Dataflow: Simplify diff-informed implementation and tweak flag name.

This commit is contained in:
Anders Schack-Mulligen
2024-09-19 13:30:17 +02:00
committed by Chuan-kai Lin
parent ff78bebf19
commit 3a1e50dcf9
32 changed files with 142 additions and 365 deletions

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I

View File

@@ -433,10 +433,15 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
default predicate includeHiddenNodes() { none() }
/**
* Holds to filter out data flows whose source and sink are both not in the
* `AlertFiltering` location range.
* Holds if sources and sinks should be filtered to only include those that
* may lead to a flow path with either a source or a sink in the location
* range given by `AlertFiltering`. This only has an effect when running
* in diff-informed incremental mode.
*
* This flag should only be applied to flow configurations whose results
* are used directly in a query result.
*/
default predicate filterForSourceOrSinkAlerts() { none() }
default predicate observeDiffInformedIncrementalMode() { none() }
}
/** An input configuration for data flow using flow state. */
@@ -555,10 +560,15 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
default predicate includeHiddenNodes() { none() }
/**
* Holds to filter out data flows whose source and sink are both not in the
* `AlertFiltering` location range.
* Holds if sources and sinks should be filtered to only include those that
* may lead to a flow path with either a source or a sink in the location
* range given by `AlertFiltering`. This only has an effect when running
* in diff-informed incremental mode.
*
* This flag should only be applied to flow configurations whose results
* are used directly in a query result.
*/
default predicate filterForSourceOrSinkAlerts() { none() }
default predicate observeDiffInformedIncrementalMode() { none() }
}
}
@@ -637,7 +647,6 @@ module DataFlowMake<LocationSig Location, InputSig<Location> Lang> {
module Global<ConfigSig Config> implements GlobalFlowSig {
private module C implements FullStateConfigSig {
import DefaultState<Config>
import FilteredSourceSink<Config>
import Config
predicate accessPathLimit = Config::accessPathLimit/0;
@@ -660,7 +669,6 @@ module DataFlowMake<LocationSig Location, InputSig<Location> Lang> {
*/
module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
private module C implements FullStateConfigSig {
import FilteredStateSourceSink<Config>
import Config
predicate accessPathLimit = Config::accessPathLimit/0;

View File

@@ -60,8 +60,8 @@ module TaintFlowMake<
Config::allowImplicitRead(node, c)
or
(
Config::isFilteredSink(node) or
Config::isFilteredSink(node, _) or
Config::isSink(node) or
Config::isSink(node, _) or
Config::isAdditionalFlowStep(node, _, _) or
Config::isAdditionalFlowStep(node, _, _, _)
) and
@@ -75,7 +75,6 @@ module TaintFlowMake<
module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
private module Config0 implements DataFlowInternal::FullStateConfigSig {
import DataFlowInternal::DefaultState<Config>
import DataFlowInternal::FilteredSourceSink<Config>
import Config
predicate isAdditionalFlowStep(
@@ -102,7 +101,6 @@ module TaintFlowMake<
*/
module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
private module Config0 implements DataFlowInternal::FullStateConfigSig {
import DataFlowInternal::FilteredStateSourceSink<Config>
import Config
predicate isAdditionalFlowStep(

View File

@@ -126,28 +126,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
predicate includeHiddenNodes();
/**
* Holds to filter out data flows whose source and sink are both not in the
* `AlertFiltering` location range.
* Holds if sources and sinks should be filtered to only include those that
* may lead to a flow path with either a source or a sink in the location
* range given by `AlertFiltering`. This only has an effect when running
* in diff-informed incremental mode.
*
* This flag should only be applied to flow configurations whose results
* are used directly in a query result.
*/
predicate filterForSourceOrSinkAlerts();
/**
* Holds if `source` is a relevant data flow source with the given initial
* `state` and passes filtering per `filterForSourceOrSinkAlerts`.
*/
predicate isFilteredSource(Node source, FlowState state);
/**
* Holds if `sink` is a relevant data flow sink accepting `state` and passes
* filtering per `filterForSourceOrSinkAlerts`.
*/
predicate isFilteredSink(Node sink, FlowState state);
/**
* Holds if `sink` is a relevant data flow sink for any state and passes
* filtering per `filterForSourceOrSinkAlerts`.
*/
predicate isFilteredSink(Node sink);
predicate observeDiffInformedIncrementalMode();
}
/**
@@ -171,112 +158,6 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
}
}
/**
* Provide `isFilteredSource` and `isFilteredSink` implementations given a `ConfigSig`.
*/
module FilteredSourceSink<ConfigSig Config> {
private import codeql.util.AlertFiltering
private module AlertFiltering = AlertFilteringImpl<Location>;
private class FlowState = Unit;
pragma[noinline]
private predicate hasFilteredSource() {
exists(Node n | Config::isSource(n) | AlertFiltering::filterByLocation(n.getLocation()))
}
pragma[noinline]
private predicate hasFilteredSink() {
exists(Node n | Config::isSink(n) | AlertFiltering::filterByLocation(n.getLocation()))
}
predicate isFilteredSource(Node source, FlowState state) {
Config::isSource(source) and
exists(state) and
(
not Config::filterForSourceOrSinkAlerts() or
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
// sources, so we can perform the source filtering right here.
hasFilteredSink() or
AlertFiltering::filterByLocation(source.getLocation())
)
}
predicate isFilteredSink(Node sink, FlowState state) { isFilteredSink(sink) and exists(state) }
predicate isFilteredSink(Node sink) {
Config::isSink(sink) and
(
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
// with filtered sources. Otherwise the only alerts of interest are those with filtered
// sinks, so we can perform the sink filtering right here.
hasFilteredSource() or
AlertFiltering::filterByLocation(sink.getLocation())
)
}
}
/**
* Provide `isFilteredSource` and `isFilteredSink` implementations given a `StateConfigSig`.
*/
module FilteredStateSourceSink<StateConfigSig Config> {
private import codeql.util.AlertFiltering
private module AlertFiltering = AlertFilteringImpl<Location>;
private class FlowState = Config::FlowState;
pragma[noinline]
private predicate hasFilteredSource() {
exists(Node n | Config::isSource(n, _) | AlertFiltering::filterByLocation(n.getLocation()))
}
pragma[noinline]
private predicate hasFilteredSink() {
exists(Node n |
Config::isSink(n, _) or
Config::isSink(n)
|
AlertFiltering::filterByLocation(n.getLocation())
)
}
predicate isFilteredSource(Node source, FlowState state) {
Config::isSource(source, state) and
(
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
// sources, so we can perform the source filtering right here.
hasFilteredSink() or
AlertFiltering::filterByLocation(source.getLocation())
)
}
predicate isFilteredSink(Node sink, FlowState state) {
Config::isSink(sink, state) and
(
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
// with filtered sources. Otherwise the only alerts of interest are those with filtered
// sinks, so we can perform the sink filtering right here.
hasFilteredSource() or
AlertFiltering::filterByLocation(sink.getLocation())
)
}
predicate isFilteredSink(Node sink) {
Config::isSink(sink) and
(
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
// with filtered sources. Otherwise the only alerts of interest are those with filtered
// sinks, so we can perform the sink filtering right here.
hasFilteredSource() or
AlertFiltering::filterByLocation(sink.getLocation())
)
}
}
/**
* Constructs a data flow computation given a full input configuration.
*/
@@ -376,11 +257,75 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
ReturnKindExt getKind() { result = pos.getKind() }
}
private module SourceSinkFiltering {
private import codeql.util.AlertFiltering
private module AlertFiltering = AlertFilteringImpl<Location>;
pragma[nomagic]
private predicate isFilteredSource(Node source) {
Config::isSource(source, _) and
if Config::observeDiffInformedIncrementalMode()
then AlertFiltering::filterByLocation(source.getLocation())
else any()
}
pragma[nomagic]
private predicate isFilteredSink(Node sink) {
(
Config::isSink(sink, _) or
Config::isSink(sink)
) and
if Config::observeDiffInformedIncrementalMode()
then AlertFiltering::filterByLocation(sink.getLocation())
else any()
}
private predicate hasFilteredSource() { isFilteredSource(_) }
private predicate hasFilteredSink() { isFilteredSink(_) }
predicate isRelevantSource(Node source, FlowState state) {
// If there are filtered sinks, we need to pass through all sources to preserve all alerts
// with filtered sinks. Otherwise the only alerts of interest are those with filtered
// sources, so we can perform the source filtering right here.
Config::isSource(source, state) and
(
isFilteredSource(source) or
hasFilteredSink()
)
}
predicate isRelevantSink(Node sink, FlowState state) {
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
// with filtered sources. Otherwise the only alerts of interest are those with filtered
// sinks, so we can perform the sink filtering right here.
Config::isSink(sink, state) and
(
isFilteredSink(sink) or
hasFilteredSource()
)
}
predicate isRelevantSink(Node sink) {
// If there are filtered sources, we need to pass through all sinks to preserve all alerts
// with filtered sources. Otherwise the only alerts of interest are those with filtered
// sinks, so we can perform the sink filtering right here.
Config::isSink(sink) and
(
isFilteredSink(sink) or
hasFilteredSource()
)
}
}
private import SourceSinkFiltering
private predicate inBarrier(NodeEx node) {
exists(Node n |
node.asNode() = n and
Config::isBarrierIn(n) and
Config::isFilteredSource(n, _)
isRelevantSource(n, _)
)
}
@@ -389,7 +334,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
exists(Node n |
node.asNode() = n and
Config::isBarrierIn(n, state) and
Config::isFilteredSource(n, state)
isRelevantSource(n, state)
)
}
@@ -398,9 +343,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
node.asNodeOrImplicitRead() = n and
Config::isBarrierOut(n)
|
Config::isFilteredSink(n, _)
isRelevantSink(n, _)
or
Config::isFilteredSink(n)
isRelevantSink(n)
)
}
@@ -410,9 +355,9 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
node.asNodeOrImplicitRead() = n and
Config::isBarrierOut(n, state)
|
Config::isFilteredSink(n, state)
isRelevantSink(n, state)
or
Config::isFilteredSink(n)
isRelevantSink(n)
)
}
@@ -422,11 +367,11 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
Config::isBarrier(n)
or
Config::isBarrierIn(n) and
not Config::isFilteredSource(n, _)
not isRelevantSource(n, _)
or
Config::isBarrierOut(n) and
not Config::isFilteredSink(n, _) and
not Config::isFilteredSink(n)
not isRelevantSink(n, _) and
not isRelevantSink(n)
)
}
@@ -436,24 +381,24 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
Config::isBarrier(n, state)
or
Config::isBarrierIn(n, state) and
not Config::isFilteredSource(n, state)
not isRelevantSource(n, state)
or
Config::isBarrierOut(n, state) and
not Config::isFilteredSink(n, state) and
not Config::isFilteredSink(n)
not isRelevantSink(n, state) and
not isRelevantSink(n)
)
}
pragma[nomagic]
private predicate sourceNode(NodeEx node, FlowState state) {
Config::isFilteredSource(node.asNode(), state) and
isRelevantSource(node.asNode(), state) and
not fullBarrier(node) and
not stateBarrier(node, state)
}
pragma[nomagic]
private predicate sinkNodeWithState(NodeEx node, FlowState state) {
Config::isFilteredSink(node.asNodeOrImplicitRead(), state) and
isRelevantSink(node.asNodeOrImplicitRead(), state) and
not fullBarrier(node) and
not stateBarrier(node, state)
}
@@ -859,7 +804,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
additional predicate sinkNode(NodeEx node, FlowState state) {
fwdFlow(node) and
fwdFlowState(state) and
Config::isFilteredSink(node.asNodeOrImplicitRead())
isRelevantSink(node.asNodeOrImplicitRead())
or
fwdFlow(node) and
fwdFlowState(state) and
@@ -3076,7 +3021,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
NodeEx toNormalSinkNodeEx() {
exists(Node n |
pragma[only_bind_out](node.asNodeOrImplicitRead()) = n and
(Config::isFilteredSink(n) or Config::isFilteredSink(n, _)) and
(isRelevantSink(n) or isRelevantSink(n, _)) and
result.asNode() = n
)
}
@@ -4922,15 +4867,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
}
private predicate interestingCallableSrc(DataFlowCallable c) {
exists(Node n | Config::isFilteredSource(n, _) and c = getNodeEnclosingCallable(n))
exists(Node n | isRelevantSource(n, _) and c = getNodeEnclosingCallable(n))
or
exists(DataFlowCallable mid | interestingCallableSrc(mid) and callableStep(mid, c))
}
private predicate interestingCallableSink(DataFlowCallable c) {
exists(Node n | c = getNodeEnclosingCallable(n) |
Config::isFilteredSink(n, _) or
Config::isFilteredSink(n)
isRelevantSink(n, _) or
isRelevantSink(n)
)
or
exists(DataFlowCallable mid | interestingCallableSink(mid) and callableStep(c, mid))
@@ -4957,7 +4902,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
or
exists(Node n |
ce1 = TCallableSrc() and
Config::isFilteredSource(n, _) and
isRelevantSource(n, _) and
ce2 = TCallable(getNodeEnclosingCallable(n))
)
or
@@ -4965,8 +4910,8 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
ce2 = TCallableSink() and
ce1 = TCallable(getNodeEnclosingCallable(n))
|
Config::isFilteredSink(n, _) or
Config::isFilteredSink(n)
isRelevantSink(n, _) or
isRelevantSink(n)
)
}
@@ -5030,7 +4975,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
private predicate revSinkNode(NodeEx node, FlowState state) {
sinkNodeWithState(node, state)
or
Config::isFilteredSink(node.asNodeOrImplicitRead()) and
isRelevantSink(node.asNodeOrImplicitRead()) and
relevantState(state) and
not fullBarrier(node) and
not stateBarrier(node, state)

View File

@@ -284,13 +284,7 @@ deprecated private module Config implements FullStateConfigSig {
predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
predicate filterForSourceOrSinkAlerts() { none() }
predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
predicate isFilteredSink(Node sink) { isSink(sink) }
predicate observeDiffInformedIncrementalMode() { none() }
}
deprecated private import Impl<Config> as I