hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12420 from kaspersv/kaspersv/dataflow-remove-alias-preds

Browse Source 
Dataflow: Remove revFlowAlias and revFlowApAlias predicates
This commit is contained in:
Anders Schack-Mulligen
2023-03-20 16:30:15 +01:00
committed by GitHub
parent be163cfc38 1d2f1b6ae6
commit 3876e4335f
8 changed files with 96 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }

40
swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll
View File

@@ -1145,19 +1145,13 @@ module Impl<FullStateConfigSig Config> {
import Param import Param
/* Begin: Stage logic. */ /* Begin: Stage logic. */
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
private predicate revFlowApAlias(NodeEx node, ApApprox apa) {
PrevStage::revFlowAp(node, apa)
}
pragma[nomagic] pragma[nomagic]
private predicate flowIntoCallApa( private predicate flowIntoCallApa(
DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, ApApprox apa
) { ) {
flowIntoCall(call, arg, p, allowsFieldFlow) and flowIntoCall(call, arg, p, allowsFieldFlow) and
PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(p, pragma[only_bind_into](apa)) and
revFlowApAlias(arg, pragma[only_bind_into](apa)) PrevStage::revFlowAp(arg, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1167,7 +1161,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and flowOutOfCall(call, ret, kind, out, allowsFieldFlow) and
PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and PrevStage::revFlowAp(out, pragma[only_bind_into](apa)) and
revFlowApAlias(ret, pragma[only_bind_into](apa)) PrevStage::revFlowAp(ret, pragma[only_bind_into](apa))
} }
pragma[nomagic] pragma[nomagic]
@@ -1695,16 +1689,6 @@ module Impl<FullStateConfigSig Config> {
pragma[nomagic] pragma[nomagic]
predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) } predicate revFlowAp(NodeEx node, Ap ap) { revFlow(node, _, _, _, ap) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node) { revFlow(node, _, _, _, _) }
// use an alias as a workaround for bad functionality-induced joins
pragma[nomagic]
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap) {
revFlow(node, state, ap)
}
private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) } private predicate fwdConsCand(TypedContent tc, Ap ap) { storeStepFwd(_, ap, tc, _, _) }
private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) } private predicate revConsCand(TypedContent tc, Ap ap) { storeStepCand(_, ap, tc, _, _) }
@@ -1978,7 +1962,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand1(call, node1, kind, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
pragma[nomagic] pragma[nomagic]
@@ -1987,7 +1971,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow) and
Stage2::revFlow(node2) and Stage2::revFlow(node2) and
Stage2::revFlowAlias(node1) Stage2::revFlow(node1)
} }
private module LocalFlowBigStep { private module LocalFlowBigStep {
@@ -2069,11 +2053,11 @@ module Impl<FullStateConfigSig Config> {
additionalLocalFlowStepNodeCand1(node1, node2) and additionalLocalFlowStepNodeCand1(node1, node2) and
state1 = state2 and state1 = state2 and
Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and Stage2::revFlow(node1, pragma[only_bind_into](state1), false) and
Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false) Stage2::revFlow(node2, pragma[only_bind_into](state2), false)
or or
additionalLocalStateStep(node1, state1, node2, state2) and additionalLocalStateStep(node1, state1, node2, state2) and
Stage2::revFlow(node1, state1, false) and Stage2::revFlow(node1, state1, false) and
Stage2::revFlowAlias(node2, state2, false) Stage2::revFlow(node2, state2, false)
} }
/** /**
@@ -2266,7 +2250,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), _) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state2), _) and
exists(lcc) exists(lcc)
} }
@@ -2277,7 +2261,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2288,7 +2272,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2590,7 +2574,7 @@ module Impl<FullStateConfigSig Config> {
) { ) {
localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getType(), lcc) and
PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and PrevStage::revFlow(node1, pragma[only_bind_into](state1), _) and
PrevStage::revFlowAlias(node2, pragma[only_bind_into](state2), _) PrevStage::revFlow(node2, pragma[only_bind_into](state2), _)
} }
pragma[nomagic] pragma[nomagic]
@@ -2600,7 +2584,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and flowOutOfCallNodeCand2(call, node1, kind, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }
@@ -2611,7 +2595,7 @@ module Impl<FullStateConfigSig Config> {
exists(FlowState state | exists(FlowState state |
flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow) and
PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and PrevStage::revFlow(node2, pragma[only_bind_into](state), _) and
PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _) PrevStage::revFlow(node1, pragma[only_bind_into](state), _)
) )
} }