hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Conflate iterator value and indirection for taint-flow to fix AST dataflow.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-01-23 10:40:25 +00:00
parent 962b651c44
commit 470abfd0aa
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll
View File

@@ -27,7 +27,12 @@ private class StdSetConstructor extends Constructor, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// taint flow from any parameter of an iterator type to the qualifier
input.isParameterDeref(this.getAnIteratorParameterIndex()) and
(
// AST dataflow doesn't have indirection for iterators.
// Once we deprecate AST dataflow we can delete this first disjunct.
input.isParameter(this.getAnIteratorParameterIndex()) or
input.isParameterDeref(this.getAnIteratorParameterIndex())
) and
(
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
or
@@ -45,7 +50,12 @@ private class StdSetInsert extends TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from last parameter to qualifier and return value
// (where the return value is a pair, this should really flow just to the first part of it)
input.isParameterDeref(this.getNumberOfParameters() - 1) and
(
// AST dataflow doesn't have indirection for iterators.
// Once we deprecate AST dataflow we can delete this first disjunct.
input.isParameter(this.getNumberOfParameters() - 1) or
input.isParameterDeref(this.getNumberOfParameters() - 1)
) and
(
output.isQualifierObject() or
output.isReturnValue()