hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use flow path in alerts

Browse Source
This commit is contained in:
Joe Farebrother
2025-03-31 11:04:13 +01:00
parent 08b4281187
commit 5b7200a041
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
python/ql/src/Variables/LoopVariableCapture.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Loop variable capture
* @description Capture of a loop variable is not the same as capturing the value of a loop variable, and may be erroneous.
* @kind problem
* @kind path-problem
* @tags correctness
* @problem.severity error
* @sub-severity low
@@ -60,13 +60,23 @@ module EscapingCaptureFlowSig implements DataFlow::ConfigSig {
module EscapingCaptureFlow = DataFlow::Global<EscapingCaptureFlowSig>;
predicate escapingCapture(CallableExpr capturing, Loop loop, Variable var) {
import EscapingCaptureFlow::PathGraph
predicate escapingCapture(
CallableExpr capturing, Loop loop, Variable var, EscapingCaptureFlow::PathNode source,
EscapingCaptureFlow::PathNode sink
) {
capturesLoopVariable(capturing, loop, var) and
EscapingCaptureFlow::flow(DataFlow::exprNode(capturing), _)
capturing = source.getNode().asExpr() and
EscapingCaptureFlow::flowPath(source, sink)
}
from CallableExpr capturing, AstNode loop, Variable var, string descr
from
CallableExpr capturing, AstNode loop, Variable var, string descr,
EscapingCaptureFlow::PathNode source, EscapingCaptureFlow::PathNode sink
where
escapingCapture(capturing, loop, var) and
escapingCapture(capturing, loop, var, source, sink) and
if capturing instanceof Lambda then descr = "lambda" else descr = "function"
select capturing, "This " + descr + " captures the loop variable $@.", loop, var.getId()
select capturing, source, sink,
"This " + descr + " captures the loop variable $@, and may escape the loop by being stored $@.",
loop, var.getId(), sink, "here"