hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make taint tracking less syntactic.

Browse Source
This commit is contained in:
Max Schaefer
2020-01-17 12:44:34 +00:00
parent 9f897132f2
commit 64049d8f3d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ql/src/semmle/go/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -59,9 +59,9 @@ predicate localAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
/** Holds if taint flows from `pred` to `succ` via a reference or dereference. */
predicate referenceStep(DataFlow::Node pred, DataFlow::Node succ) {
succ.asExpr().(AddressExpr).getOperand() = pred.asExpr()
succ.(DataFlow::AddressOperationNode).getOperand() = pred
or
succ.asExpr().(StarExpr).getBase() = pred.asExpr()
succ.(DataFlow::PointerDereferenceNode).getOperand() = pred
}
/** Holds if taint flows from `pred` to `succ` via a field read. */
@@ -71,7 +71,7 @@ predicate fieldReadStep(DataFlow::Node pred, DataFlow::Node succ) {
/** Holds if taint flows from `pred` to `succ` via an array index operation. */
predicate arrayStep(DataFlow::Node pred, DataFlow::Node succ) {
succ.asExpr().(IndexExpr).getBase() = pred.asExpr()
succ.(DataFlow::ElementReadNode).getBase() = pred
}
/** Holds if taint flows from `pred` to `succ` via an extract tuple operation. */
@@ -88,7 +88,7 @@ predicate stringConcatStep(DataFlow::Node pred, DataFlow::Node succ) {
/** Holds if taint flows from `pred` to `succ` via a slice operation. */
predicate sliceStep(DataFlow::Node pred, DataFlow::Node succ) {
succ.asExpr().(SliceExpr).getBase() = pred.asExpr()
succ.(DataFlow::SliceNode).getBase() = pred
}
/** Holds if taint flows from `pred` to `succ` via a function model. */