hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1226 from hvitved/dataflow/prepare-for-csharp

Browse Source 
Generalize data-flow library in preparation for C# adoption
This commit is contained in:
Jonas Jensen
2019-05-06 14:42:46 +02:00
committed by GitHub
parent 19c7360e19 d9bf0a670e
commit 639d715d03
28 changed files with 3994 additions and 2378 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
View File

@@ -1,4 +1,5 @@
private import java
private import DataFlowPrivate
import semmle.code.java.dispatch.VirtualDispatch
cached

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

316
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
View File

@@ -1,6 +1,7 @@
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
private ReturnNode getAReturnNodeOfKind(ReturnKind kind) { result.getKind() = kind }
cached
private module ImplCommon {
@@ -9,19 +10,17 @@ private module ImplCommon {
* The instance parameter is considered to have index `-1`.
*/
pragma[nomagic]
private predicate viableParam(Call call, int i, ParameterNode p) {
exists(Callable callable |
callable = viableCallable(call) and
p.isParameterOf(callable, i)
)
private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
p.isParameterOf(viableCallable(call), i)
}
/**
* Holds if `arg` is a possible argument to `p` taking virtual dispatch into account.
* Holds if `arg` is a possible argument to `p` in `call`, taking virtual
* dispatch into account.
*/
cached
predicate viableParamArg(ParameterNode p, ArgumentNode arg) {
exists(int i, Call call |
predicate viableParamArg(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
exists(int i |
viableParam(call, i, p) and
arg.argumentOf(call, i)
)
@@ -29,44 +28,167 @@ private module ImplCommon {
/**
* Holds if `p` can flow to `node` in the same callable using only
* value-preserving steps.
* value-preserving steps, not taking call contexts into account.
*/
private predicate parameterValueFlow(ParameterNode p, Node node) {
private predicate parameterValueFlowNoCtx(ParameterNode p, Node node) {
p = node
or
exists(Node mid |
parameterValueFlow(p, mid) and
parameterValueFlowNoCtx(p, mid) and
localFlowStep(mid, node) and
compatibleTypes(p.getType(), node.getType())
)
or
// flow through a callable
exists(Node arg |
parameterValueFlow(p, arg) and
argumentValueFlowsThrough(arg, node) and
parameterValueFlowNoCtx(p, arg) and
argumentValueFlowsThroughNoCtx(arg, node) and
compatibleTypes(p.getType(), node.getType())
)
}
/**
* Holds if `p` can flow to a `ReturnNode` in the same callable using only
* value-preserving steps.
* Holds if `p` can flow to a return node of kind `kind` in the same
* callable using only value-preserving steps, not taking call contexts
* into account.
*/
cached
predicate parameterValueFlowsThrough(ParameterNode p) {
exists(ReturnNode ret | parameterValueFlow(p, ret))
private predicate parameterValueFlowsThroughNoCtx(ParameterNode p, ReturnKind kind) {
parameterValueFlowNoCtx(p, getAReturnNodeOfKind(kind))
}
pragma[nomagic]
private predicate argumentValueFlowsThroughNoCtx0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind
) {
exists(ParameterNode param | viableParamArg(call, param, arg) |
parameterValueFlowsThroughNoCtx(param, kind)
)
}
/**
* Holds if `arg` flows through `call` using only value-preserving steps.
* Holds if `arg` flows to `out` through a call using only value-preserving steps,
* not taking call contexts into account.
*/
private predicate argumentValueFlowsThroughNoCtx(ArgumentNode arg, OutNode out) {
exists(DataFlowCall call, ReturnKind kind | argumentValueFlowsThroughNoCtx0(call, arg, kind) |
out = getAnOutNode(call, kind) and
compatibleTypes(arg.getType(), out.getType())
)
}
/**
* Holds if `arg` is the `i`th argument of `call` inside the callable
* `enclosing`, and `arg` may flow through `call`.
*/
pragma[noinline]
private predicate argumentOf(
DataFlowCall call, int i, ArgumentNode arg, DataFlowCallable enclosing
) {
arg.argumentOf(call, i) and
argumentValueFlowsThroughNoCtx(arg, _) and
enclosing = arg.getEnclosingCallable()
}
pragma[noinline]
private predicate viableParamArg0(int i, ArgumentNode arg, CallContext outercc, DataFlowCall call) {
exists(DataFlowCallable c | argumentOf(call, i, arg, c) |
outercc = TAnyCallContext()
or
exists(ParameterNode p | outercc = TSomeCall(p, _) | c = p.getEnclosingCallable())
or
exists(DataFlowCall other | outercc = TSpecificCall(other, _, _) |
reducedViableImplInCallContext(_, c, other)
)
)
}
pragma[noinline]
private predicate viableParamArg1(
ParameterNode p, DataFlowCallable callable, int i, ArgumentNode arg, CallContext outercc,
DataFlowCall call
) {
viableParamArg0(i, arg, outercc, call) and
callable = resolveCall(call, outercc) and
p.isParameterOf(callable, any(int j | j <= i and j >= i))
}
/**
* Holds if `arg` is a possible argument to `p`, in the call `call`, and
* `arg` may flow through `call`. The possible contexts before and after
* entering the callable are `outercc` and `innercc`, respectively.
*/
private predicate viableParamArg(
DataFlowCall call, ParameterNode p, ArgumentNode arg, CallContext outercc,
CallContextCall innercc
) {
exists(int i, DataFlowCallable callable | viableParamArg1(p, callable, i, arg, outercc, call) |
if reducedViableImplInCallContext(_, callable, call)
then innercc = TSpecificCall(call, i, true)
else innercc = TSomeCall(p, true)
)
}
private CallContextCall getAValidCallContextForParameter(ParameterNode p) {
result = TSomeCall(p, _)
or
exists(DataFlowCall call, int i, DataFlowCallable callable |
result = TSpecificCall(call, i, _) and
p.isParameterOf(callable, i) and
reducedViableImplInCallContext(_, callable, call)
)
}
/**
* Holds if `p` can flow to `node` in the same callable using only
* value-preserving steps, in call context `cc`.
*/
private predicate parameterValueFlow(ParameterNode p, Node node, CallContextCall cc) {
p = node and
parameterValueFlowsThroughNoCtx(p, _) and
cc = getAValidCallContextForParameter(p)
or
exists(Node mid |
parameterValueFlow(p, mid, cc) and
localFlowStep(mid, node) and
compatibleTypes(p.getType(), node.getType())
)
or
// flow through a callable
exists(Node arg |
parameterValueFlow(p, arg, cc) and
argumentValueFlowsThrough(arg, node, cc) and
compatibleTypes(p.getType(), node.getType())
)
}
/**
* Holds if `p` can flow to a return node of kind `kind` in the same
* callable using only value-preserving steps, in call context `cc`.
*/
cached
predicate argumentValueFlowsThrough(ArgumentNode arg, ExprNode call) {
exists(ParameterNode param |
viableParamArg(param, arg) and
parameterValueFlowsThrough(param) and
arg.argumentOf(call.getExpr(), _) and
compatibleTypes(arg.getType(), call.getType())
predicate parameterValueFlowsThrough(ParameterNode p, ReturnKind kind, CallContextCall cc) {
parameterValueFlow(p, getAReturnNodeOfKind(kind), cc)
}
pragma[nomagic]
private predicate argumentValueFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, CallContext cc
) {
exists(ParameterNode param, CallContext innercc |
viableParamArg(call, param, arg, cc, innercc) and
parameterValueFlowsThrough(param, kind, innercc)
)
}
/**
* Holds if `arg` flows to `out` through a call using only value-preserving steps,
* in call context cc.
*/
cached
predicate argumentValueFlowsThrough(ArgumentNode arg, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind | argumentValueFlowsThrough0(call, arg, kind, cc) |
out = getAnOutNode(call, kind) and
compatibleTypes(arg.getType(), out.getType())
)
}
@@ -76,7 +198,7 @@ private module ImplCommon {
*/
cached
predicate parameterValueFlowsToUpdate(ParameterNode p, PostUpdateNode n) {
parameterValueFlow(p, n.getPreUpdateNode())
parameterValueFlowNoCtx(p, n.getPreUpdateNode())
}
/**
@@ -85,7 +207,7 @@ private module ImplCommon {
*/
private predicate localValueStep(Node node1, Node node2) {
localFlowStep(node1, node2) or
argumentValueFlowsThrough(node1, node2)
argumentValueFlowsThrough(node1, node2, _)
}
/*
@@ -113,7 +235,7 @@ private module ImplCommon {
private predicate storeViaSideEffect(Node node1, Content f, PostUpdateNode node2) {
storeStep(node1, f, node2) and readStep(_, f, _)
or
exists(Call call, int i1, int i2 |
exists(DataFlowCall call, int i1, int i2 |
setterCall(call, i1, i2, f) and
node1.(ArgumentNode).argumentOf(call, i1) and
node2.getPreUpdateNode().(ArgumentNode).argumentOf(call, i2) and
@@ -125,16 +247,16 @@ private module ImplCommon {
pragma[nomagic]
private predicate setterInParam(ParameterNode p1, Content f, ParameterNode p2) {
exists(Node n1, PostUpdateNode n2 |
parameterValueFlow(p1, n1) and
parameterValueFlowNoCtx(p1, n1) and
storeViaSideEffect(n1, f, n2) and
parameterValueFlow(p2, n2.getPreUpdateNode()) and
parameterValueFlowNoCtx(p2, n2.getPreUpdateNode()) and
p1 != p2
)
}
pragma[nomagic]
private predicate setterCall(Call call, int i1, int i2, Content f) {
exists(Callable callable, ParameterNode p1, ParameterNode p2 |
private predicate setterCall(DataFlowCall call, int i1, int i2, Content f) {
exists(DataFlowCallable callable, ParameterNode p1, ParameterNode p2 |
setterInParam(p1, f, p2) and
callable = viableCallable(call) and
p1.isParameterOf(callable, i1) and
@@ -142,22 +264,36 @@ private module ImplCommon {
)
}
pragma[noinline]
private predicate storeReturn0(DataFlowCall call, ReturnKind kind, ArgumentNode arg, Content f) {
exists(ParameterNode p |
viableParamArg(call, p, arg) and
setterReturn(p, f, kind)
)
}
private predicate storeReturn(Node node1, Content f, Node node2) {
exists(ParameterNode p, ArgumentNode arg |
arg = node1 and
viableParamArg(p, arg) and
setterReturn(p, f) and
arg.argumentOf(node2.asExpr(), _) and
exists(DataFlowCall call, ReturnKind kind |
storeReturn0(call, kind, node1, f) and
node2 = getAnOutNode(call, kind) and
compatibleTypes(node1.getTypeBound(), f.getType()) and
compatibleTypes(node2.getTypeBound(), f.getContainerType())
)
}
private predicate setterReturn(ParameterNode p, Content f) {
exists(Node n1, Node n2, ReturnNode ret |
parameterValueFlow(p, n1) and
private predicate setterReturn(ParameterNode p, Content f, ReturnKind kind) {
exists(Node n1, Node n2 |
parameterValueFlowNoCtx(p, n1) and
store(n1, f, n2) and
localValueStep*(n2, ret)
localValueStep*(n2, getAReturnNodeOfKind(kind))
)
}
pragma[noinline]
private predicate read0(DataFlowCall call, ReturnKind kind, ArgumentNode arg, Content f) {
exists(ParameterNode p |
viableParamArg(call, p, arg) and
getter(p, f, kind)
)
}
@@ -169,21 +305,19 @@ private module ImplCommon {
predicate read(Node node1, Content f, Node node2) {
readStep(node1, f, node2) and storeStep(_, f, _)
or
exists(ParameterNode p, ArgumentNode arg |
arg = node1 and
viableParamArg(p, arg) and
getter(p, f) and
arg.argumentOf(node2.asExpr(), _) and
exists(DataFlowCall call, ReturnKind kind |
read0(call, kind, node1, f) and
node2 = getAnOutNode(call, kind) and
compatibleTypes(node1.getTypeBound(), f.getContainerType()) and
compatibleTypes(node2.getTypeBound(), f.getType())
)
}
private predicate getter(ParameterNode p, Content f) {
exists(Node n1, Node n2, ReturnNode ret |
parameterValueFlow(p, n1) and
private predicate getter(ParameterNode p, Content f, ReturnKind kind) {
exists(Node n1, Node n2 |
parameterValueFlowNoCtx(p, n1) and
read(n1, f, n2) and
localValueStep*(n2, ret)
localValueStep*(n2, getAReturnNodeOfKind(kind))
)
}
@@ -200,14 +334,14 @@ private module ImplCommon {
* Holds if `call` passes an implicit or explicit instance argument, i.e., an
* expression that reaches a `this` parameter.
*/
private predicate callHasInstanceArgument(Call call) {
private predicate callHasInstanceArgument(DataFlowCall call) {
exists(ArgumentNode arg | arg.argumentOf(call, -1))
}
cached
newtype TCallContext =
TAnyCallContext() or
TSpecificCall(Call call, int i, boolean emptyAp) {
TSpecificCall(DataFlowCall call, int i, boolean emptyAp) {
reducedViableImplInCallContext(_, _, call) and
(emptyAp = true or emptyAp = false) and
(
@@ -217,24 +351,34 @@ private module ImplCommon {
)
} or
TSomeCall(ParameterNode p, boolean emptyAp) { emptyAp = true or emptyAp = false } or
TReturn(Method m, MethodAccess ma) { reducedViableImplInReturn(m, ma) }
TReturn(DataFlowCallable c, DataFlowCall call) { reducedViableImplInReturn(c, call) }
cached
newtype TReturnPosition =
TReturnPosition0(DataFlowCallable c, ReturnKind kind) { returnPosition(_, c, kind) }
}
import ImplCommon
pragma[noinline]
private predicate returnPosition(ReturnNode ret, DataFlowCallable c, ReturnKind kind) {
c = returnNodeGetEnclosingCallable(ret) and
kind = ret.getKind()
}
/**
* A call context to restrict the targets of virtual dispatch and match the
* call sites of flow into a method with flow out of a method.
*
* There are four cases:
* - `TAnyCallContext()` : No restrictions on method flow.
* - `TSpecificCall(Call call, int i)` : Flow entered through the `i`th
* - `TSpecificCall(DataFlowCall call, int i)` : Flow entered through the `i`th
* parameter at the given `call`. This call improves the set of viable
* dispatch targets for at least one method call in the current callable.
* - `TSomeCall(ParameterNode p)` : Flow entered through parameter `p`. The
* originating call does not improve the set of dispatch targets for any
* method call in the current callable and was therefore not recorded.
* - `TReturn(Method m, MethodAccess ma)` : Flow reached `ma` from `m` and
* this dispatch target of `ma` implies a reduced set of dispatch origins
* - `TReturn(Callable c, DataFlowCall call)` : Flow reached `call` from `c` and
* this dispatch target of `call` implies a reduced set of dispatch origins
* to which data may flow if it should reach a `return` statement.
*/
abstract class CallContext extends TCallContext {
@@ -248,7 +392,11 @@ class CallContextAny extends CallContext, TAnyCallContext {
abstract class CallContextCall extends CallContext { }
class CallContextSpecificCall extends CallContextCall, TSpecificCall {
override string toString() { result = "CcCall" }
override string toString() {
exists(DataFlowCall call, int i | this = TSpecificCall(call, i, _) |
result = "CcCall(" + call + ", " + i + ")"
)
}
}
class CallContextSomeCall extends CallContextCall, TSomeCall {
@@ -256,23 +404,55 @@ class CallContextSomeCall extends CallContextCall, TSomeCall {
}
class CallContextReturn extends CallContext, TReturn {
override string toString() { result = "CcReturn" }
override string toString() {
exists(DataFlowCall call | this = TReturn(_, call) | result = "CcReturn(" + call + ")")
}
}
/** A callable tagged with a relevant return kind. */
class ReturnPosition extends TReturnPosition0 {
private DataFlowCallable c;
private ReturnKind kind;
ReturnPosition() { this = TReturnPosition0(c, kind) }
/** Gets the callable. */
DataFlowCallable getCallable() { result = c }
/** Gets the return kind. */
ReturnKind getKind() { result = kind }
/** Gets a textual representation of this return position. */
string toString() { result = "[" + kind + "] " + c }
}
pragma[noinline]
DataFlowCallable returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
pragma[noinline]
ReturnPosition getReturnPosition(ReturnNode ret) {
exists(DataFlowCallable c, ReturnKind k | returnPosition(ret, c, k) |
result = TReturnPosition0(c, k)
)
}
bindingset[cc, callable]
predicate resolveReturn(CallContext cc, Callable callable, Call call) {
predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
cc instanceof CallContextAny and callable = viableCallable(call)
or
exists(Method m0, MethodAccess ma0 |
ma0.getEnclosingCallable() = callable and
cc = TReturn(m0, ma0) and
m0 = prunedViableImplInCallContextReverse(ma0, call)
exists(DataFlowCallable c0, DataFlowCall call0 |
call0.getEnclosingCallable() = callable and
cc = TReturn(c0, call0) and
c0 = prunedViableImplInCallContextReverse(call0, call)
)
}
bindingset[call, cc]
Callable resolveCall(Call call, CallContext cc) {
exists(Call ctx | cc = TSpecificCall(ctx, _, _) |
DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
exists(DataFlowCall ctx | cc = TSpecificCall(ctx, _, _) |
if reducedViableImplInCallContext(call, _, ctx)
then result = prunedViableImplInCallContext(call, ctx)
else result = viableCallable(call)

342
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplDepr.qll
View File

@@ -1,16 +1,15 @@
/**
* Provides an implementation of global (interprocedural) data flow. This file
* re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
* and adds a global analysis, mainly exposed through the `Configuration` class.
* This file exists in several identical copies, allowing queries to use
* multiple `Configuration` classes that depend on each other without
* introducing mutual recursion among those configurations.
* re-exports the local (intraprocedural) data flow analysis from
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
* through the `Configuration` class. This file exists in several identical
* copies, allowing queries to use multiple `Configuration` classes that depend
* on each other without introducing mutual recursion among those configurations.
*/
import DataFlowUtil
private import DataFlowPrivate
private import DataFlowDispatch
private import DataFlowImplCommon
private import DataFlowImplSpecific::Private
import DataFlowImplSpecific::Public
/**
* A configuration of interprocedural data flow analysis. This defines
@@ -95,7 +94,7 @@ abstract class Configuration extends string {
/**
* Holds if data may flow from some source to `sink` for this configuration.
*/
predicate hasFlowToExpr(Expr sink) { hasFlowTo(exprNode(sink)) }
predicate hasFlowToExpr(DataFlowExpr sink) { hasFlowTo(exprNode(sink)) }
/** DEPRECATED: use `hasFlow` instead. */
deprecated predicate hasFlowForward(Node source, Node sink) { hasFlow(source, sink) }
@@ -114,7 +113,8 @@ private predicate additionalJumpStep(Node node1, Node node2, Configuration confi
pragma[noinline]
private predicate isAdditionalFlowStep(
Node node1, Node node2, Callable callable1, Callable callable2, Configuration config
Node node1, Node node2, DataFlowCallable callable1, DataFlowCallable callable2,
Configuration config
) {
config.isAdditionalFlowStep(node1, node2) and
callable1 = node1.getEnclosingCallable() and
@@ -125,7 +125,7 @@ private predicate isAdditionalFlowStep(
* Holds if the additional step from `node1` to `node2` does not jump between callables.
*/
private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
exists(Callable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
exists(DataFlowCallable callable | isAdditionalFlowStep(node1, node2, callable, callable, config))
}
/**
@@ -148,16 +148,17 @@ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue,
additionalLocalFlowStep(node1, node2, config) and preservesValue = false
}
pragma[noinline]
private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
result = ret.getEnclosingCallable()
}
/**
* Holds if field flow should be used for the given configuration.
*/
private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
pragma[noinline]
private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKind kind) {
viableImpl(call) = result.getCallable() and
kind = result.getKind()
}
/**
* Holds if `node` is reachable from a source in the given configuration
* ignoring call contexts.
@@ -198,22 +199,21 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
// flow into a callable
exists(Node arg |
nodeCandFwd1(arg, stored, config) and
viableParamArg(node, arg)
viableParamArg(_, node, arg)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
nodeCandFwd1(mid, stored, config) and
parameterValueFlowsToUpdate(p, mid) and
viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a callable
exists(Method m, MethodAccess ma, ReturnNode ret |
exists(DataFlowCall call, ReturnNode ret, ReturnKind kind |
nodeCandFwd1(ret, stored, config) and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node.asExpr() = ma
getReturnPosition(ret) = viableReturnPos(call, kind) and
node = getAnOutNode(call, kind)
)
)
}
@@ -275,22 +275,22 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
or
// flow into a callable
exists(Node param |
viableParamArg(param, node) and
viableParamArg(_, param, node) and
nodeCand1(param, stored, config)
)
or
// flow out of an argument
exists(PostUpdateNode mid, ParameterNode p |
parameterValueFlowsToUpdate(p, node) and
viableParamArg(p, mid.getPreUpdateNode()) and
viableParamArg(_, p, mid.getPreUpdateNode()) and
nodeCand1(mid, stored, config)
)
or
// flow out of a callable
exists(Method m, ExprNode ma |
nodeCand1(ma, stored, config) and
m = returnNodeGetEnclosingCallable(node) and
m = viableImpl(ma.getExpr())
exists(DataFlowCall call, ReturnKind kind, OutNode out |
nodeCand1(out, stored, config) and
getReturnPosition(node) = viableReturnPos(call, kind) and
out = getAnOutNode(call, kind)
)
)
}
@@ -316,11 +316,17 @@ private predicate readCand1(Content f, Configuration config) {
* from the configuration.
*/
pragma[nomagic]
private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
private predicate simpleParameterFlow(
ParameterNode p, Node node, DataFlowType t, Configuration config
) {
nodeCand1(node, false, config) and
p = node and
t = getErasedRepr(node.getType()) and
not parameterValueFlowsThrough(p)
exists(ReturnNode ret, ReturnKind kind |
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
kind = ret.getKind() and
not parameterValueFlowsThrough(p, kind, _)
)
or
nodeCand1(node, false, unbind(config)) and
exists(Node mid |
@@ -347,7 +353,7 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
nodeCand1(node, false, config) and
exists(Node arg |
simpleParameterFlow(p, arg, t, config) and
argumentValueFlowsThrough(arg, node) and
argumentValueFlowsThrough(arg, node, _) and
compatibleTypes(t, node.getType())
)
or
@@ -359,45 +365,55 @@ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Con
)
}
/**
* Holds if data can flow from `arg` through the `call` taking simple call
* contexts into consideration and that this is part of a path from a source
* to a sink. This is restricted to paths through the `call` that does not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, ExprNode call, RefType t, Configuration config
pragma[noinline]
private predicate simpleArgumentFlowsThrough0(
DataFlowCall call, ArgumentNode arg, ReturnKind kind, DataFlowType t, Configuration config
) {
exists(ParameterNode param, ReturnNode ret |
nodeCand1(arg, false, unbind(config)) and
nodeCand1(call, false, unbind(config)) and
viableParamArg(param, arg) and
simpleParameterFlow(param, ret, t, config) and
arg.argumentOf(call.getExpr(), _)
nodeCand1(arg, false, unbind(config)) and
exists(ParameterNode p, ReturnNode ret |
simpleParameterFlow(p, ret, t, config) and
kind = ret.getKind() and
viableParamArg(call, p, arg)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a method.
* Holds if data can flow from `arg` to `out` through a call, taking simple
* call contexts into consideration, and that this is part of a path from a
* source to a sink. This is restricted to paths through calls that do not
* necessarily preserve the value of `arg` by making use of at least one
* additional step from the configuration.
*/
private predicate flowThroughMethod(
private predicate simpleArgumentFlowsThrough(
ArgumentNode arg, Node out, DataFlowType t, Configuration config
) {
exists(DataFlowCall call, ReturnKind kind |
nodeCand1(out, false, unbind(config)) and
simpleArgumentFlowsThrough0(call, arg, kind, t, config) and
out = getAnOutNode(call, kind)
)
}
/**
* Holds if data can flow from `node1` to `node2` by a step through a callable.
*/
private predicate flowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false
or
argumentValueFlowsThrough(node1, node2) and preservesValue = true
argumentValueFlowsThrough(node1, node2, _) and preservesValue = true
}
/**
* Holds if data can flow from `node1` to `node2` in one local step or a step
* through a method.
* through a callable.
*/
private predicate localFlowStepOrFlowThroughMethod(
private predicate localFlowStepOrFlowThroughCallable(
Node node1, Node node2, boolean preservesValue, Configuration config
) {
localFlowStep(node1, node2, preservesValue, config) or
flowThroughMethod(node1, node2, preservesValue, config)
flowThroughCallable(node1, node2, preservesValue, config)
}
/**
@@ -412,15 +428,13 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
// flow out of an argument
exists(ParameterNode p |
parameterValueFlowsToUpdate(p, node1) and
viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
viableParamArg(_, p, node2.(PostUpdateNode).getPreUpdateNode())
)
or
// flow out of a method
exists(Method m, MethodAccess ma, ReturnNode ret |
ret = node1 and
m = returnNodeGetEnclosingCallable(ret) and
m = viableImpl(ma) and
node2.asExpr() = ma
// flow out of a callable
exists(DataFlowCall call, ReturnKind kind |
getReturnPosition(node1) = viableReturnPos(call, kind) and
node2 = getAnOutNode(call, kind)
)
)
}
@@ -430,7 +444,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
* path from a source to a sink.
*/
private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
viableParamArg(node2, node1) and
viableParamArg(_, node2, node1) and
nodeCand1(node1, _, unbind(config)) and
nodeCand1(node2, _, config)
}
@@ -505,7 +519,7 @@ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Confi
(
exists(Node mid, boolean preservesValue |
nodeCandFwd2(mid, fromArg, stored, config) and
localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
localFlowStepOrFlowThroughCallable(mid, node, preservesValue, config) and
(stored = false or preservesValue = true)
)
or
@@ -574,7 +588,7 @@ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configu
nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
(
exists(Node mid, boolean preservesValue |
localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
localFlowStepOrFlowThroughCallable(node, mid, preservesValue, config) and
nodeCand2(mid, toReturn, stored, config) and
(stored = false or preservesValue = true)
)
@@ -663,10 +677,10 @@ private predicate localFlowEntry(Node node, Configuration config) {
config.isSource(node) or
jumpStep(_, node, _, config) or
node instanceof ParameterNode or
node.asExpr() instanceof MethodAccess or
node instanceof OutNode or
node instanceof PostUpdateNode or
read(_, _, node) or
node.asExpr() instanceof CastExpr
node instanceof CastNode
)
}
@@ -679,12 +693,12 @@ private predicate localFlowExit(Node node, Configuration config) {
jumpStep(node, next, _, config) or
flowIntoCallable(node, next, config) or
flowOutOfCallable(node, next, config) or
flowThroughMethod(node, next, _, config) or
flowThroughCallable(node, next, _, config) or
store(node, _, next) or
read(node, _, next)
)
or
node.asExpr() instanceof CastExpr
node instanceof CastNode
or
config.isSink(node)
}
@@ -706,7 +720,7 @@ private predicate localFlowStepPlus(
exists(Node mid, boolean pv1, boolean pv2 |
localFlowStepPlus(node1, mid, pv1, config) and
localFlowStep(mid, node2, pv2, config) and
not mid.asExpr() instanceof CastExpr and
not mid instanceof CastNode and
preservesValue = pv1.booleanAnd(pv2) and
nodeCand(node2, unbind(config))
)
@@ -725,7 +739,7 @@ private predicate localFlowBigStep(
}
private newtype TAccessPathFront =
TFrontNil(Type t) or
TFrontNil(DataFlowType t) or
TFrontHead(Content f)
/**
@@ -733,12 +747,12 @@ private newtype TAccessPathFront =
*/
private class AccessPathFront extends TAccessPathFront {
string toString() {
exists(Type t | this = TFrontNil(t) | result = ppReprType(t))
exists(DataFlowType t | this = TFrontNil(t) | result = ppReprType(t))
or
exists(Content f | this = TFrontHead(f) | result = f.toString())
}
Type getType() {
DataFlowType getType() {
this = TFrontNil(result)
or
exists(Content head | this = TFrontHead(head) | result = head.getContainerType())
@@ -755,8 +769,8 @@ private class AccessPathFrontNil extends AccessPathFront, TFrontNil { }
private class CastingNode extends Node {
CastingNode() {
this instanceof ParameterNode or
this.asExpr() instanceof CastExpr or
this.asExpr() instanceof MethodAccess or
this instanceof CastNode or
this instanceof OutNode or
this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
}
}
@@ -819,7 +833,7 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowCandFwd(mid, fromArg, apf0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and apf = apf0
or
@@ -915,7 +929,7 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
)
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flowCand(mid, toReturn, apf0, config) and
(
preservesValue = true and apf = apf0
@@ -954,7 +968,7 @@ private predicate consCand(Content f, AccessPathFront apf, Configuration config)
}
private newtype TAccessPath =
TNil(Type t) or
TNil(DataFlowType t) or
TCons(Content f, int len) { len in [1 .. 5] }
/**
@@ -975,7 +989,7 @@ private class AccessPath extends TAccessPath {
this = TCons(_, result)
}
Type getType() {
DataFlowType getType() {
this = TNil(result)
or
exists(Content head | this = TCons(head, _) | result = head.getContainerType())
@@ -985,9 +999,11 @@ private class AccessPath extends TAccessPath {
}
private class AccessPathNil extends AccessPath, TNil {
override string toString() { exists(Type t | this = TNil(t) | result = ppReprType(t)) }
override string toString() { exists(DataFlowType t | this = TNil(t) | result = ppReprType(t)) }
override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
override AccessPathFront getFront() {
exists(DataFlowType t | this = TNil(t) | result = TFrontNil(t))
}
}
private class AccessPathCons extends AccessPath, TCons {
@@ -1083,7 +1099,7 @@ private predicate flowFwd0(
or
exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
flowFwd(mid, fromArg, apf0, ap0, config) and
flowThroughMethod(mid, node, preservesValue, config) and
flowThroughCallable(mid, node, preservesValue, config) and
(
preservesValue = true and ap = ap0 and apf = apf0
or
@@ -1196,7 +1212,7 @@ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuratio
)
or
exists(Node mid, boolean preservesValue, AccessPath ap0 |
flowThroughMethod(node, mid, preservesValue, config) and
flowThroughCallable(node, mid, preservesValue, config) and
flow(mid, toReturn, ap0, config) and
(
preservesValue = true and ap = ap0
@@ -1255,7 +1271,7 @@ private newtype TPathNode =
or
// ... or a step from an existing PathNode to another node.
exists(PathNodeMid mid |
flowStep(mid, node, cc, ap) and
pathStep(mid, node, cc, ap) and
config = mid.getConfiguration() and
flow(node, _, ap, unbind(config))
)
@@ -1274,8 +1290,14 @@ abstract class PathNode extends TPathNode {
/** Gets a textual representation of this element. */
string toString() { result = getNode().toString() + ppAp() }
/**
* Gets a textual representation of this element, including a textual
* representation of the call context.
*/
string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
/** Gets the source location for this element. */
Location getLocation() { result = getNode().getLocation() }
DataFlowLocation getLocation() { result = getNode().getLocation() }
/** Gets the underlying `Node`. */
abstract Node getNode();
@@ -1284,20 +1306,31 @@ abstract class PathNode extends TPathNode {
abstract Configuration getConfiguration();
/** Gets a successor. */
abstract PathNode getSucc();
deprecated final PathNode getSucc() { result = this.getASuccessor() }
/** Gets a successor of this node, if any. */
abstract PathNode getASuccessor();
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
result = " [" + this.(PathNodeMid).getAp().toString() + "]"
exists(string s | s = this.(PathNodeMid).getAp().toString() |
if s = "" then result = "" else result = " [" + s + "]"
)
}
private string ppCtx() {
this instanceof PathNodeSink and result = ""
or
result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
}
}
/** Holds if `n` can reach a sink. */
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getASuccessor()) }
/** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
private predicate pathSucc(PathNode n1, PathNode n2) { n1.getASuccessor() = n2 and reach(n2) }
private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
@@ -1333,11 +1366,11 @@ private class PathNodeMid extends PathNode, TPathNodeMid {
override Configuration getConfiguration() { result = config }
private PathNodeMid getSuccMid() {
flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
pathStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
result.getConfiguration() = unbind(this.getConfiguration())
}
override PathNode getSucc() {
override PathNode getASuccessor() {
// an intermediate step to another intermediate node
result = getSuccMid()
or
@@ -1391,14 +1424,14 @@ private class PathNodeSink extends PathNode, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNode getSucc() { none() }
override PathNode getASuccessor() { none() }
}
/**
* Holds if data may flow from `mid` to `node`. The last step in or out of
* a callable is recorded by `cc`.
*/
private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
cc = mid.getCallContext() and
ap = mid.getAp()
@@ -1421,15 +1454,15 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
or
exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
or
flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
pathOutOfArgument(mid, node, cc) and ap = mid.getAp()
or
flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
pathIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
or
flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
or
flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
pathThroughCallable(mid, node, cc) and ap = TNil(getErasedRepr(node.getType()))
or
valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
}
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1449,37 +1482,41 @@ private predicate contentStoreStep(
cc = mid.getCallContext()
}
/**
* Holds if data may flow from `mid` to an exit of `m` in the context
* `innercc`, and the path did not flow through a parameter of `m`.
*/
private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
exists(ReturnNode ret |
ret = mid.getNode() and
innercc = mid.getCallContext() and
m = returnNodeGetEnclosingCallable(ret) and
not innercc instanceof CallContextCall
private predicate pathOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallContext innercc) {
pos = getReturnPosition(mid.getNode()) and
innercc = mid.getCallContext() and
not innercc instanceof CallContextCall
}
pragma[noinline]
private predicate pathOutOfCallable1(
PathNodeMid mid, DataFlowCall call, ReturnKind kind, CallContext cc
) {
exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
pathOutOfCallable0(mid, pos, innercc) and
c = pos.getCallable() and
kind = pos.getKind() and
resolveReturn(innercc, c, call)
|
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
)
}
/**
* Holds if data may flow from `mid` to `ma`. The last step of this path
* is a return from a method and is recorded by `cc`, if needed.
* Holds if data may flow from `mid` to `out`. The last step of this path
* is a return from a callable and is recorded by `cc`, if needed.
*/
pragma[noinline]
private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
exists(Method m, CallContext innercc |
flowOutOfMethod0(mid, m, innercc) and
resolveReturn(innercc, m, ma)
|
if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
private predicate pathOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(ReturnKind kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
out = getAnOutNode(call, kind)
)
}
private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
private predicate pathOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
exists(
PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call,
ArgumentNode arg
PostUpdateNode n, ParameterNode p, DataFlowCallable callable, CallContext innercc, int i,
DataFlowCall call, ArgumentNode arg
|
mid.getNode() = n and
parameterValueFlowsToUpdate(p, n) and
@@ -1500,7 +1537,9 @@ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallCo
* Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
*/
pragma[noinline]
private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
private predicate pathIntoArg(
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, boolean emptyAp
) {
exists(ArgumentNode arg, AccessPath ap |
arg = mid.getNode() and
cc = mid.getCallContext() and
@@ -1514,7 +1553,7 @@ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call,
}
pragma[noinline]
private predicate parameterCand(Callable callable, int i, Configuration config) {
private predicate parameterCand(DataFlowCallable callable, int i, Configuration config) {
exists(ParameterNode p |
flow(p, config) and
p.isParameterOf(callable, i)
@@ -1522,10 +1561,11 @@ private predicate parameterCand(Callable callable, int i, Configuration config)
}
pragma[nomagic]
private predicate flowIntoCallable0(
PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp
private predicate pathIntoCallable0(
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
boolean emptyAp
) {
flowIntoArg(mid, i, outercc, call, emptyAp) and
pathIntoArg(mid, i, outercc, call, emptyAp) and
callable = resolveCall(call, outercc) and
parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
}
@@ -1535,11 +1575,11 @@ private predicate flowIntoCallable0(
* before and after entering the callable are `outercc` and `innercc`,
* respectively.
*/
private predicate flowIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call
private predicate pathIntoCallable(
PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, DataFlowCall call
) {
exists(int i, Callable callable, boolean emptyAp |
flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
exists(int i, DataFlowCallable callable, boolean emptyAp |
pathIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
p.isParameterOf(callable, i)
|
if reducedViableImplInCallContext(_, callable, call)
@@ -1548,11 +1588,14 @@ private predicate flowIntoCallable(
)
}
/** Holds if data may flow from `p` to a return statement in the callable. */
/** Holds if data may flow from `p` to a return of kind `kind`. */
pragma[nomagic]
private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
private predicate paramFlowsThrough(
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
) {
exists(PathNodeMid mid, ReturnNode ret |
mid.getNode() = ret and
kind = ret.getKind() and
cc = mid.getCallContext() and
config = mid.getConfiguration() and
mid.getAp() instanceof AccessPathNil
@@ -1565,25 +1608,44 @@ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configu
)
}
/**
* Holds if data may flow from `mid` to an argument of `methodcall`,
* through a called method `m`, and back out through a return statement in
* `m`. The context `cc` is restored to its value prior to entering `m`.
*/
pragma[noinline]
private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
private predicate pathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
flowIntoCallable(mid, p, cc, innercc, methodcall) and
paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p) and
pathIntoCallable(mid, p, cc, innercc, call) and
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
not parameterValueFlowsThrough(p, kind, innercc) and
mid.getAp() instanceof AccessPathNil
)
}
private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
exists(ParameterNode p |
flowIntoCallable(mid, p, cc, _, methodcall) and
parameterValueFlowsThrough(p)
/**
* Holds if data may flow from `mid` through a callable to the node `out`.
* The context `cc` is restored to its value prior to entering the callable.
*/
pragma[noinline]
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
pathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}
pragma[noinline]
private predicate valuePathThroughCallable0(
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
) {
exists(ParameterNode p, CallContext innercc |
pathIntoCallable(mid, p, cc, innercc, call) and
parameterValueFlowsThrough(p, kind, innercc)
)
}
private predicate valuePathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
exists(DataFlowCall call, ReturnKind kind |
valuePathThroughCallable0(call, mid, kind, cc) and
out = getAnOutNode(call, kind)
)
}

11
java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplSpecific.qll Normal file
View File

@@ -0,0 +1,11 @@
/**
* Provides Java-specific definitions for use in the data flow library.
*/
module Private {
import DataFlowPrivate
import DataFlowDispatch
}
module Public {
import DataFlowUtil
}

57
java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
View File

@@ -1,8 +1,29 @@
import java
private import java
private import DataFlowUtil
private import DataFlowDispatch
private import semmle.code.java.dataflow.SSA
private import semmle.code.java.dataflow.TypeFlow
private newtype TReturnKind = TNormalReturnKind()
/**
* A return kind. A return kind describes how a value can be returned
* from a callable. For Java, this is simply a method return.
*/
class ReturnKind extends TReturnKind {
/** Gets a textual representation of this return kind. */
string toString() { result = "return" }
}
/**
* Gets a node that can read the value returned from `call` with return kind
* `kind`.
*/
OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
result = call.getNode() and
kind = TNormalReturnKind()
}
/**
* A data flow node that occurs as the argument of a call and is passed as-is
* to the callable. Arguments that are wrapped in an implicit varargs array
@@ -22,7 +43,7 @@ class ArgumentNode extends Node {
* Holds if this argument occurs at the given position in the given call.
* The instance argument is considered to have index `-1`.
*/
predicate argumentOf(Call call, int pos) {
predicate argumentOf(DataFlowCall call, int pos) {
exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
or
call = this.(ImplicitVarargsArray).getCall() and
@@ -30,11 +51,25 @@ class ArgumentNode extends Node {
or
pos = -1 and this = getInstanceArgument(call)
}
/** Gets the call in which this node is an argument. */
DataFlowCall getCall() { this.argumentOf(result, _) }
}
/** A data flow node that occurs as the result of a `ReturnStmt`. */
class ReturnNode extends ExprNode {
ReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getResult()) }
/** Gets the kind of this returned value. */
ReturnKind getKind() { any() }
}
/** A data flow node that represents the output of a call. */
class OutNode extends ExprNode {
OutNode() { this.getExpr() instanceof MethodAccess }
/** Gets the underlying call. */
DataFlowCall getCall() { result = this.getExpr() }
}
/**
@@ -230,3 +265,21 @@ predicate compatibleTypes(Type t1, Type t2) {
canContainBool(e1) and canContainBool(e2)
)
}
/** A node that performs a type cast. */
class CastNode extends ExprNode {
CastNode() { this.getExpr() instanceof CastExpr }
}
class DataFlowCallable = Callable;
class DataFlowExpr = Expr;
class DataFlowType = RefType;
class DataFlowLocation = Location;
class DataFlowCall extends Call {
/** Gets the data flow node corresponding to this call. */
ExprNode getNode() { result.getExpr() = this }
}