diff --git a/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll b/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll index 51dad0fc18c..74fe756093c 100644 --- a/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll +++ b/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll @@ -10,7 +10,7 @@ import ExternalAPIsSpecific /** A node representing untrusted data being passed to an external API. */ class UntrustedExternalApiDataNode extends ExternalApiDataNode { - UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } + UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) } /** Gets a source of untrusted data which is passed to this external API data node. */ DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } diff --git a/cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll b/cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll index 51dad0fc18c..74fe756093c 100644 --- a/cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll +++ b/cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll @@ -10,7 +10,7 @@ import ExternalAPIsSpecific /** A node representing untrusted data being passed to an external API. */ class UntrustedExternalApiDataNode extends ExternalApiDataNode { - UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } + UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) } /** Gets a source of untrusted data which is passed to this external API data node. */ DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql b/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql index 01d078cf545..392650022e2 100644 --- a/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql +++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql @@ -263,7 +263,7 @@ module FromSensitiveFlow = TaintTracking::Global; * A taint flow configuration for flow from a sensitive expression to an encryption operation. */ module ToEncryptionConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { FromSensitiveFlow::flow(source, _) } + predicate isSource(DataFlow::Node source) { FromSensitiveFlow::flowFrom(source) } predicate isSink(DataFlow::Node sink) { isSinkEncrypt(sink, _) } @@ -311,7 +311,7 @@ where FromSensitiveFlow::flowPath(source, sink) and isSinkSendRecv(sink.getNode(), networkSendRecv) and // no flow from sensitive -> evidence of encryption - not ToEncryptionFlow::flow(source.getNode(), _) and + not ToEncryptionFlow::flowFrom(source.getNode()) and not FromEncryptionFlow::flowTo(sink.getNode()) and // construct result if networkSendRecv instanceof NetworkSend diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql b/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql index 58f5dc2ade4..003c4f27f49 100644 --- a/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql +++ b/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql @@ -129,7 +129,7 @@ module PointerArithmeticToDerefFlow = DataFlow::Global; private DataFlow::CallNode getALargeLenCall() { - exists(DataFlow::Node lenArg | FindLargeLensFlow::flow(_, lenArg) | + exists(DataFlow::Node lenArg | FindLargeLensFlow::flowTo(lenArg) | result.getArgument(0) = lenArg ) } diff --git a/go/ql/lib/semmle/go/security/ExternalAPIs.qll b/go/ql/lib/semmle/go/security/ExternalAPIs.qll index f85f939258f..0a9be6bcc70 100644 --- a/go/ql/lib/semmle/go/security/ExternalAPIs.qll +++ b/go/ql/lib/semmle/go/security/ExternalAPIs.qll @@ -211,7 +211,7 @@ module UntrustedDataToUnknownExternalApiFlow = /** A node representing untrusted data being passed to an external API. */ class UntrustedExternalApiDataNode extends ExternalApiDataNode { - UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) } + UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) } /** Gets a source of untrusted data which is passed to this external API data node. */ DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) } diff --git a/go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll b/go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll index 15afe81944f..1f8185d4397 100644 --- a/go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll +++ b/go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll @@ -15,7 +15,7 @@ module MissingJwtSignatureCheck { module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { source instanceof Source and - not SafeParse::flow(source, _) + not SafeParse::flowFrom(source) } predicate isSink(DataFlow::Node sink) { sink instanceof Sink } diff --git a/go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll b/go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll index 19047b12b78..0ced26c3eff 100644 --- a/go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll +++ b/go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll @@ -32,7 +32,7 @@ module UnsafeUnzipSymlink { * Holds if `node` is an archive header field read that flows to a `path/filepath.EvalSymlinks` call. */ private predicate symlinksEvald(DataFlow::Node node) { - EvalSymlinksFlow::flow(getASimilarReadNode(node), _) + EvalSymlinksFlow::flowFrom(getASimilarReadNode(node)) } private module Config implements DataFlow::ConfigSig { diff --git a/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql b/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql index 43a24b1aef3..a4b18bff8d3 100644 --- a/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql +++ b/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql @@ -81,5 +81,5 @@ module Config implements DataFlow::ConfigSig { module Flow = DataFlow::Global; from DataFlow::Node source, string msg -where Flow::flow(source, _) and Config::isSourceString(source, msg) +where Flow::flowFrom(source) and Config::isSourceString(source, msg) select source, msg diff --git a/go/ql/src/Security/CWE-352/ConstantOauth2State.ql b/go/ql/src/Security/CWE-352/ConstantOauth2State.ql index 501eb6109c7..edbb41782b8 100644 --- a/go/ql/src/Security/CWE-352/ConstantOauth2State.ql +++ b/go/ql/src/Security/CWE-352/ConstantOauth2State.ql @@ -154,7 +154,7 @@ module FlowToPrintFlow = DataFlow::Global; /** Holds if the provided `CallNode`'s result flows to an argument of a printer call. */ predicate resultFlowsToPrinter(DataFlow::CallNode authCodeUrlCall) { - FlowToPrintFlow::flow(authCodeUrlCall.getResult(), _) + FlowToPrintFlow::flowFrom(authCodeUrlCall.getResult()) } /** Get a data-flow node that reads the value of `os.Stdin`. */ diff --git a/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql b/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql index 17ec112955f..34023f6161e 100644 --- a/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql +++ b/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql @@ -21,6 +21,6 @@ where OpenUrlRedirect::Flow::flowPath(source, sink) and // this excludes flow from safe parts of request URLs, for example the full URL when the // doing a redirect from `http://` to `https://` - not SafeUrlFlow::Flow::flow(_, sink.getNode()) + not SafeUrlFlow::Flow::flowTo(sink.getNode()) select sink.getNode(), source, sink, "This path to an untrusted URL redirection depends on a $@.", source.getNode(), "user-provided value" diff --git a/go/ql/src/Security/CWE-918/RequestForgery.ql b/go/ql/src/Security/CWE-918/RequestForgery.ql index 5a5c3265483..a54f51db9ce 100644 --- a/go/ql/src/Security/CWE-918/RequestForgery.ql +++ b/go/ql/src/Security/CWE-918/RequestForgery.ql @@ -21,6 +21,6 @@ where RequestForgery::Flow::flowPath(source, sink) and request = sink.getNode().(RequestForgery::Sink).getARequest() and // this excludes flow from safe parts of request URLs, for example the full URL - not SafeUrlFlow::Flow::flow(_, sink.getNode()) + not SafeUrlFlow::Flow::flowTo(sink.getNode()) select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(), sink.getNode().(RequestForgery::Sink).getKind(), source, "user-provided value" diff --git a/go/ql/src/experimental/CWE-285/PamAuthBypass.ql b/go/ql/src/experimental/CWE-285/PamAuthBypass.ql index 755a023ef62..daba2f89544 100644 --- a/go/ql/src/experimental/CWE-285/PamAuthBypass.ql +++ b/go/ql/src/experimental/CWE-285/PamAuthBypass.ql @@ -70,5 +70,6 @@ module PamStartToAuthenticateFlow = TaintTracking::Global; -private TypeLiteral getSourceWithFlowToParseAs() { - TypeLiteralToParseAsFlow::flow(DataFlow::exprNode(result), _) -} +private TypeLiteral getSourceWithFlowToParseAs() { TypeLiteralToParseAsFlow::flowFromExpr(result) } /** A field that is deserialized by `HttpResponse.parseAs`. */ class HttpResponseParseAsDeserializableField extends DeserializableField { diff --git a/java/ql/lib/semmle/code/java/frameworks/jackson/JacksonSerializability.qll b/java/ql/lib/semmle/code/java/frameworks/jackson/JacksonSerializability.qll index aa7da753f43..b9fdbe58f77 100644 --- a/java/ql/lib/semmle/code/java/frameworks/jackson/JacksonSerializability.qll +++ b/java/ql/lib/semmle/code/java/frameworks/jackson/JacksonSerializability.qll @@ -110,7 +110,7 @@ private module TypeLiteralToJacksonDatabindFlow = DataFlow::Global; private TypeLiteral getSourceWithFlowToJacksonDatabind() { - TypeLiteralToJacksonDatabindFlow::flow(DataFlow::exprNode(result), _) + TypeLiteralToJacksonDatabindFlow::flowFromExpr(result) } /** A type whose values are explicitly deserialized in a call to a Jackson method. */ diff --git a/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll b/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll index 929fa2d6c91..4deb2bc812b 100644 --- a/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll +++ b/java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll @@ -164,7 +164,7 @@ private module RegexFlowConfig implements DataFlow::ConfigSig { private module RegexFlow = DataFlow::Global; private predicate usedAsRegexImpl(StringLiteral regex, string mode, boolean match_full_string) { - RegexFlow::flow(DataFlow::exprNode(regex), _) and + RegexFlow::flowFromExpr(regex) and mode = "None" and // TODO: proper mode detection (if matchesFullString(regex) then match_full_string = true else match_full_string = false) } diff --git a/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll b/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll index ff5ebe86217..61f88f39578 100644 --- a/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll +++ b/java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll @@ -51,7 +51,7 @@ private module VerifiedIntentFlow = DataFlow::Global; /** An `onReceive` method that doesn't verify the action of the intent it receives. */ private class UnverifiedOnReceiveMethod extends OnReceiveMethod { UnverifiedOnReceiveMethod() { - not VerifiedIntentFlow::flow(DataFlow::parameterNode(this.getIntentParameter()), _) and + not VerifiedIntentFlow::flowFrom(DataFlow::parameterNode(this.getIntentParameter())) and // Empty methods do not need to be verified since they do not perform any actions. this.getBody().getNumStmt() > 0 } diff --git a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql index 45767185dfd..cc076039940 100644 --- a/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql +++ b/java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsAllowsContentAccess.ql @@ -118,7 +118,7 @@ where // implicit: no setAllowContentAccess(false) exists(WebViewSource source | source.asExpr() = e and - not WebViewDisallowContentAccessFlow::flow(source, _) + not WebViewDisallowContentAccessFlow::flowFrom(source) ) select e, "Sensitive information may be exposed via a malicious link due to access to content:// links being allowed in this WebView." diff --git a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql index 48c49d5c071..c53c2cacdae 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql +++ b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql @@ -85,7 +85,7 @@ private module JxBrowserFlow = DataFlow::Global; deprecated query predicate problems(DataFlow::Node src, string message) { JxBrowserFlowConfig::isSource(src) and - not JxBrowserFlow::flow(src, _) and + not JxBrowserFlow::flowFrom(src) and not isSafeJxBrowserVersion() and message = "This JxBrowser instance may not check HTTPS certificates." } diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql index ef95db6f6c5..fc0cc59244c 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql +++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql @@ -50,7 +50,7 @@ private Expr getAccessControlAllowOriginHeaderName() { * A taint-tracking configuration for flow from a source node to CorsProbableCheckAccess methods. */ module CorsSourceReachesCheckConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { CorsOriginFlow::flow(source, _) } + predicate isSource(DataFlow::Node source) { CorsOriginFlow::flowFrom(source) } predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(CorsProbableCheckAccess check).getAnArgument() @@ -86,7 +86,7 @@ deprecated query predicate problems( string message1, DataFlow::Node sourceNode, string message2 ) { CorsOriginFlow::flowPath(source, sink) and - not CorsSourceReachesCheckFlow::flow(sourceNode, _) and + not CorsSourceReachesCheckFlow::flowFrom(sourceNode) and sinkNode = sink.getNode() and message1 = "CORS header is being set using user controlled value $@." and sourceNode = source.getNode() and diff --git a/java/ql/src/experimental/Security/CWE/CWE-347/Auth0NoVerifier.ql b/java/ql/src/experimental/Security/CWE/CWE-347/Auth0NoVerifier.ql index 778939887f0..16b0f024329 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-347/Auth0NoVerifier.ql +++ b/java/ql/src/experimental/Security/CWE/CWE-347/Auth0NoVerifier.ql @@ -17,7 +17,7 @@ deprecated import JwtAuth0 as JwtAuth0 deprecated module JwtDecodeConfig implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource and - not FlowToJwtVerify::flow(source, _) + not FlowToJwtVerify::flowFrom(source) } predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(JwtAuth0::GetPayload a) } diff --git a/java/ql/test-kotlin1/library-tests/parameter-defaults/flowTest.ql b/java/ql/test-kotlin1/library-tests/parameter-defaults/flowTest.ql index da0fc33464b..0bf36d842e1 100644 --- a/java/ql/test-kotlin1/library-tests/parameter-defaults/flowTest.ql +++ b/java/ql/test-kotlin1/library-tests/parameter-defaults/flowTest.ql @@ -25,9 +25,7 @@ module Config implements DataFlow::ConfigSig { module Flow = DataFlow::Global; -predicate isSunk(StringLiteral sl) { - exists(DataFlow::Node source | Flow::flow(source, _) and sl = source.asExpr()) -} +predicate isSunk(StringLiteral sl) { Flow::flowFromExpr(sl) } query predicate shouldBeSunkButIsnt(ShouldBeSunk src) { not isSunk(src) } diff --git a/java/ql/test-kotlin2/library-tests/parameter-defaults/flowTest.ql b/java/ql/test-kotlin2/library-tests/parameter-defaults/flowTest.ql index da0fc33464b..0bf36d842e1 100644 --- a/java/ql/test-kotlin2/library-tests/parameter-defaults/flowTest.ql +++ b/java/ql/test-kotlin2/library-tests/parameter-defaults/flowTest.ql @@ -25,9 +25,7 @@ module Config implements DataFlow::ConfigSig { module Flow = DataFlow::Global; -predicate isSunk(StringLiteral sl) { - exists(DataFlow::Node source | Flow::flow(source, _) and sl = source.asExpr()) -} +predicate isSunk(StringLiteral sl) { Flow::flowFromExpr(sl) } query predicate shouldBeSunkButIsnt(ShouldBeSunk src) { not isSunk(src) } diff --git a/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql b/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql index 5ca38c7e29b..ae4f8ca0da0 100644 --- a/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql +++ b/java/ql/test/library-tests/frameworks/android/taint-database/flowSteps.ql @@ -20,7 +20,7 @@ module FlowStepTest implements TestSig { predicate hasActualResult(Location l, string element, string tag, string value) { tag = "taintReachesReturn" and value = "" and - exists(DataFlow::Node source | Flow::flow(source, _) | + exists(DataFlow::Node source | Flow::flowFrom(source) | l = source.getLocation() and element = source.toString() ) diff --git a/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql b/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql index ccdb9698009..58b749364d2 100644 --- a/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql +++ b/java/ql/test/library-tests/frameworks/android/taint-database/sinks.ql @@ -20,7 +20,7 @@ module SinkTest implements TestSig { predicate hasActualResult(Location l, string element, string tag, string value) { tag = "taintReachesSink" and value = "" and - exists(DataFlow::Node source | Flow::flow(source, _) | + exists(DataFlow::Node source | Flow::flowFrom(source) | l = source.getLocation() and element = source.toString() ) diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll index 7972c379e87..7a936044756 100644 --- a/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll +++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataQuery.qll @@ -97,7 +97,7 @@ class ExternalApiDataNode extends DataFlow::Node instanceof Sink { } /** A node representing untrusted data being passed to an external API. */ class UntrustedExternalApiDataNode extends ExternalApiDataNode { - UntrustedExternalApiDataNode() { ExternalAPIUsedWithUntrustedDataFlow::flow(_, this) } + UntrustedExternalApiDataNode() { ExternalAPIUsedWithUntrustedDataFlow::flowTo(this) } /** Gets a source of untrusted data which is passed to this external API data node. */ DataFlow::Node getAnUntrustedSource() { ExternalAPIUsedWithUntrustedDataFlow::flow(result, this) } @@ -110,7 +110,7 @@ private newtype TExternalApi = /** An external API sink with `name`. */ MkExternalApiNode(string name) { exists(Sink sink | - ExternalAPIUsedWithUntrustedDataFlow::flow(_, sink) and + ExternalAPIUsedWithUntrustedDataFlow::flowTo(sink) and name = sink.getApiName() ) } diff --git a/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql b/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql index 429744bbbd1..259d27227a3 100644 --- a/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql +++ b/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql @@ -36,6 +36,6 @@ import UnverifiedDecodeFlow::PathGraph from UnverifiedDecodeFlow::PathNode source, UnverifiedDecodeFlow::PathNode sink where UnverifiedDecodeFlow::flowPath(source, sink) and - not VerifiedDecodeFlow::flow(source.getNode(), _) + not VerifiedDecodeFlow::flowFrom(source.getNode()) select source.getNode(), source, sink, "Decoding JWT $@.", sink.getNode(), "without signature verification" diff --git a/javascript/ql/test/library-tests/FlowSummary/test.ql b/javascript/ql/test/library-tests/FlowSummary/test.ql index 0e40dcdadb0..147908706c8 100644 --- a/javascript/ql/test/library-tests/FlowSummary/test.ql +++ b/javascript/ql/test/library-tests/FlowSummary/test.ql @@ -32,5 +32,5 @@ class BasicBarrierGuard extends DataFlow::CallNode { deprecated class ConsistencyConfig extends ConsistencyConfiguration { ConsistencyConfig() { this = "ConsistencyConfig" } - override DataFlow::Node getAnAlert() { Flow::flow(_, result) } + override DataFlow::Node getAnAlert() { Flow::flowTo(result) } } diff --git a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query17.qll b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query17.qll index e6dff623e97..e0a5ac34a91 100644 --- a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query17.qll +++ b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query17.qll @@ -14,7 +14,7 @@ predicate passwordVarAssign(Variable v, DataFlow::Node nd) { module PasswordFlow = DataFlow::Global; query predicate test_query17(DataFlow::Node sink, string res) { - exists(Variable v | PasswordFlow::flow(_, sink) and passwordVarAssign(v, sink) | + exists(Variable v | PasswordFlow::flowTo(sink) and passwordVarAssign(v, sink) | res = "Password variable " + v.toString() + " is assigned a constant string." ) } diff --git a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll index e60afa470ec..304e6376d2c 100644 --- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll +++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll @@ -50,7 +50,7 @@ module FullServerSideRequestForgeryFlow = TaintTracking::Global; from DataFlow::Node reachable -where RemoteFlowSourceReachFlow::flow(_, reachable) +where RemoteFlowSourceReachFlow::flowTo(reachable) select reachable, prettyNode(reachable) diff --git a/ruby/ql/src/queries/meta/TaintedNodes.ql b/ruby/ql/src/queries/meta/TaintedNodes.ql index 2ee6e83e0de..1594c59d3b0 100644 --- a/ruby/ql/src/queries/meta/TaintedNodes.ql +++ b/ruby/ql/src/queries/meta/TaintedNodes.ql @@ -28,5 +28,5 @@ private module BasicTaintConfig implements DataFlow::ConfigSig { private module BasicTaintFlow = TaintTracking::Global; from DataFlow::Node node -where BasicTaintFlow::flow(_, node) +where BasicTaintFlow::flowTo(node) select node, "Tainted node" diff --git a/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql b/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql index 61996adaf05..4de9cc98948 100644 --- a/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql +++ b/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql @@ -88,5 +88,5 @@ import InsecureCookieFlow::PathGraph from InsecureCookieFlow::PathNode sourceNode, InsecureCookieFlow::PathNode sinkNode where InsecureCookieFlow::flowPath(sourceNode, sinkNode) and - not PartitionedCookieFlow::flow(_, sinkNode.getNode()) + not PartitionedCookieFlow::flowTo(sinkNode.getNode()) select sinkNode.getNode(), sourceNode, sinkNode, "Cookie attribute 'Secure' is not set to true." diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll index ddcd052e8fd..aa74e44a8e8 100644 --- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll +++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll @@ -207,6 +207,28 @@ module MakeImpl Lang> { flowLocal(source, sink) and Config::observeOverlayInformedIncrementalMode() } + /** + * Holds if data can flow from `source` to some sink. + * This is a local predicate that only has results local to the overlay/base database. + */ + predicate flowFromLocal(Node source) = forceLocal(Flow::flowFrom/1)(source) + + /** + * Holds if data can flow from `source` to some sink. + */ + predicate flowFrom(Node source) { + Flow::flowFrom(source) + or + // If we are overlay informed (i.e. we are not diff-informed), we + // merge in the local results which includes the base database results. + flowFromLocal(source) and Config::observeOverlayInformedIncrementalMode() + } + + /** + * Holds if data can flow from `source` to some sink. + */ + predicate flowFromExpr(Lang::DataFlowExpr source) { flowFrom(exprNode(source)) } + /** * Holds if data can flow from some source to `sink`. * This is a local predicate that only has results local to the overlay/base database. @@ -3501,6 +3523,16 @@ module MakeImpl Lang> { ) } + /** + * Holds if data can flow from `source` to some sink. + */ + predicate flowFrom(Node source) { exists(PathNode n | n.isSource() and n.getNode() = source) } + + /** + * Holds if data can flow from `source` to some sink. + */ + predicate flowFromExpr(Expr source) { flowFrom(exprNode(source)) } + /** * Holds if data can flow from some source to `sink`. */ diff --git a/swift/ql/lib/codeql/swift/security/CleartextTransmissionExtensions.qll b/swift/ql/lib/codeql/swift/security/CleartextTransmissionExtensions.qll index 4b31a7ab23f..03d8dff3148 100644 --- a/swift/ql/lib/codeql/swift/security/CleartextTransmissionExtensions.qll +++ b/swift/ql/lib/codeql/swift/security/CleartextTransmissionExtensions.qll @@ -87,7 +87,7 @@ private class UrlTransmittedSink extends CleartextTransmissionSink { // exclude `tel:` and similar URLs. These URLs necessarily contain // sensitive data which you expect to transmit only by making the // phone call (or similar operation). - not ExcludeUrlFlow::flow(_, this) + not ExcludeUrlFlow::flowTo(this) } }