.splitAt(";", 0) = namespace and
|
||||
@@ -185,14 +192,14 @@ predicate summaryModel(
|
||||
row.splitAt(";", 5) = ext and
|
||||
row.splitAt(";", 6) = input and
|
||||
row.splitAt(";", 7) = output and
|
||||
row.splitAt(";", 8) = kind
|
||||
exists(string k | row.splitAt(";", 8) = k and getKind(k, kind, generated))
|
||||
}
|
||||
|
||||
/** Holds if `package` have CSV framework coverage. */
|
||||
private predicate packageHasCsvCoverage(string package) {
|
||||
sourceModel(package, _, _, _, _, _, _, _) or
|
||||
sinkModel(package, _, _, _, _, _, _, _) or
|
||||
summaryModel(package, _, _, _, _, _, _, _, _)
|
||||
sourceModel(package, _, _, _, _, _, _, _, _) or
|
||||
sinkModel(package, _, _, _, _, _, _, _, _) or
|
||||
summaryModel(package, _, _, _, _, _, _, _, _, _)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -234,25 +241,25 @@ predicate modelCoverage(string package, int pkgs, string kind, string part, int
|
||||
part = "source" and
|
||||
n =
|
||||
strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
|
||||
string ext, string output |
|
||||
string ext, string output, boolean generated |
|
||||
canonicalPackageHasASubpackage(package, subpkg) and
|
||||
sourceModel(subpkg, type, subtypes, name, signature, ext, output, kind)
|
||||
sourceModel(subpkg, type, subtypes, name, signature, ext, output, kind, generated)
|
||||
)
|
||||
or
|
||||
part = "sink" and
|
||||
n =
|
||||
strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
|
||||
string ext, string input |
|
||||
string ext, string input, boolean generated |
|
||||
canonicalPackageHasASubpackage(package, subpkg) and
|
||||
sinkModel(subpkg, type, subtypes, name, signature, ext, input, kind)
|
||||
sinkModel(subpkg, type, subtypes, name, signature, ext, input, kind, generated)
|
||||
)
|
||||
or
|
||||
part = "summary" and
|
||||
n =
|
||||
strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
|
||||
string ext, string input, string output |
|
||||
string ext, string input, string output, boolean generated |
|
||||
canonicalPackageHasASubpackage(package, subpkg) and
|
||||
summaryModel(subpkg, type, subtypes, name, signature, ext, input, output, kind)
|
||||
summaryModel(subpkg, type, subtypes, name, signature, ext, input, output, kind, generated)
|
||||
)
|
||||
)
|
||||
}
|
||||
@@ -261,9 +268,9 @@ predicate modelCoverage(string package, int pkgs, string kind, string part, int
|
||||
module CsvValidation {
|
||||
private string getInvalidModelInput() {
|
||||
exists(string pred, AccessPath input, string part |
|
||||
sinkModel(_, _, _, _, _, _, input, _) and pred = "sink"
|
||||
sinkModel(_, _, _, _, _, _, input, _, _) and pred = "sink"
|
||||
or
|
||||
summaryModel(_, _, _, _, _, _, input, _, _) and pred = "summary"
|
||||
summaryModel(_, _, _, _, _, _, input, _, _, _) and pred = "summary"
|
||||
|
|
||||
(
|
||||
invalidSpecComponent(input, part) and
|
||||
@@ -279,9 +286,9 @@ module CsvValidation {
|
||||
|
||||
private string getInvalidModelOutput() {
|
||||
exists(string pred, string output, string part |
|
||||
sourceModel(_, _, _, _, _, _, output, _) and pred = "source"
|
||||
sourceModel(_, _, _, _, _, _, output, _, _) and pred = "source"
|
||||
or
|
||||
summaryModel(_, _, _, _, _, _, _, output, _) and pred = "summary"
|
||||
summaryModel(_, _, _, _, _, _, _, output, _, _) and pred = "summary"
|
||||
|
|
||||
invalidSpecComponent(output, part) and
|
||||
not part = "" and
|
||||
@@ -291,8 +298,9 @@ module CsvValidation {
|
||||
}
|
||||
|
||||
private string getInvalidModelKind() {
|
||||
exists(string row, string kind | summaryModel(row) |
|
||||
kind = row.splitAt(";", 8) and
|
||||
exists(string row, string k, string kind | summaryModel(row) |
|
||||
k = row.splitAt(";", 8) and
|
||||
getKind(k, kind, _) and
|
||||
not kind = ["taint", "value"] and
|
||||
result = "Invalid kind \"" + kind + "\" in summary model."
|
||||
)
|
||||
@@ -334,11 +342,11 @@ module CsvValidation {
|
||||
|
||||
private string getInvalidModelSignature() {
|
||||
exists(string pred, string namespace, string type, string name, string signature, string ext |
|
||||
sourceModel(namespace, type, _, name, signature, ext, _, _) and pred = "source"
|
||||
sourceModel(namespace, type, _, name, signature, ext, _, _, _) and pred = "source"
|
||||
or
|
||||
sinkModel(namespace, type, _, name, signature, ext, _, _) and pred = "sink"
|
||||
sinkModel(namespace, type, _, name, signature, ext, _, _, _) and pred = "sink"
|
||||
or
|
||||
summaryModel(namespace, type, _, name, signature, ext, _, _, _) and pred = "summary"
|
||||
summaryModel(namespace, type, _, name, signature, ext, _, _, _, _) and pred = "summary"
|
||||
|
|
||||
not namespace.regexpMatch("[a-zA-Z0-9_\\./]*") and
|
||||
result = "Dubious namespace \"" + namespace + "\" in " + pred + " model."
|
||||
@@ -371,9 +379,9 @@ pragma[nomagic]
|
||||
private predicate elementSpec(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
||||
) {
|
||||
sourceModel(namespace, type, subtypes, name, signature, ext, _, _) or
|
||||
sinkModel(namespace, type, subtypes, name, signature, ext, _, _) or
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _)
|
||||
sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _) or
|
||||
sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _) or
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _)
|
||||
}
|
||||
|
||||
private string paramsStringPart(Function f, int i) {
|
||||
@@ -421,7 +429,9 @@ SourceOrSinkElement interpretElement(
|
||||
predicate hasExternalSpecification(Function f) {
|
||||
f = any(SummarizedCallable sc).asFunction()
|
||||
or
|
||||
exists(SourceOrSinkElement e | f = e.asEntity() | sourceElement(e, _, _) or sinkElement(e, _, _))
|
||||
exists(SourceOrSinkElement e | f = e.asEntity() |
|
||||
sourceElement(e, _, _, _) or sinkElement(e, _, _, _)
|
||||
)
|
||||
}
|
||||
|
||||
private predicate parseField(AccessPathToken c, DataFlow::FieldContent f) {
|
||||
|
||||
@@ -6,6 +6,15 @@
|
||||
* (which does not use the shared data flow libraries).
|
||||
*/
|
||||
|
||||
/**
|
||||
* Convenience-predicate for extracting two capture groups at once.
|
||||
*/
|
||||
bindingset[input, regexp]
|
||||
private predicate regexpCaptureTwo(string input, string regexp, string capture1, string capture2) {
|
||||
capture1 = input.regexpCapture(regexp, 1) and
|
||||
capture2 = input.regexpCapture(regexp, 2)
|
||||
}
|
||||
|
||||
/** Companion module to the `AccessPath` class. */
|
||||
module AccessPath {
|
||||
/** A string that should be parsed as an access path. */
|
||||
@@ -13,6 +22,93 @@ module AccessPath {
|
||||
bindingset[this]
|
||||
Range() { any() }
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses an integer constant `n` or interval `n1..n2` (inclusive) and gets the value
|
||||
* of the constant or any value contained in the interval.
|
||||
*/
|
||||
bindingset[arg]
|
||||
int parseInt(string arg) {
|
||||
result = arg.toInt()
|
||||
or
|
||||
// Match "n1..n2"
|
||||
exists(string lo, string hi |
|
||||
regexpCaptureTwo(arg, "(-?\\d+)\\.\\.(-?\\d+)", lo, hi) and
|
||||
result = [lo.toInt() .. hi.toInt()]
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses a lower-bounded interval `n..` and gets the lower bound.
|
||||
*/
|
||||
bindingset[arg]
|
||||
int parseLowerBound(string arg) { result = arg.regexpCapture("(-?\\d+)\\.\\.", 1).toInt() }
|
||||
|
||||
/**
|
||||
* Parses an integer constant or interval (bounded or unbounded) that explicitly
|
||||
* references the arity, such as `N-1` or `N-3..N-1`.
|
||||
*
|
||||
* Note that expressions of form `N-x` will never resolve to a negative index,
|
||||
* even if `N` is zero (it will have no result in that case).
|
||||
*/
|
||||
bindingset[arg, arity]
|
||||
private int parseIntWithExplicitArity(string arg, int arity) {
|
||||
result >= 0 and // do not allow N-1 to resolve to a negative index
|
||||
exists(string lo |
|
||||
// N-x
|
||||
lo = arg.regexpCapture("N-(\\d+)", 1) and
|
||||
result = arity - lo.toInt()
|
||||
or
|
||||
// N-x..
|
||||
lo = arg.regexpCapture("N-(\\d+)\\.\\.", 1) and
|
||||
result = [arity - lo.toInt(), arity - 1]
|
||||
)
|
||||
or
|
||||
exists(string lo, string hi |
|
||||
// x..N-y
|
||||
regexpCaptureTwo(arg, "(-?\\d+)\\.\\.N-(\\d+)", lo, hi) and
|
||||
result = [lo.toInt() .. arity - hi.toInt()]
|
||||
or
|
||||
// N-x..N-y
|
||||
regexpCaptureTwo(arg, "N-(\\d+)\\.\\.N-(\\d+)", lo, hi) and
|
||||
result = [arity - lo.toInt() .. arity - hi.toInt()] and
|
||||
result >= 0
|
||||
or
|
||||
// N-x..y
|
||||
regexpCaptureTwo(arg, "N-(\\d+)\\.\\.(\\d+)", lo, hi) and
|
||||
result = [arity - lo.toInt() .. hi.toInt()] and
|
||||
result >= 0
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses an integer constant or interval (bounded or unbounded) and gets any
|
||||
* of the integers contained within (of which there may be infinitely many).
|
||||
*
|
||||
* Has no result for arguments involving an explicit arity, such as `N-1`.
|
||||
*/
|
||||
bindingset[arg, result]
|
||||
int parseIntUnbounded(string arg) {
|
||||
result = parseInt(arg)
|
||||
or
|
||||
result >= parseLowerBound(arg)
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses an integer constant or interval (bounded or unbounded) that
|
||||
* may reference the arity of a call, such as `N-1` or `N-3..N-1`.
|
||||
*
|
||||
* Note that expressions of form `N-x` will never resolve to a negative index,
|
||||
* even if `N` is zero (it will have no result in that case).
|
||||
*/
|
||||
bindingset[arg, arity]
|
||||
int parseIntWithArity(string arg, int arity) {
|
||||
result = parseInt(arg)
|
||||
or
|
||||
result in [parseLowerBound(arg) .. arity - 1]
|
||||
or
|
||||
result = parseIntWithExplicitArity(arg, arity)
|
||||
}
|
||||
}
|
||||
|
||||
/** Gets the `n`th token on the access path as a string. */
|
||||
@@ -53,7 +149,7 @@ class AccessPath extends string instanceof AccessPath::Range {
|
||||
* An access part token such as `Argument[1]` or `ReturnValue`, appearing in one or more access paths.
|
||||
*/
|
||||
class AccessPathToken extends string {
|
||||
AccessPathToken() { this = getRawToken(any(AccessPath path), _) }
|
||||
AccessPathToken() { this = getRawToken(_, _) }
|
||||
|
||||
private string getPart(int part) {
|
||||
result = this.regexpCapture("([^\\[]+)(?:\\[([^\\]]*)\\])?", part)
|
||||
@@ -71,9 +167,16 @@ class AccessPathToken extends string {
|
||||
/** Gets the `n`th argument to this token, such as `x` or `y` from `Member[x,y]`. */
|
||||
string getArgument(int n) { result = this.getArgumentList().splitAt(",", n).trim() }
|
||||
|
||||
/** Gets the `n`th argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
|
||||
pragma[nomagic]
|
||||
string getArgument(string name, int n) { name = this.getName() and result = this.getArgument(n) }
|
||||
|
||||
/** Gets an argument to this token, such as `x` or `y` from `Member[x,y]`. */
|
||||
string getAnArgument() { result = this.getArgument(_) }
|
||||
|
||||
/** Gets an argument to this `name` token, such as `x` or `y` from `Member[x,y]`. */
|
||||
string getAnArgument(string name) { result = this.getArgument(name, _) }
|
||||
|
||||
/** Gets the number of arguments to this token, such as 2 for `Member[x,y]` or zero for `ReturnValue`. */
|
||||
int getNumArgument() { result = count(int n | exists(this.getArgument(n))) }
|
||||
}
|
||||
|
||||
@@ -108,3 +108,21 @@ predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable f) { non
|
||||
* restricted to those `call`s for which a context might make a difference.
|
||||
*/
|
||||
DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) { none() }
|
||||
|
||||
private int parameterPosition() {
|
||||
result = [-1 .. any(DataFlowCallable c).getType().getNumParameter()]
|
||||
}
|
||||
|
||||
/** A parameter position represented by an integer. */
|
||||
class ParameterPosition extends int {
|
||||
ParameterPosition() { this = parameterPosition() }
|
||||
}
|
||||
|
||||
/** An argument position represented by an integer. */
|
||||
class ArgumentPosition extends int {
|
||||
ArgumentPosition() { this = parameterPosition() }
|
||||
}
|
||||
|
||||
/** Holds if arguments at position `apos` match parameters at position `ppos`. */
|
||||
pragma[inline]
|
||||
predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -3,6 +3,17 @@ private import DataFlowImplSpecific::Public
|
||||
import Cached
|
||||
|
||||
module DataFlowImplCommonPublic {
|
||||
/** A state value to track during data flow. */
|
||||
class FlowState = string;
|
||||
|
||||
/**
|
||||
* The default state, which is used when the state is unspecified for a source
|
||||
* or a sink.
|
||||
*/
|
||||
class FlowStateEmpty extends FlowState {
|
||||
FlowStateEmpty() { this = "" }
|
||||
}
|
||||
|
||||
private newtype TFlowFeature =
|
||||
TFeatureHasSourceCallContext() or
|
||||
TFeatureHasSinkCallContext() or
|
||||
@@ -62,6 +73,18 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
|
||||
tupleLimit = 1000
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `arg` is an argument of `call` with an argument position that matches
|
||||
* parameter position `ppos`.
|
||||
*/
|
||||
pragma[noinline]
|
||||
predicate argumentPositionMatch(DataFlowCall call, ArgNode arg, ParameterPosition ppos) {
|
||||
exists(ArgumentPosition apos |
|
||||
arg.argumentOf(call, apos) and
|
||||
parameterMatch(ppos, apos)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Provides a simple data-flow analysis for resolving lambda calls. The analysis
|
||||
* currently excludes read-steps, store-steps, and flow-through.
|
||||
@@ -71,25 +94,27 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
|
||||
* calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
|
||||
*/
|
||||
private module LambdaFlow {
|
||||
private predicate viableParamNonLambda(DataFlowCall call, int i, ParamNode p) {
|
||||
p.isParameterOf(viableCallable(call), i)
|
||||
pragma[noinline]
|
||||
private predicate viableParamNonLambda(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
|
||||
p.isParameterOf(viableCallable(call), ppos)
|
||||
}
|
||||
|
||||
private predicate viableParamLambda(DataFlowCall call, int i, ParamNode p) {
|
||||
p.isParameterOf(viableCallableLambda(call, _), i)
|
||||
pragma[noinline]
|
||||
private predicate viableParamLambda(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
|
||||
p.isParameterOf(viableCallableLambda(call, _), ppos)
|
||||
}
|
||||
|
||||
private predicate viableParamArgNonLambda(DataFlowCall call, ParamNode p, ArgNode arg) {
|
||||
exists(int i |
|
||||
viableParamNonLambda(call, i, p) and
|
||||
arg.argumentOf(call, i)
|
||||
exists(ParameterPosition ppos |
|
||||
viableParamNonLambda(call, ppos, p) and
|
||||
argumentPositionMatch(call, arg, ppos)
|
||||
)
|
||||
}
|
||||
|
||||
private predicate viableParamArgLambda(DataFlowCall call, ParamNode p, ArgNode arg) {
|
||||
exists(int i |
|
||||
viableParamLambda(call, i, p) and
|
||||
arg.argumentOf(call, i)
|
||||
exists(ParameterPosition ppos |
|
||||
viableParamLambda(call, ppos, p) and
|
||||
argumentPositionMatch(call, arg, ppos)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -191,10 +216,9 @@ private module LambdaFlow {
|
||||
or
|
||||
// jump step
|
||||
exists(Node mid, DataFlowType t0 |
|
||||
revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
|
||||
revLambdaFlow(lambdaCall, kind, mid, t0, _, _, lastCall) and
|
||||
toReturn = false and
|
||||
toJump = true and
|
||||
lastCall = TDataFlowCallNone()
|
||||
toJump = true
|
||||
|
|
||||
jumpStepCached(node, mid) and
|
||||
t = t0
|
||||
@@ -301,7 +325,10 @@ private module Cached {
|
||||
predicate jumpStepCached(Node node1, Node node2) { jumpStep(node1, node2) }
|
||||
|
||||
cached
|
||||
predicate clearsContentCached(Node n, Content c) { clearsContent(n, c) }
|
||||
predicate clearsContentCached(Node n, ContentSet c) { clearsContent(n, c) }
|
||||
|
||||
cached
|
||||
predicate expectsContentCached(Node n, ContentSet c) { expectsContent(n, c) }
|
||||
|
||||
cached
|
||||
predicate isUnreachableInCallCached(Node n, DataFlowCall call) { isUnreachableInCall(n, call) }
|
||||
@@ -322,7 +349,7 @@ private module Cached {
|
||||
or
|
||||
exists(ArgNode arg |
|
||||
result.(PostUpdateNode).getPreUpdateNode() = arg and
|
||||
arg.argumentOf(call, k.(ParamUpdateReturnKind).getPosition())
|
||||
arg.argumentOf(call, k.(ParamUpdateReturnKind).getAMatchingArgumentPosition())
|
||||
)
|
||||
}
|
||||
|
||||
@@ -330,7 +357,7 @@ private module Cached {
|
||||
predicate returnNodeExt(Node n, ReturnKindExt k) {
|
||||
k = TValueReturn(n.(ReturnNode).getKind())
|
||||
or
|
||||
exists(ParamNode p, int pos |
|
||||
exists(ParamNode p, ParameterPosition pos |
|
||||
parameterValueFlowsToPreUpdate(p, n) and
|
||||
p.isParameterOf(_, pos) and
|
||||
k = TParamUpdate(pos)
|
||||
@@ -348,15 +375,17 @@ private module Cached {
|
||||
// For reads, `x.f`, we want to check that the tracked type after the read (which
|
||||
// is obtained by popping the head of the access path stack) is compatible with
|
||||
// the type of `x.f`.
|
||||
read(_, _, n)
|
||||
readSet(_, _, n)
|
||||
}
|
||||
|
||||
cached
|
||||
predicate parameterNode(Node p, DataFlowCallable c, int pos) { isParameterNode(p, c, pos) }
|
||||
predicate parameterNode(Node p, DataFlowCallable c, ParameterPosition pos) {
|
||||
isParameterNode(p, c, pos)
|
||||
}
|
||||
|
||||
cached
|
||||
predicate argumentNode(Node n, DataFlowCall call, int pos) {
|
||||
n.(ArgumentNode).argumentOf(call, pos)
|
||||
predicate argumentNode(Node n, DataFlowCall call, ArgumentPosition pos) {
|
||||
isArgumentNode(n, call, pos)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -374,12 +403,12 @@ private module Cached {
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
|
||||
* The instance parameter is considered to have index `-1`.
|
||||
* Holds if `p` is the parameter of a viable dispatch target of `call`,
|
||||
* and `p` has position `ppos`.
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private predicate viableParam(DataFlowCall call, int i, ParamNode p) {
|
||||
p.isParameterOf(viableCallableExt(call), i)
|
||||
private predicate viableParam(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
|
||||
p.isParameterOf(viableCallableExt(call), ppos)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -388,9 +417,9 @@ private module Cached {
|
||||
*/
|
||||
cached
|
||||
predicate viableParamArg(DataFlowCall call, ParamNode p, ArgNode arg) {
|
||||
exists(int i |
|
||||
viableParam(call, i, p) and
|
||||
arg.argumentOf(call, i) and
|
||||
exists(ParameterPosition ppos |
|
||||
viableParam(call, ppos, p) and
|
||||
argumentPositionMatch(call, arg, ppos) and
|
||||
compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p))
|
||||
)
|
||||
}
|
||||
@@ -442,7 +471,7 @@ private module Cached {
|
||||
// read
|
||||
exists(Node mid |
|
||||
parameterValueFlowCand(p, mid, false) and
|
||||
read(mid, _, node) and
|
||||
readSet(mid, _, node) and
|
||||
read = true
|
||||
)
|
||||
or
|
||||
@@ -630,8 +659,10 @@ private module Cached {
|
||||
* Holds if `arg` flows to `out` through a call using only
|
||||
* value-preserving steps and a single read step, not taking call
|
||||
* contexts into account, thus representing a getter-step.
|
||||
*
|
||||
* This predicate is exposed for testing only.
|
||||
*/
|
||||
predicate getterStep(ArgNode arg, Content c, Node out) {
|
||||
predicate getterStep(ArgNode arg, ContentSet c, Node out) {
|
||||
argumentValueFlowsThrough(arg, TReadStepTypesSome(_, c, _), out)
|
||||
}
|
||||
|
||||
@@ -754,8 +785,12 @@ private module Cached {
|
||||
parameterValueFlow(p, n.getPreUpdateNode(), TReadStepTypesNone())
|
||||
}
|
||||
|
||||
private predicate store(
|
||||
Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
|
||||
cached
|
||||
predicate readSet(Node node1, ContentSet c, Node node2) { readStep(node1, c, node2) }
|
||||
|
||||
cached
|
||||
predicate storeSet(
|
||||
Node node1, ContentSet c, Node node2, DataFlowType contentType, DataFlowType containerType
|
||||
) {
|
||||
storeStep(node1, c, node2) and
|
||||
contentType = getNodeDataFlowType(node1) and
|
||||
@@ -767,14 +802,19 @@ private module Cached {
|
||||
|
|
||||
argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, c, contentType), n1)
|
||||
or
|
||||
read(n2, c, n1) and
|
||||
readSet(n2, c, n1) and
|
||||
contentType = getNodeDataFlowType(n1) and
|
||||
containerType = getNodeDataFlowType(n2)
|
||||
)
|
||||
}
|
||||
|
||||
cached
|
||||
predicate read(Node node1, Content c, Node node2) { readStep(node1, c, node2) }
|
||||
private predicate store(
|
||||
Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
|
||||
) {
|
||||
exists(ContentSet cs |
|
||||
c = cs.getAStoreContent() and storeSet(node1, cs, node2, contentType, containerType)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if data can flow from `node1` to `node2` via a direct assignment to
|
||||
@@ -862,7 +902,7 @@ private module Cached {
|
||||
cached
|
||||
newtype TReturnKindExt =
|
||||
TValueReturn(ReturnKind kind) or
|
||||
TParamUpdate(int pos) { exists(ParamNode p | p.isParameterOf(_, pos)) }
|
||||
TParamUpdate(ParameterPosition pos) { exists(ParamNode p | p.isParameterOf(_, pos)) }
|
||||
|
||||
cached
|
||||
newtype TBooleanOption =
|
||||
@@ -905,16 +945,16 @@ class CastingNode extends Node {
|
||||
}
|
||||
|
||||
private predicate readStepWithTypes(
|
||||
Node n1, DataFlowType container, Content c, Node n2, DataFlowType content
|
||||
Node n1, DataFlowType container, ContentSet c, Node n2, DataFlowType content
|
||||
) {
|
||||
read(n1, c, n2) and
|
||||
readSet(n1, c, n2) and
|
||||
container = getNodeDataFlowType(n1) and
|
||||
content = getNodeDataFlowType(n2)
|
||||
}
|
||||
|
||||
private newtype TReadStepTypesOption =
|
||||
TReadStepTypesNone() or
|
||||
TReadStepTypesSome(DataFlowType container, Content c, DataFlowType content) {
|
||||
TReadStepTypesSome(DataFlowType container, ContentSet c, DataFlowType content) {
|
||||
readStepWithTypes(_, container, c, _, content)
|
||||
}
|
||||
|
||||
@@ -923,7 +963,7 @@ private class ReadStepTypesOption extends TReadStepTypesOption {
|
||||
|
||||
DataFlowType getContainerType() { this = TReadStepTypesSome(result, _, _) }
|
||||
|
||||
Content getContent() { this = TReadStepTypesSome(_, result, _) }
|
||||
ContentSet getContent() { this = TReadStepTypesSome(_, result, _) }
|
||||
|
||||
DataFlowType getContentType() { this = TReadStepTypesSome(_, _, result) }
|
||||
|
||||
@@ -1054,9 +1094,9 @@ class ParamNode extends Node {
|
||||
|
||||
/**
|
||||
* Holds if this node is the parameter of callable `c` at the specified
|
||||
* (zero-based) position.
|
||||
* position.
|
||||
*/
|
||||
predicate isParameterOf(DataFlowCallable c, int i) { parameterNode(this, c, i) }
|
||||
predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) { parameterNode(this, c, pos) }
|
||||
}
|
||||
|
||||
/** A data-flow node that represents a call argument. */
|
||||
@@ -1064,7 +1104,9 @@ class ArgNode extends Node {
|
||||
ArgNode() { argumentNode(this, _, _) }
|
||||
|
||||
/** Holds if this argument occurs at the given position in the given call. */
|
||||
final predicate argumentOf(DataFlowCall call, int pos) { argumentNode(this, call, pos) }
|
||||
final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
|
||||
argumentNode(this, call, pos)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -1110,11 +1152,14 @@ class ValueReturnKind extends ReturnKindExt, TValueReturn {
|
||||
}
|
||||
|
||||
class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
|
||||
private int pos;
|
||||
private ParameterPosition pos;
|
||||
|
||||
ParamUpdateReturnKind() { this = TParamUpdate(pos) }
|
||||
|
||||
int getPosition() { result = pos }
|
||||
ParameterPosition getPosition() { result = pos }
|
||||
|
||||
pragma[nomagic]
|
||||
ArgumentPosition getAMatchingArgumentPosition() { parameterMatch(pos, result) }
|
||||
|
||||
override string toString() { result = "param update " + pos }
|
||||
}
|
||||
@@ -1258,7 +1303,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
|
||||
}
|
||||
}
|
||||
|
||||
/** Content tagged with the type of a containing object. */
|
||||
/** A `Content` tagged with the type of a containing object. */
|
||||
class TypedContent extends MkTypedContent {
|
||||
private Content c;
|
||||
private DataFlowType t;
|
||||
@@ -1293,8 +1338,6 @@ abstract class AccessPathFront extends TAccessPathFront {
|
||||
abstract boolean toBoolNonEmpty();
|
||||
|
||||
TypedContent getHead() { this = TFrontHead(result) }
|
||||
|
||||
predicate isClearedAt(Node n) { clearsContentCached(n, this.getHead().getContent()) }
|
||||
}
|
||||
|
||||
class AccessPathFrontNil extends AccessPathFront, TFrontNil {
|
||||
|
||||
@@ -12,7 +12,7 @@ private newtype TNode =
|
||||
MkGlobalFunctionNode(Function f) or
|
||||
MkSummarizedParameterNode(DataFlowCallable c, int i) {
|
||||
not exists(c.getFuncDef()) and
|
||||
c instanceof SummarizedCallable and
|
||||
c.asCallable() instanceof SummarizedCallable and
|
||||
(
|
||||
i in [0 .. c.getType().getNumParameter() - 1]
|
||||
or
|
||||
@@ -25,6 +25,8 @@ private newtype TNode =
|
||||
|
||||
/** Nodes intended for only use inside the data-flow libraries. */
|
||||
module Private {
|
||||
private import DataFlowDispatch
|
||||
|
||||
/** Gets the callable in which this node occurs. */
|
||||
DataFlowCallable nodeGetEnclosingCallable(Node n) {
|
||||
result.asCallable() = n.getEnclosingCallable()
|
||||
@@ -33,10 +35,15 @@ module Private {
|
||||
}
|
||||
|
||||
/** Holds if `p` is a `ParameterNode` of `c` with position `pos`. */
|
||||
predicate isParameterNode(ParameterNode p, DataFlowCallable c, int pos) {
|
||||
predicate isParameterNode(ParameterNode p, DataFlowCallable c, ParameterPosition pos) {
|
||||
p.isParameterOf(c.asCallable(), pos)
|
||||
}
|
||||
|
||||
/** Holds if `arg` is an `ArgumentNode` of `c` with position `pos`. */
|
||||
predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos) {
|
||||
arg.argumentOf(c, pos)
|
||||
}
|
||||
|
||||
/** A data flow node that represents returning a value from a function. */
|
||||
class ReturnNode extends Node {
|
||||
ReturnKind kind;
|
||||
@@ -115,7 +122,7 @@ module Public {
|
||||
exists(DataFlowCallable dfc | result = dfc.asCallable() |
|
||||
this = MkSummarizedParameterNode(dfc, _)
|
||||
or
|
||||
this = MkSummaryInternalNode(dfc, _)
|
||||
this = MkSummaryInternalNode(dfc.asCallable(), _)
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -188,6 +188,14 @@ predicate clearsContent(Node n, Content c) {
|
||||
// FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the value that is being tracked is expected to be stored inside content `c`
|
||||
* at node `n`.
|
||||
*/
|
||||
predicate expectsContent(Node n, ContentSet c) {
|
||||
FlowSummaryImpl::Private::Steps::summaryExpectsContent(n, c)
|
||||
}
|
||||
|
||||
/** Gets the type of `n` used for type pruning. */
|
||||
DataFlowType getNodeType(Node n) {
|
||||
result = n.getType()
|
||||
|
||||
@@ -108,7 +108,7 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
or
|
||||
// Simple flow through library code is included in the exposed local
|
||||
// step relation, even though flow is technically inter-procedural
|
||||
FlowSummaryImpl::Private::Steps::summaryThroughStep(nodeFrom, nodeTo, true)
|
||||
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(nodeFrom, nodeTo, _)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -131,6 +131,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
* Holds if data flows from `source` to `sink` in zero or more local
|
||||
* (intra-procedural) steps.
|
||||
*/
|
||||
pragma[inline]
|
||||
predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
|
||||
|
||||
private newtype TContent =
|
||||
@@ -160,8 +161,10 @@ class Content extends TContent {
|
||||
* For more information, see
|
||||
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
|
||||
*/
|
||||
predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
|
||||
path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
|
||||
predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
|
||||
}
|
||||
}
|
||||
|
||||
@@ -230,6 +233,36 @@ class SyntheticFieldContent extends Content, TSyntheticFieldContent {
|
||||
override string toString() { result = s.toString() }
|
||||
}
|
||||
|
||||
/**
|
||||
* An entity that represents a set of `Content`s.
|
||||
*
|
||||
* The set may be interpreted differently depending on whether it is
|
||||
* stored into (`getAStoreContent`) or read from (`getAReadContent`).
|
||||
*/
|
||||
class ContentSet instanceof Content {
|
||||
/** Gets a content that may be stored into when storing into this set. */
|
||||
Content getAStoreContent() { result = this }
|
||||
|
||||
/** Gets a content that may be read from when reading from this set. */
|
||||
Content getAReadContent() { result = this }
|
||||
|
||||
/** Gets a textual representation of this content set. */
|
||||
string toString() { result = super.toString() }
|
||||
|
||||
/**
|
||||
* Holds if this element is at the specified location.
|
||||
* The location spans column `startcolumn` of line `startline` to
|
||||
* column `endcolumn` of line `endline` in file `filepath`.
|
||||
* For more information, see
|
||||
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
|
||||
*/
|
||||
predicate hasLocationInfo(
|
||||
string filepath, int startline, int startcolumn, int endline, int endcolumn
|
||||
) {
|
||||
super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
|
||||
*
|
||||
|
||||
@@ -24,7 +24,11 @@ module Public {
|
||||
class SummaryComponent extends TSummaryComponent {
|
||||
/** Gets a textual representation of this summary component. */
|
||||
string toString() {
|
||||
exists(Content c | this = TContentSummaryComponent(c) and result = c.toString())
|
||||
exists(ContentSet c | this = TContentSummaryComponent(c) and result = c.toString())
|
||||
or
|
||||
exists(ContentSet c | this = TWithoutContentSummaryComponent(c) and result = "without " + c)
|
||||
or
|
||||
exists(ContentSet c | this = TWithContentSummaryComponent(c) and result = "with " + c)
|
||||
or
|
||||
exists(ArgumentPosition pos |
|
||||
this = TParameterSummaryComponent(pos) and result = "parameter " + pos
|
||||
@@ -41,7 +45,13 @@ module Public {
|
||||
/** Provides predicates for constructing summary components. */
|
||||
module SummaryComponent {
|
||||
/** Gets a summary component for content `c`. */
|
||||
SummaryComponent content(Content c) { result = TContentSummaryComponent(c) }
|
||||
SummaryComponent content(ContentSet c) { result = TContentSummaryComponent(c) }
|
||||
|
||||
/** Gets a summary component where data is not allowed to be stored in `c`. */
|
||||
SummaryComponent withoutContent(ContentSet c) { result = TWithoutContentSummaryComponent(c) }
|
||||
|
||||
/** Gets a summary component where data must be stored in `c`. */
|
||||
SummaryComponent withContent(ContentSet c) { result = TWithContentSummaryComponent(c) }
|
||||
|
||||
/** Gets a summary component for a parameter at position `pos`. */
|
||||
SummaryComponent parameter(ArgumentPosition pos) { result = TParameterSummaryComponent(pos) }
|
||||
@@ -185,7 +195,10 @@ module Public {
|
||||
}
|
||||
|
||||
/** A callable with a flow summary. */
|
||||
abstract class SummarizedCallable extends DataFlowCallable {
|
||||
abstract class SummarizedCallable extends SummarizedCallableBase {
|
||||
bindingset[this]
|
||||
SummarizedCallable() { any() }
|
||||
|
||||
/**
|
||||
* Holds if data may flow from `input` to `output` through this callable.
|
||||
*
|
||||
@@ -216,9 +229,16 @@ module Public {
|
||||
/**
|
||||
* Holds if values stored inside `content` are cleared on objects passed as
|
||||
* arguments at position `pos` to this callable.
|
||||
*
|
||||
* TODO: Remove once all languages support `WithoutContent` tokens.
|
||||
*/
|
||||
pragma[nomagic]
|
||||
predicate clearsContent(ParameterPosition pos, Content content) { none() }
|
||||
predicate clearsContent(ParameterPosition pos, ContentSet content) { none() }
|
||||
|
||||
/**
|
||||
* Holds if the summary is auto generated.
|
||||
*/
|
||||
predicate isAutoGenerated() { none() }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -231,10 +251,12 @@ module Private {
|
||||
import AccessPathSyntax
|
||||
|
||||
newtype TSummaryComponent =
|
||||
TContentSummaryComponent(Content c) or
|
||||
TContentSummaryComponent(ContentSet c) or
|
||||
TParameterSummaryComponent(ArgumentPosition pos) or
|
||||
TArgumentSummaryComponent(ParameterPosition pos) or
|
||||
TReturnSummaryComponent(ReturnKind rk)
|
||||
TReturnSummaryComponent(ReturnKind rk) or
|
||||
TWithoutContentSummaryComponent(ContentSet c) or
|
||||
TWithContentSummaryComponent(ContentSet c)
|
||||
|
||||
private TParameterSummaryComponent thisParam() {
|
||||
result = TParameterSummaryComponent(instanceParameterPosition())
|
||||
@@ -296,6 +318,23 @@ module Private {
|
||||
SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
|
||||
preservesValue = preservesValue1.booleanAnd(preservesValue2)
|
||||
)
|
||||
or
|
||||
exists(ParameterPosition ppos, ContentSet cs |
|
||||
c.clearsContent(ppos, cs) and
|
||||
input = SummaryComponentStack::push(SummaryComponent::withoutContent(cs), output) and
|
||||
output = SummaryComponentStack::argument(ppos) and
|
||||
preservesValue = true
|
||||
)
|
||||
}
|
||||
|
||||
private class MkClearStack extends RequiredSummaryComponentStack {
|
||||
override predicate required(SummaryComponent head, SummaryComponentStack tail) {
|
||||
exists(SummarizedCallable sc, ParameterPosition ppos, ContentSet cs |
|
||||
sc.clearsContent(ppos, cs) and
|
||||
head = SummaryComponent::withoutContent(cs) and
|
||||
tail = SummaryComponentStack::argument(ppos)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -378,10 +417,7 @@ module Private {
|
||||
|
||||
private newtype TSummaryNodeState =
|
||||
TSummaryNodeInputState(SummaryComponentStack s) { inputState(_, s) } or
|
||||
TSummaryNodeOutputState(SummaryComponentStack s) { outputState(_, s) } or
|
||||
TSummaryNodeClearsContentState(ParameterPosition pos, boolean post) {
|
||||
any(SummarizedCallable sc).clearsContent(pos, _) and post in [false, true]
|
||||
}
|
||||
TSummaryNodeOutputState(SummaryComponentStack s) { outputState(_, s) }
|
||||
|
||||
/**
|
||||
* A state used to break up (complex) flow summaries into atomic flow steps.
|
||||
@@ -428,12 +464,6 @@ module Private {
|
||||
this = TSummaryNodeOutputState(s) and
|
||||
result = "to write: " + s
|
||||
)
|
||||
or
|
||||
exists(ParameterPosition pos, boolean post, string postStr |
|
||||
this = TSummaryNodeClearsContentState(pos, post) and
|
||||
(if post = true then postStr = " (post)" else postStr = "") and
|
||||
result = "clear: " + pos + postStr
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -457,11 +487,6 @@ module Private {
|
||||
not parameterReadState(c, state, _)
|
||||
or
|
||||
state.isOutputState(c, _)
|
||||
or
|
||||
exists(ParameterPosition pos |
|
||||
c.clearsContent(pos, _) and
|
||||
state = TSummaryNodeClearsContentState(pos, _)
|
||||
)
|
||||
}
|
||||
|
||||
pragma[noinline]
|
||||
@@ -471,7 +496,7 @@ module Private {
|
||||
or
|
||||
exists(ParameterPosition pos |
|
||||
parameterReadState(c, state, pos) and
|
||||
result.(ParamNode).isParameterOf(c, pos)
|
||||
result.(ParamNode).isParameterOf(inject(c), pos)
|
||||
)
|
||||
)
|
||||
}
|
||||
@@ -497,8 +522,6 @@ module Private {
|
||||
parameterReadState(c, _, pos)
|
||||
or
|
||||
isParameterPostUpdate(_, c, pos)
|
||||
or
|
||||
c.clearsContent(pos, _)
|
||||
}
|
||||
|
||||
private predicate callbackOutput(
|
||||
@@ -506,7 +529,7 @@ module Private {
|
||||
) {
|
||||
any(SummaryNodeState state).isInputState(c, s) and
|
||||
s.head() = TReturnSummaryComponent(rk) and
|
||||
receiver = summaryNodeInputState(c, s.drop(1))
|
||||
receiver = summaryNodeInputState(c, s.tail())
|
||||
}
|
||||
|
||||
private predicate callbackInput(
|
||||
@@ -514,7 +537,7 @@ module Private {
|
||||
) {
|
||||
any(SummaryNodeState state).isOutputState(c, s) and
|
||||
s.head() = TParameterSummaryComponent(pos) and
|
||||
receiver = summaryNodeInputState(c, s.drop(1))
|
||||
receiver = summaryNodeInputState(c, s.tail())
|
||||
}
|
||||
|
||||
/** Holds if a call targeting `receiver` should be synthesized inside `c`. */
|
||||
@@ -540,21 +563,27 @@ module Private {
|
||||
exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
|
||||
n = summaryNodeInputState(c, s) and
|
||||
(
|
||||
exists(Content cont |
|
||||
head = TContentSummaryComponent(cont) and result = getContentType(cont)
|
||||
exists(ContentSet cont | result = getContentType(cont) |
|
||||
head = TContentSummaryComponent(cont) or
|
||||
head = TWithContentSummaryComponent(cont)
|
||||
)
|
||||
or
|
||||
exists(ContentSet cont |
|
||||
head = TWithoutContentSummaryComponent(cont) and
|
||||
result = getNodeType(summaryNodeInputState(c, s.tail()))
|
||||
)
|
||||
or
|
||||
exists(ReturnKind rk |
|
||||
head = TReturnSummaryComponent(rk) and
|
||||
result =
|
||||
getCallbackReturnType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
|
||||
s.drop(1))), rk)
|
||||
s.tail())), rk)
|
||||
)
|
||||
)
|
||||
or
|
||||
n = summaryNodeOutputState(c, s) and
|
||||
(
|
||||
exists(Content cont |
|
||||
exists(ContentSet cont |
|
||||
head = TContentSummaryComponent(cont) and result = getContentType(cont)
|
||||
)
|
||||
or
|
||||
@@ -567,16 +596,10 @@ module Private {
|
||||
exists(ArgumentPosition pos | head = TParameterSummaryComponent(pos) |
|
||||
result =
|
||||
getCallbackParameterType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
|
||||
s.drop(1))), pos)
|
||||
s.tail())), pos)
|
||||
)
|
||||
)
|
||||
)
|
||||
or
|
||||
exists(SummarizedCallable c, ParameterPosition pos, ParamNode p |
|
||||
n = summaryNode(c, TSummaryNodeClearsContentState(pos, false)) and
|
||||
p.isParameterOf(c, pos) and
|
||||
result = getNodeType(p)
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if summary node `out` contains output of kind `rk` from call `c`. */
|
||||
@@ -601,10 +624,7 @@ module Private {
|
||||
predicate summaryPostUpdateNode(Node post, Node pre) {
|
||||
exists(SummarizedCallable c, ParameterPosition pos |
|
||||
isParameterPostUpdate(post, c, pos) and
|
||||
pre.(ParamNode).isParameterOf(c, pos)
|
||||
or
|
||||
pre = summaryNode(c, TSummaryNodeClearsContentState(pos, false)) and
|
||||
post = summaryNode(c, TSummaryNodeClearsContentState(pos, true))
|
||||
pre.(ParamNode).isParameterOf(inject(c), pos)
|
||||
)
|
||||
or
|
||||
exists(SummarizedCallable callable, SummaryComponentStack s |
|
||||
@@ -627,9 +647,7 @@ module Private {
|
||||
* node, and back out to `p`.
|
||||
*/
|
||||
predicate summaryAllowParameterReturnInSelf(ParamNode p) {
|
||||
exists(SummarizedCallable c, ParameterPosition ppos | p.isParameterOf(c, ppos) |
|
||||
c.clearsContent(ppos, _)
|
||||
or
|
||||
exists(SummarizedCallable c, ParameterPosition ppos | p.isParameterOf(inject(c), ppos) |
|
||||
exists(SummaryComponentStack inputContents, SummaryComponentStack outputContents |
|
||||
summary(c, inputContents, outputContents, _) and
|
||||
inputContents.bottom() = pragma[only_bind_into](TArgumentSummaryComponent(ppos)) and
|
||||
@@ -658,9 +676,10 @@ module Private {
|
||||
preservesValue = false and not summary(c, inputContents, outputContents, true)
|
||||
)
|
||||
or
|
||||
exists(SummarizedCallable c, ParameterPosition pos |
|
||||
pred.(ParamNode).isParameterOf(c, pos) and
|
||||
succ = summaryNode(c, TSummaryNodeClearsContentState(pos, _)) and
|
||||
exists(SummarizedCallable c, SummaryComponentStack s |
|
||||
pred = summaryNodeInputState(c, s.tail()) and
|
||||
succ = summaryNodeInputState(c, s) and
|
||||
s.head() = [SummaryComponent::withContent(_), SummaryComponent::withoutContent(_)] and
|
||||
preservesValue = true
|
||||
)
|
||||
}
|
||||
@@ -669,9 +688,9 @@ module Private {
|
||||
* Holds if there is a read step of content `c` from `pred` to `succ`, which
|
||||
* is synthesized from a flow summary.
|
||||
*/
|
||||
predicate summaryReadStep(Node pred, Content c, Node succ) {
|
||||
predicate summaryReadStep(Node pred, ContentSet c, Node succ) {
|
||||
exists(SummarizedCallable sc, SummaryComponentStack s |
|
||||
pred = summaryNodeInputState(sc, s.drop(1)) and
|
||||
pred = summaryNodeInputState(sc, s.tail()) and
|
||||
succ = summaryNodeInputState(sc, s) and
|
||||
SummaryComponent::content(c) = s.head()
|
||||
)
|
||||
@@ -681,10 +700,10 @@ module Private {
|
||||
* Holds if there is a store step of content `c` from `pred` to `succ`, which
|
||||
* is synthesized from a flow summary.
|
||||
*/
|
||||
predicate summaryStoreStep(Node pred, Content c, Node succ) {
|
||||
predicate summaryStoreStep(Node pred, ContentSet c, Node succ) {
|
||||
exists(SummarizedCallable sc, SummaryComponentStack s |
|
||||
pred = summaryNodeOutputState(sc, s) and
|
||||
succ = summaryNodeOutputState(sc, s.drop(1)) and
|
||||
succ = summaryNodeOutputState(sc, s.tail()) and
|
||||
SummaryComponent::content(c) = s.head()
|
||||
)
|
||||
}
|
||||
@@ -708,10 +727,23 @@ module Private {
|
||||
* `a` on line 2 to the post-update node for `a` on that line (via an intermediate
|
||||
* node where field `b` is cleared).
|
||||
*/
|
||||
predicate summaryClearsContent(Node n, Content c) {
|
||||
exists(SummarizedCallable sc, ParameterPosition pos |
|
||||
n = summaryNode(sc, TSummaryNodeClearsContentState(pos, true)) and
|
||||
sc.clearsContent(pos, c)
|
||||
predicate summaryClearsContent(Node n, ContentSet c) {
|
||||
exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
|
||||
n = summaryNode(sc, state) and
|
||||
state.isInputState(sc, stack) and
|
||||
stack.head() = SummaryComponent::withoutContent(c)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the value that is being tracked is expected to be stored inside
|
||||
* content `c` at `n`.
|
||||
*/
|
||||
predicate summaryExpectsContent(Node n, ContentSet c) {
|
||||
exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
|
||||
n = summaryNode(sc, state) and
|
||||
state.isInputState(sc, stack) and
|
||||
stack.head() = SummaryComponent::withContent(c)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -719,55 +751,79 @@ module Private {
|
||||
private predicate viableParam(
|
||||
DataFlowCall call, SummarizedCallable sc, ParameterPosition ppos, ParamNode p
|
||||
) {
|
||||
p.isParameterOf(sc, ppos) and
|
||||
sc = viableCallable(call)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if values stored inside content `c` are cleared inside a
|
||||
* callable to which `arg` is an argument.
|
||||
*
|
||||
* In such cases, it is important to prevent use-use flow out of
|
||||
* `arg` (see comment for `summaryClearsContent`).
|
||||
*/
|
||||
predicate summaryClearsContentArg(ArgNode arg, Content c) {
|
||||
exists(DataFlowCall call, SummarizedCallable sc, ParameterPosition ppos |
|
||||
argumentPositionMatch(call, arg, ppos) and
|
||||
viableParam(call, sc, ppos, _) and
|
||||
sc.clearsContent(ppos, c)
|
||||
exists(DataFlowCallable c |
|
||||
c = inject(sc) and
|
||||
p.isParameterOf(c, ppos) and
|
||||
c = viableCallable(call)
|
||||
)
|
||||
}
|
||||
|
||||
pragma[nomagic]
|
||||
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg) {
|
||||
exists(ParameterPosition ppos, SummarizedCallable sc |
|
||||
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
|
||||
exists(ParameterPosition ppos |
|
||||
argumentPositionMatch(call, arg, ppos) and
|
||||
viableParam(call, sc, ppos, result)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if use-use flow starting from `arg` should be prohibited.
|
||||
*
|
||||
* This is the case when `arg` is the argument of a call that targets a
|
||||
* flow summary where the corresponding parameter either clears contents
|
||||
* or expects contents.
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private ParamNode summaryArgParam(ArgNode arg, ReturnKindExt rk, OutNodeExt out) {
|
||||
exists(DataFlowCall call |
|
||||
result = summaryArgParam0(call, arg) and
|
||||
out = rk.getAnOutNode(call)
|
||||
predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
|
||||
exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
|
||||
p = summaryArgParam0(_, arg, sc) and
|
||||
p.isParameterOf(_, pragma[only_bind_into](ppos)) and
|
||||
summaryLocalStep(p, mid, true) and
|
||||
summaryLocalStep(mid, ret, true) and
|
||||
isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
|
||||
|
|
||||
summaryClearsContent(mid, _) or
|
||||
summaryExpectsContent(mid, _)
|
||||
)
|
||||
}
|
||||
|
||||
bindingset[ret]
|
||||
private ParamNode summaryArgParam(
|
||||
ArgNode arg, ReturnNodeExt ret, OutNodeExt out, SummarizedCallable sc
|
||||
) {
|
||||
exists(DataFlowCall call, ReturnKindExt rk |
|
||||
result = summaryArgParam0(call, arg, sc) and
|
||||
ret.getKind() = pragma[only_bind_into](rk) and
|
||||
out = pragma[only_bind_into](rk).getAnOutNode(call)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `arg` flows to `out` using a simple flow summary, that is, a flow
|
||||
* summary without reads and stores.
|
||||
* Holds if `arg` flows to `out` using a simple value-preserving flow
|
||||
* summary, that is, a flow summary without reads and stores.
|
||||
*
|
||||
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
|
||||
* be useful to include in the exposed local data-flow/taint-tracking relations.
|
||||
*/
|
||||
predicate summaryThroughStep(ArgNode arg, Node out, boolean preservesValue) {
|
||||
exists(ReturnKindExt rk, ReturnNodeExt ret |
|
||||
summaryLocalStep(summaryArgParam(arg, rk, out), ret, preservesValue) and
|
||||
ret.getKind() = rk
|
||||
predicate summaryThroughStepValue(ArgNode arg, Node out, SummarizedCallable sc) {
|
||||
exists(ReturnKind rk, ReturnNode ret, DataFlowCall call |
|
||||
summaryLocalStep(summaryArgParam0(call, arg, sc), ret, true) and
|
||||
ret.getKind() = pragma[only_bind_into](rk) and
|
||||
out = getAnOutNode(call, pragma[only_bind_into](rk))
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `arg` flows to `out` using a simple flow summary involving taint
|
||||
* step, that is, a flow summary without reads and stores.
|
||||
*
|
||||
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
|
||||
* be useful to include in the exposed local data-flow/taint-tracking relations.
|
||||
*/
|
||||
predicate summaryThroughStepTaint(ArgNode arg, Node out, SummarizedCallable sc) {
|
||||
exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out, sc), ret, false))
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if there is a read(+taint) of `c` from `arg` to `out` using a
|
||||
* flow summary.
|
||||
@@ -775,11 +831,10 @@ module Private {
|
||||
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
|
||||
* be useful to include in the exposed local data-flow/taint-tracking relations.
|
||||
*/
|
||||
predicate summaryGetterStep(ArgNode arg, Content c, Node out) {
|
||||
exists(ReturnKindExt rk, Node mid, ReturnNodeExt ret |
|
||||
summaryReadStep(summaryArgParam(arg, rk, out), c, mid) and
|
||||
summaryLocalStep(mid, ret, _) and
|
||||
ret.getKind() = rk
|
||||
predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
|
||||
exists(Node mid, ReturnNodeExt ret |
|
||||
summaryReadStep(summaryArgParam(arg, ret, out, sc), c, mid) and
|
||||
summaryLocalStep(mid, ret, _)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -790,11 +845,10 @@ module Private {
|
||||
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
|
||||
* be useful to include in the exposed local data-flow/taint-tracking relations.
|
||||
*/
|
||||
predicate summarySetterStep(ArgNode arg, Content c, Node out) {
|
||||
exists(ReturnKindExt rk, Node mid, ReturnNodeExt ret |
|
||||
summaryLocalStep(summaryArgParam(arg, rk, out), mid, _) and
|
||||
summaryStoreStep(mid, c, ret) and
|
||||
ret.getKind() = rk
|
||||
predicate summarySetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
|
||||
exists(Node mid, ReturnNodeExt ret |
|
||||
summaryLocalStep(summaryArgParam(arg, ret, out, sc), mid, _) and
|
||||
summaryStoreStep(mid, c, ret)
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -806,10 +860,10 @@ module Private {
|
||||
module External {
|
||||
/** Holds if `spec` is a relevant external specification. */
|
||||
private predicate relevantSpec(string spec) {
|
||||
summaryElement(_, spec, _, _) or
|
||||
summaryElement(_, _, spec, _) or
|
||||
sourceElement(_, spec, _) or
|
||||
sinkElement(_, spec, _)
|
||||
summaryElement(_, spec, _, _, _) or
|
||||
summaryElement(_, _, spec, _, _) or
|
||||
sourceElement(_, spec, _, _) or
|
||||
sinkElement(_, spec, _, _)
|
||||
}
|
||||
|
||||
private class AccessPathRange extends AccessPath::Range {
|
||||
@@ -875,13 +929,27 @@ module Private {
|
||||
}
|
||||
|
||||
private class SummarizedCallableExternal extends SummarizedCallable {
|
||||
SummarizedCallableExternal() { summaryElement(this, _, _, _) }
|
||||
SummarizedCallableExternal() { summaryElement(this, _, _, _, _) }
|
||||
|
||||
private predicate relevantSummaryElementGenerated(
|
||||
AccessPath inSpec, AccessPath outSpec, string kind
|
||||
) {
|
||||
summaryElement(this, inSpec, outSpec, kind, true) and
|
||||
not summaryElement(this, _, _, _, false) and
|
||||
not this.clearsContent(_, _)
|
||||
}
|
||||
|
||||
private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
|
||||
summaryElement(this, inSpec, outSpec, kind, false)
|
||||
or
|
||||
this.relevantSummaryElementGenerated(inSpec, outSpec, kind)
|
||||
}
|
||||
|
||||
override predicate propagatesFlow(
|
||||
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
|
||||
) {
|
||||
exists(AccessPath inSpec, AccessPath outSpec, string kind |
|
||||
summaryElement(this, inSpec, outSpec, kind) and
|
||||
this.relevantSummaryElement(inSpec, outSpec, kind) and
|
||||
interpretSpec(inSpec, input) and
|
||||
interpretSpec(outSpec, output)
|
||||
|
|
||||
@@ -890,6 +958,8 @@ module Private {
|
||||
kind = "taint" and preservesValue = false
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isAutoGenerated() { this.relevantSummaryElementGenerated(_, _, _) }
|
||||
}
|
||||
|
||||
/** Holds if component `c` of specification `spec` cannot be parsed. */
|
||||
@@ -910,7 +980,7 @@ module Private {
|
||||
|
||||
private predicate sourceElementRef(InterpretNode ref, AccessPath output, string kind) {
|
||||
exists(SourceOrSinkElement e |
|
||||
sourceElement(e, output, kind) and
|
||||
sourceElement(e, output, kind, _) and
|
||||
if outputNeedsReference(output.getToken(0))
|
||||
then e = ref.getCallTarget()
|
||||
else e = ref.asElement()
|
||||
@@ -919,7 +989,7 @@ module Private {
|
||||
|
||||
private predicate sinkElementRef(InterpretNode ref, AccessPath input, string kind) {
|
||||
exists(SourceOrSinkElement e |
|
||||
sinkElement(e, input, kind) and
|
||||
sinkElement(e, input, kind, _) and
|
||||
if inputNeedsReference(input.getToken(0))
|
||||
then e = ref.getCallTarget()
|
||||
else e = ref.asElement()
|
||||
@@ -1025,7 +1095,7 @@ module Private {
|
||||
/** Provides a query predicate for outputting a set of relevant flow summaries. */
|
||||
module TestOutput {
|
||||
/** A flow summary to include in the `summary/3` query predicate. */
|
||||
abstract class RelevantSummarizedCallable extends SummarizedCallable {
|
||||
abstract class RelevantSummarizedCallable instanceof SummarizedCallable {
|
||||
/** Gets the string representation of this callable used by `summary/1`. */
|
||||
abstract string getCallableCsv();
|
||||
|
||||
@@ -1033,8 +1103,10 @@ module Private {
|
||||
predicate relevantSummary(
|
||||
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
|
||||
) {
|
||||
this.propagatesFlow(input, output, preservesValue)
|
||||
super.propagatesFlow(input, output, preservesValue)
|
||||
}
|
||||
|
||||
string toString() { result = super.toString() }
|
||||
}
|
||||
|
||||
/** Render the kind in the format used in flow summaries. */
|
||||
@@ -1044,9 +1116,13 @@ module Private {
|
||||
preservesValue = false and result = "taint"
|
||||
}
|
||||
|
||||
private string renderProvenance(RelevantSummarizedCallable c) {
|
||||
if c.(SummarizedCallable).isAutoGenerated() then result = "generated" else result = "manual"
|
||||
}
|
||||
|
||||
/**
|
||||
* A query predicate for outputting flow summaries in semi-colon separated format in QL tests.
|
||||
* The syntax is: "namespace;type;overrides;name;signature;ext;inputspec;outputspec;kind",
|
||||
* The syntax is: "namespace;type;overrides;name;signature;ext;inputspec;outputspec;kind;provenance"",
|
||||
* ext is hardcoded to empty.
|
||||
*/
|
||||
query predicate summary(string csv) {
|
||||
@@ -1056,8 +1132,8 @@ module Private {
|
||||
|
|
||||
c.relevantSummary(input, output, preservesValue) and
|
||||
csv =
|
||||
c.getCallableCsv() + ";;" + getComponentStackCsv(input) + ";" +
|
||||
getComponentStackCsv(output) + ";" + renderKind(preservesValue)
|
||||
c.getCallableCsv() + getComponentStackCsv(input) + ";" + getComponentStackCsv(output) +
|
||||
";" + renderKind(preservesValue) + ";" + renderProvenance(c)
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -1071,19 +1147,21 @@ module Private {
|
||||
*/
|
||||
module RenderSummarizedCallable {
|
||||
/** A summarized callable to include in the graph. */
|
||||
abstract class RelevantSummarizedCallable extends SummarizedCallable { }
|
||||
abstract class RelevantSummarizedCallable instanceof SummarizedCallable {
|
||||
string toString() { result = super.toString() }
|
||||
}
|
||||
|
||||
private newtype TNodeOrCall =
|
||||
MkNode(Node n) {
|
||||
exists(RelevantSummarizedCallable c |
|
||||
n = summaryNode(c, _)
|
||||
or
|
||||
n.(ParamNode).isParameterOf(c, _)
|
||||
n.(ParamNode).isParameterOf(inject(c), _)
|
||||
)
|
||||
} or
|
||||
MkCall(DataFlowCall call) {
|
||||
call = summaryDataFlowCall(_) and
|
||||
call.getEnclosingCallable() instanceof RelevantSummarizedCallable
|
||||
call.getEnclosingCallable() = inject(any(RelevantSummarizedCallable c))
|
||||
}
|
||||
|
||||
private class NodeOrCall extends TNodeOrCall {
|
||||
@@ -1123,7 +1201,7 @@ module Private {
|
||||
if preservesValue = true then value = "value" else value = "taint"
|
||||
)
|
||||
or
|
||||
exists(Content c |
|
||||
exists(ContentSet c |
|
||||
Private::Steps::summaryReadStep(a.asNode(), c, b.asNode()) and
|
||||
value = "read (" + c + ")"
|
||||
or
|
||||
@@ -1133,6 +1211,10 @@ module Private {
|
||||
Private::Steps::summaryClearsContent(a.asNode(), c) and
|
||||
b = a and
|
||||
value = "clear (" + c + ")"
|
||||
or
|
||||
Private::Steps::summaryExpectsContent(a.asNode(), c) and
|
||||
b = a and
|
||||
value = "expect (" + c + ")"
|
||||
)
|
||||
or
|
||||
summaryPostUpdateNode(b.asNode(), a.asNode()) and
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
*/
|
||||
|
||||
private import go
|
||||
private import DataFlowDispatch
|
||||
private import DataFlowPrivate
|
||||
private import DataFlowUtil
|
||||
private import FlowSummaryImpl::Private
|
||||
@@ -14,39 +15,12 @@ private module FlowSummaries {
|
||||
private import semmle.go.dataflow.FlowSummary as F
|
||||
}
|
||||
|
||||
/** Holds if `i` is a valid parameter position. */
|
||||
predicate parameterPosition(int i) {
|
||||
i = [-1 .. any(DataFlowCallable c).getType().getNumParameter()]
|
||||
}
|
||||
class SummarizedCallableBase = Callable;
|
||||
|
||||
DataFlowCallable inject(SummarizedCallable c) { result.asCallable() = c }
|
||||
|
||||
/** Gets the parameter position of the instance parameter. */
|
||||
int instanceParameterPosition() { result = -1 }
|
||||
|
||||
/** A parameter position represented by an integer. */
|
||||
class ParameterPosition extends int {
|
||||
ParameterPosition() { parameterPosition(this) }
|
||||
}
|
||||
|
||||
/** An argument position represented by an integer. */
|
||||
class ArgumentPosition extends int {
|
||||
ArgumentPosition() { parameterPosition(this) }
|
||||
}
|
||||
|
||||
/** Holds if arguments at position `apos` match parameters at position `ppos`. */
|
||||
pragma[inline]
|
||||
predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
|
||||
|
||||
/**
|
||||
* Holds if `arg` is an argument of `call` with an argument position that matches
|
||||
* parameter position `ppos`.
|
||||
*/
|
||||
pragma[noinline]
|
||||
predicate argumentPositionMatch(DataFlowCall call, ArgNode arg, ParameterPosition ppos) {
|
||||
exists(ArgumentPosition apos |
|
||||
arg.argumentOf(call, apos) and
|
||||
parameterMatch(ppos, apos)
|
||||
)
|
||||
}
|
||||
ArgumentPosition instanceParameterPosition() { result = -1 }
|
||||
|
||||
/** Gets the textual representation of a parameter position in the format used for flow summaries. */
|
||||
string getParameterPositionCsv(ParameterPosition pos) { result = pos.toString() }
|
||||
@@ -84,13 +58,16 @@ DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { none() }
|
||||
|
||||
/**
|
||||
* Holds if an external flow summary exists for `c` with input specification
|
||||
* `input`, output specification `output`, and kind `kind`.
|
||||
* `input`, output specification `output`, kind `kind`, and a flag `generated`
|
||||
* stating whether the summary is autogenerated.
|
||||
*/
|
||||
predicate summaryElement(DataFlowCallable c, string input, string output, string kind) {
|
||||
predicate summaryElement(
|
||||
SummarizedCallableBase c, string input, string output, string kind, boolean generated
|
||||
) {
|
||||
exists(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
||||
|
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind) and
|
||||
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, generated) and
|
||||
c.asFunction() = interpretElement(namespace, type, subtypes, name, signature, ext).asEntity()
|
||||
)
|
||||
}
|
||||
@@ -166,26 +143,28 @@ class SourceOrSinkElement extends TSourceOrSinkElement {
|
||||
|
||||
/**
|
||||
* Holds if an external source specification exists for `e` with output specification
|
||||
* `output` and kind `kind`.
|
||||
* `output`, kind `kind`, and a flag `generated` stating whether the source specification is
|
||||
* autogenerated.
|
||||
*/
|
||||
predicate sourceElement(SourceOrSinkElement e, string output, string kind) {
|
||||
predicate sourceElement(SourceOrSinkElement e, string output, string kind, boolean generated) {
|
||||
exists(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
||||
|
|
||||
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind) and
|
||||
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, generated) and
|
||||
e = interpretElement(namespace, type, subtypes, name, signature, ext)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if an external sink specification exists for `e` with input specification
|
||||
* `input` and kind `kind`.
|
||||
* `input`, kind `kind` and a flag `generated` stating whether the sink specification is
|
||||
* autogenerated.
|
||||
*/
|
||||
predicate sinkElement(SourceOrSinkElement e, string input, string kind) {
|
||||
predicate sinkElement(SourceOrSinkElement e, string input, string kind, boolean generated) {
|
||||
exists(
|
||||
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
||||
|
|
||||
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind) and
|
||||
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, generated) and
|
||||
e = interpretElement(namespace, type, subtypes, name, signature, ext)
|
||||
)
|
||||
}
|
||||
@@ -271,7 +250,10 @@ predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode n) {
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if specification component `c` parses as return value `n`. */
|
||||
/**
|
||||
* Holds if specification component `c` parses as return value `n` or a range
|
||||
* containing `n`.
|
||||
*/
|
||||
predicate parseReturn(AccessPathToken c, int n) {
|
||||
(
|
||||
c = "ReturnValue" and n = 0
|
||||
@@ -292,8 +274,10 @@ private int parseConstantOrRange(string arg) {
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
|
||||
bindingset[arg]
|
||||
ArgumentPosition parseParamBody(string arg) { result = parseConstantOrRange(arg) }
|
||||
|
||||
/** Gets the parameter position obtained by parsing `X` in `Argument[X]`. */
|
||||
bindingset[arg]
|
||||
ParameterPosition parseArgBody(string arg) { result = parseConstantOrRange(arg) }
|
||||
|
||||
@@ -9,12 +9,14 @@ private import FlowSummaryImpl as FlowSummaryImpl
|
||||
* Holds if taint can flow from `src` to `sink` in zero or more
|
||||
* local (intra-procedural) steps.
|
||||
*/
|
||||
pragma[inline]
|
||||
predicate localTaint(DataFlow::Node src, DataFlow::Node sink) { localTaintStep*(src, sink) }
|
||||
|
||||
/**
|
||||
* Holds if taint can flow from `src` to `sink` in zero or more
|
||||
* local (intra-procedural) steps.
|
||||
*/
|
||||
pragma[inline]
|
||||
predicate localExprTaint(Expr src, Expr sink) {
|
||||
localTaint(DataFlow::exprNode(src), DataFlow::exprNode(sink))
|
||||
}
|
||||
@@ -27,7 +29,7 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
|
||||
localAdditionalTaintStep(src, sink) or
|
||||
// Simple flow through library code is included in the exposed local
|
||||
// step relation, even though flow is technically inter-procedural
|
||||
FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
|
||||
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(src, sink, _)
|
||||
}
|
||||
|
||||
private Type getElementType(Type containerType) {
|
||||
|
||||
@@ -61,15 +61,32 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
abstract override predicate isSource(DataFlow::Node source);
|
||||
override predicate isSource(DataFlow::Node source) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink.
|
||||
* Holds if `source` is a relevant taint source with the given initial
|
||||
* `state`.
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
abstract override predicate isSink(DataFlow::Node sink);
|
||||
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
override predicate isSink(DataFlow::Node sink) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink accepting `state`.
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
|
||||
|
||||
/** Holds if the node `node` is a taint sanitizer. */
|
||||
predicate isSanitizer(DataFlow::Node node) { none() }
|
||||
@@ -79,6 +96,16 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
defaultTaintSanitizer(node)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the node `node` is a taint sanitizer when the flow state is
|
||||
* `state`.
|
||||
*/
|
||||
predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
|
||||
|
||||
final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
|
||||
this.isSanitizer(node, state)
|
||||
}
|
||||
|
||||
/** Holds if taint propagation into `node` is prohibited. */
|
||||
predicate isSanitizerIn(DataFlow::Node node) { none() }
|
||||
|
||||
@@ -101,8 +128,23 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the additional taint propagation step from `node1` to `node2`
|
||||
* must be taken into account in the analysis.
|
||||
* DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
|
||||
*
|
||||
* Holds if taint propagation through nodes guarded by `guard` is prohibited
|
||||
* when the flow state is `state`.
|
||||
*/
|
||||
deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard, DataFlow::FlowState state) {
|
||||
none()
|
||||
}
|
||||
|
||||
deprecated final override predicate isBarrierGuard(
|
||||
DataFlow::BarrierGuard guard, DataFlow::FlowState state
|
||||
) {
|
||||
this.isSanitizerGuard(guard, state)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
|
||||
*/
|
||||
predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
|
||||
|
||||
@@ -111,7 +153,25 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
defaultAdditionalTaintStep(node1, node2)
|
||||
}
|
||||
|
||||
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
|
||||
/**
|
||||
* Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
|
||||
* This step is only applicable in `state1` and updates the flow state to `state2`.
|
||||
*/
|
||||
predicate isAdditionalTaintStep(
|
||||
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
|
||||
DataFlow::FlowState state2
|
||||
) {
|
||||
none()
|
||||
}
|
||||
|
||||
final override predicate isAdditionalFlowStep(
|
||||
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
|
||||
DataFlow::FlowState state2
|
||||
) {
|
||||
this.isAdditionalTaintStep(node1, state1, node2, state2)
|
||||
}
|
||||
|
||||
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
|
||||
(this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
|
||||
defaultImplicitTaintRead(node, c)
|
||||
}
|
||||
|
||||
@@ -61,15 +61,32 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
abstract override predicate isSource(DataFlow::Node source);
|
||||
override predicate isSource(DataFlow::Node source) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink.
|
||||
* Holds if `source` is a relevant taint source with the given initial
|
||||
* `state`.
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
abstract override predicate isSink(DataFlow::Node sink);
|
||||
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
override predicate isSink(DataFlow::Node sink) { none() }
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant taint sink accepting `state`.
|
||||
*
|
||||
* The smaller this predicate is, the faster `hasFlow()` will converge.
|
||||
*/
|
||||
// overridden to provide taint-tracking specific qldoc
|
||||
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
|
||||
|
||||
/** Holds if the node `node` is a taint sanitizer. */
|
||||
predicate isSanitizer(DataFlow::Node node) { none() }
|
||||
@@ -79,6 +96,16 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
defaultTaintSanitizer(node)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the node `node` is a taint sanitizer when the flow state is
|
||||
* `state`.
|
||||
*/
|
||||
predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
|
||||
|
||||
final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
|
||||
this.isSanitizer(node, state)
|
||||
}
|
||||
|
||||
/** Holds if taint propagation into `node` is prohibited. */
|
||||
predicate isSanitizerIn(DataFlow::Node node) { none() }
|
||||
|
||||
@@ -101,8 +128,23 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the additional taint propagation step from `node1` to `node2`
|
||||
* must be taken into account in the analysis.
|
||||
* DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
|
||||
*
|
||||
* Holds if taint propagation through nodes guarded by `guard` is prohibited
|
||||
* when the flow state is `state`.
|
||||
*/
|
||||
deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard, DataFlow::FlowState state) {
|
||||
none()
|
||||
}
|
||||
|
||||
deprecated final override predicate isBarrierGuard(
|
||||
DataFlow::BarrierGuard guard, DataFlow::FlowState state
|
||||
) {
|
||||
this.isSanitizerGuard(guard, state)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
|
||||
*/
|
||||
predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
|
||||
|
||||
@@ -111,7 +153,25 @@ abstract class Configuration extends DataFlow::Configuration {
|
||||
defaultAdditionalTaintStep(node1, node2)
|
||||
}
|
||||
|
||||
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
|
||||
/**
|
||||
* Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
|
||||
* This step is only applicable in `state1` and updates the flow state to `state2`.
|
||||
*/
|
||||
predicate isAdditionalTaintStep(
|
||||
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
|
||||
DataFlow::FlowState state2
|
||||
) {
|
||||
none()
|
||||
}
|
||||
|
||||
final override predicate isAdditionalFlowStep(
|
||||
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
|
||||
DataFlow::FlowState state2
|
||||
) {
|
||||
this.isAdditionalTaintStep(node1, state1, node2, state2)
|
||||
}
|
||||
|
||||
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
|
||||
(this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
|
||||
defaultImplicitTaintRead(node, c)
|
||||
}
|
||||
|
||||
@@ -48,11 +48,11 @@ module AllocationSizeOverflow {
|
||||
* Holds if `nd` is at a position where overflow might occur, and its result is used to compute
|
||||
* allocation size `allocsz`.
|
||||
*/
|
||||
predicate isSink(DataFlow::Node nd, DataFlow::Node allocsz) {
|
||||
predicate isSinkWithAllocationSize(DataFlow::Node nd, DataFlow::Node allocsz) {
|
||||
nd.(Sink).getAllocationSize() = allocsz
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node nd) { isSink(nd, _) }
|
||||
override predicate isSink(DataFlow::Node nd) { isSinkWithAllocationSize(nd, _) }
|
||||
|
||||
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
additionalStep(pred, succ)
|
||||
|
||||
@@ -109,7 +109,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
|
||||
* not also in a right-shift expression. We allow this case because it is
|
||||
* a common pattern to serialise `byte(v)`, `byte(v >> 8)`, and so on.
|
||||
*/
|
||||
predicate isSink(DataFlow::TypeCastNode sink, int bitSize) {
|
||||
predicate isSinkWithBitSize(DataFlow::TypeCastNode sink, int bitSize) {
|
||||
sink.asExpr() instanceof ConversionExpr and
|
||||
exists(IntegerType integerType | sink.getResultType().getUnderlyingType() = integerType |
|
||||
bitSize = integerType.getSize()
|
||||
@@ -125,7 +125,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, sinkBitSize) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkWithBitSize(sink, sinkBitSize) }
|
||||
|
||||
override predicate isSanitizer(DataFlow::Node node) {
|
||||
// To catch flows that only happen on 32-bit architectures we
|
||||
@@ -140,7 +140,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
|
||||
|
||||
override predicate isSanitizerOut(DataFlow::Node node) {
|
||||
exists(int bitSize | isIncorrectIntegerConversion(sourceBitSize, bitSize) |
|
||||
this.isSink(node, bitSize)
|
||||
this.isSinkWithBitSize(node, bitSize)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -25,10 +25,10 @@ module InsecureRandomness {
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { source instanceof Source }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkWithKind(sink, _) }
|
||||
|
||||
/** Holds if `sink` is a sink for this configuration with kind `kind`. */
|
||||
predicate isSink(Sink sink, string kind) { kind = sink.getKind() }
|
||||
predicate isSinkWithKind(Sink sink, string kind) { kind = sink.getKind() }
|
||||
|
||||
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
|
||||
}
|
||||
|
||||
@@ -83,7 +83,7 @@ predicate regexpGuardsError(RegexpPattern regexp) {
|
||||
class Config extends DataFlow::Configuration {
|
||||
Config() { this = "IncompleteHostNameRegexp::Config" }
|
||||
|
||||
predicate isSource(DataFlow::Node source, string hostPart) {
|
||||
predicate isSourceString(DataFlow::Node source, string hostPart) {
|
||||
exists(Expr e |
|
||||
e = source.asExpr() and
|
||||
isIncompleteHostNameRegexpPattern(e.getStringValue(), hostPart)
|
||||
@@ -95,7 +95,7 @@ class Config extends DataFlow::Configuration {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
|
||||
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
sink instanceof RegexpPattern and
|
||||
@@ -107,7 +107,7 @@ class Config extends DataFlow::Configuration {
|
||||
}
|
||||
|
||||
from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string hostPart
|
||||
where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), hostPart)
|
||||
where c.hasFlowPath(source, sink) and c.isSourceString(source.getNode(), hostPart)
|
||||
select source, source, sink,
|
||||
"This regular expression has an unescaped dot before '" + hostPart + "', " +
|
||||
"so it might match more hosts than expected when $@.", sink, "the regular expression is used"
|
||||
|
||||
@@ -63,7 +63,7 @@ predicate isInterestingUnanchoredRegexpString(string re, string msg) {
|
||||
class Config extends DataFlow::Configuration {
|
||||
Config() { this = "MissingRegexpAnchor::Config" }
|
||||
|
||||
predicate isSource(DataFlow::Node source, string msg) {
|
||||
predicate isSourceString(DataFlow::Node source, string msg) {
|
||||
exists(Expr e | e = source.asExpr() |
|
||||
isInterestingUnanchoredRegexpString(e.getStringValue(), msg)
|
||||
or
|
||||
@@ -71,11 +71,11 @@ class Config extends DataFlow::Configuration {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
|
||||
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
|
||||
}
|
||||
|
||||
from Config c, DataFlow::PathNode source, string msg
|
||||
where c.hasFlowPath(source, _) and c.isSource(source.getNode(), msg)
|
||||
where c.hasFlowPath(source, _) and c.isSourceString(source.getNode(), msg)
|
||||
select source.getNode(), msg
|
||||
|
||||
@@ -32,7 +32,7 @@ predicate containsEscapedCharacter(DataFlow::Node source, string character) {
|
||||
class Config extends DataFlow::Configuration {
|
||||
Config() { this = "SuspiciousRegexpEscape" }
|
||||
|
||||
predicate isSource(DataFlow::Node source, string report) {
|
||||
predicate isSourceString(DataFlow::Node source, string report) {
|
||||
containsEscapedCharacter(source, "a") and
|
||||
report =
|
||||
"the bell character \\a; did you mean \\\\a, the Vim alphabetic character class (use [[:alpha:]] instead) or \\\\A, the beginning of text?"
|
||||
@@ -41,12 +41,12 @@ class Config extends DataFlow::Configuration {
|
||||
report = "a literal backspace \\b; did you mean \\\\b, a word boundary?"
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
|
||||
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
|
||||
}
|
||||
|
||||
from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string report
|
||||
where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), report)
|
||||
where c.hasFlowPath(source, sink) and c.isSourceString(source.getNode(), report)
|
||||
select source, source, sink, "This string literal that is $@ contains " + report, sink,
|
||||
"used as a regular expression"
|
||||
|
||||
@@ -20,7 +20,7 @@ from
|
||||
DataFlow::Node allocsz
|
||||
where
|
||||
cfg.hasFlowPath(source, sink) and
|
||||
cfg.isSink(sink.getNode(), allocsz)
|
||||
cfg.isSinkWithAllocationSize(sink.getNode(), allocsz)
|
||||
select sink, source, sink,
|
||||
"This operation, which is used in an $@, involves a $@ and might overflow.", allocsz,
|
||||
"allocation", source, "potentially large value"
|
||||
|
||||
@@ -66,14 +66,14 @@ class HostKeyCallbackAssignmentConfig extends DataFlow::Configuration {
|
||||
/**
|
||||
* Holds if `sink` is a value written by `write` to a field `ClientConfig.HostKeyCallback`.
|
||||
*/
|
||||
predicate isSink(DataFlow::Node sink, Write write) {
|
||||
predicate writeIsSink(DataFlow::Node sink, Write write) {
|
||||
exists(Field f |
|
||||
f.hasQualifiedName(CryptoSsh::packagePath(), "ClientConfig", "HostKeyCallback") and
|
||||
write.writesField(_, f, sink)
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.writeIsSink(sink, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -92,8 +92,8 @@ predicate hostCheckReachesSink(DataFlow::PathNode sink) {
|
||||
SsaWithFields sinkAccessPath, SsaWithFields otherSinkAccessPath
|
||||
|
|
||||
config.hasFlowPath(source, otherSink) and
|
||||
config.isSink(sink.getNode(), sinkWrite) and
|
||||
config.isSink(otherSink.getNode(), otherSinkWrite) and
|
||||
config.writeIsSink(sink.getNode(), sinkWrite) and
|
||||
config.writeIsSink(otherSink.getNode(), otherSinkWrite) and
|
||||
sinkWrite.writesField(sinkAccessPath.getAUse(), _, sink.getNode()) and
|
||||
otherSinkWrite.writesField(otherSinkAccessPath.getAUse(), _, otherSink.getNode()) and
|
||||
otherSinkAccessPath = sinkAccessPath.similar()
|
||||
|
||||
@@ -60,7 +60,7 @@ class TlsVersionFlowConfig extends TaintTracking::Configuration {
|
||||
/**
|
||||
* Holds if `source` is a TLS version source yielding value `val`.
|
||||
*/
|
||||
predicate isSource(DataFlow::Node source, int val) {
|
||||
predicate intIsSource(DataFlow::Node source, int val) {
|
||||
val = source.getIntValue() and
|
||||
val = getATlsVersion() and
|
||||
not DataFlow::isReturnedWithError(source)
|
||||
@@ -74,7 +74,7 @@ class TlsVersionFlowConfig extends TaintTracking::Configuration {
|
||||
fieldWrite.writesField(base, fld, sink)
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
|
||||
override predicate isSource(DataFlow::Node source) { intIsSource(source, _) }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { isSink(sink, _, _, _) }
|
||||
}
|
||||
@@ -87,7 +87,7 @@ predicate secureTlsVersionFlow(
|
||||
) {
|
||||
exists(int version |
|
||||
config.hasFlowPath(source, sink) and
|
||||
config.isSource(source.getNode(), version) and
|
||||
config.intIsSource(source.getNode(), version) and
|
||||
not isInsecureTlsVersion(version, _, fld.getName())
|
||||
)
|
||||
}
|
||||
@@ -130,7 +130,7 @@ predicate isInsecureTlsVersionFlow(
|
||||
) {
|
||||
exists(TlsVersionFlowConfig cfg, int version, Field fld |
|
||||
cfg.hasFlowPath(source, sink) and
|
||||
cfg.isSource(source.getNode(), version) and
|
||||
cfg.intIsSource(source.getNode(), version) and
|
||||
cfg.isSink(sink.getNode(), fld, base, _) and
|
||||
isInsecureTlsVersion(version, _, fld.getName()) and
|
||||
// Exclude cases where a secure TLS version can also flow to the same
|
||||
|
||||
@@ -17,7 +17,7 @@ import DataFlow::PathGraph
|
||||
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string kind
|
||||
where
|
||||
cfg.hasFlowPath(source, sink) and
|
||||
cfg.isSink(sink.getNode(), kind) and
|
||||
cfg.isSinkWithKind(sink.getNode(), kind) and
|
||||
(
|
||||
kind != "A password-related function"
|
||||
or
|
||||
|
||||
@@ -31,7 +31,7 @@ class AuthCodeUrl extends Method {
|
||||
class ConstantStateFlowConf extends DataFlow::Configuration {
|
||||
ConstantStateFlowConf() { this = "ConstantStateFlowConf" }
|
||||
|
||||
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
exists(AuthCodeUrl m | call = m.getACall() | sink = call.getArgument(0))
|
||||
}
|
||||
|
||||
@@ -46,7 +46,7 @@ class ConstantStateFlowConf extends DataFlow::Configuration {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -109,11 +109,11 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
|
||||
any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
exists(AuthCodeUrl m | call = m.getACall() | sink = call.getReceiver())
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -126,7 +126,7 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
|
||||
predicate privateUrlFlowsToAuthCodeUrlCall(DataFlow::CallNode call) {
|
||||
exists(PrivateUrlFlowsToAuthCodeUrlCall flowConfig, DataFlow::Node receiver |
|
||||
flowConfig.hasFlowTo(receiver) and
|
||||
flowConfig.isSink(receiver, call)
|
||||
flowConfig.isSinkCall(receiver, call)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -134,7 +134,7 @@ predicate privateUrlFlowsToAuthCodeUrlCall(DataFlow::CallNode call) {
|
||||
class FlowToPrint extends DataFlow::Configuration {
|
||||
FlowToPrint() { this = "FlowToPrint" }
|
||||
|
||||
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
|
||||
exists(LoggerCall logCall | call = logCall | sink = logCall.getAMessageComponent())
|
||||
}
|
||||
|
||||
@@ -142,7 +142,7 @@ class FlowToPrint extends DataFlow::Configuration {
|
||||
source = any(AuthCodeUrl m).getACall().getResult()
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
|
||||
}
|
||||
|
||||
/** Holds if the provided `CallNode`'s result flows to an argument of a printer call. */
|
||||
@@ -198,7 +198,7 @@ from
|
||||
DataFlow::CallNode sinkCall
|
||||
where
|
||||
cfg.hasFlowPath(source, sink) and
|
||||
cfg.isSink(sink.getNode(), sinkCall) and
|
||||
cfg.isSinkCall(sink.getNode(), sinkCall) and
|
||||
// Exclude cases that seem to be oauth flows done from within a terminal:
|
||||
not seemsLikeDoneWithinATerminal(sinkCall) and
|
||||
not privateUrlFlowsToAuthCodeUrlCall(sinkCall)
|
||||
|
||||
@@ -94,13 +94,13 @@ predicate urlPath(DataFlow::Node nd) {
|
||||
class Configuration extends TaintTracking::Configuration {
|
||||
Configuration() { this = "BadRedirectCheck" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { this.isSource(source, _) }
|
||||
override predicate isSource(DataFlow::Node source) { this.isCheckedSource(source, _) }
|
||||
|
||||
/**
|
||||
* Holds if `source` is the first node that flows into a use of a variable that is checked by a
|
||||
* bad redirect check `check`..
|
||||
*/
|
||||
predicate isSource(DataFlow::Node source, DataFlow::Node check) {
|
||||
predicate isCheckedSource(DataFlow::Node source, DataFlow::Node check) {
|
||||
exists(SsaWithFields v |
|
||||
DataFlow::localFlow(source, v.getAUse()) and
|
||||
not exists(source.getAPredecessor()) and
|
||||
@@ -170,7 +170,7 @@ predicate isBadRedirectCheckWrapper(DataFlow::Node check, FuncDef f, FunctionInp
|
||||
|
||||
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node check
|
||||
where
|
||||
cfg.isSource(source.getNode(), check) and
|
||||
cfg.isCheckedSource(source.getNode(), check) and
|
||||
cfg.hasFlowPath(source, sink)
|
||||
select check, source, sink,
|
||||
"This is a check that $@, which flows into a $@, has a leading slash, but not that it does not have '/' or '\\' in its second position.",
|
||||
|
||||
@@ -61,7 +61,7 @@ class FlowsUntrustedToAllowOriginHeader extends TaintTracking::Configuration {
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
|
||||
|
||||
predicate isSink(DataFlow::Node sink, AllowOriginHeaderWrite hw) { sink = hw.getValue() }
|
||||
predicate isSinkHW(DataFlow::Node sink, AllowOriginHeaderWrite hw) { sink = hw.getValue() }
|
||||
|
||||
override predicate isSanitizer(DataFlow::Node node) {
|
||||
exists(ControlFlow::ConditionGuardNode cgn |
|
||||
@@ -71,7 +71,7 @@ class FlowsUntrustedToAllowOriginHeader extends TaintTracking::Configuration {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkHW(sink, _) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -95,7 +95,7 @@ predicate allowCredentialsIsSetToTrue(AllowOriginHeaderWrite allowOriginHW) {
|
||||
predicate flowsFromUntrustedToAllowOrigin(AllowOriginHeaderWrite allowOriginHW, string message) {
|
||||
exists(FlowsUntrustedToAllowOriginHeader cfg, DataFlow::Node sink |
|
||||
cfg.hasFlowTo(sink) and
|
||||
cfg.isSink(sink, allowOriginHW)
|
||||
cfg.isSinkHW(sink, allowOriginHW)
|
||||
|
|
||||
message =
|
||||
headerAllowOrigin() + " header is set to a user-defined value, and " +
|
||||
@@ -130,9 +130,9 @@ class FlowsFromUntrusted extends TaintTracking::Configuration {
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
|
||||
override predicate isSink(DataFlow::Node sink) { this.isSinkCgn(sink, _) }
|
||||
|
||||
predicate isSink(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
|
||||
predicate isSinkCgn(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
|
||||
exists(IfStmt ifs |
|
||||
exists(Expr operand |
|
||||
operand = ifs.getCond().getAChildExpr*() and
|
||||
@@ -171,7 +171,7 @@ class FlowsFromUntrusted extends TaintTracking::Configuration {
|
||||
*/
|
||||
predicate flowsToGuardedByCheckOnUntrusted(AllowOriginHeaderWrite allowOriginHW) {
|
||||
exists(FlowsFromUntrusted cfg, DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn |
|
||||
cfg.hasFlowTo(sink) and cfg.isSink(sink, cgn)
|
||||
cfg.hasFlowTo(sink) and cfg.isSinkCgn(sink, cgn)
|
||||
|
|
||||
cgn.dominates(allowOriginHW.getBasicBlock())
|
||||
)
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user