mirror of
https://github.com/github/codeql.git
synced 2026-04-24 16:25:15 +02:00
Java: Move SSA data flow test and extend it to cover phi-read input edges.
This commit is contained in:
24
java/ql/test/library-tests/dataflow/ssa/A.java
Normal file
24
java/ql/test/library-tests/dataflow/ssa/A.java
Normal file
@@ -0,0 +1,24 @@
|
||||
public class A {
|
||||
Object source() { return null; }
|
||||
void sink(Object o) { }
|
||||
|
||||
boolean isSafe(Object o) { return o == null; }
|
||||
|
||||
void foo() {
|
||||
Object x = source();
|
||||
if (!isSafe(x)) {
|
||||
x = null;
|
||||
}
|
||||
sink(x);
|
||||
|
||||
x = source();
|
||||
if (!isSafe(x)) {
|
||||
if (isSafe(x)) {
|
||||
sink(x);
|
||||
} else {
|
||||
throw new RuntimeException();
|
||||
}
|
||||
}
|
||||
sink(x);
|
||||
}
|
||||
}
|
||||
31
java/ql/test/library-tests/dataflow/ssa/test.ql
Normal file
31
java/ql/test/library-tests/dataflow/ssa/test.ql
Normal file
@@ -0,0 +1,31 @@
|
||||
import java
|
||||
import semmle.code.java.controlflow.Guards
|
||||
import semmle.code.java.dataflow.DataFlow
|
||||
|
||||
private predicate isSafe(Guard g, Expr checked, boolean branch) {
|
||||
exists(MethodCall mc | g = mc |
|
||||
mc.getMethod().hasName("isSafe") and
|
||||
checked = mc.getAnArgument() and
|
||||
branch = true
|
||||
)
|
||||
}
|
||||
|
||||
module TestConfig implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
source.asExpr().(MethodCall).getMethod().hasName("source")
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists(MethodCall mc | mc.getMethod().hasName("sink") and mc.getAnArgument() = sink.asExpr())
|
||||
}
|
||||
|
||||
predicate isBarrier(DataFlow::Node node) {
|
||||
node = DataFlow::BarrierGuard<isSafe/3>::getABarrierNode()
|
||||
}
|
||||
}
|
||||
|
||||
module Flow = DataFlow::Global<TestConfig>;
|
||||
|
||||
from DataFlow::Node source, DataFlow::Node sink
|
||||
where Flow::flow(source, sink)
|
||||
select source, sink
|
||||
@@ -24,13 +24,6 @@ public class GuardTest {
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
String s2 = "string";
|
||||
|
||||
if (!isSafe(s2)) {
|
||||
s2 = null;
|
||||
}
|
||||
sink(s2);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user