hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

patch upper-case acronyms to be PascalCase

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-03-11 11:10:33 +01:00
parent e3a15792fa
commit 69353bb014
422 changed files with 3532 additions and 2244 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/lib/semmle/code/cpp/Print.qll
View File

@@ -8,9 +8,9 @@ private import PrintAST
private predicate shouldPrintDeclaration(Declaration decl) {
not decl instanceof Function
or
not exists(PrintASTConfiguration c)
not exists(PrintAstConfiguration c)
or
exists(PrintASTConfiguration config | config.shouldPrintFunction(decl))
exists(PrintAstConfiguration config | config.shouldPrintFunction(decl))
}
/**

2
cpp/ql/lib/semmle/code/cpp/PrintAST.ql
View File

@@ -12,7 +12,7 @@ import PrintAST
* Temporarily tweak this class or make a copy to control which functions are
* printed.
*/
class Cfg extends PrintASTConfiguration {
class Cfg extends PrintAstConfiguration {
/**
* TWEAK THIS PREDICATE AS NEEDED.
* Holds if the AST for `func` should be printed.

129
cpp/ql/lib/semmle/code/cpp/PrintAST.qll
View File

@@ -9,12 +9,12 @@
import cpp
private import semmle.code.cpp.Print
private newtype TPrintASTConfiguration = MkPrintASTConfiguration()
private newtype TPrintAstConfiguration = MkPrintAstConfiguration()
/**
* The query can extend this class to control which functions are printed.
*/
class PrintASTConfiguration extends TPrintASTConfiguration {
class PrintAstConfiguration extends TPrintAstConfiguration {
/**
* Gets a textual representation of this `PrintASTConfiguration`.
*/
@@ -27,8 +27,11 @@ class PrintASTConfiguration extends TPrintASTConfiguration {
predicate shouldPrintFunction(Function func) { any() }
}
/** DEPRECATED: Alias for PrintAstConfiguration */
deprecated class PrintASTConfiguration = PrintAstConfiguration;
private predicate shouldPrintFunction(Function func) {
exists(PrintASTConfiguration config | config.shouldPrintFunction(func))
exists(PrintAstConfiguration config | config.shouldPrintFunction(func))
}
bindingset[s]
@@ -85,8 +88,8 @@ private Function getEnclosingFunction(Locatable ast) {
* Most nodes are just a wrapper around `Locatable`, but we do synthesize new
* nodes for things like parameter lists and constructor init lists.
*/
private newtype TPrintASTNode =
TASTNode(Locatable ast) { shouldPrintFunction(getEnclosingFunction(ast)) } or
private newtype TPrintAstNode =
TAstNode(Locatable ast) { shouldPrintFunction(getEnclosingFunction(ast)) } or
TDeclarationEntryNode(DeclStmt stmt, DeclarationEntry entry) {
// We create a unique node for each pair of (stmt, entry), to avoid having one node with
// multiple parents due to extractor bug CPP-413.
@@ -106,7 +109,7 @@ private newtype TPrintASTNode =
/**
* A node in the output tree.
*/
class PrintASTNode extends TPrintASTNode {
class PrintAstNode extends TPrintAstNode {
/**
* Gets a textual representation of this node in the PrintAST output tree.
*/
@@ -116,17 +119,17 @@ class PrintASTNode extends TPrintASTNode {
* Gets the child node at index `childIndex`. Child indices must be unique,
* but need not be contiguous.
*/
abstract PrintASTNode getChildInternal(int childIndex);
abstract PrintAstNode getChildInternal(int childIndex);
/**
* Gets the child node at index `childIndex`.
* Adds edges to fully converted expressions, that are not part of the
* regular parent/child relation traversal.
*/
final PrintASTNode getChild(int childIndex) {
final PrintAstNode getChild(int childIndex) {
// The exact value of `childIndex` doesn't matter, as long as we preserve the correct order.
result =
rank[childIndex](PrintASTNode child, int nonConvertedIndex, boolean isConverted |
rank[childIndex](PrintAstNode child, int nonConvertedIndex, boolean isConverted |
childAndAccessorPredicate(child, _, nonConvertedIndex, isConverted)
|
// Unconverted children come first, then sort by original child index within each group.
@@ -138,11 +141,11 @@ class PrintASTNode extends TPrintASTNode {
* Gets the node for the `.getFullyConverted()` version of the child originally at index
* `childIndex`, if that node has any conversions.
*/
private PrintASTNode getConvertedChild(int childIndex) {
private PrintAstNode getConvertedChild(int childIndex) {
exists(Expr expr |
expr = getChildInternal(childIndex).(ASTNode).getAST() and
expr = getChildInternal(childIndex).(AstNode).getAst() and
expr.getFullyConverted() instanceof Conversion and
result.(ASTNode).getAST() = expr.getFullyConverted() and
result.(AstNode).getAst() = expr.getFullyConverted() and
not expr instanceof Conversion
)
}
@@ -166,12 +169,12 @@ class PrintASTNode extends TPrintASTNode {
/**
* Gets the children of this node.
*/
final PrintASTNode getAChild() { result = getChild(_) }
final PrintAstNode getAChild() { result = getChild(_) }
/**
* Gets the parent of this node, if any.
*/
final PrintASTNode getParent() { result.getAChild() = this }
final PrintAstNode getParent() { result.getAChild() = this }
/**
* Gets the location of this node in the source code.
@@ -196,7 +199,7 @@ class PrintASTNode extends TPrintASTNode {
* one result tuple, with `isConverted = false`.
*/
private predicate childAndAccessorPredicate(
PrintASTNode child, string childPredicate, int nonConvertedIndex, boolean isConverted
PrintAstNode child, string childPredicate, int nonConvertedIndex, boolean isConverted
) {
child = getChildInternal(nonConvertedIndex) and
childPredicate = getChildAccessorPredicateInternal(nonConvertedIndex) and
@@ -234,12 +237,15 @@ class PrintASTNode extends TPrintASTNode {
private Function getEnclosingFunction() { result = getParent*().(FunctionNode).getFunction() }
}
/** DEPRECATED: Alias for PrintAstNode */
deprecated class PrintASTNode = PrintAstNode;
/**
* Class that restricts the elements that we compute `qlClass` for.
*/
private class PrintableElement extends Element {
PrintableElement() {
exists(TASTNode(this))
exists(TAstNode(this))
or
exists(TDeclarationEntryNode(_, this))
or
@@ -262,7 +268,7 @@ private string qlClass(PrintableElement el) {
/**
* A node representing an AST node.
*/
abstract class BaseASTNode extends PrintASTNode {
abstract class BaseAstNode extends PrintAstNode {
Locatable ast;
override string toString() { result = qlClass(ast) + ast.toString() }
@@ -272,25 +278,34 @@ abstract class BaseASTNode extends PrintASTNode {
/**
* Gets the AST represented by this node.
*/
final Locatable getAST() { result = ast }
final Locatable getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated Locatable getAST() { result = getAst() }
}
/** DEPRECATED: Alias for BaseAstNode */
deprecated class BaseASTNode = BaseAstNode;
/**
* A node representing an AST node other than a `DeclarationEntry`.
*/
abstract class ASTNode extends BaseASTNode, TASTNode {
ASTNode() { this = TASTNode(ast) }
abstract class AstNode extends BaseAstNode, TAstNode {
AstNode() { this = TAstNode(ast) }
}
/** DEPRECATED: Alias for AstNode */
deprecated class ASTNode = AstNode;
/**
* A node representing an `Expr`.
*/
class ExprNode extends ASTNode {
class ExprNode extends AstNode {
Expr expr;
ExprNode() { expr = ast }
override ASTNode getChildInternal(int childIndex) { result.getAST() = expr.getChild(childIndex) }
override AstNode getChildInternal(int childIndex) { result.getAst() = expr.getChild(childIndex) }
override string getProperty(string key) {
result = super.getProperty(key)
@@ -306,7 +321,7 @@ class ExprNode extends ASTNode {
}
override string getChildAccessorPredicateInternal(int childIndex) {
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST())
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAst())
}
/**
@@ -334,9 +349,9 @@ class ConversionNode extends ExprNode {
ConversionNode() { conv = expr }
override ASTNode getChildInternal(int childIndex) {
override AstNode getChildInternal(int childIndex) {
childIndex = 0 and
result.getAST() = conv.getExpr() and
result.getAst() = conv.getExpr() and
conv.getExpr() instanceof Conversion
}
}
@@ -363,27 +378,27 @@ class CastNode extends ConversionNode {
class StmtExprNode extends ExprNode {
override StmtExpr expr;
override ASTNode getChildInternal(int childIndex) {
override AstNode getChildInternal(int childIndex) {
childIndex = 0 and
result.getAST() = expr.getStmt()
result.getAst() = expr.getStmt()
}
}
/**
* A node representing a `DeclarationEntry`.
*/
class DeclarationEntryNode extends BaseASTNode, TDeclarationEntryNode {
class DeclarationEntryNode extends BaseAstNode, TDeclarationEntryNode {
override DeclarationEntry ast;
DeclStmt declStmt;
DeclarationEntryNode() { this = TDeclarationEntryNode(declStmt, ast) }
override PrintASTNode getChildInternal(int childIndex) { none() }
override PrintAstNode getChildInternal(int childIndex) { none() }
override string getChildAccessorPredicateInternal(int childIndex) { none() }
override string getProperty(string key) {
result = BaseASTNode.super.getProperty(key)
result = BaseAstNode.super.getProperty(key)
or
key = "Type" and
result = qlClass(ast.getType()) + ast.getType().toString()
@@ -396,9 +411,9 @@ class DeclarationEntryNode extends BaseASTNode, TDeclarationEntryNode {
class VariableDeclarationEntryNode extends DeclarationEntryNode {
override VariableDeclarationEntry ast;
override ASTNode getChildInternal(int childIndex) {
override AstNode getChildInternal(int childIndex) {
childIndex = 0 and
result.getAST() = ast.getVariable().getInitializer()
result.getAst() = ast.getVariable().getInitializer()
}
override string getChildAccessorPredicateInternal(int childIndex) {
@@ -410,23 +425,23 @@ class VariableDeclarationEntryNode extends DeclarationEntryNode {
/**
* A node representing a `Stmt`.
*/
class StmtNode extends ASTNode {
class StmtNode extends AstNode {
Stmt stmt;
StmtNode() { stmt = ast }
override BaseASTNode getChildInternal(int childIndex) {
override BaseAstNode getChildInternal(int childIndex) {
exists(Locatable child |
child = stmt.getChild(childIndex) and
(
result.getAST() = child.(Expr) or
result.getAST() = child.(Stmt)
result.getAst() = child.(Expr) or
result.getAst() = child.(Stmt)
)
)
}
override string getChildAccessorPredicateInternal(int childIndex) {
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST())
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAst())
}
}
@@ -449,12 +464,12 @@ class DeclStmtNode extends StmtNode {
/**
* A node representing a `Parameter`.
*/
class ParameterNode extends ASTNode {
class ParameterNode extends AstNode {
Parameter param;
ParameterNode() { param = ast }
final override PrintASTNode getChildInternal(int childIndex) { none() }
final override PrintAstNode getChildInternal(int childIndex) { none() }
final override string getChildAccessorPredicateInternal(int childIndex) { none() }
@@ -469,14 +484,14 @@ class ParameterNode extends ASTNode {
/**
* A node representing an `Initializer`.
*/
class InitializerNode extends ASTNode {
class InitializerNode extends AstNode {
Initializer init;
InitializerNode() { init = ast }
override ASTNode getChildInternal(int childIndex) {
override AstNode getChildInternal(int childIndex) {
childIndex = 0 and
result.getAST() = init.getExpr()
result.getAst() = init.getExpr()
}
override string getChildAccessorPredicateInternal(int childIndex) {
@@ -488,7 +503,7 @@ class InitializerNode extends ASTNode {
/**
* A node representing the parameters of a `Function`.
*/
class ParametersNode extends PrintASTNode, TParametersNode {
class ParametersNode extends PrintAstNode, TParametersNode {
Function func;
ParametersNode() { this = TParametersNode(func) }
@@ -497,8 +512,8 @@ class ParametersNode extends PrintASTNode, TParametersNode {
final override Location getLocation() { result = getRepresentativeLocation(func) }
override ASTNode getChildInternal(int childIndex) {
result.getAST() = func.getParameter(childIndex)
override AstNode getChildInternal(int childIndex) {
result.getAst() = func.getParameter(childIndex)
}
override string getChildAccessorPredicateInternal(int childIndex) {
@@ -515,7 +530,7 @@ class ParametersNode extends PrintASTNode, TParametersNode {
/**
* A node representing the initializer list of a `Constructor`.
*/
class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializersNode {
class ConstructorInitializersNode extends PrintAstNode, TConstructorInitializersNode {
Constructor ctor;
ConstructorInitializersNode() { this = TConstructorInitializersNode(ctor) }
@@ -524,8 +539,8 @@ class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializers
final override Location getLocation() { result = getRepresentativeLocation(ctor) }
final override ASTNode getChildInternal(int childIndex) {
result.getAST() = ctor.getInitializer(childIndex)
final override AstNode getChildInternal(int childIndex) {
result.getAst() = ctor.getInitializer(childIndex)
}
final override string getChildAccessorPredicateInternal(int childIndex) {
@@ -542,7 +557,7 @@ class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializers
/**
* A node representing the destruction list of a `Destructor`.
*/
class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNode {
class DestructorDestructionsNode extends PrintAstNode, TDestructorDestructionsNode {
Destructor dtor;
DestructorDestructionsNode() { this = TDestructorDestructionsNode(dtor) }
@@ -551,8 +566,8 @@ class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNo
final override Location getLocation() { result = getRepresentativeLocation(dtor) }
final override ASTNode getChildInternal(int childIndex) {
result.getAST() = dtor.getDestruction(childIndex)
final override AstNode getChildInternal(int childIndex) {
result.getAst() = dtor.getDestruction(childIndex)
}
final override string getChildAccessorPredicateInternal(int childIndex) {
@@ -569,14 +584,14 @@ class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNo
/**
* A node representing a `Function`.
*/
class FunctionNode extends ASTNode {
class FunctionNode extends AstNode {
Function func;
FunctionNode() { func = ast }
override string toString() { result = qlClass(func) + getIdentityString(func) }
override PrintASTNode getChildInternal(int childIndex) {
override PrintAstNode getChildInternal(int childIndex) {
childIndex = 0 and
result.(ParametersNode).getFunction() = func
or
@@ -584,7 +599,7 @@ class FunctionNode extends ASTNode {
result.(ConstructorInitializersNode).getConstructor() = func
or
childIndex = 2 and
result.(ASTNode).getAST() = func.getEntryPoint()
result.(AstNode).getAst() = func.getEntryPoint()
or
childIndex = 3 and
result.(DestructorDestructionsNode).getDestructor() = func
@@ -603,7 +618,7 @@ class FunctionNode extends ASTNode {
private int getOrder() {
this =
rank[result](FunctionNode node, Function function, string file, int line, int column |
node.getAST() = function and
node.getAst() = function and
locationSortKeys(function, file, line, column)
|
node order by file, line, column, getIdentityString(function)
@@ -856,7 +871,7 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
}
/** Holds if `node` belongs to the output tree, and its property `key` has the given `value`. */
query predicate nodes(PrintASTNode node, string key, string value) {
query predicate nodes(PrintAstNode node, string key, string value) {
node.shouldPrint() and
value = node.getProperty(key)
}
@@ -865,7 +880,7 @@ query predicate nodes(PrintASTNode node, string key, string value) {
* Holds if `target` is a child of `source` in the AST, and property `key` of the edge has the
* given `value`.
*/
query predicate edges(PrintASTNode source, PrintASTNode target, string key, string value) {
query predicate edges(PrintAstNode source, PrintAstNode target, string key, string value) {
exists(int childIndex |
source.shouldPrint() and
target.shouldPrint() and

4
cpp/ql/lib/semmle/code/cpp/XML.qll
View File

@@ -4,11 +4,11 @@
import semmle.files.FileSystem
private class TXMLLocatable =
private class TXmlLocatable =
@xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
/** An XML element that has a location. */
class XMLLocatable extends @xmllocatable, TXMLLocatable {
class XMLLocatable extends @xmllocatable, TXmlLocatable {
/** Gets the source location for this element. */
Location getLocation() { xmllocations(this, result) }

6
cpp/ql/lib/semmle/code/cpp/controlflow/ControlFlowGraph.qll
View File

@@ -65,7 +65,7 @@ class ControlFlowNode extends Locatable, ControlFlowNodeBase {
* taken when this expression is true.
*/
ControlFlowNode getATrueSuccessor() {
qlCFGTrueSuccessor(this, result) and
qlCfgTrueSuccessor(this, result) and
result = this.getASuccessor()
}
@@ -74,7 +74,7 @@ class ControlFlowNode extends Locatable, ControlFlowNodeBase {
* taken when this expression is false.
*/
ControlFlowNode getAFalseSuccessor() {
qlCFGFalseSuccessor(this, result) and
qlCfgFalseSuccessor(this, result) and
result = this.getASuccessor()
}
@@ -121,7 +121,7 @@ abstract class AdditionalControlFlowEdge extends ControlFlowNodeBase {
* `AdditionalControlFlowEdge`. Use this relation instead of `qlCFGSuccessor`.
*/
predicate successors_extended(ControlFlowNodeBase source, ControlFlowNodeBase target) {
qlCFGSuccessor(source, target)
qlCfgSuccessor(source, target)
or
source.(AdditionalControlFlowEdge).getAnEdgeTarget() = target
}

10
cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
View File

@@ -33,8 +33,8 @@ class GuardCondition extends Expr {
or
// the IR short-circuits if(!x)
// don't produce a guard condition for `y = !x` and other non-short-circuited cases
not exists(Instruction inst | this.getFullyConverted() = inst.getAST()) and
exists(IRGuardCondition ir | this.(NotExpr).getOperand() = ir.getAST())
not exists(Instruction inst | this.getFullyConverted() = inst.getAst()) and
exists(IRGuardCondition ir | this.(NotExpr).getOperand() = ir.getAst())
}
/**
@@ -146,8 +146,8 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
*/
private class GuardConditionFromShortCircuitNot extends GuardCondition, NotExpr {
GuardConditionFromShortCircuitNot() {
not exists(Instruction inst | this.getFullyConverted() = inst.getAST()) and
exists(IRGuardCondition ir | this.getOperand() = ir.getAST())
not exists(Instruction inst | this.getFullyConverted() = inst.getAst()) and
exists(IRGuardCondition ir | this.getOperand() = ir.getAst())
}
override predicate controls(BasicBlock controlled, boolean testIsTrue) {
@@ -241,7 +241,7 @@ private class GuardConditionFromIR extends GuardCondition {
private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
exists(IRBlock irb |
forex(IRGuardCondition inst | inst = ir | inst.controls(irb, testIsTrue)) and
irb.getAnInstruction().getAST().(ControlFlowNode).getBasicBlock() = controlled and
irb.getAnInstruction().getAst().(ControlFlowNode).getBasicBlock() = controlled and
not isUnreachedBlock(irb)
)
}

19
cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll
View File

@@ -10,10 +10,13 @@ import SSAUtils
* The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA.
* This class provides the standard SSA logic.
*/
library class StandardSSA extends SSAHelper {
StandardSSA() { this = 0 }
library class StandardSsa extends SsaHelper {
StandardSsa() { this = 0 }
}
/** DEPRECATED: Alias for StandardSsa */
deprecated class StandardSSA = StandardSsa;
/**
* A definition of one or more SSA variables, including phi node definitions.
* An _SSA variable_, as defined in the literature, is effectively the pair of
@@ -27,22 +30,22 @@ library class StandardSSA extends SSAHelper {
* statically seen to be unreachable.
*/
class SsaDefinition extends ControlFlowNodeBase {
SsaDefinition() { exists(StandardSSA x | x.ssa_defn(_, this, _, _)) }
SsaDefinition() { exists(StandardSsa x | x.ssa_defn(_, this, _, _)) }
/**
* Gets a variable corresponding to an SSA StackVariable defined by
* this definition.
*/
StackVariable getAVariable() { exists(StandardSSA x | x.ssa_defn(result, this, _, _)) }
StackVariable getAVariable() { exists(StandardSsa x | x.ssa_defn(result, this, _, _)) }
/**
* Gets a string representation of the SSA variable represented by the pair
* `(this, v)`.
*/
string toString(StackVariable v) { exists(StandardSSA x | result = x.toString(this, v)) }
string toString(StackVariable v) { exists(StandardSsa x | result = x.toString(this, v)) }
/** Gets a use of the SSA variable represented by the pair `(this, v)`. */
VariableAccess getAUse(StackVariable v) { exists(StandardSSA x | result = x.getAUse(this, v)) }
VariableAccess getAUse(StackVariable v) { exists(StandardSsa x | result = x.getAUse(this, v)) }
/**
* Gets the control-flow node for this definition. This will usually be the
@@ -62,7 +65,7 @@ class SsaDefinition extends ControlFlowNodeBase {
BasicBlock getBasicBlock() { result.contains(this.getDefinition()) }
/** Holds if this definition is a phi node for variable `v`. */
predicate isPhiNode(StackVariable v) { exists(StandardSSA x | x.phi_node(v, this)) }
predicate isPhiNode(StackVariable v) { exists(StandardSsa x | x.phi_node(v, this)) }
/** Gets the location of this definition. */
Location getLocation() { result = this.(ControlFlowNode).getLocation() }
@@ -124,7 +127,7 @@ class SsaDefinition extends ControlFlowNodeBase {
/** Holds if `(this, v)` reaches the end of basic block `b`. */
predicate reachesEndOfBB(StackVariable v, BasicBlock b) {
exists(StandardSSA x | x.ssaDefinitionReachesEndOfBB(v, this, b))
exists(StandardSsa x | x.ssaDefinitionReachesEndOfBB(v, this, b))
}
/**

7
cpp/ql/lib/semmle/code/cpp/controlflow/SSAUtils.qll
View File

@@ -114,10 +114,10 @@ private predicate live_at_exit_of_bb(StackVariable v, BasicBlock b) {
/** Common SSA logic for standard SSA and range-analysis SSA. */
cached
library class SSAHelper extends int {
library class SsaHelper extends int {
/* 0 = StandardSSA, 1 = RangeSSA */
cached
SSAHelper() { this in [0 .. 1] }
SsaHelper() { this in [0 .. 1] }
/**
* Override to insert a custom phi node for variable `v` at the start of
@@ -311,3 +311,6 @@ library class SSAHelper extends int {
ssa_use(v, result, _, _)
}
}
/** DEPRECATED: Alias for SsaHelper */
deprecated class SSAHelper = SsaHelper;

15
cpp/ql/lib/semmle/code/cpp/controlflow/internal/CFG.qll
View File

@@ -1379,7 +1379,7 @@ private module Cached {
* true-successors and false-successors.
*/
cached
predicate qlCFGSuccessor(Node n1, Node n2) {
predicate qlCfgSuccessor(Node n1, Node n2) {
exists(Node memberNode, Pos memberPos |
subEdgeIncludingDestructors(any(Pos at | at.isAt()), n1, memberNode, memberPos) and
normalGroupMember(memberNode, memberPos, n2)
@@ -1388,23 +1388,32 @@ private module Cached {
conditionalSuccessor(n1, _, n2)
}
/** DEPRECATED: Alias for qlCfgSuccessor */
deprecated predicate qlCFGSuccessor = qlCfgSuccessor/2;
/**
* Holds if `n2` is a control-flow node such that the control-flow
* edge `(n1, n2)` may be taken when `n1` is an expression that is true.
*/
cached
predicate qlCFGTrueSuccessor(Node n1, Node n2) {
predicate qlCfgTrueSuccessor(Node n1, Node n2) {
conditionalSuccessor(n1, true, n2) and
not conditionalSuccessor(n1, false, n2)
}
/** DEPRECATED: Alias for qlCfgTrueSuccessor */
deprecated predicate qlCFGTrueSuccessor = qlCfgTrueSuccessor/2;
/**
* Holds if `n2` is a control-flow node such that the control-flow
* edge `(n1, n2)` may be taken when `n1` is an expression that is false.
*/
cached
predicate qlCFGFalseSuccessor(Node n1, Node n2) {
predicate qlCfgFalseSuccessor(Node n1, Node n2) {
conditionalSuccessor(n1, false, n2) and
not conditionalSuccessor(n1, true, n2)
}
/** DEPRECATED: Alias for qlCfgFalseSuccessor */
deprecated predicate qlCFGFalseSuccessor = qlCfgFalseSuccessor/2;
}

12
cpp/ql/lib/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
View File

@@ -188,8 +188,8 @@ private predicate nonAnalyzableFunction(Function f) {
*/
private predicate impossibleFalseEdge(Expr condition, Node succ) {
conditionAlwaysTrue(condition) and
qlCFGFalseSuccessor(condition, succ) and
not qlCFGTrueSuccessor(condition, succ)
qlCfgFalseSuccessor(condition, succ) and
not qlCfgTrueSuccessor(condition, succ)
}
/**
@@ -197,8 +197,8 @@ private predicate impossibleFalseEdge(Expr condition, Node succ) {
*/
private predicate impossibleTrueEdge(Expr condition, Node succ) {
conditionAlwaysFalse(condition) and
qlCFGTrueSuccessor(condition, succ) and
not qlCFGFalseSuccessor(condition, succ)
qlCfgTrueSuccessor(condition, succ) and
not qlCfgFalseSuccessor(condition, succ)
}
/**
@@ -960,9 +960,9 @@ library class ConditionEvaluator extends ExprEvaluator {
ConditionEvaluator() { this = 0 }
override predicate interesting(Expr e) {
qlCFGFalseSuccessor(e, _)
qlCfgFalseSuccessor(e, _)
or
qlCFGTrueSuccessor(e, _)
qlCfgTrueSuccessor(e, _)
}
}

8
cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
View File

@@ -129,11 +129,11 @@ private class FromGlobalVarTaintTrackingCfg extends TaintTracking2::Configuratio
}
private predicate readsVariable(LoadInstruction load, Variable var) {
load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var
load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
}
private predicate writesVariable(StoreInstruction store, Variable var) {
store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var
store.getDestinationAddress().(VariableAddressInstruction).getAstVariable() = var
}
/**
@@ -489,9 +489,9 @@ module TaintedWithPath {
/** Gets the element that `pathNode` wraps, if any. */
Element getElementFromPathNode(PathNode pathNode) {
exists(DataFlow::Node node | node = pathNode.(WrapPathNode).inner().getNode() |
result = node.asInstruction().getAST()
result = node.asInstruction().getAst()
or
result = node.asOperand().getDef().getAST()
result = node.asOperand().getDef().getAst()
)
or
result = pathNode.(EndpointPathNode).inner()

2
cpp/ql/lib/semmle/code/cpp/ir/dataflow/ResolveCall.qll
View File

@@ -17,7 +17,7 @@ private import semmle.code.cpp.ir.IR
*/
Function resolveCall(Call call) {
exists(CallInstruction callInstruction |
callInstruction.getAST() = call and
callInstruction.getAst() = call and
result = viableCallable(callInstruction)
)
}

4
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
View File

@@ -116,12 +116,12 @@ private module VirtualDispatch {
/** Holds if `addressInstr` is an instruction that produces the address of `var`. */
private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
// Access directly to the global variable
addressInstr.(VariableAddressInstruction).getASTVariable() = var
addressInstr.(VariableAddressInstruction).getAstVariable() = var
or
// Access to a field on a global union
exists(FieldAddressInstruction fa |
fa = addressInstr and
fa.getObjectAddress().(VariableAddressInstruction).getASTVariable() = var and
fa.getObjectAddress().(VariableAddressInstruction).getAstVariable() = var and
fa.getField().getDeclaringType() instanceof Union
)
}

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation.
*/
Language::AST getAST() { none() }
Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/**
* Gets the source location of this variable.
*/
final Language::Location getLocation() { result = getAST().getLocation() }
final Language::Location getLocation() { result = getAst().getLocation() }
/**
* Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var }
final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast }
final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
}
/** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() }
final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() {
this.shouldGenerateDumpStrings() and
result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank()
this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
}
/**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/**
* Gets the AST that caused this instruction to be generated.
*/
final Language::AST getAST() { result = Construction::getInstructionAST(this) }
final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets the location of the source code for this instruction.
*/
final Language::Location getLocation() { result = this.getAST().getLocation() }
final Language::Location getLocation() { result = this.getAst().getLocation() }
/**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/**
* Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() }
final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
}
/**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage.
*/
private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand;
TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or
exists(Instruction use | this = nonSSAMemoryOperand(use, _))
exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or
exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand {
cached
MemoryOperand() {
this instanceof TNonSSAMemoryOperand or
this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or
this instanceof TChiOperand
}
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or
this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag)
}
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached
NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag)
this = nonSsaMemoryOperand(useInstr, tag)
or
this = chiOperand(useInstr, tag)
}

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1
count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or
instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast
unique( | | instr.getIRVariable().getAst()) = ast
}
private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var
instr.getIRVariable().getAst() = var
}
private predicate constantValueNumber(

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
View File

@@ -2,12 +2,12 @@ private import AliasConfigurationInternal
private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR
private import cpp
private import AliasAnalysis
private import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SimpleSSA as UnaliasedSSA
private import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SimpleSSA as UnaliasedSsa
private newtype TAllocation =
TVariableAllocation(IRVariable var) {
// Only model variables that were not already handled in unaliased SSA.
not UnaliasedSSA::canReuseSSAForVariable(var)
not UnaliasedSsa::canReuseSsaForVariable(var)
} or
TIndirectParameterAllocation(IRAutomaticVariable var) {
exists(InitializeIndirectionInstruction instr | instr.getIRVariable() = var)

14
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
View File

@@ -133,7 +133,10 @@ abstract class MemoryLocation extends TMemoryLocation {
*/
predicate isAlwaysAllocatedOnStack() { none() }
final predicate canReuseSSA() { none() }
final predicate canReuseSsa() { none() }
/** DEPRECATED: Alias for canReuseSsa */
deprecated predicate canReuseSSA() { canReuseSsa() }
}
/**
@@ -569,13 +572,16 @@ private Overlap getVariableMemoryLocationOverlap(
* Holds if the def/use information for the result of `instr` can be reused from the previous
* iteration of the IR.
*/
predicate canReuseSSAForOldResult(Instruction instr) { OldSSA::canReuseSSAForMemoryResult(instr) }
predicate canReuseSsaForOldResult(Instruction instr) { OldSSA::canReuseSsaForMemoryResult(instr) }
/** DEPRECATED: Alias for canReuseSsaForOldResult */
deprecated predicate canReuseSSAForOldResult = canReuseSsaForOldResult/1;
bindingset[result, b]
private boolean unbindBool(boolean b) { result != b.booleanNot() }
MemoryLocation getResultMemoryLocation(Instruction instr) {
not canReuseSSAForOldResult(instr) and
not canReuseSsaForOldResult(instr) and
exists(MemoryAccessKind kind, boolean isMayAccess |
kind = instr.getResultMemoryAccess() and
(if instr.hasResultMayMemoryAccess() then isMayAccess = true else isMayAccess = false) and
@@ -608,7 +614,7 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
}
MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
not canReuseSSAForOldResult(operand.getAnyDef()) and
not canReuseSsaForOldResult(operand.getAnyDef()) and
exists(MemoryAccessKind kind, boolean isMayAccess |
kind = operand.getMemoryAccess() and
(if operand.hasMayReadMemoryAccess() then isMayAccess = true else isMayAccess = false) and

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandInternal.qll
View File

@@ -1,2 +1,2 @@
private import semmle.code.cpp.ir.implementation.internal.TOperand
import AliasedSSAOperands
import AliasedSsaOperands

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll
View File

@@ -2,7 +2,7 @@ private import SSAConstructionInternal
private import OldIR
private import Alias
private import SSAConstruction
private import DebugSSA
private import DebugSsa
bindingset[offset]
private string getKeySuffixForOffset(int offset) {

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll
View File

@@ -1,2 +1,2 @@
private import SSAConstruction as SSA
import SSA::SSAConsistency
import SSA::SsaConsistency

51
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
View File

@@ -112,7 +112,7 @@ private module Cached {
exists(Alias::getResultMemoryLocation(oldInstruction))
or
// This result was already modeled by a previous iteration of SSA.
Alias::canReuseSSAForOldResult(oldInstruction)
Alias::canReuseSsaForOldResult(oldInstruction)
}
cached
@@ -182,7 +182,7 @@ private module Cached {
* unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the
* true definition.
*/
private Instruction getNewDefinitionFromOldSSA(OldIR::MemoryOperand oldOperand, Overlap overlap) {
private Instruction getNewDefinitionFromOldSsa(OldIR::MemoryOperand oldOperand, Overlap overlap) {
exists(Overlap originalOverlap |
originalOverlap = oldOperand.getDefinitionOverlap() and
(
@@ -191,7 +191,7 @@ private module Cached {
or
exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap |
phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and
result = getNewDefinitionFromOldSSA(phiOperand, phiOperandOverlap) and
result = getNewDefinitionFromOldSsa(phiOperand, phiOperandOverlap) and
overlap =
combineOverlap(pragma[only_bind_out](phiOperandOverlap),
pragma[only_bind_out](originalOverlap))
@@ -233,7 +233,7 @@ private module Cached {
)
or
exists(OldIR::NonPhiMemoryOperand oldOperand |
result = getNewDefinitionFromOldSSA(oldOperand, overlap) and
result = getNewDefinitionFromOldSsa(oldOperand, overlap) and
oldOperand.getUse() = instruction and
tag = oldOperand.getOperandTag()
)
@@ -307,13 +307,13 @@ private module Cached {
* Gets the new definition instruction for the operand of `instr` that flows from the block
* `newPredecessorBlock`, based on that operand's definition in the old IR.
*/
private Instruction getNewPhiOperandDefinitionFromOldSSA(
private Instruction getNewPhiOperandDefinitionFromOldSsa(
Instruction instr, IRBlock newPredecessorBlock, Overlap overlap
) {
exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand |
oldPhi = getOldInstruction(instr) and
oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and
result = getNewDefinitionFromOldSSA(oldOperand, overlap)
result = getNewDefinitionFromOldSsa(oldOperand, overlap)
)
}
@@ -333,7 +333,7 @@ private module Cached {
overlap = Alias::getOverlap(actualDefLocation, useLocation)
)
or
result = getNewPhiOperandDefinitionFromOldSSA(instr, newPredecessorBlock, overlap)
result = getNewPhiOperandDefinitionFromOldSsa(instr, newPredecessorBlock, overlap)
}
cached
@@ -412,17 +412,17 @@ private module Cached {
}
cached
Language::AST getInstructionAST(Instruction instr) {
result = getOldInstruction(instr).getAST()
Language::AST getInstructionAst(Instruction instr) {
result = getOldInstruction(instr).getAst()
or
exists(RawIR::Instruction blockStartInstr |
instr = phiInstruction(blockStartInstr, _) and
result = blockStartInstr.getAST()
result = blockStartInstr.getAst()
)
or
exists(RawIR::Instruction primaryInstr |
instr = chiInstruction(primaryInstr) and
result = primaryInstr.getAST()
result = primaryInstr.getAst()
)
or
exists(IRFunctionBase irFunc |
@@ -430,6 +430,12 @@ private module Cached {
)
}
/** DEPRECATED: Alias for getInstructionAst */
cached
deprecated Language::AST getInstructionAST(Instruction instr) {
result = getInstructionAst(instr)
}
cached
Language::LanguageType getInstructionResultType(Instruction instr) {
result = instr.(RawIR::Instruction).getResultLanguageType()
@@ -975,35 +981,41 @@ module DefUse {
}
}
predicate canReuseSSAForMemoryResult(Instruction instruction) {
predicate canReuseSsaForMemoryResult(Instruction instruction) {
exists(OldInstruction oldInstruction |
oldInstruction = getOldInstruction(instruction) and
(
// The previous iteration said it was reusable, so we should mark it as reusable as well.
Alias::canReuseSSAForOldResult(oldInstruction)
Alias::canReuseSsaForOldResult(oldInstruction)
or
// The current alias analysis says it is reusable.
Alias::getResultMemoryLocation(oldInstruction).canReuseSSA()
Alias::getResultMemoryLocation(oldInstruction).canReuseSsa()
)
)
or
exists(Alias::MemoryLocation defLocation |
// This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well.
instruction = phiInstruction(_, defLocation) and
defLocation.canReuseSSA()
defLocation.canReuseSsa()
)
// We don't support reusing SSA for any location that could create a `Chi` instruction.
}
/** DEPRECATED: Alias for canReuseSsaForMemoryResult */
deprecated predicate canReuseSSAForMemoryResult = canReuseSsaForMemoryResult/1;
/**
* Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the
* `DebugSSA` module, which is then imported by PrintSSA.
*/
module DebugSSA {
module DebugSsa {
import PhiInsertion
import DefUse
}
/** DEPRECATED: Alias for DebugSsa */
deprecated module DebugSSA = DebugSsa;
import CachedForDebugging
cached
@@ -1038,7 +1050,7 @@ private module CachedForDebugging {
private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
result.getEnclosingFunction() = var.getEnclosingFunction() and
result.getAST() = var.getAST() and
result.getAst() = var.getAst() and
result.getTag() = var.getTag()
}
@@ -1061,7 +1073,7 @@ private module CachedForDebugging {
int maxValue() { result = 2147483647 }
}
module SSAConsistency {
module SsaConsistency {
/**
* Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
*/
@@ -1114,6 +1126,9 @@ module SSAConsistency {
}
}
/** DEPRECATED: Alias for SsaConsistency */
deprecated module SSAConsistency = SsaConsistency;
/**
* Provides the portion of the parameterized IR interface that is used to construct the SSA stages
* of the IR. The raw stage of the IR does not expose these predicates.

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionInternal.qll
View File

@@ -2,7 +2,7 @@ import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as OldIR
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.ReachableBlock as Reachability
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.Dominance as Dominance
import semmle.code.cpp.ir.implementation.aliased_ssa.IR as NewIR
import semmle.code.cpp.ir.implementation.internal.TInstruction::AliasedSSAInstructions as SSAInstructions
import semmle.code.cpp.ir.implementation.internal.TInstruction::AliasedSsaInstructions as SSAInstructions
import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import AliasedSSA as Alias
import semmle.code.cpp.ir.implementation.internal.TOperand::AliasedSSAOperands as SSAOperands
import semmle.code.cpp.ir.implementation.internal.TOperand::AliasedSsaOperands as SSAOperands

56
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll
View File

@@ -19,24 +19,24 @@ newtype TInstruction =
) {
IRConstruction::Raw::hasInstruction(tag1, tag2)
} or
TUnaliasedSSAPhiInstruction(
TRawInstruction blockStartInstr, UnaliasedSSA::SSA::MemoryLocation memoryLocation
TUnaliasedSsaPhiInstruction(
TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
) {
UnaliasedSSA::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
UnaliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
} or
TUnaliasedSSAChiInstruction(TRawInstruction primaryInstruction) { none() } or
TUnaliasedSSAUnreachedInstruction(IRFunctionBase irFunc) {
UnaliasedSSA::SSA::hasUnreachedInstruction(irFunc)
TUnaliasedSsaChiInstruction(TRawInstruction primaryInstruction) { none() } or
TUnaliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
UnaliasedSsa::SSA::hasUnreachedInstruction(irFunc)
} or
TAliasedSSAPhiInstruction(
TAliasedSsaPhiInstruction(
TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation
) {
AliasedSSA::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
} or
TAliasedSSAChiInstruction(TRawInstruction primaryInstruction) {
TAliasedSsaChiInstruction(TRawInstruction primaryInstruction) {
AliasedSSA::SSA::hasChiInstruction(primaryInstruction)
} or
TAliasedSSAUnreachedInstruction(IRFunctionBase irFunc) {
TAliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
AliasedSSA::SSA::hasUnreachedInstruction(irFunc)
}
@@ -46,58 +46,64 @@ newtype TInstruction =
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias.
*/
module UnaliasedSSAInstructions {
class TPhiInstruction = TUnaliasedSSAPhiInstruction;
module UnaliasedSsaInstructions {
class TPhiInstruction = TUnaliasedSsaPhiInstruction;
TPhiInstruction phiInstruction(
TRawInstruction blockStartInstr, UnaliasedSSA::SSA::MemoryLocation memoryLocation
TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
) {
result = TUnaliasedSSAPhiInstruction(blockStartInstr, memoryLocation)
result = TUnaliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
}
TRawInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) { none() }
class TChiInstruction = TUnaliasedSSAChiInstruction;
class TChiInstruction = TUnaliasedSsaChiInstruction;
TChiInstruction chiInstruction(TRawInstruction primaryInstruction) {
result = TUnaliasedSSAChiInstruction(primaryInstruction)
result = TUnaliasedSsaChiInstruction(primaryInstruction)
}
class TUnreachedInstruction = TUnaliasedSSAUnreachedInstruction;
class TUnreachedInstruction = TUnaliasedSsaUnreachedInstruction;
TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) {
result = TUnaliasedSSAUnreachedInstruction(irFunc)
result = TUnaliasedSsaUnreachedInstruction(irFunc)
}
}
/** DEPRECATED: Alias for UnaliasedSsaInstructions */
deprecated module UnaliasedSSAInstructions = UnaliasedSsaInstructions;
/**
* Provides wrappers for the constructors of each branch of `TInstruction` that is used by the
* aliased SSA stage.
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias.
*/
module AliasedSSAInstructions {
class TPhiInstruction = TAliasedSSAPhiInstruction or TUnaliasedSSAPhiInstruction;
module AliasedSsaInstructions {
class TPhiInstruction = TAliasedSsaPhiInstruction or TUnaliasedSsaPhiInstruction;
TPhiInstruction phiInstruction(
TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation
) {
result = TAliasedSSAPhiInstruction(blockStartInstr, memoryLocation)
result = TAliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
}
TPhiInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) {
result = TUnaliasedSSAPhiInstruction(blockStartInstr, _)
result = TUnaliasedSsaPhiInstruction(blockStartInstr, _)
}
class TChiInstruction = TAliasedSSAChiInstruction;
class TChiInstruction = TAliasedSsaChiInstruction;
TChiInstruction chiInstruction(TRawInstruction primaryInstruction) {
result = TAliasedSSAChiInstruction(primaryInstruction)
result = TAliasedSsaChiInstruction(primaryInstruction)
}
class TUnreachedInstruction = TAliasedSSAUnreachedInstruction;
class TUnreachedInstruction = TAliasedSsaUnreachedInstruction;
TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) {
result = TAliasedSSAUnreachedInstruction(irFunc)
result = TAliasedSsaUnreachedInstruction(irFunc)
}
}
/** DEPRECATED: Alias for AliasedSsaInstructions */
deprecated module AliasedSSAInstructions = AliasedSsaInstructions;

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstructionInternal.qll
View File

@@ -1,4 +1,4 @@
import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as IRConstruction
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SSAConstruction as UnaliasedSSA
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SSAConstruction as UnaliasedSsa
import semmle.code.cpp.ir.implementation.aliased_ssa.internal.SSAConstruction as AliasedSSA

38
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TOperand.qll
View File

@@ -31,7 +31,7 @@ private module Internal {
TNoOperand() { none() } or
// Can be "removed" later when there's unreachable code
// These operands can be reused across all three stages. They just get different defs.
TNonSSAMemoryOperand(Raw::Instruction useInstr, MemoryOperandTag tag) {
TNonSsaMemoryOperand(Raw::Instruction useInstr, MemoryOperandTag tag) {
// Has no definition in raw but will get definitions later
useInstr.getOpcode().hasOperand(tag)
} or
@@ -49,11 +49,11 @@ private module Internal {
// important that we use the same definition of "is variable aliased" across
// the phases.
TAliasedPhiOperand(
TAliasedSSAPhiInstruction useInstr, Aliased::IRBlock predecessorBlock, Overlap overlap
TAliasedSsaPhiInstruction useInstr, Aliased::IRBlock predecessorBlock, Overlap overlap
) {
exists(AliasedConstruction::getPhiOperandDefinition(useInstr, predecessorBlock, overlap))
} or
TAliasedChiOperand(TAliasedSSAChiInstruction useInstr, ChiOperandTag tag) { any() }
TAliasedChiOperand(TAliasedSsaChiInstruction useInstr, ChiOperandTag tag) { any() }
}
/**
@@ -72,13 +72,21 @@ private module Shared {
result = Internal::TRegisterOperand(useInstr, tag, defInstr)
}
class TNonSSAMemoryOperand = Internal::TNonSSAMemoryOperand;
class TNonSsaMemoryOperand = Internal::TNonSsaMemoryOperand;
/** DEPRECATED: Alias for TNonSsaMemoryOperand */
deprecated class TNonSSAMemoryOperand = TNonSsaMemoryOperand;
/**
* Returns the non-Phi memory operand with the specified parameters.
*/
TNonSSAMemoryOperand nonSSAMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) {
result = Internal::TNonSSAMemoryOperand(useInstr, tag)
TNonSsaMemoryOperand nonSsaMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) {
result = Internal::TNonSsaMemoryOperand(useInstr, tag)
}
/** DEPRECATED: Alias for nonSsaMemoryOperand */
deprecated TNonSSAMemoryOperand nonSSAMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) {
result = nonSsaMemoryOperand(useInstr, tag)
}
}
@@ -95,7 +103,7 @@ module RawOperands {
class TChiOperand = Internal::TNoOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand;
class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/**
* Returns the Phi operand with the specified parameters.
@@ -126,14 +134,14 @@ module RawOperands {
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias.
*/
module UnaliasedSSAOperands {
module UnaliasedSsaOperands {
import Shared
class TPhiOperand = Internal::TUnaliasedPhiOperand;
class TChiOperand = Internal::TNoOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand;
class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/**
* Returns the Phi operand with the specified parameters.
@@ -159,20 +167,23 @@ module UnaliasedSSAOperands {
TChiOperand chiOperand(Unaliased::Instruction useInstr, ChiOperandTag tag) { none() }
}
/** DEPRECATED: Alias for UnaliasedSsaOperands */
deprecated module UnaliasedSSAOperands = UnaliasedSsaOperands;
/**
* Provides wrappers for the constructors of each branch of `TOperand` that is used by the
* asliased SSA stage.
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias.
*/
module AliasedSSAOperands {
module AliasedSsaOperands {
import Shared
class TPhiOperand = Internal::TAliasedPhiOperand or Internal::TUnaliasedPhiOperand;
class TChiOperand = Internal::TAliasedChiOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand;
class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/**
* Returns the Phi operand with the specified parameters.
@@ -202,7 +213,10 @@ module AliasedSSAOperands {
/**
* Returns the Chi operand with the specified parameters.
*/
TChiOperand chiOperand(TAliasedSSAChiInstruction useInstr, ChiOperandTag tag) {
TChiOperand chiOperand(TAliasedSsaChiInstruction useInstr, ChiOperandTag tag) {
result = Internal::TAliasedChiOperand(useInstr, tag)
}
}
/** DEPRECATED: Alias for AliasedSsaOperands */
deprecated module AliasedSSAOperands = AliasedSsaOperands;

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation.
*/
Language::AST getAST() { none() }
Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/**
* Gets the source location of this variable.
*/
final Language::Location getLocation() { result = getAST().getLocation() }
final Language::Location getLocation() { result = getAst().getLocation() }
/**
* Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var }
final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast }
final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
}
/** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() }
final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() {
this.shouldGenerateDumpStrings() and
result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank()
this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
}
/**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/**
* Gets the AST that caused this instruction to be generated.
*/
final Language::AST getAST() { result = Construction::getInstructionAST(this) }
final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets the location of the source code for this instruction.
*/
final Language::Location getLocation() { result = this.getAST().getLocation() }
final Language::Location getLocation() { result = this.getAst().getLocation() }
/**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/**
* Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() }
final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
}
/**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage.
*/
private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand;
TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or
exists(Instruction use | this = nonSSAMemoryOperand(use, _))
exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or
exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand {
cached
MemoryOperand() {
this instanceof TNonSSAMemoryOperand or
this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or
this instanceof TChiOperand
}
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or
this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag)
}
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached
NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag)
this = nonSsaMemoryOperand(useInstr, tag)
or
this = chiOperand(useInstr, tag)
}

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1
count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or
instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast
unique( | | instr.getIRVariable().getAst()) = ast
}
private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var
instr.getIRVariable().getAst() = var
}
private predicate constantValueNumber(

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
View File

@@ -48,7 +48,7 @@ module Raw {
cached
predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag, CppType type) {
exists(TranslatedElement element |
element.getAST() = ast and
element.getAst() = ast and
func = element.getFunction() and
element.hasTempVariable(tag, type)
)
@@ -75,7 +75,7 @@ module Raw {
tag = getInstructionTag(instruction) and
(
result = element.getInstructionVariable(tag) or
result.(IRStringLiteral).getAST() = element.getInstructionStringLiteral(tag)
result.(IRStringLiteral).getAst() = element.getInstructionStringLiteral(tag)
)
)
}
@@ -339,7 +339,7 @@ Instruction getInstructionBackEdgeSuccessor(Instruction instruction, EdgeKind ki
// such a `goto` creates a back edge.
exists(TranslatedElement s, GotoStmt goto |
not isStrictlyForwardGoto(goto) and
goto = s.getAST() and
goto = s.getAst() and
exists(InstructionTag tag |
result = s.getInstructionSuccessor(tag, kind) and
instruction = s.getInstruction(tag)
@@ -352,8 +352,13 @@ private predicate isStrictlyForwardGoto(GotoStmt goto) {
goto.getLocation().isBefore(goto.getTarget().getLocation())
}
Locatable getInstructionAST(TStageInstruction instr) {
result = getInstructionTranslatedElement(instr).getAST()
Locatable getInstructionAst(TStageInstruction instr) {
result = getInstructionTranslatedElement(instr).getAst()
}
/** DEPRECATED: Alias for getInstructionAst */
deprecated Locatable getInstructionAST(TStageInstruction instr) {
result = getInstructionAst(instr)
}
CppType getInstructionResultType(TStageInstruction instr) {

25
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
View File

@@ -175,7 +175,10 @@ abstract class TranslatedSideEffects extends TranslatedElement {
/** Gets the expression whose side effects are being modeled. */
abstract Expr getExpr();
final override Locatable getAST() { result = getExpr() }
final override Locatable getAst() { result = getExpr() }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = getExpr().getEnclosingFunction() }
@@ -522,7 +525,10 @@ class TranslatedArgumentExprSideEffect extends TranslatedArgumentSideEffect,
this = TTranslatedArgumentExprSideEffect(call, arg, index, sideEffectOpcode)
}
final override Locatable getAST() { result = arg }
final override Locatable getAst() { result = arg }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Type getIndirectionType() {
result = arg.getUnspecifiedType().(DerivedType).getBaseType()
@@ -553,7 +559,10 @@ class TranslatedStructorQualifierSideEffect extends TranslatedArgumentSideEffect
index = -1
}
final override Locatable getAST() { result = call }
final override Locatable getAst() { result = call }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Type getIndirectionType() { result = call.getTarget().getDeclaringType() }
@@ -574,7 +583,10 @@ class TranslatedCallSideEffect extends TranslatedSideEffect, TTranslatedCallSide
TranslatedCallSideEffect() { this = TTranslatedCallSideEffect(expr, sideEffectOpcode) }
override Locatable getAST() { result = expr }
override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Expr getPrimaryExpr() { result = expr }
@@ -612,7 +624,10 @@ class TranslatedAllocationSideEffect extends TranslatedSideEffect, TTranslatedAl
TranslatedAllocationSideEffect() { this = TTranslatedAllocationSideEffect(expr) }
override Locatable getAST() { result = expr }
override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Expr getPrimaryExpr() { result = expr }

5
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCondition.qll
View File

@@ -19,7 +19,10 @@ abstract class TranslatedCondition extends TranslatedElement {
final override string toString() { result = expr.toString() }
final override Locatable getAST() { result = expr }
final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final ConditionContext getConditionContext() { result = getParent() }

24
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
View File

@@ -14,7 +14,7 @@ private import TranslatedInitialization
* `entry`.
*/
TranslatedDeclarationEntry getTranslatedDeclarationEntry(DeclarationEntry entry) {
result.getAST() = entry
result.getAst() = entry
}
/**
@@ -37,7 +37,10 @@ abstract class TranslatedDeclarationEntry extends TranslatedElement, TTranslated
final override string toString() { result = entry.toString() }
final override Locatable getAST() { result = entry }
final override Locatable getAst() { result = entry }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
}
/**
@@ -223,7 +226,10 @@ class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
final override string toString() { result = "init: " + entry.toString() }
final override Locatable getAST() { result = entry }
final override Locatable getAst() { result = entry }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override LocalVariable getVariable() { result = var }
@@ -254,7 +260,10 @@ class TranslatedRangeBasedForVariableDeclaration extends TranslatedLocalVariable
override string toString() { result = var.toString() }
override Locatable getAST() { result = var }
override Locatable getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = forStmt.getEnclosingFunction() }
@@ -262,7 +271,7 @@ class TranslatedRangeBasedForVariableDeclaration extends TranslatedLocalVariable
}
TranslatedConditionDecl getTranslatedConditionDecl(ConditionDeclExpr expr) {
result.getAST() = expr
result.getAst() = expr
}
/**
@@ -280,7 +289,10 @@ class TranslatedConditionDecl extends TranslatedLocalVariableDeclaration, TTrans
override string toString() { result = "decl: " + conditionDeclExpr.toString() }
override Locatable getAST() { result = conditionDeclExpr }
override Locatable getAst() { result = conditionDeclExpr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = conditionDeclExpr.getEnclosingFunction() }

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
View File

@@ -31,7 +31,7 @@ IRUserVariable getIRUserVariable(Function func, Variable var) {
}
IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
result.getAST() = ast and
result.getAst() = ast and
result.getTag() = tag
}
@@ -730,7 +730,10 @@ abstract class TranslatedElement extends TTranslatedElement {
/**
* Gets the AST node being translated.
*/
abstract Locatable getAST();
abstract Locatable getAst();
/** DEPRECATED: Alias for getAst */
deprecated Locatable getAST() { result = getAst() }
/**
* Get the first instruction to be executed in the evaluation of this element.
@@ -929,16 +932,16 @@ abstract class TranslatedElement extends TTranslatedElement {
*/
final IRTempVariable getTempVariable(TempVariableTag tag) {
exists(Locatable ast |
result.getAST() = ast and
result.getAst() = ast and
result.getTag() = tag and
hasTempVariableAndAST(tag, ast)
hasTempVariableAndAst(tag, ast)
)
}
pragma[noinline]
private predicate hasTempVariableAndAST(TempVariableTag tag, Locatable ast) {
private predicate hasTempVariableAndAst(TempVariableTag tag, Locatable ast) {
hasTempVariable(tag, _) and
ast = getAST()
ast = getAst()
}
/**

9
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
View File

@@ -74,7 +74,10 @@ abstract class TranslatedExpr extends TranslatedElement {
expr.isGLValueCategory()
}
final override Locatable getAST() { result = expr }
final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = expr.getEnclosingFunction() }
@@ -1709,7 +1712,7 @@ abstract class TranslatedAllocationSize extends TranslatedExpr, TTranslatedAlloc
}
TranslatedAllocationSize getTranslatedAllocationSize(NewOrNewArrayExpr newExpr) {
result.getAST() = newExpr
result.getAst() = newExpr
}
/**
@@ -1875,7 +1878,7 @@ class TranslatedAllocatorCall extends TTranslatedAllocatorCall, TranslatedDirect
}
TranslatedAllocatorCall getTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) {
result.getAST() = newExpr
result.getAst() = newExpr
}
/**

59
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll
View File

@@ -15,7 +15,7 @@ private import VarArgs
/**
* Gets the `TranslatedFunction` that represents function `func`.
*/
TranslatedFunction getTranslatedFunction(Function func) { result.getAST() = func }
TranslatedFunction getTranslatedFunction(Function func) { result.getAst() = func }
/**
* Gets the size, in bytes, of the variable used to represent the `...` parameter in a varargs
@@ -65,7 +65,10 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
final override string toString() { result = func.toString() }
final override Locatable getAST() { result = func }
final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
/**
* Gets the function being translated.
@@ -344,7 +347,7 @@ TranslatedThisParameter getTranslatedThisParameter(Function func) { result.getFu
/**
* Gets the `TranslatedPositionalParameter` that represents parameter `param`.
*/
TranslatedPositionalParameter getTranslatedParameter(Parameter param) { result.getAST() = param }
TranslatedPositionalParameter getTranslatedParameter(Parameter param) { result.getAst() = param }
/**
* Gets the `TranslatedEllipsisParameter` for function `func`, if one exists.
@@ -457,7 +460,10 @@ class TranslatedThisParameter extends TranslatedParameter, TTranslatedThisParame
final override string toString() { result = "this" }
final override Locatable getAST() { result = func }
final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = func }
@@ -489,7 +495,10 @@ class TranslatedPositionalParameter extends TranslatedParameter, TTranslatedPara
final override string toString() { result = param.toString() }
final override Locatable getAST() { result = param }
final override Locatable getAst() { result = param }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() {
result = param.getFunction() or
@@ -526,7 +535,10 @@ class TranslatedEllipsisParameter extends TranslatedParameter, TTranslatedEllips
final override string toString() { result = "..." }
final override Locatable getAST() { result = func }
final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = func }
@@ -544,7 +556,7 @@ class TranslatedEllipsisParameter extends TranslatedParameter, TTranslatedEllips
}
private TranslatedConstructorInitList getTranslatedConstructorInitList(Function func) {
result.getAST() = func
result.getAst() = func
}
/**
@@ -561,7 +573,10 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
override string toString() { result = "ctor init: " + func.toString() }
override Locatable getAST() { result = func }
override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override TranslatedElement getChild(int id) {
exists(ConstructorFieldInit fieldInit |
@@ -611,7 +626,7 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
}
private TranslatedDestructorDestructionList getTranslatedDestructorDestructionList(Function func) {
result.getAST() = func
result.getAst() = func
}
/**
@@ -629,7 +644,10 @@ class TranslatedDestructorDestructionList extends TranslatedElement,
override string toString() { result = "dtor destruction: " + func.toString() }
override Locatable getAST() { result = func }
override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override TranslatedElement getChild(int id) {
exists(DestructorFieldDestruction fieldDestruction |
@@ -667,14 +685,17 @@ class TranslatedDestructorDestructionList extends TranslatedElement,
}
}
TranslatedReadEffects getTranslatedReadEffects(Function func) { result.getAST() = func }
TranslatedReadEffects getTranslatedReadEffects(Function func) { result.getAst() = func }
class TranslatedReadEffects extends TranslatedElement, TTranslatedReadEffects {
Function func;
TranslatedReadEffects() { this = TTranslatedReadEffects(func) }
override Locatable getAST() { result = func }
override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = func }
@@ -718,11 +739,11 @@ class TranslatedReadEffects extends TranslatedElement, TTranslatedReadEffects {
}
private TranslatedThisReadEffect getTranslatedThisReadEffect(Function func) {
result.getAST() = func
result.getAst() = func
}
private TranslatedParameterReadEffect getTranslatedParameterReadEffect(Parameter param) {
result.getAST() = param
result.getAst() = param
}
abstract class TranslatedReadEffect extends TranslatedElement {
@@ -758,7 +779,10 @@ class TranslatedThisReadEffect extends TranslatedReadEffect, TTranslatedThisRead
TranslatedThisReadEffect() { this = TTranslatedThisReadEffect(func) }
override Locatable getAST() { result = func }
override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = func }
@@ -781,7 +805,10 @@ class TranslatedParameterReadEffect extends TranslatedReadEffect, TTranslatedPar
TranslatedParameterReadEffect() { this = TTranslatedParameterReadEffect(param) }
override Locatable getAST() { result = param }
override Locatable getAst() { result = param }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override string toString() { result = "read effect: " + param.toString() }

35
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
View File

@@ -139,7 +139,10 @@ abstract class TranslatedInitialization extends TranslatedElement, TTranslatedIn
final override Function getFunction() { result = expr.getEnclosingFunction() }
final override Locatable getAST() { result = expr }
final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
/**
* Gets the expression that is doing the initialization.
@@ -461,11 +464,11 @@ class TranslatedConstructorInitialization extends TranslatedDirectInitialization
TranslatedFieldInitialization getTranslatedFieldInitialization(
ClassAggregateLiteral initList, Field field
) {
result.getAST() = initList and result.getField() = field
result.getAst() = initList and result.getField() = field
}
TranslatedFieldInitialization getTranslatedConstructorFieldInitialization(ConstructorFieldInit init) {
result.getAST() = init
result.getAst() = init
}
/**
@@ -478,7 +481,10 @@ abstract class TranslatedFieldInitialization extends TranslatedElement {
final override string toString() { result = ast.toString() + "." + field.toString() }
final override Locatable getAST() { result = ast }
final override Locatable getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = ast.getEnclosingFunction() }
@@ -622,7 +628,10 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
result = initList.toString() + "[" + getElementIndex().toString() + "]"
}
final override Locatable getAST() { result = initList }
final override Locatable getAst() { result = initList }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = initList.getEnclosingFunction() }
@@ -802,7 +811,10 @@ class TranslatedElementValueInitialization extends TranslatedElementInitializati
abstract class TranslatedStructorCallFromStructor extends TranslatedElement, StructorCallContext {
FunctionCall call;
final override Locatable getAST() { result = call }
final override Locatable getAst() { result = call }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override TranslatedElement getChild(int id) {
id = 0 and
@@ -864,7 +876,7 @@ abstract class TranslatedConstructorCallFromConstructor extends TranslatedStruct
}
TranslatedConstructorCallFromConstructor getTranslatedConstructorBaseInit(ConstructorBaseInit init) {
result.getAST() = init
result.getAst() = init
}
/**
@@ -904,7 +916,7 @@ class TranslatedConstructorBaseInit extends TranslatedConstructorCallFromConstru
TranslatedDestructorBaseDestruction getTranslatedDestructorBaseDestruction(
DestructorBaseDestruction destruction
) {
result.getAST() = destruction
result.getAst() = destruction
}
/**
@@ -928,7 +940,10 @@ class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstr
TranslatedConstructorBareInit() { this = TTranslatedConstructorBareInit(init) }
override Locatable getAST() { result = init }
override Locatable getAst() { result = init }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override string toString() { result = "construct base (no constructor)" }
@@ -948,5 +963,5 @@ class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstr
}
TranslatedConstructorBareInit getTranslatedConstructorBareInit(ConstructorInit init) {
result.getAST() = init
result.getAst() = init
}

7
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
View File

@@ -11,7 +11,7 @@ private import TranslatedExpr
private import TranslatedFunction
private import TranslatedInitialization
TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAST() = stmt }
TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAst() = stmt }
abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
Stmt stmt;
@@ -20,7 +20,10 @@ abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
final override string toString() { result = stmt.toString() }
final override Locatable getAST() { result = stmt }
final override Locatable getAst() { result = stmt }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = stmt.getEnclosingFunction() }
}

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation.
*/
Language::AST getAST() { none() }
Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/**
* Gets the source location of this variable.
*/
final Language::Location getLocation() { result = getAST().getLocation() }
final Language::Location getLocation() { result = getAst().getLocation() }
/**
* Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var }
final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast }
final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
}
/** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() }
final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() {
this.shouldGenerateDumpStrings() and
result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank()
this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
}
/**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/**
* Gets the AST that caused this instruction to be generated.
*/
final Language::AST getAST() { result = Construction::getInstructionAST(this) }
final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/**
* Gets the location of the source code for this instruction.
*/
final Language::Location getLocation() { result = this.getAST().getLocation() }
final Language::Location getLocation() { result = this.getAst().getLocation() }
/**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/**
* Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() }
final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
}
/**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage.
*/
private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand;
TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or
exists(Instruction use | this = nonSSAMemoryOperand(use, _))
exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or
exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand {
cached
MemoryOperand() {
this instanceof TNonSSAMemoryOperand or
this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or
this instanceof TChiOperand
}
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or
this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag)
}
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached
NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag)
this = nonSsaMemoryOperand(useInstr, tag)
or
this = chiOperand(useInstr, tag)
}

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1
count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or
instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast
unique( | | instr.getIRVariable().getAst()) = ast
}
private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var
instr.getIRVariable().getAst() = var
}
private predicate constantValueNumber(

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandInternal.qll
View File

@@ -1,2 +1,2 @@
private import semmle.code.cpp.ir.implementation.internal.TOperand
import UnaliasedSSAOperands
import UnaliasedSsaOperands

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll
View File

@@ -2,7 +2,7 @@ private import SSAConstructionInternal
private import OldIR
private import Alias
private import SSAConstruction
private import DebugSSA
private import DebugSsa
bindingset[offset]
private string getKeySuffixForOffset(int offset) {

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
View File

@@ -1,2 +1,2 @@
private import SSAConstruction as SSA
import SSA::SSAConsistency
import SSA::SsaConsistency

51
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
View File

@@ -112,7 +112,7 @@ private module Cached {
exists(Alias::getResultMemoryLocation(oldInstruction))
or
// This result was already modeled by a previous iteration of SSA.
Alias::canReuseSSAForOldResult(oldInstruction)
Alias::canReuseSsaForOldResult(oldInstruction)
}
cached
@@ -182,7 +182,7 @@ private module Cached {
* unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the
* true definition.
*/
private Instruction getNewDefinitionFromOldSSA(OldIR::MemoryOperand oldOperand, Overlap overlap) {
private Instruction getNewDefinitionFromOldSsa(OldIR::MemoryOperand oldOperand, Overlap overlap) {
exists(Overlap originalOverlap |
originalOverlap = oldOperand.getDefinitionOverlap() and
(
@@ -191,7 +191,7 @@ private module Cached {
or
exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap |
phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and
result = getNewDefinitionFromOldSSA(phiOperand, phiOperandOverlap) and
result = getNewDefinitionFromOldSsa(phiOperand, phiOperandOverlap) and
overlap =
combineOverlap(pragma[only_bind_out](phiOperandOverlap),
pragma[only_bind_out](originalOverlap))
@@ -233,7 +233,7 @@ private module Cached {
)
or
exists(OldIR::NonPhiMemoryOperand oldOperand |
result = getNewDefinitionFromOldSSA(oldOperand, overlap) and
result = getNewDefinitionFromOldSsa(oldOperand, overlap) and
oldOperand.getUse() = instruction and
tag = oldOperand.getOperandTag()
)
@@ -307,13 +307,13 @@ private module Cached {
* Gets the new definition instruction for the operand of `instr` that flows from the block
* `newPredecessorBlock`, based on that operand's definition in the old IR.
*/
private Instruction getNewPhiOperandDefinitionFromOldSSA(
private Instruction getNewPhiOperandDefinitionFromOldSsa(
Instruction instr, IRBlock newPredecessorBlock, Overlap overlap
) {
exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand |
oldPhi = getOldInstruction(instr) and
oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and
result = getNewDefinitionFromOldSSA(oldOperand, overlap)
result = getNewDefinitionFromOldSsa(oldOperand, overlap)
)
}
@@ -333,7 +333,7 @@ private module Cached {
overlap = Alias::getOverlap(actualDefLocation, useLocation)
)
or
result = getNewPhiOperandDefinitionFromOldSSA(instr, newPredecessorBlock, overlap)
result = getNewPhiOperandDefinitionFromOldSsa(instr, newPredecessorBlock, overlap)
}
cached
@@ -412,17 +412,17 @@ private module Cached {
}
cached
Language::AST getInstructionAST(Instruction instr) {
result = getOldInstruction(instr).getAST()
Language::AST getInstructionAst(Instruction instr) {
result = getOldInstruction(instr).getAst()
or
exists(RawIR::Instruction blockStartInstr |
instr = phiInstruction(blockStartInstr, _) and
result = blockStartInstr.getAST()
result = blockStartInstr.getAst()
)
or
exists(RawIR::Instruction primaryInstr |
instr = chiInstruction(primaryInstr) and
result = primaryInstr.getAST()
result = primaryInstr.getAst()
)
or
exists(IRFunctionBase irFunc |
@@ -430,6 +430,12 @@ private module Cached {
)
}
/** DEPRECATED: Alias for getInstructionAst */
cached
deprecated Language::AST getInstructionAST(Instruction instr) {
result = getInstructionAst(instr)
}
cached
Language::LanguageType getInstructionResultType(Instruction instr) {
result = instr.(RawIR::Instruction).getResultLanguageType()
@@ -975,35 +981,41 @@ module DefUse {
}
}
predicate canReuseSSAForMemoryResult(Instruction instruction) {
predicate canReuseSsaForMemoryResult(Instruction instruction) {
exists(OldInstruction oldInstruction |
oldInstruction = getOldInstruction(instruction) and
(
// The previous iteration said it was reusable, so we should mark it as reusable as well.
Alias::canReuseSSAForOldResult(oldInstruction)
Alias::canReuseSsaForOldResult(oldInstruction)
or
// The current alias analysis says it is reusable.
Alias::getResultMemoryLocation(oldInstruction).canReuseSSA()
Alias::getResultMemoryLocation(oldInstruction).canReuseSsa()
)
)
or
exists(Alias::MemoryLocation defLocation |
// This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well.
instruction = phiInstruction(_, defLocation) and
defLocation.canReuseSSA()
defLocation.canReuseSsa()
)
// We don't support reusing SSA for any location that could create a `Chi` instruction.
}
/** DEPRECATED: Alias for canReuseSsaForMemoryResult */
deprecated predicate canReuseSSAForMemoryResult = canReuseSsaForMemoryResult/1;
/**
* Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the
* `DebugSSA` module, which is then imported by PrintSSA.
*/
module DebugSSA {
module DebugSsa {
import PhiInsertion
import DefUse
}
/** DEPRECATED: Alias for DebugSsa */
deprecated module DebugSSA = DebugSsa;
import CachedForDebugging
cached
@@ -1038,7 +1050,7 @@ private module CachedForDebugging {
private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
result.getEnclosingFunction() = var.getEnclosingFunction() and
result.getAST() = var.getAST() and
result.getAst() = var.getAst() and
result.getTag() = var.getTag()
}
@@ -1061,7 +1073,7 @@ private module CachedForDebugging {
int maxValue() { result = 2147483647 }
}
module SSAConsistency {
module SsaConsistency {
/**
* Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
*/
@@ -1114,6 +1126,9 @@ module SSAConsistency {
}
}
/** DEPRECATED: Alias for SsaConsistency */
deprecated module SSAConsistency = SsaConsistency;
/**
* Provides the portion of the parameterized IR interface that is used to construct the SSA stages
* of the IR. The raw stage of the IR does not expose these predicates.

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionInternal.qll
View File

@@ -3,7 +3,7 @@ import semmle.code.cpp.ir.implementation.raw.internal.reachability.ReachableBloc
import semmle.code.cpp.ir.implementation.raw.internal.reachability.Dominance as Dominance
import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as NewIR
import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as RawStage
import semmle.code.cpp.ir.implementation.internal.TInstruction::UnaliasedSSAInstructions as SSAInstructions
import semmle.code.cpp.ir.implementation.internal.TInstruction::UnaliasedSsaInstructions as SSAInstructions
import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import SimpleSSA as Alias
import semmle.code.cpp.ir.implementation.internal.TOperand::UnaliasedSSAOperands as SSAOperands
import semmle.code.cpp.ir.implementation.internal.TOperand::UnaliasedSsaOperands as SSAOperands

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll
View File

@@ -41,11 +41,14 @@ predicate isVariableModeled(Allocation var) {
* subsequent iterations will recompute SSA for any variable that we assumed did not escape, but
* actually would have escaped if we had used a sound escape analysis.
*/
predicate canReuseSSAForVariable(IRAutomaticVariable var) {
predicate canReuseSsaForVariable(IRAutomaticVariable var) {
isVariableModeled(var) and
not allocationEscapes(var)
}
/** DEPRECATED: Alias for canReuseSsaForVariable */
deprecated predicate canReuseSSAForVariable = canReuseSsaForVariable/1;
private newtype TMemoryLocation = MkMemoryLocation(Allocation var) { isVariableModeled(var) }
private MemoryLocation getMemoryLocation(Allocation var) { result.getAllocation() = var }
@@ -69,10 +72,16 @@ class MemoryLocation extends TMemoryLocation {
final string getUniqueId() { result = var.getUniqueId() }
final predicate canReuseSSA() { canReuseSSAForVariable(var) }
final predicate canReuseSsa() { canReuseSsaForVariable(var) }
/** DEPRECATED: Alias for canReuseSsa */
deprecated predicate canReuseSSA() { canReuseSsa() }
}
predicate canReuseSSAForOldResult(Instruction instr) { none() }
predicate canReuseSsaForOldResult(Instruction instr) { none() }
/** DEPRECATED: Alias for canReuseSsaForOldResult */
deprecated predicate canReuseSSAForOldResult = canReuseSsaForOldResult/1;
/**
* Represents a set of `MemoryLocation`s that cannot overlap with

19
cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeSSA.qll
View File

@@ -29,8 +29,8 @@ private import RangeAnalysisUtils
* The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA.
* This class provides the range-analysis SSA logic.
*/
library class RangeSSA extends SSAHelper {
RangeSSA() { this = 1 }
library class RangeSsa extends SsaHelper {
RangeSsa() { this = 1 }
/**
* Add a phi node on the out-edge of a guard.
@@ -40,6 +40,9 @@ library class RangeSSA extends SSAHelper {
}
}
/** DEPRECATED: Alias for RangeSsa */
deprecated class RangeSSA = RangeSsa;
private predicate guard_defn(VariableAccess v, Expr guard, BasicBlock b, boolean branch) {
guardCondition(guard, v, branch) and
guardSuccessor(guard, branch, b)
@@ -67,22 +70,22 @@ private predicate guardSuccessor(Expr guard, boolean branch, BasicBlock succ) {
* nodes.
*/
class RangeSsaDefinition extends ControlFlowNodeBase {
RangeSsaDefinition() { exists(RangeSSA x | x.ssa_defn(_, this, _, _)) }
RangeSsaDefinition() { exists(RangeSsa x | x.ssa_defn(_, this, _, _)) }
/**
* Gets a variable corresponding to a SSA StackVariable defined by
* this definition.
*/
StackVariable getAVariable() { exists(RangeSSA x | x.ssa_defn(result, this, _, _)) }
StackVariable getAVariable() { exists(RangeSsa x | x.ssa_defn(result, this, _, _)) }
/**
* A string representation of the SSA variable represented by the pair
* `(this, v)`.
*/
string toString(StackVariable v) { exists(RangeSSA x | result = x.toString(this, v)) }
string toString(StackVariable v) { exists(RangeSsa x | result = x.toString(this, v)) }
/** Gets a use of the SSA variable represented by the pair `(this, v)`. */
VariableAccess getAUse(StackVariable v) { exists(RangeSSA x | result = x.getAUse(this, v)) }
VariableAccess getAUse(StackVariable v) { exists(RangeSsa x | result = x.getAUse(this, v)) }
/** Gets the control flow node for this definition. */
ControlFlowNode getDefinition() { result = this }
@@ -91,7 +94,7 @@ class RangeSsaDefinition extends ControlFlowNodeBase {
BasicBlock getBasicBlock() { result.contains(this.getDefinition()) }
/** Whether this definition is a phi node for variable `v`. */
predicate isPhiNode(StackVariable v) { exists(RangeSSA x | x.phi_node(v, this)) }
predicate isPhiNode(StackVariable v) { exists(RangeSsa x | x.phi_node(v, this)) }
/**
* DEPRECATED: Use isGuardPhi/4 instead
@@ -172,6 +175,6 @@ class RangeSsaDefinition extends ControlFlowNodeBase {
* Holds if this definition of the variable `v` reached the end of the basic block `b`.
*/
predicate reachesEndOfBB(StackVariable v, BasicBlock b) {
exists(RangeSSA x | x.ssaDefinitionReachesEndOfBB(v, this, b))
exists(RangeSsa x | x.ssaDefinitionReachesEndOfBB(v, this, b))
}
}

4
cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
View File

@@ -89,7 +89,7 @@ private ControlFlowNode getControlFlowEntry(ControlFlowNode node) {
* graph so that we can use the dominator tree to find the most recent
* side-effect.
*/
private predicate sideEffectCFG(ControlFlowNode src, ControlFlowNode dst) {
private predicate sideEffectCfg(ControlFlowNode src, ControlFlowNode dst) {
src.getASuccessor() = dst
or
// Add an edge from the entry point to any node that might have a side
@@ -103,7 +103,7 @@ private predicate sideEffectCFG(ControlFlowNode src, ControlFlowNode dst) {
* the side-effect CFG.
*/
private predicate iDomEffect(ControlFlowNode dominator, ControlFlowNode node) =
idominance(functionEntry/1, sideEffectCFG/2)(_, dominator, node)
idominance(functionEntry/1, sideEffectCfg/2)(_, dominator, node)
/**
* Gets the most recent side effect. To be more precise, `result` is a

6
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
View File

@@ -34,7 +34,7 @@ class ReturnStackAllocatedMemoryConfig extends MustFlowConfiguration {
exists(VariableAddressInstruction var, Function func |
var = source.asInstruction() and
func = var.getEnclosingFunction() and
var.getASTVariable() instanceof StackVariable and
var.getAstVariable() instanceof StackVariable and
// Pointer-to-member types aren't properly handled in the dbscheme.
not var.getResultType() instanceof PointerToMemberType and
// Rule out FPs caused by extraction errors.
@@ -84,5 +84,5 @@ where
// Only raise an alert if we're returning from the _same_ callable as the on that
// declared the stack variable.
var.getEnclosingFunction() = sink.getNode().getEnclosingCallable()
select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAST(),
var.getAST().toString()
select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAst(),
var.getAst().toString()

4
cpp/ql/src/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql
View File

@@ -19,7 +19,7 @@ import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.ir.IR
predicate instructionHasVariable(VariableAddressInstruction vai, StackVariable var, Function f) {
var = vai.getASTVariable() and
var = vai.getAstVariable() and
f = vai.getEnclosingFunction() and
// Pointer-to-member types aren't properly handled in the dbscheme.
not vai.getResultType() instanceof PointerToMemberType and
@@ -108,7 +108,7 @@ predicate inheritanceConversionTypes(
/** Gets the HashCons value of an address computed by `instr`, if any. */
TGlobalAddress globalAddress(Instruction instr) {
result = TGlobalVariable(instr.(VariableAddressInstruction).getASTVariable())
result = TGlobalVariable(instr.(VariableAddressInstruction).getAstVariable())
or
not instr instanceof LoadInstruction and
result = globalAddress(instr.(CopyInstruction).getSourceValue())

2
cpp/ql/src/Likely Bugs/RedundantNullCheckSimple.ql
View File

@@ -52,7 +52,7 @@ predicate explicitNullTestOfInstruction(Instruction checked, Instruction bool) {
pragma[noinline]
predicate candidateResult(LoadInstruction checked, ValueNumber value, IRBlock dominator) {
explicitNullTestOfInstruction(checked, _) and
not checked.getAST().isInMacroExpansion() and
not checked.getAst().isInMacroExpansion() and
value.getAnInstruction() = checked and
dominator.dominates(checked.getBlock())
}

6
cpp/ql/src/Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.ql
View File

@@ -11,7 +11,7 @@
import cpp
import ExternalAPIs
from ExternalAPIUsedWithUntrustedData externalAPI
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
from ExternalApiUsedWithUntrustedData externalApi
select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc

26
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll
View File

@@ -9,28 +9,31 @@ private import semmle.code.cpp.models.interfaces.Taint
import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) }
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { any(UntrustedDataToExternalApiConfig c).hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() {
any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this)
any(UntrustedDataToExternalApiConfig c).hasFlow(result, this)
}
}
private newtype TExternalAPI =
TExternalAPIParameter(Function f, int index) {
exists(UntrustedExternalAPIDataNode n |
/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
private newtype TExternalApi =
TExternalApiParameter(Function f, int index) {
exists(UntrustedExternalApiDataNode n |
f = n.getExternalFunction() and
index = n.getIndex()
)
}
/** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex())
UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalApiParameter(result.getExternalFunction(), result.getIndex())
}
/** Gets the number of untrusted sources used with this external API. */
@@ -43,8 +46,11 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Function f, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index
|
this = TExternalAPIParameter(f, index) and
this = TExternalApiParameter(f, index) and
result = f.toString() + " [" + indexString + "]"
)
}
}
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

20
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll
View File

@@ -8,11 +8,11 @@ import semmle.code.cpp.models.interfaces.DataFlow
import SafeExternalAPIFunction
/** A node representing untrusted data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node {
class ExternalApiDataNode extends DataFlow::Node {
Call call;
int i;
ExternalAPIDataNode() {
ExternalApiDataNode() {
// Argument to call to a function
(
this.asExpr() = call.getArgument(i)
@@ -27,7 +27,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
not f instanceof DataFlowFunction and
not f instanceof TaintFunction and
// Not a call to a known safe external API
not f instanceof SafeExternalAPIFunction
not f instanceof SafeExternalApiFunction
)
}
@@ -41,9 +41,12 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getFunctionDescription() { result = this.getExternalFunction().toString() }
}
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
/** DEPRECATED: Alias for ExternalApiDataNode */
deprecated class ExternalAPIDataNode = ExternalApiDataNode;
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
override predicate isSource(DataFlow::Node source) {
exists(RemoteFlowSourceFunction remoteFlow |
@@ -52,5 +55,8 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
)
}
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}
/** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;

6
cpp/ql/src/Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.ql
View File

@@ -11,7 +11,7 @@
import cpp
import ir.ExternalAPIs
from ExternalAPIUsedWithUntrustedData externalAPI
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
from ExternalApiUsedWithUntrustedData externalApi
select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc

4
cpp/ql/src/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.ql
View File

@@ -15,8 +15,8 @@ import ir.ExternalAPIs
import semmle.code.cpp.security.FlowSources
import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() +
"Call to " + sink.getNode().(ExternalApiDataNode).getExternalFunction().toString() +
" with untrusted data from $@.", source, source.getNode().(RemoteFlowSource).getSourceType()

9
cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll
View File

@@ -8,11 +8,14 @@ private import semmle.code.cpp.models.interfaces.SideEffect
/**
* A `Function` that is considered a "safe" external API from a security perspective.
*/
abstract class SafeExternalAPIFunction extends Function { }
abstract class SafeExternalApiFunction extends Function { }
/** DEPRECATED: Alias for SafeExternalApiFunction */
deprecated class SafeExternalAPIFunction = SafeExternalApiFunction;
/** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction {
DefaultSafeExternalAPIFunction() {
private class DefaultSafeExternalApiFunction extends SafeExternalApiFunction {
DefaultSafeExternalApiFunction() {
// If a function does not write to any of its arguments, we consider it safe to
// pass untrusted data to it. This means that string functions such as `strcmp`
// and `strlen`, as well as memory functions such as `memcmp`, are considered safe.

4
cpp/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.ql
View File

@@ -14,8 +14,8 @@ import semmle.code.cpp.dataflow.TaintTracking
import ExternalAPIs
import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() +
"Call to " + sink.getNode().(ExternalApiDataNode).getExternalFunction().toString() +
" with untrusted data from $@.", source, source.toString()

26
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll
View File

@@ -9,28 +9,31 @@ private import semmle.code.cpp.models.interfaces.Taint
import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) }
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { any(UntrustedDataToExternalApiConfig c).hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() {
any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this)
any(UntrustedDataToExternalApiConfig c).hasFlow(result, this)
}
}
private newtype TExternalAPI =
TExternalAPIParameter(Function f, int index) {
exists(UntrustedExternalAPIDataNode n |
/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
private newtype TExternalApi =
TExternalApiParameter(Function f, int index) {
exists(UntrustedExternalApiDataNode n |
f = n.getExternalFunction() and
index = n.getIndex()
)
}
/** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex())
UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalApiParameter(result.getExternalFunction(), result.getIndex())
}
/** Gets the number of untrusted sources used with this external API. */
@@ -43,8 +46,11 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Function f, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index
|
this = TExternalAPIParameter(f, index) and
this = TExternalApiParameter(f, index) and
result = f.toString() + " [" + indexString + "]"
)
}
}
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

20
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIsSpecific.qll
View File

@@ -8,11 +8,11 @@ private import semmle.code.cpp.models.interfaces.DataFlow
import SafeExternalAPIFunction
/** A node representing untrusted data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node {
class ExternalApiDataNode extends DataFlow::Node {
Call call;
int i;
ExternalAPIDataNode() {
ExternalApiDataNode() {
// Argument to call to a function
(
this.asExpr() = call.getArgument(i)
@@ -27,7 +27,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
not f instanceof DataFlowFunction and
not f instanceof TaintFunction and
// Not a call to a known safe external API
not f instanceof SafeExternalAPIFunction
not f instanceof SafeExternalApiFunction
)
}
@@ -41,11 +41,17 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getFunctionDescription() { result = this.getExternalFunction().toString() }
}
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfigIR" }
/** DEPRECATED: Alias for ExternalApiDataNode */
deprecated class ExternalAPIDataNode = ExternalApiDataNode;
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfigIR" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}
/** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;

9
cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll
View File

@@ -8,11 +8,14 @@ private import semmle.code.cpp.models.interfaces.SideEffect
/**
* A `Function` that is considered a "safe" external API from a security perspective.
*/
abstract class SafeExternalAPIFunction extends Function { }
abstract class SafeExternalApiFunction extends Function { }
/** DEPRECATED: Alias for SafeExternalApiFunction */
deprecated class SafeExternalAPIFunction = SafeExternalApiFunction;
/** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction {
DefaultSafeExternalAPIFunction() {
private class DefaultSafeExternalApiFunction extends SafeExternalApiFunction {
DefaultSafeExternalApiFunction() {
// If a function does not write to any of its arguments, we consider it safe to
// pass untrusted data to it. This means that string functions such as `strcmp`
// and `strlen`, as well as memory functions such as `memcmp`, are considered safe.

8
cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View File

@@ -18,15 +18,15 @@ import semmle.code.cpp.security.FunctionWithWrappers
import semmle.code.cpp.security.TaintTracking
import TaintedWithPath
class SQLLikeFunction extends FunctionWithWrappers {
SQLLikeFunction() { sqlArgument(this.getName(), _) }
class SqlLikeFunction extends FunctionWithWrappers {
SqlLikeFunction() { sqlArgument(this.getName(), _) }
override predicate interestingArg(int arg) { sqlArgument(this.getName(), arg) }
}
class Configuration extends TaintTrackingConfiguration {
override predicate isSink(Element tainted) {
exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
exists(SqlLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
}
override predicate isBarrier(Expr e) {
@@ -43,7 +43,7 @@ class Configuration extends TaintTrackingConfiguration {
}
from
SQLLikeFunction runSql, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode,
SqlLikeFunction runSql, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode,
string taintCause, string callChain
where
runSql.outermostWrapperFunctionCall(taintedArg, callChain) and

8
cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
View File

@@ -46,8 +46,8 @@ class EnvData extends SystemData {
/**
* Data originating from a call to `mysql_get_client_info()`.
*/
class SQLClientInfo extends SystemData {
SQLClientInfo() { this.(FunctionCall).getTarget().hasName("mysql_get_client_info") }
class SqlClientInfo extends SystemData {
SqlClientInfo() { this.(FunctionCall).getTarget().hasName("mysql_get_client_info") }
override Expr getAnExpr() { result = this }
}
@@ -63,8 +63,8 @@ private predicate sqlConnectInfo(FunctionCall source, VariableAccess use) {
/**
* Data passed into an SQL connect function.
*/
class SQLConnectInfo extends SystemData {
SQLConnectInfo() { sqlConnectInfo(this, _) }
class SqlConnectInfo extends SystemData {
SqlConnectInfo() { sqlConnectInfo(this, _) }
override Expr getAnExpr() { sqlConnectInfo(this, result) }
}

4
cpp/ql/src/jsf/4.10 Classes/AV Rule 97.ql
View File

@@ -27,13 +27,13 @@ predicate containsArray(Type t) {
)
}
predicate functionAPIViolation(MemberFunction f) {
predicate functionApiViolation(MemberFunction f) {
f.isPublic() and
containsArray(f.getAParameter().getType())
}
from MemberFunction m
where
functionAPIViolation(m) and
functionApiViolation(m) and
not m.getDeclaringType() instanceof Struct
select m, "Raw arrays should not be used in interfaces. A container class should be used instead."

4
cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 186.ql
View File

@@ -12,13 +12,13 @@
import cpp
// whether f is to be considered an API entry point, and hence reachable by default
predicate isAPI(Function f) {
predicate isApi(Function f) {
f.hasName("main") or
f.(MemberFunction).hasSpecifier("public")
}
predicate unusedFunction(Function f) {
not isAPI(f) and
not isApi(f) and
not exists(FunctionCall c | c.getTarget() = f) and
not exists(Access acc | acc.getTarget() = f) and
f.hasDefinition()

2
cpp/ql/src/printAst.ql
View File

@@ -16,7 +16,7 @@ import definitions
*/
external string selectedSourceFile();
class Cfg extends PrintASTConfiguration {
class Cfg extends PrintAstConfiguration {
/**
* Holds if the AST for `func` should be printed.
* Print All functions from the selected file.

7
cpp/ql/test/TestUtilities/dataflow/FlowTestCommon.qll
View File

@@ -42,8 +42,8 @@ class IRFlowTest extends InlineExpectationsTest {
}
}
class ASTFlowTest extends InlineExpectationsTest {
ASTFlowTest() { this = "ASTFlowTest" }
class AstFlowTest extends InlineExpectationsTest {
AstFlowTest() { this = "ASTFlowTest" }
override string getARelevantTag() { result = "ast" }
@@ -69,3 +69,6 @@ class ASTFlowTest extends InlineExpectationsTest {
)
}
}
/** DEPRECATED: Alias for AstFlowTest */
deprecated class ASTFlowTest = AstFlowTest;

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql
View File

@@ -67,8 +67,8 @@ class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
}
}
class ASTTaintTrackingTest extends InlineExpectationsTest {
ASTTaintTrackingTest() { this = "ASTTaintTrackingTest" }
class AstTaintTrackingTest extends InlineExpectationsTest {
AstTaintTrackingTest() { this = "ASTTaintTrackingTest" }
override string getARelevantTag() { result = "ast" }

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql
View File

@@ -55,8 +55,8 @@ class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
}
}
class ASTTaintTrackingTest extends InlineExpectationsTest {
ASTTaintTrackingTest() { this = "ASTTaintTrackingTest" }
class AstTaintTrackingTest extends InlineExpectationsTest {
AstTaintTrackingTest() { this = "ASTTaintTrackingTest" }
override string getARelevantTag() { result = "ast" }

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/globals/global.ql
View File

@@ -27,8 +27,8 @@ class IRGlobalDefaultTaintTrackingTest extends InlineExpectationsTest {
}
}
class ASTGlobalDefaultTaintTrackingTest extends InlineExpectationsTest {
ASTGlobalDefaultTaintTrackingTest() { this = "ASTGlobalDefaultTaintTrackingTest" }
class AstGlobalDefaultTaintTrackingTest extends InlineExpectationsTest {
AstGlobalDefaultTaintTrackingTest() { this = "ASTGlobalDefaultTaintTrackingTest" }
override string getARelevantTag() { result = "ast" }

10
cpp/ql/test/library-tests/dataflow/dataflow-tests/test.ql
View File

@@ -1,6 +1,6 @@
import TestUtilities.dataflow.FlowTestCommon
module ASTTest {
module AstTest {
private import semmle.code.cpp.dataflow.DataFlow
/**
@@ -18,8 +18,8 @@ module ASTTest {
}
/** Common data flow configuration to be used by tests. */
class ASTTestAllocationConfig extends DataFlow::Configuration {
ASTTestAllocationConfig() { this = "ASTTestAllocationConfig" }
class AstTestAllocationConfig extends DataFlow::Configuration {
AstTestAllocationConfig() { this = "ASTTestAllocationConfig" }
override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source"
@@ -100,10 +100,10 @@ module IRTest {
}
private predicate readsVariable(LoadInstruction load, Variable var) {
load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var
load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
}
private predicate writesVariable(StoreInstruction store, Variable var) {
store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var
store.getDestinationAddress().(VariableAddressInstruction).getAstVariable() = var
}
}

7
cpp/ql/test/library-tests/dataflow/fields/ASTConfiguration.qll
View File

@@ -1,8 +1,8 @@
private import semmle.code.cpp.dataflow.DataFlow
private import DataFlow
class ASTConf extends Configuration {
ASTConf() { this = "ASTFieldFlowConf" }
class AstConf extends Configuration {
AstConf() { this = "ASTFieldFlowConf" }
override predicate isSource(Node src) {
src.asExpr() instanceof NewExpr
@@ -30,3 +30,6 @@ class ASTConf extends Configuration {
b.asExpr().(AddressOfExpr).getOperand() = a.asExpr()
}
}
/** DEPRECATED: Alias for AstConf */
deprecated class ASTConf = AstConf;

19
cpp/ql/test/library-tests/dataflow/fields/Nodes.qll
View File

@@ -3,7 +3,7 @@ private import semmle.code.cpp.dataflow.DataFlow as AST
private import cpp
private newtype TNode =
TASTNode(AST::DataFlow::Node n) or
TAstNode(AST::DataFlow::Node n) or
TIRNode(IR::DataFlow::Node n)
class Node extends TNode {
@@ -11,23 +11,32 @@ class Node extends TNode {
IR::DataFlow::Node asIR() { none() }
AST::DataFlow::Node asAST() { none() }
AST::DataFlow::Node asAst() { none() }
/** DEPRECATED: Alias for asAst */
deprecated AST::DataFlow::Node asAST() { result = asAst() }
Location getLocation() { none() }
}
class ASTNode extends Node, TASTNode {
class AstNode extends Node, TAstNode {
AST::DataFlow::Node n;
ASTNode() { this = TASTNode(n) }
AstNode() { this = TAstNode(n) }
override string toString() { result = n.toString() }
override AST::DataFlow::Node asAST() { result = n }
override AST::DataFlow::Node asAst() { result = n }
/** DEPRECATED: Alias for asAst */
deprecated override AST::DataFlow::Node asAST() { result = asAst() }
override Location getLocation() { result = n.getLocation() }
}
/** DEPRECATED: Alias for AstNode */
deprecated class ASTNode = AstNode;
class IRNode extends Node, TIRNode {
IR::DataFlow::Node n;

2
cpp/ql/test/library-tests/dataflow/fields/flow.ql
View File

@@ -1,6 +1,6 @@
import TestUtilities.dataflow.FlowTestCommon
module ASTTest {
module AstTest {
private import ASTConfiguration
}

6
cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
View File

@@ -7,8 +7,8 @@ import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as IR
import semmle.code.cpp.dataflow.DataFlow::DataFlow as AST
import Nodes
class ASTPartialDefNode extends ASTNode {
ASTPartialDefNode() { exists(n.asPartialDefinition()) }
class AstPartialDefNode extends AstNode {
AstPartialDefNode() { exists(n.asPartialDefinition()) }
override string toString() { result = n.asPartialDefinition().toString() }
}
@@ -29,7 +29,7 @@ where
msg = "IR only"
or
exists(AST::Node astNode, Expr partial |
node.asAST() = astNode and
node.asAst() = astNode and
partial = astNode.asPartialDefinition() and
not exists(IR::Node otherNode | otherNode.asPartialDefinition() = partial)
) and

2
cpp/ql/test/library-tests/dataflow/fields/path-flow.ql
View File

@@ -7,6 +7,6 @@ import ASTConfiguration
import cpp
import DataFlow::PathGraph
from DataFlow::PathNode src, DataFlow::PathNode sink, ASTConf conf
from DataFlow::PathNode src, DataFlow::PathNode sink, AstConf conf
where conf.hasFlowPath(src, sink)
select sink, src, sink, sink + " flows from $@", src, src.toString()

6
cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql
View File

@@ -1,10 +1,10 @@
import TestUtilities.dataflow.FlowTestCommon
module ASTTest {
module AstTest {
private import semmle.code.cpp.dataflow.TaintTracking
class ASTSmartPointerTaintConfig extends TaintTracking::Configuration {
ASTSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" }
class AstSmartPointerTaintConfig extends TaintTracking::Configuration {
AstSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" }
override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source"

6
cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
View File

@@ -38,13 +38,13 @@ module TaintModels {
}
}
module ASTTest {
module AstTest {
private import semmle.code.cpp.dataflow.TaintTracking
private import semmle.code.cpp.models.interfaces.Taint
/** Common data flow configuration to be used by tests. */
class ASTTestAllocationConfig extends TaintTracking::Configuration {
ASTTestAllocationConfig() { this = "ASTTestAllocationConfig" }
class AstTestAllocationConfig extends TaintTracking::Configuration {
AstTestAllocationConfig() { this = "ASTTestAllocationConfig" }
override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source"

4
cpp/ql/test/library-tests/depends_initializers/InitializerCFG.ql
View File

@@ -1,7 +1,7 @@
import cpp
Function getCFGFunction(Initializer i) { result = i.getASuccessor*() }
Function getCfgFunction(Initializer i) { result = i.getASuccessor*() }
from Initializer i, string f
where if exists(getCFGFunction(i)) then f = getCFGFunction(i).toString() else f = ""
where if exists(getCfgFunction(i)) then f = getCfgFunction(i).toString() else f = ""
select i, f

2
cpp/ql/test/library-tests/ir/ir/PrintAST.ql
View File

@@ -6,6 +6,6 @@ private import cpp
private import semmle.code.cpp.PrintAST
private import PrintConfig
private class PrintConfig extends PrintASTConfiguration {
private class PrintConfig extends PrintAstConfiguration {
override predicate shouldPrintFunction(Function func) { shouldDumpFunction(func) }
}

6
cpp/ql/test/library-tests/ir/points_to/points_to.ql
View File

@@ -40,7 +40,7 @@ module Raw {
}
}
module UnaliasedSSA {
module UnaliasedSsa {
private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR
private import semmle.code.cpp.ir.implementation.aliased_ssa.internal.AliasedSSA
@@ -49,8 +49,8 @@ module UnaliasedSSA {
result = getOperandMemoryLocation(instr.getAnOperand())
}
class UnaliasedSSAPointsToTest extends InlineExpectationsTest {
UnaliasedSSAPointsToTest() { this = "UnaliasedSSAPointsToTest" }
class UnaliasedSsaPointsToTest extends InlineExpectationsTest {
UnaliasedSsaPointsToTest() { this = "UnaliasedSSAPointsToTest" }
override string getARelevantTag() { result = "ussa" }

67
csharp/ql/lib/semmle/code/asp/WebConfig.qll
View File

@@ -7,67 +7,88 @@ import csharp
/**
* A `Web.config` file.
*/
class WebConfigXML extends XMLFile {
WebConfigXML() { this.getName().matches("%Web.config") }
class WebConfigXml extends XMLFile {
WebConfigXml() { this.getName().matches("%Web.config") }
}
/** DEPRECATED: Alias for WebConfigXml */
deprecated class WebConfigXML = WebConfigXml;
/** A `<configuration>` tag in an ASP.NET configuration file. */
class ConfigurationXMLElement extends XMLElement {
ConfigurationXMLElement() { this.getName().toLowerCase() = "configuration" }
class ConfigurationXmlElement extends XMLElement {
ConfigurationXmlElement() { this.getName().toLowerCase() = "configuration" }
}
/** DEPRECATED: Alias for ConfigurationXmlElement */
deprecated class ConfigurationXMLElement = ConfigurationXmlElement;
/** A `<location>` tag in an ASP.NET configuration file. */
class LocationXMLElement extends XMLElement {
LocationXMLElement() {
this.getParent() instanceof ConfigurationXMLElement and
class LocationXmlElement extends XMLElement {
LocationXmlElement() {
this.getParent() instanceof ConfigurationXmlElement and
this.getName().toLowerCase() = "location"
}
}
/** DEPRECATED: Alias for LocationXmlElement */
deprecated class LocationXMLElement = LocationXmlElement;
/** A `<system.web>` tag in an ASP.NET configuration file. */
class SystemWebXMLElement extends XMLElement {
SystemWebXMLElement() {
class SystemWebXmlElement extends XMLElement {
SystemWebXmlElement() {
(
this.getParent() instanceof ConfigurationXMLElement
this.getParent() instanceof ConfigurationXmlElement
or
this.getParent() instanceof LocationXMLElement
this.getParent() instanceof LocationXmlElement
) and
this.getName().toLowerCase() = "system.web"
}
}
/** DEPRECATED: Alias for SystemWebXmlElement */
deprecated class SystemWebXMLElement = SystemWebXmlElement;
/** A `<system.webServer>` tag in an ASP.NET configuration file. */
class SystemWebServerXMLElement extends XMLElement {
SystemWebServerXMLElement() {
class SystemWebServerXmlElement extends XMLElement {
SystemWebServerXmlElement() {
(
this.getParent() instanceof ConfigurationXMLElement
this.getParent() instanceof ConfigurationXmlElement
or
this.getParent() instanceof LocationXMLElement
this.getParent() instanceof LocationXmlElement
) and
this.getName().toLowerCase() = "system.webserver"
}
}
/** DEPRECATED: Alias for SystemWebServerXmlElement */
deprecated class SystemWebServerXMLElement = SystemWebServerXmlElement;
/** A `<customErrors>` tag in an ASP.NET configuration file. */
class CustomErrorsXMLElement extends XMLElement {
CustomErrorsXMLElement() {
this.getParent() instanceof SystemWebXMLElement and
class CustomErrorsXmlElement extends XMLElement {
CustomErrorsXmlElement() {
this.getParent() instanceof SystemWebXmlElement and
this.getName().toLowerCase() = "customerrors"
}
}
/** DEPRECATED: Alias for CustomErrorsXmlElement */
deprecated class CustomErrorsXMLElement = CustomErrorsXmlElement;
/** A `<httpRuntime>` tag in an ASP.NET configuration file. */
class HttpRuntimeXMLElement extends XMLElement {
HttpRuntimeXMLElement() {
this.getParent() instanceof SystemWebXMLElement and
class HttpRuntimeXmlElement extends XMLElement {
HttpRuntimeXmlElement() {
this.getParent() instanceof SystemWebXmlElement and
this.getName().toLowerCase() = "httpruntime"
}
}
/** DEPRECATED: Alias for HttpRuntimeXmlElement */
deprecated class HttpRuntimeXMLElement = HttpRuntimeXmlElement;
/** A `<forms>` tag under `<system.web><authentication>` in an ASP.NET configuration file. */
class FormsElement extends XMLElement {
FormsElement() {
this = any(SystemWebXMLElement sw).getAChild("authentication").getAChild("forms")
this = any(SystemWebXmlElement sw).getAChild("authentication").getAChild("forms")
}
/**
@@ -85,7 +106,7 @@ class FormsElement extends XMLElement {
/** A `<httpCookies>` tag in an ASP.NET configuration file. */
class HttpCookiesElement extends XMLElement {
HttpCookiesElement() { this = any(SystemWebXMLElement sw).getAChild("httpCookies") }
HttpCookiesElement() { this = any(SystemWebXmlElement sw).getAChild("httpCookies") }
/**
* Gets attribute's `httpOnlyCookies` value.

4
csharp/ql/lib/semmle/code/csharp/XML.qll
View File

@@ -4,11 +4,11 @@
import semmle.files.FileSystem
private class TXMLLocatable =
private class TXmlLocatable =
@xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
/** An XML element that has a location. */
class XMLLocatable extends @xmllocatable, TXMLLocatable {
class XMLLocatable extends @xmllocatable, TXmlLocatable {
/** Gets the source location for this element. */
Location getLocation() { xmllocations(this, result) }

8
csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
View File

@@ -1000,7 +1000,7 @@ module Internal {
// The predicates in this module should be evaluated in the same stage as the CFG
// construction stage. This is to avoid recomputation of pre-basic-blocks and
// pre-SSA predicates
private module PreCFG {
private module PreCfg {
private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
private import semmle.code.csharp.controlflow.internal.PreSsa
@@ -1414,7 +1414,7 @@ module Internal {
}
cached
private module CachedWithCFG {
private module CachedWithCfg {
private import semmle.code.csharp.Caching
cached
@@ -1719,10 +1719,10 @@ module Internal {
}
}
import CachedWithCFG
import CachedWithCfg
}
import PreCFG
import PreCfg
private predicate interestingDescendantCandidate(Expr e) {
guardControls(e, _, _)

59
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
View File

@@ -12,15 +12,18 @@ private import semmle.code.csharp.dataflow.FlowSummary
/**
* A callable that is considered a "safe" external API from a security perspective.
*/
abstract class SafeExternalAPICallable extends Callable { }
abstract class SafeExternalApiCallable extends Callable { }
private class SummarizedCallableSafe extends SafeExternalAPICallable {
/** DEPRECATED: Alias for SafeExternalApiCallable */
deprecated class SafeExternalAPICallable = SafeExternalApiCallable;
private class SummarizedCallableSafe extends SafeExternalApiCallable {
SummarizedCallableSafe() { this instanceof SummarizedCallable }
}
/** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPICallable extends SafeExternalAPICallable {
DefaultSafeExternalAPICallable() {
private class DefaultSafeExternalApiCallable extends SafeExternalApiCallable {
DefaultSafeExternalApiCallable() {
this instanceof EqualsMethod or
this instanceof IEquatableEqualsMethod or
this = any(SystemObjectClass s).getEqualsMethod() or
@@ -36,11 +39,11 @@ private class DefaultSafeExternalAPICallable extends SafeExternalAPICallable {
}
/** A node representing data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node {
class ExternalApiDataNode extends DataFlow::Node {
Call call;
int i;
ExternalAPIDataNode() {
ExternalApiDataNode() {
(
// Argument to call
this.asExpr() = call.getArgument(i)
@@ -59,7 +62,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
m.fromSource()
) and
// Not a call to a known safe external API
not call.getTarget().getUnboundDeclaration() instanceof SafeExternalAPICallable
not call.getTarget().getUnboundDeclaration() instanceof SafeExternalApiCallable
}
/** Gets the called API callable. */
@@ -72,38 +75,47 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getCallableDescription() { result = this.getCallable().getQualifiedName() }
}
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
/** DEPRECATED: Alias for ExternalApiDataNode */
deprecated class ExternalAPIDataNode = ExternalApiDataNode;
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
}
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
private UntrustedDataToExternalAPIConfig c;
/** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;
UntrustedExternalAPIDataNode() { c.hasFlow(_, this) }
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
private UntrustedDataToExternalApiConfig c;
UntrustedExternalApiDataNode() { c.hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { c.hasFlow(result, this) }
}
private newtype TExternalAPI =
TExternalAPIParameter(Callable m, int index) {
exists(UntrustedExternalAPIDataNode n |
/** DEPRECATED: Alias for UntrustedExternalApiDataNode */
deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
private newtype TExternalApi =
TExternalApiParameter(Callable m, int index) {
exists(UntrustedExternalApiDataNode n |
m = n.getCallable().getUnboundDeclaration() and
index = n.getIndex()
)
}
/** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getCallable().getUnboundDeclaration(), result.getIndex())
UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalApiParameter(result.getCallable().getUnboundDeclaration(), result.getIndex())
}
/** Gets the number of untrusted sources used with this external API. */
@@ -116,10 +128,13 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Callable m, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index
|
this = TExternalAPIParameter(m, index) and
this = TExternalApiParameter(m, index) and
result =
m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes() + " [" + indexString +
"]"
)
}
}
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

7
csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View File

@@ -117,12 +117,15 @@ class SearchRequestFilterSink extends Sink {
*
* This will match the encoding methods provided by the AntiXSS library.
*/
class LDAPEncodeSanitizer extends Sanitizer {
LDAPEncodeSanitizer() {
class LdapEncodeSanitizer extends Sanitizer {
LdapEncodeSanitizer() {
this.getExpr().(MethodCall).getTarget().getName().regexpMatch("(?i)LDAP.*Encode.*")
}
}
/** DEPRECATED: Alias for LdapEncodeSanitizer */
deprecated class LDAPEncodeSanitizer = LdapEncodeSanitizer;
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }

4
csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
View File

@@ -28,10 +28,10 @@ abstract class Sink extends DataFlow::ExprNode {
abstract string getReason();
}
private class InsecureXMLSink extends Sink {
private class InsecureXmlSink extends Sink {
private string reason;
InsecureXMLSink() {
InsecureXmlSink() {
exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(reason) |
this.getExpr() = r.getAnArgument()
)

2
csharp/ql/src/Security Features/CWE-011/ASPNetDebug.ql
View File

@@ -17,7 +17,7 @@
import csharp
import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute debugAttribute
from SystemWebXmlElement web, XMLAttribute debugAttribute
where
debugAttribute = web.getAChild("compilation").getAttribute("debug") and
not debugAttribute.getValue().toLowerCase() = "false"

2
csharp/ql/src/Security Features/CWE-016/ASPNetMaxRequestLength.ql
View File

@@ -14,7 +14,7 @@
import csharp
import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute maxReqLength
from SystemWebXmlElement web, XMLAttribute maxReqLength
where
maxReqLength =
web.getAChild(any(string s | s.toLowerCase() = "httpruntime"))

2
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequest.ql
View File

@@ -13,7 +13,7 @@
import csharp
import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute requestvalidateAttribute
from SystemWebXmlElement web, XMLAttribute requestvalidateAttribute
where
requestvalidateAttribute = web.getAChild("pages").getAttribute("validateRequest") and
requestvalidateAttribute.getValue().toLowerCase() = "false"

6
csharp/ql/src/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql
View File

@@ -11,7 +11,7 @@
import csharp
import semmle.code.csharp.security.dataflow.ExternalAPIsQuery
from ExternalAPIUsedWithUntrustedData externalAPI
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
from ExternalApiUsedWithUntrustedData externalApi
select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc

4
csharp/ql/src/Security Features/CWE-020/UntrustedDataToExternalAPI.ql
View File

@@ -14,8 +14,8 @@ import semmle.code.csharp.dataflow.TaintTracking
import semmle.code.csharp.security.dataflow.ExternalAPIsQuery
import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getCallableDescription() +
"Call to " + sink.getNode().(ExternalApiDataNode).getCallableDescription() +
" with untrusted data from $@.", source, source.toString()

2
csharp/ql/src/Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql
View File

@@ -24,7 +24,7 @@ class Application_Error extends Method {
}
}
from CustomErrorsXMLElement customError
from CustomErrorsXmlElement customError
where
// `<customErrors>` must be set to "off" to be dangerous
customError.getAttributeValue("mode").toLowerCase() = "off" and

4
csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql
View File

@@ -19,7 +19,7 @@ import semmle.code.csharp.frameworks.system.Web
/**
* Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header.
*/
predicate hasWebConfigXFrameOptions(WebConfigXML webConfig) {
predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) {
// Looking for an entry in `webConfig` that looks like this:
// ```xml
// <system.webServer>
@@ -52,7 +52,7 @@ predicate hasCodeXFrameOptions() {
)
}
from WebConfigXML webConfig
from WebConfigXml webConfig
where
not hasWebConfigXFrameOptions(webConfig) and
not hasCodeXFrameOptions()

2
csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.ql
View File

@@ -13,7 +13,7 @@
import csharp
import semmle.code.asp.WebConfig
from SystemWebServerXMLElement ws, XMLAttribute a
from SystemWebServerXmlElement ws, XMLAttribute a
where
ws.getAChild("directoryBrowse").getAttribute("enabled") = a and
a.getValue() = "true"

2
csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
View File

@@ -27,7 +27,7 @@ where
)
or
// header checking is disabled in a configuration file
exists(HttpRuntimeXMLElement e, XMLAttribute a |
exists(HttpRuntimeXmlElement e, XMLAttribute a |
a = e.getAttribute("enableHeaderChecking") and
a.getValue().toLowerCase() = "false" and
a = l

Some files were not shown because too many files have changed in this diff Show More