hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17007 from michaelnebel/shared/neutralimplementation

Browse Source 
C#/Java/Go: Neutrals are split into separate classes.
This commit is contained in:
Michael Nebel
2024-08-12 13:58:12 +02:00
committed by GitHub
parent 3c6459e65a 2796597d1a
commit 4a5c9f0ec4
14 changed files with 163 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
View File

@@ -636,21 +636,6 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
override predicate hasExactModel() { summaryElement(this, _, _, _, _, _, true) }
}
// adapter class for converting Mad neutrals to `NeutralCallable`s
private class NeutralCallableAdapter extends NeutralCallable {
string kind;
string provenance_;
boolean exact;
NeutralCallableAdapter() { neutralElement(this, kind, provenance_, exact) }
override string getKind() { result = kind }
override predicate hasProvenance(Provenance provenance) { provenance = provenance_ }
override predicate hasExactModel() { exact = true }
}
/**
* A callable where there exists a MaD sink model that applies to it.
*/

22
java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -29,6 +29,15 @@ private string positionToString(int pos) {
module Input implements InputSig<Location, DataFlowImplSpecific::JavaDataFlow> {
class SummarizedCallableBase = FlowSummary::SummarizedCallableBase;
predicate neutralElement(
Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
) {
exists(string namespace, string type, string name, string signature |
neutralModel(namespace, type, name, signature, kind, provenance) and
c.asCallable() = interpretElement(namespace, type, false, name, signature, "", isExact)
)
}
ArgumentPosition callbackSelfParameterPosition() { result = -1 }
ReturnKind getStandardReturnValueKind() { any() }
@@ -332,18 +341,7 @@ module Private {
)
}
/**
* Holds if a neutral model exists for `c` of kind `kind`
* and with provenance `provenance`.
*/
predicate neutralElement(
Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
) {
exists(string namespace, string type, string name, string signature |
neutralModel(namespace, type, name, signature, kind, provenance) and
c.asCallable() = interpretElement(namespace, type, false, name, signature, "", isExact)
)
}
predicate neutralElement = Input::neutralElement/4;
}
/** Provides predicates for constructing summary components. */

7
java/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ext.yml Normal file
View File

@@ -0,0 +1,7 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: neutralModel
data:
- [ "p", "Sinks", "nosink", "(Object)", "sink", "manual"]
- [ "p", "Sinks", "nosink", "(Object)", "summary", "df-generated"]

4
java/ql/test/utils/modelgenerator/dataflow/p/Sinks.java
View File

@@ -21,6 +21,10 @@ public class Sinks {
// neutral=p;Sinks;sink2;(Object);summary;df-generated
public void sink2(Object o) {}
// Defined as sink neutral in the file next to the neutral summary test.
// neutral=p;Sinks;nosink;(Object);summary;df-generated
public void nosink(Object o) {}
// sink=p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[0];path-injection;df-generated
// sink=p;Sinks;true;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];path-injection;df-generated
// neutral=p;Sinks;copyFileToDirectory;(Path,Path,CopyOption[]);summary;df-generated