mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
C++: Move all of the swap models into Swap.qll.
This commit is contained in:
@@ -170,24 +170,6 @@ private class StdSequenceContainerAssign extends TaintFunction {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard container `swap` functions.
|
||||
*/
|
||||
private class StdSequenceContainerSwap extends TaintFunction {
|
||||
StdSequenceContainerSwap() {
|
||||
this.hasQualifiedName("std", ["array", "vector", "deque", "list", "forward_list"], "swap")
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard container functions `at` and `operator[]`.
|
||||
*/
|
||||
|
||||
@@ -102,22 +102,6 @@ private class StdMapTryEmplace extends TaintFunction {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard map `swap` function.
|
||||
*/
|
||||
private class StdMapSwap extends TaintFunction {
|
||||
StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard map `merge` function.
|
||||
*/
|
||||
|
||||
@@ -60,19 +60,3 @@ private class StdPairConstructor extends Constructor, TaintFunction {
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard pair `swap` function.
|
||||
*/
|
||||
private class StdPairSwap extends TaintFunction {
|
||||
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -72,22 +72,6 @@ private class StdSetEmplace extends TaintFunction {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard set `swap` functions.
|
||||
*/
|
||||
private class StdSetSwap extends TaintFunction {
|
||||
StdSetSwap() { this.hasQualifiedName("std", ["set", "unordered_set"], "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard set `merge` function.
|
||||
*/
|
||||
|
||||
@@ -252,25 +252,6 @@ private class StdStringSubstr extends TaintFunction {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard functions `std::string.swap` and `std::stringstream::swap`.
|
||||
*/
|
||||
private class StdStringSwap extends TaintFunction {
|
||||
StdStringSwap() {
|
||||
this.hasQualifiedName("std", "basic_string", "swap") or
|
||||
this.hasQualifiedName("std", "basic_stringstream", "swap")
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// str1.swap(str2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The `std::string` functions `at` and `operator[]`.
|
||||
*/
|
||||
|
||||
@@ -15,3 +15,88 @@ private class Swap extends DataFlowFunction {
|
||||
output.isParameterDeref(0)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard functions `std::string.swap` and `std::stringstream::swap`.
|
||||
*/
|
||||
private class StdStringSwap extends TaintFunction {
|
||||
StdStringSwap() {
|
||||
this.hasQualifiedName("std", "basic_string", "swap") or
|
||||
this.hasQualifiedName("std", "basic_stringstream", "swap")
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// str1.swap(str2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard container `swap` functions.
|
||||
*/
|
||||
private class StdSequenceContainerSwap extends TaintFunction {
|
||||
StdSequenceContainerSwap() {
|
||||
this.hasQualifiedName("std", ["array", "vector", "deque", "list", "forward_list"], "swap")
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard set `swap` functions.
|
||||
*/
|
||||
private class StdSetSwap extends TaintFunction {
|
||||
StdSetSwap() { this.hasQualifiedName("std", ["set", "unordered_set"], "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard pair `swap` function.
|
||||
*/
|
||||
private class StdPairSwap extends TaintFunction {
|
||||
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The standard map `swap` function.
|
||||
*/
|
||||
private class StdMapSwap extends TaintFunction {
|
||||
StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
// container1.swap(container2)
|
||||
input.isQualifierObject() and
|
||||
output.isParameterDeref(0)
|
||||
or
|
||||
input.isParameterDeref(0) and
|
||||
output.isQualifierObject()
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user