hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 22:14:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Add tentative support for speculative taint flow.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2024-10-04 10:41:04 +02:00
parent 7497d9530d
commit 635071fe8a
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
View File

@@ -99,3 +99,29 @@ private module Cached {
}
import Cached
import SpeculativeTaintFlow
private module SpeculativeTaintFlow {
private import codeql.swift.dataflow.internal.DataFlowDispatch as DataFlowDispatch
private import codeql.swift.dataflow.internal.DataFlowPublic as DataFlowPublic
private import codeql.swift.dataflow.internal.DataFlowPrivate as DataFlowPrivate
predicate speculativeTaintStep(DataFlow::Node src, DataFlow::Node sink) {
exists(DataFlowDispatch::DataFlowCall call, DataFlowDispatch::ArgumentPosition argpos |
// TODO: exclude neutrals and anything that has QL modeling.
not exists(DataFlowDispatch::viableCallable(call)) and
src.(DataFlowPrivate::ArgumentNode).argumentOf(call, argpos)
|
not argpos instanceof DataFlowDispatch::ThisArgumentPosition and
sink.(DataFlowPublic::PostUpdateNode)
.getPreUpdateNode()
.(DataFlowPrivate::ArgumentNode)
.argumentOf(call,
any(DataFlowDispatch::ArgumentPosition qualpos |
qualpos instanceof DataFlowDispatch::ThisArgumentPosition
))
or
sink.(DataFlowPrivate::OutNode).getCall(_) = call
)
}
}