mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
Dataflow: Simplify diff-informed implementation and tweak flag name.
This commit is contained in:
committed by
Chuan-kai Lin
parent
ff78bebf19
commit
3a1e50dcf9
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
@@ -433,10 +433,15 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
|
||||
default predicate includeHiddenNodes() { none() }
|
||||
|
||||
/**
|
||||
* Holds to filter out data flows whose source and sink are both not in the
|
||||
* `AlertFiltering` location range.
|
||||
* Holds if sources and sinks should be filtered to only include those that
|
||||
* may lead to a flow path with either a source or a sink in the location
|
||||
* range given by `AlertFiltering`. This only has an effect when running
|
||||
* in diff-informed incremental mode.
|
||||
*
|
||||
* This flag should only be applied to flow configurations whose results
|
||||
* are used directly in a query result.
|
||||
*/
|
||||
default predicate filterForSourceOrSinkAlerts() { none() }
|
||||
default predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
/** An input configuration for data flow using flow state. */
|
||||
@@ -555,10 +560,15 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
|
||||
default predicate includeHiddenNodes() { none() }
|
||||
|
||||
/**
|
||||
* Holds to filter out data flows whose source and sink are both not in the
|
||||
* `AlertFiltering` location range.
|
||||
* Holds if sources and sinks should be filtered to only include those that
|
||||
* may lead to a flow path with either a source or a sink in the location
|
||||
* range given by `AlertFiltering`. This only has an effect when running
|
||||
* in diff-informed incremental mode.
|
||||
*
|
||||
* This flag should only be applied to flow configurations whose results
|
||||
* are used directly in a query result.
|
||||
*/
|
||||
default predicate filterForSourceOrSinkAlerts() { none() }
|
||||
default predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -637,7 +647,6 @@ module DataFlowMake<LocationSig Location, InputSig<Location> Lang> {
|
||||
module Global<ConfigSig Config> implements GlobalFlowSig {
|
||||
private module C implements FullStateConfigSig {
|
||||
import DefaultState<Config>
|
||||
import FilteredSourceSink<Config>
|
||||
import Config
|
||||
|
||||
predicate accessPathLimit = Config::accessPathLimit/0;
|
||||
@@ -660,7 +669,6 @@ module DataFlowMake<LocationSig Location, InputSig<Location> Lang> {
|
||||
*/
|
||||
module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
|
||||
private module C implements FullStateConfigSig {
|
||||
import FilteredStateSourceSink<Config>
|
||||
import Config
|
||||
|
||||
predicate accessPathLimit = Config::accessPathLimit/0;
|
||||
|
||||
@@ -60,8 +60,8 @@ module TaintFlowMake<
|
||||
Config::allowImplicitRead(node, c)
|
||||
or
|
||||
(
|
||||
Config::isFilteredSink(node) or
|
||||
Config::isFilteredSink(node, _) or
|
||||
Config::isSink(node) or
|
||||
Config::isSink(node, _) or
|
||||
Config::isAdditionalFlowStep(node, _, _) or
|
||||
Config::isAdditionalFlowStep(node, _, _, _)
|
||||
) and
|
||||
@@ -75,7 +75,6 @@ module TaintFlowMake<
|
||||
module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
|
||||
private module Config0 implements DataFlowInternal::FullStateConfigSig {
|
||||
import DataFlowInternal::DefaultState<Config>
|
||||
import DataFlowInternal::FilteredSourceSink<Config>
|
||||
import Config
|
||||
|
||||
predicate isAdditionalFlowStep(
|
||||
@@ -102,7 +101,6 @@ module TaintFlowMake<
|
||||
*/
|
||||
module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
|
||||
private module Config0 implements DataFlowInternal::FullStateConfigSig {
|
||||
import DataFlowInternal::FilteredStateSourceSink<Config>
|
||||
import Config
|
||||
|
||||
predicate isAdditionalFlowStep(
|
||||
|
||||
@@ -126,28 +126,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
predicate includeHiddenNodes();
|
||||
|
||||
/**
|
||||
* Holds to filter out data flows whose source and sink are both not in the
|
||||
* `AlertFiltering` location range.
|
||||
* Holds if sources and sinks should be filtered to only include those that
|
||||
* may lead to a flow path with either a source or a sink in the location
|
||||
* range given by `AlertFiltering`. This only has an effect when running
|
||||
* in diff-informed incremental mode.
|
||||
*
|
||||
* This flag should only be applied to flow configurations whose results
|
||||
* are used directly in a query result.
|
||||
*/
|
||||
predicate filterForSourceOrSinkAlerts();
|
||||
|
||||
/**
|
||||
* Holds if `source` is a relevant data flow source with the given initial
|
||||
* `state` and passes filtering per `filterForSourceOrSinkAlerts`.
|
||||
*/
|
||||
predicate isFilteredSource(Node source, FlowState state);
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant data flow sink accepting `state` and passes
|
||||
* filtering per `filterForSourceOrSinkAlerts`.
|
||||
*/
|
||||
predicate isFilteredSink(Node sink, FlowState state);
|
||||
|
||||
/**
|
||||
* Holds if `sink` is a relevant data flow sink for any state and passes
|
||||
* filtering per `filterForSourceOrSinkAlerts`.
|
||||
*/
|
||||
predicate isFilteredSink(Node sink);
|
||||
predicate observeDiffInformedIncrementalMode();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -171,112 +158,6 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provide `isFilteredSource` and `isFilteredSink` implementations given a `ConfigSig`.
|
||||
*/
|
||||
module FilteredSourceSink<ConfigSig Config> {
|
||||
private import codeql.util.AlertFiltering
|
||||
|
||||
private module AlertFiltering = AlertFilteringImpl<Location>;
|
||||
|
||||
private class FlowState = Unit;
|
||||
|
||||
pragma[noinline]
|
||||
private predicate hasFilteredSource() {
|
||||
exists(Node n | Config::isSource(n) | AlertFiltering::filterByLocation(n.getLocation()))
|
||||
}
|
||||
|
||||
pragma[noinline]
|
||||
private predicate hasFilteredSink() {
|
||||
exists(Node n | Config::isSink(n) | AlertFiltering::filterByLocation(n.getLocation()))
|
||||
}
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) {
|
||||
Config::isSource(source) and
|
||||
exists(state) and
|
||||
(
|
||||
not Config::filterForSourceOrSinkAlerts() or
|
||||
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
|
||||
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
|
||||
// sources, so we can perform the source filtering right here.
|
||||
hasFilteredSink() or
|
||||
AlertFiltering::filterByLocation(source.getLocation())
|
||||
)
|
||||
}
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isFilteredSink(sink) and exists(state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) {
|
||||
Config::isSink(sink) and
|
||||
(
|
||||
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
|
||||
// with filtered sources. Otherwise the only alerts of interest are those with filtered
|
||||
// sinks, so we can perform the sink filtering right here.
|
||||
hasFilteredSource() or
|
||||
AlertFiltering::filterByLocation(sink.getLocation())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provide `isFilteredSource` and `isFilteredSink` implementations given a `StateConfigSig`.
|
||||
*/
|
||||
module FilteredStateSourceSink<StateConfigSig Config> {
|
||||
private import codeql.util.AlertFiltering
|
||||
|
||||
private module AlertFiltering = AlertFilteringImpl<Location>;
|
||||
|
||||
private class FlowState = Config::FlowState;
|
||||
|
||||
pragma[noinline]
|
||||
private predicate hasFilteredSource() {
|
||||
exists(Node n | Config::isSource(n, _) | AlertFiltering::filterByLocation(n.getLocation()))
|
||||
}
|
||||
|
||||
pragma[noinline]
|
||||
private predicate hasFilteredSink() {
|
||||
exists(Node n |
|
||||
Config::isSink(n, _) or
|
||||
Config::isSink(n)
|
||||
|
|
||||
AlertFiltering::filterByLocation(n.getLocation())
|
||||
)
|
||||
}
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) {
|
||||
Config::isSource(source, state) and
|
||||
(
|
||||
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
|
||||
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
|
||||
// sources, so we can perform the source filtering right here.
|
||||
hasFilteredSink() or
|
||||
AlertFiltering::filterByLocation(source.getLocation())
|
||||
)
|
||||
}
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) {
|
||||
Config::isSink(sink, state) and
|
||||
(
|
||||
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
|
||||
// with filtered sources. Otherwise the only alerts of interest are those with filtered
|
||||
// sinks, so we can perform the sink filtering right here.
|
||||
hasFilteredSource() or
|
||||
AlertFiltering::filterByLocation(sink.getLocation())
|
||||
)
|
||||
}
|
||||
|
||||
predicate isFilteredSink(Node sink) {
|
||||
Config::isSink(sink) and
|
||||
(
|
||||
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
|
||||
// with filtered sources. Otherwise the only alerts of interest are those with filtered
|
||||
// sinks, so we can perform the sink filtering right here.
|
||||
hasFilteredSource() or
|
||||
AlertFiltering::filterByLocation(sink.getLocation())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructs a data flow computation given a full input configuration.
|
||||
*/
|
||||
@@ -376,11 +257,75 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
ReturnKindExt getKind() { result = pos.getKind() }
|
||||
}
|
||||
|
||||
private module SourceSinkFiltering {
|
||||
private import codeql.util.AlertFiltering
|
||||
|
||||
private module AlertFiltering = AlertFilteringImpl<Location>;
|
||||
|
||||
pragma[nomagic]
|
||||
private predicate isFilteredSource(Node source) {
|
||||
Config::isSource(source, _) and
|
||||
if Config::observeDiffInformedIncrementalMode()
|
||||
then AlertFiltering::filterByLocation(source.getLocation())
|
||||
else any()
|
||||
}
|
||||
|
||||
pragma[nomagic]
|
||||
private predicate isFilteredSink(Node sink) {
|
||||
(
|
||||
Config::isSink(sink, _) or
|
||||
Config::isSink(sink)
|
||||
) and
|
||||
if Config::observeDiffInformedIncrementalMode()
|
||||
then AlertFiltering::filterByLocation(sink.getLocation())
|
||||
else any()
|
||||
}
|
||||
|
||||
private predicate hasFilteredSource() { isFilteredSource(_) }
|
||||
|
||||
private predicate hasFilteredSink() { isFilteredSink(_) }
|
||||
|
||||
predicate isRelevantSource(Node source, FlowState state) {
|
||||
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
|
||||
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
|
||||
// sources, so we can perform the source filtering right here.
|
||||
Config::isSource(source, state) and
|
||||
(
|
||||
isFilteredSource(source) or
|
||||
hasFilteredSink()
|
||||
)
|
||||
}
|
||||
|
||||
predicate isRelevantSink(Node sink, FlowState state) {
|
||||
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
|
||||
// with filtered sources. Otherwise the only alerts of interest are those with filtered
|
||||
// sinks, so we can perform the sink filtering right here.
|
||||
Config::isSink(sink, state) and
|
||||
(
|
||||
isFilteredSink(sink) or
|
||||
hasFilteredSource()
|
||||
)
|
||||
}
|
||||
|
||||
predicate isRelevantSink(Node sink) {
|
||||
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
|
||||
// with filtered sources. Otherwise the only alerts of interest are those with filtered
|
||||
// sinks, so we can perform the sink filtering right here.
|
||||
Config::isSink(sink) and
|
||||
(
|
||||
isFilteredSink(sink) or
|
||||
hasFilteredSource()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private import SourceSinkFiltering
|
||||
|
||||
private predicate inBarrier(NodeEx node) {
|
||||
exists(Node n |
|
||||
node.asNode() = n and
|
||||
Config::isBarrierIn(n) and
|
||||
Config::isFilteredSource(n, _)
|
||||
isRelevantSource(n, _)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -389,7 +334,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
exists(Node n |
|
||||
node.asNode() = n and
|
||||
Config::isBarrierIn(n, state) and
|
||||
Config::isFilteredSource(n, state)
|
||||
isRelevantSource(n, state)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -398,9 +343,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
node.asNodeOrImplicitRead() = n and
|
||||
Config::isBarrierOut(n)
|
||||
|
|
||||
Config::isFilteredSink(n, _)
|
||||
isRelevantSink(n, _)
|
||||
or
|
||||
Config::isFilteredSink(n)
|
||||
isRelevantSink(n)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -410,9 +355,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
node.asNodeOrImplicitRead() = n and
|
||||
Config::isBarrierOut(n, state)
|
||||
|
|
||||
Config::isFilteredSink(n, state)
|
||||
isRelevantSink(n, state)
|
||||
or
|
||||
Config::isFilteredSink(n)
|
||||
isRelevantSink(n)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -422,11 +367,11 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
Config::isBarrier(n)
|
||||
or
|
||||
Config::isBarrierIn(n) and
|
||||
not Config::isFilteredSource(n, _)
|
||||
not isRelevantSource(n, _)
|
||||
or
|
||||
Config::isBarrierOut(n) and
|
||||
not Config::isFilteredSink(n, _) and
|
||||
not Config::isFilteredSink(n)
|
||||
not isRelevantSink(n, _) and
|
||||
not isRelevantSink(n)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -436,24 +381,24 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
Config::isBarrier(n, state)
|
||||
or
|
||||
Config::isBarrierIn(n, state) and
|
||||
not Config::isFilteredSource(n, state)
|
||||
not isRelevantSource(n, state)
|
||||
or
|
||||
Config::isBarrierOut(n, state) and
|
||||
not Config::isFilteredSink(n, state) and
|
||||
not Config::isFilteredSink(n)
|
||||
not isRelevantSink(n, state) and
|
||||
not isRelevantSink(n)
|
||||
)
|
||||
}
|
||||
|
||||
pragma[nomagic]
|
||||
private predicate sourceNode(NodeEx node, FlowState state) {
|
||||
Config::isFilteredSource(node.asNode(), state) and
|
||||
isRelevantSource(node.asNode(), state) and
|
||||
not fullBarrier(node) and
|
||||
not stateBarrier(node, state)
|
||||
}
|
||||
|
||||
pragma[nomagic]
|
||||
private predicate sinkNodeWithState(NodeEx node, FlowState state) {
|
||||
Config::isFilteredSink(node.asNodeOrImplicitRead(), state) and
|
||||
isRelevantSink(node.asNodeOrImplicitRead(), state) and
|
||||
not fullBarrier(node) and
|
||||
not stateBarrier(node, state)
|
||||
}
|
||||
@@ -859,7 +804,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
additional predicate sinkNode(NodeEx node, FlowState state) {
|
||||
fwdFlow(node) and
|
||||
fwdFlowState(state) and
|
||||
Config::isFilteredSink(node.asNodeOrImplicitRead())
|
||||
isRelevantSink(node.asNodeOrImplicitRead())
|
||||
or
|
||||
fwdFlow(node) and
|
||||
fwdFlowState(state) and
|
||||
@@ -3076,7 +3021,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
NodeEx toNormalSinkNodeEx() {
|
||||
exists(Node n |
|
||||
pragma[only_bind_out](node.asNodeOrImplicitRead()) = n and
|
||||
(Config::isFilteredSink(n) or Config::isFilteredSink(n, _)) and
|
||||
(isRelevantSink(n) or isRelevantSink(n, _)) and
|
||||
result.asNode() = n
|
||||
)
|
||||
}
|
||||
@@ -4922,15 +4867,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
}
|
||||
|
||||
private predicate interestingCallableSrc(DataFlowCallable c) {
|
||||
exists(Node n | Config::isFilteredSource(n, _) and c = getNodeEnclosingCallable(n))
|
||||
exists(Node n | isRelevantSource(n, _) and c = getNodeEnclosingCallable(n))
|
||||
or
|
||||
exists(DataFlowCallable mid | interestingCallableSrc(mid) and callableStep(mid, c))
|
||||
}
|
||||
|
||||
private predicate interestingCallableSink(DataFlowCallable c) {
|
||||
exists(Node n | c = getNodeEnclosingCallable(n) |
|
||||
Config::isFilteredSink(n, _) or
|
||||
Config::isFilteredSink(n)
|
||||
isRelevantSink(n, _) or
|
||||
isRelevantSink(n)
|
||||
)
|
||||
or
|
||||
exists(DataFlowCallable mid | interestingCallableSink(mid) and callableStep(c, mid))
|
||||
@@ -4957,7 +4902,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
or
|
||||
exists(Node n |
|
||||
ce1 = TCallableSrc() and
|
||||
Config::isFilteredSource(n, _) and
|
||||
isRelevantSource(n, _) and
|
||||
ce2 = TCallable(getNodeEnclosingCallable(n))
|
||||
)
|
||||
or
|
||||
@@ -4965,8 +4910,8 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
ce2 = TCallableSink() and
|
||||
ce1 = TCallable(getNodeEnclosingCallable(n))
|
||||
|
|
||||
Config::isFilteredSink(n, _) or
|
||||
Config::isFilteredSink(n)
|
||||
isRelevantSink(n, _) or
|
||||
isRelevantSink(n)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -5030,7 +4975,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
|
||||
private predicate revSinkNode(NodeEx node, FlowState state) {
|
||||
sinkNodeWithState(node, state)
|
||||
or
|
||||
Config::isFilteredSink(node.asNodeOrImplicitRead()) and
|
||||
isRelevantSink(node.asNodeOrImplicitRead()) and
|
||||
relevantState(state) and
|
||||
not fullBarrier(node) and
|
||||
not stateBarrier(node, state)
|
||||
|
||||
@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
|
||||
|
||||
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
|
||||
|
||||
predicate filterForSourceOrSinkAlerts() { none() }
|
||||
|
||||
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
|
||||
|
||||
predicate isFilteredSink(Node sink) { isSink(sink) }
|
||||
predicate observeDiffInformedIncrementalMode() { none() }
|
||||
}
|
||||
|
||||
deprecated private import Impl<Config> as I
|
||||
|
||||
Reference in New Issue
Block a user