hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

patch upper-case acronyms to be PascalCase

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-03-11 11:10:33 +01:00
parent e3a15792fa
commit 69353bb014
422 changed files with 3532 additions and 2244 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/lib/semmle/code/cpp/Print.qll
View File

@@ -8,9 +8,9 @@ private import PrintAST
private predicate shouldPrintDeclaration(Declaration decl) { private predicate shouldPrintDeclaration(Declaration decl) {
not decl instanceof Function not decl instanceof Function
or or
not exists(PrintASTConfiguration c) not exists(PrintAstConfiguration c)
or or
exists(PrintASTConfiguration config | config.shouldPrintFunction(decl)) exists(PrintAstConfiguration config | config.shouldPrintFunction(decl))
} }
/** /**

2
cpp/ql/lib/semmle/code/cpp/PrintAST.ql
View File

@@ -12,7 +12,7 @@ import PrintAST
* Temporarily tweak this class or make a copy to control which functions are * Temporarily tweak this class or make a copy to control which functions are
* printed. * printed.
*/ */
class Cfg extends PrintASTConfiguration { class Cfg extends PrintAstConfiguration {
/** /**
* TWEAK THIS PREDICATE AS NEEDED. * TWEAK THIS PREDICATE AS NEEDED.
* Holds if the AST for `func` should be printed. * Holds if the AST for `func` should be printed.

129
cpp/ql/lib/semmle/code/cpp/PrintAST.qll
View File

@@ -9,12 +9,12 @@
import cpp import cpp
private import semmle.code.cpp.Print private import semmle.code.cpp.Print
private newtype TPrintASTConfiguration = MkPrintASTConfiguration() private newtype TPrintAstConfiguration = MkPrintAstConfiguration()
/** /**
* The query can extend this class to control which functions are printed. * The query can extend this class to control which functions are printed.
*/ */
class PrintASTConfiguration extends TPrintASTConfiguration { class PrintAstConfiguration extends TPrintAstConfiguration {
/** /**
* Gets a textual representation of this `PrintASTConfiguration`. * Gets a textual representation of this `PrintASTConfiguration`.
*/ */
@@ -27,8 +27,11 @@ class PrintASTConfiguration extends TPrintASTConfiguration {
predicate shouldPrintFunction(Function func) { any() } predicate shouldPrintFunction(Function func) { any() }
} }
/** DEPRECATED: Alias for PrintAstConfiguration */
deprecated class PrintASTConfiguration = PrintAstConfiguration;
private predicate shouldPrintFunction(Function func) { private predicate shouldPrintFunction(Function func) {
exists(PrintASTConfiguration config | config.shouldPrintFunction(func)) exists(PrintAstConfiguration config | config.shouldPrintFunction(func))
} }
bindingset[s] bindingset[s]
@@ -85,8 +88,8 @@ private Function getEnclosingFunction(Locatable ast) {
* Most nodes are just a wrapper around `Locatable`, but we do synthesize new * Most nodes are just a wrapper around `Locatable`, but we do synthesize new
* nodes for things like parameter lists and constructor init lists. * nodes for things like parameter lists and constructor init lists.
*/ */
private newtype TPrintASTNode = private newtype TPrintAstNode =
TASTNode(Locatable ast) { shouldPrintFunction(getEnclosingFunction(ast)) } or TAstNode(Locatable ast) { shouldPrintFunction(getEnclosingFunction(ast)) } or
TDeclarationEntryNode(DeclStmt stmt, DeclarationEntry entry) { TDeclarationEntryNode(DeclStmt stmt, DeclarationEntry entry) {
// We create a unique node for each pair of (stmt, entry), to avoid having one node with // We create a unique node for each pair of (stmt, entry), to avoid having one node with
// multiple parents due to extractor bug CPP-413. // multiple parents due to extractor bug CPP-413.
@@ -106,7 +109,7 @@ private newtype TPrintASTNode =
/** /**
* A node in the output tree. * A node in the output tree.
*/ */
class PrintASTNode extends TPrintASTNode { class PrintAstNode extends TPrintAstNode {
/** /**
* Gets a textual representation of this node in the PrintAST output tree. * Gets a textual representation of this node in the PrintAST output tree.
*/ */
@@ -116,17 +119,17 @@ class PrintASTNode extends TPrintASTNode {
* Gets the child node at index `childIndex`. Child indices must be unique, * Gets the child node at index `childIndex`. Child indices must be unique,
* but need not be contiguous. * but need not be contiguous.
*/ */
abstract PrintASTNode getChildInternal(int childIndex); abstract PrintAstNode getChildInternal(int childIndex);
/** /**
* Gets the child node at index `childIndex`. * Gets the child node at index `childIndex`.
* Adds edges to fully converted expressions, that are not part of the * Adds edges to fully converted expressions, that are not part of the
* regular parent/child relation traversal. * regular parent/child relation traversal.
*/ */
final PrintASTNode getChild(int childIndex) { final PrintAstNode getChild(int childIndex) {
// The exact value of `childIndex` doesn't matter, as long as we preserve the correct order. // The exact value of `childIndex` doesn't matter, as long as we preserve the correct order.
result = result =
rank[childIndex](PrintASTNode child, int nonConvertedIndex, boolean isConverted | rank[childIndex](PrintAstNode child, int nonConvertedIndex, boolean isConverted |
childAndAccessorPredicate(child, _, nonConvertedIndex, isConverted) childAndAccessorPredicate(child, _, nonConvertedIndex, isConverted)
| |
// Unconverted children come first, then sort by original child index within each group. // Unconverted children come first, then sort by original child index within each group.
@@ -138,11 +141,11 @@ class PrintASTNode extends TPrintASTNode {
* Gets the node for the `.getFullyConverted()` version of the child originally at index * Gets the node for the `.getFullyConverted()` version of the child originally at index
* `childIndex`, if that node has any conversions. * `childIndex`, if that node has any conversions.
*/ */
private PrintASTNode getConvertedChild(int childIndex) { private PrintAstNode getConvertedChild(int childIndex) {
exists(Expr expr | exists(Expr expr |
expr = getChildInternal(childIndex).(ASTNode).getAST() and expr = getChildInternal(childIndex).(AstNode).getAst() and
expr.getFullyConverted() instanceof Conversion and expr.getFullyConverted() instanceof Conversion and
result.(ASTNode).getAST() = expr.getFullyConverted() and result.(AstNode).getAst() = expr.getFullyConverted() and
not expr instanceof Conversion not expr instanceof Conversion
) )
} }
@@ -166,12 +169,12 @@ class PrintASTNode extends TPrintASTNode {
/** /**
* Gets the children of this node. * Gets the children of this node.
*/ */
final PrintASTNode getAChild() { result = getChild(_) } final PrintAstNode getAChild() { result = getChild(_) }
/** /**
* Gets the parent of this node, if any. * Gets the parent of this node, if any.
*/ */
final PrintASTNode getParent() { result.getAChild() = this } final PrintAstNode getParent() { result.getAChild() = this }
/** /**
* Gets the location of this node in the source code. * Gets the location of this node in the source code.
@@ -196,7 +199,7 @@ class PrintASTNode extends TPrintASTNode {
* one result tuple, with `isConverted = false`. * one result tuple, with `isConverted = false`.
*/ */
private predicate childAndAccessorPredicate( private predicate childAndAccessorPredicate(
PrintASTNode child, string childPredicate, int nonConvertedIndex, boolean isConverted PrintAstNode child, string childPredicate, int nonConvertedIndex, boolean isConverted
) { ) {
child = getChildInternal(nonConvertedIndex) and child = getChildInternal(nonConvertedIndex) and
childPredicate = getChildAccessorPredicateInternal(nonConvertedIndex) and childPredicate = getChildAccessorPredicateInternal(nonConvertedIndex) and
@@ -234,12 +237,15 @@ class PrintASTNode extends TPrintASTNode {
private Function getEnclosingFunction() { result = getParent*().(FunctionNode).getFunction() } private Function getEnclosingFunction() { result = getParent*().(FunctionNode).getFunction() }
} }
/** DEPRECATED: Alias for PrintAstNode */
deprecated class PrintASTNode = PrintAstNode;
/** /**
* Class that restricts the elements that we compute `qlClass` for. * Class that restricts the elements that we compute `qlClass` for.
*/ */
private class PrintableElement extends Element { private class PrintableElement extends Element {
PrintableElement() { PrintableElement() {
exists(TASTNode(this)) exists(TAstNode(this))
or or
exists(TDeclarationEntryNode(_, this)) exists(TDeclarationEntryNode(_, this))
or or
@@ -262,7 +268,7 @@ private string qlClass(PrintableElement el) {
/** /**
* A node representing an AST node. * A node representing an AST node.
*/ */
abstract class BaseASTNode extends PrintASTNode { abstract class BaseAstNode extends PrintAstNode {
Locatable ast; Locatable ast;
override string toString() { result = qlClass(ast) + ast.toString() } override string toString() { result = qlClass(ast) + ast.toString() }
@@ -272,25 +278,34 @@ abstract class BaseASTNode extends PrintASTNode {
/** /**
* Gets the AST represented by this node. * Gets the AST represented by this node.
*/ */
final Locatable getAST() { result = ast } final Locatable getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated Locatable getAST() { result = getAst() }
} }
/** DEPRECATED: Alias for BaseAstNode */
deprecated class BaseASTNode = BaseAstNode;
/** /**
* A node representing an AST node other than a `DeclarationEntry`. * A node representing an AST node other than a `DeclarationEntry`.
*/ */
abstract class ASTNode extends BaseASTNode, TASTNode { abstract class AstNode extends BaseAstNode, TAstNode {
ASTNode() { this = TASTNode(ast) } AstNode() { this = TAstNode(ast) }
} }
/** DEPRECATED: Alias for AstNode */
deprecated class ASTNode = AstNode;
/** /**
* A node representing an `Expr`. * A node representing an `Expr`.
*/ */
class ExprNode extends ASTNode { class ExprNode extends AstNode {
Expr expr; Expr expr;
ExprNode() { expr = ast } ExprNode() { expr = ast }
override ASTNode getChildInternal(int childIndex) { result.getAST() = expr.getChild(childIndex) } override AstNode getChildInternal(int childIndex) { result.getAst() = expr.getChild(childIndex) }
override string getProperty(string key) { override string getProperty(string key) {
result = super.getProperty(key) result = super.getProperty(key)
@@ -306,7 +321,7 @@ class ExprNode extends ASTNode {
} }
override string getChildAccessorPredicateInternal(int childIndex) { override string getChildAccessorPredicateInternal(int childIndex) {
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST()) result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAst())
} }
/** /**
@@ -334,9 +349,9 @@ class ConversionNode extends ExprNode {
ConversionNode() { conv = expr } ConversionNode() { conv = expr }
override ASTNode getChildInternal(int childIndex) { override AstNode getChildInternal(int childIndex) {
childIndex = 0 and childIndex = 0 and
result.getAST() = conv.getExpr() and result.getAst() = conv.getExpr() and
conv.getExpr() instanceof Conversion conv.getExpr() instanceof Conversion
} }
} }
@@ -363,27 +378,27 @@ class CastNode extends ConversionNode {
class StmtExprNode extends ExprNode { class StmtExprNode extends ExprNode {
override StmtExpr expr; override StmtExpr expr;
override ASTNode getChildInternal(int childIndex) { override AstNode getChildInternal(int childIndex) {
childIndex = 0 and childIndex = 0 and
result.getAST() = expr.getStmt() result.getAst() = expr.getStmt()
} }
} }
/** /**
* A node representing a `DeclarationEntry`. * A node representing a `DeclarationEntry`.
*/ */
class DeclarationEntryNode extends BaseASTNode, TDeclarationEntryNode { class DeclarationEntryNode extends BaseAstNode, TDeclarationEntryNode {
override DeclarationEntry ast; override DeclarationEntry ast;
DeclStmt declStmt; DeclStmt declStmt;
DeclarationEntryNode() { this = TDeclarationEntryNode(declStmt, ast) } DeclarationEntryNode() { this = TDeclarationEntryNode(declStmt, ast) }
override PrintASTNode getChildInternal(int childIndex) { none() } override PrintAstNode getChildInternal(int childIndex) { none() }
override string getChildAccessorPredicateInternal(int childIndex) { none() } override string getChildAccessorPredicateInternal(int childIndex) { none() }
override string getProperty(string key) { override string getProperty(string key) {
result = BaseASTNode.super.getProperty(key) result = BaseAstNode.super.getProperty(key)
or or
key = "Type" and key = "Type" and
result = qlClass(ast.getType()) + ast.getType().toString() result = qlClass(ast.getType()) + ast.getType().toString()
@@ -396,9 +411,9 @@ class DeclarationEntryNode extends BaseASTNode, TDeclarationEntryNode {
class VariableDeclarationEntryNode extends DeclarationEntryNode { class VariableDeclarationEntryNode extends DeclarationEntryNode {
override VariableDeclarationEntry ast; override VariableDeclarationEntry ast;
override ASTNode getChildInternal(int childIndex) { override AstNode getChildInternal(int childIndex) {
childIndex = 0 and childIndex = 0 and
result.getAST() = ast.getVariable().getInitializer() result.getAst() = ast.getVariable().getInitializer()
} }
override string getChildAccessorPredicateInternal(int childIndex) { override string getChildAccessorPredicateInternal(int childIndex) {
@@ -410,23 +425,23 @@ class VariableDeclarationEntryNode extends DeclarationEntryNode {
/** /**
* A node representing a `Stmt`. * A node representing a `Stmt`.
*/ */
class StmtNode extends ASTNode { class StmtNode extends AstNode {
Stmt stmt; Stmt stmt;
StmtNode() { stmt = ast } StmtNode() { stmt = ast }
override BaseASTNode getChildInternal(int childIndex) { override BaseAstNode getChildInternal(int childIndex) {
exists(Locatable child | exists(Locatable child |
child = stmt.getChild(childIndex) and child = stmt.getChild(childIndex) and
( (
result.getAST() = child.(Expr) or result.getAst() = child.(Expr) or
result.getAST() = child.(Stmt) result.getAst() = child.(Stmt)
) )
) )
} }
override string getChildAccessorPredicateInternal(int childIndex) { override string getChildAccessorPredicateInternal(int childIndex) {
result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST()) result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAst())
} }
} }
@@ -449,12 +464,12 @@ class DeclStmtNode extends StmtNode {
/** /**
* A node representing a `Parameter`. * A node representing a `Parameter`.
*/ */
class ParameterNode extends ASTNode { class ParameterNode extends AstNode {
Parameter param; Parameter param;
ParameterNode() { param = ast } ParameterNode() { param = ast }
final override PrintASTNode getChildInternal(int childIndex) { none() } final override PrintAstNode getChildInternal(int childIndex) { none() }
final override string getChildAccessorPredicateInternal(int childIndex) { none() } final override string getChildAccessorPredicateInternal(int childIndex) { none() }
@@ -469,14 +484,14 @@ class ParameterNode extends ASTNode {
/** /**
* A node representing an `Initializer`. * A node representing an `Initializer`.
*/ */
class InitializerNode extends ASTNode { class InitializerNode extends AstNode {
Initializer init; Initializer init;
InitializerNode() { init = ast } InitializerNode() { init = ast }
override ASTNode getChildInternal(int childIndex) { override AstNode getChildInternal(int childIndex) {
childIndex = 0 and childIndex = 0 and
result.getAST() = init.getExpr() result.getAst() = init.getExpr()
} }
override string getChildAccessorPredicateInternal(int childIndex) { override string getChildAccessorPredicateInternal(int childIndex) {
@@ -488,7 +503,7 @@ class InitializerNode extends ASTNode {
/** /**
* A node representing the parameters of a `Function`. * A node representing the parameters of a `Function`.
*/ */
class ParametersNode extends PrintASTNode, TParametersNode { class ParametersNode extends PrintAstNode, TParametersNode {
Function func; Function func;
ParametersNode() { this = TParametersNode(func) } ParametersNode() { this = TParametersNode(func) }
@@ -497,8 +512,8 @@ class ParametersNode extends PrintASTNode, TParametersNode {
final override Location getLocation() { result = getRepresentativeLocation(func) } final override Location getLocation() { result = getRepresentativeLocation(func) }
override ASTNode getChildInternal(int childIndex) { override AstNode getChildInternal(int childIndex) {
result.getAST() = func.getParameter(childIndex) result.getAst() = func.getParameter(childIndex)
} }
override string getChildAccessorPredicateInternal(int childIndex) { override string getChildAccessorPredicateInternal(int childIndex) {
@@ -515,7 +530,7 @@ class ParametersNode extends PrintASTNode, TParametersNode {
/** /**
* A node representing the initializer list of a `Constructor`. * A node representing the initializer list of a `Constructor`.
*/ */
class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializersNode { class ConstructorInitializersNode extends PrintAstNode, TConstructorInitializersNode {
Constructor ctor; Constructor ctor;
ConstructorInitializersNode() { this = TConstructorInitializersNode(ctor) } ConstructorInitializersNode() { this = TConstructorInitializersNode(ctor) }
@@ -524,8 +539,8 @@ class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializers
final override Location getLocation() { result = getRepresentativeLocation(ctor) } final override Location getLocation() { result = getRepresentativeLocation(ctor) }
final override ASTNode getChildInternal(int childIndex) { final override AstNode getChildInternal(int childIndex) {
result.getAST() = ctor.getInitializer(childIndex) result.getAst() = ctor.getInitializer(childIndex)
} }
final override string getChildAccessorPredicateInternal(int childIndex) { final override string getChildAccessorPredicateInternal(int childIndex) {
@@ -542,7 +557,7 @@ class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializers
/** /**
* A node representing the destruction list of a `Destructor`. * A node representing the destruction list of a `Destructor`.
*/ */
class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNode { class DestructorDestructionsNode extends PrintAstNode, TDestructorDestructionsNode {
Destructor dtor; Destructor dtor;
DestructorDestructionsNode() { this = TDestructorDestructionsNode(dtor) } DestructorDestructionsNode() { this = TDestructorDestructionsNode(dtor) }
@@ -551,8 +566,8 @@ class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNo
final override Location getLocation() { result = getRepresentativeLocation(dtor) } final override Location getLocation() { result = getRepresentativeLocation(dtor) }
final override ASTNode getChildInternal(int childIndex) { final override AstNode getChildInternal(int childIndex) {
result.getAST() = dtor.getDestruction(childIndex) result.getAst() = dtor.getDestruction(childIndex)
} }
final override string getChildAccessorPredicateInternal(int childIndex) { final override string getChildAccessorPredicateInternal(int childIndex) {
@@ -569,14 +584,14 @@ class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNo
/** /**
* A node representing a `Function`. * A node representing a `Function`.
*/ */
class FunctionNode extends ASTNode { class FunctionNode extends AstNode {
Function func; Function func;
FunctionNode() { func = ast } FunctionNode() { func = ast }
override string toString() { result = qlClass(func) + getIdentityString(func) } override string toString() { result = qlClass(func) + getIdentityString(func) }
override PrintASTNode getChildInternal(int childIndex) { override PrintAstNode getChildInternal(int childIndex) {
childIndex = 0 and childIndex = 0 and
result.(ParametersNode).getFunction() = func result.(ParametersNode).getFunction() = func
or or
@@ -584,7 +599,7 @@ class FunctionNode extends ASTNode {
result.(ConstructorInitializersNode).getConstructor() = func result.(ConstructorInitializersNode).getConstructor() = func
or or
childIndex = 2 and childIndex = 2 and
result.(ASTNode).getAST() = func.getEntryPoint() result.(AstNode).getAst() = func.getEntryPoint()
or or
childIndex = 3 and childIndex = 3 and
result.(DestructorDestructionsNode).getDestructor() = func result.(DestructorDestructionsNode).getDestructor() = func
@@ -603,7 +618,7 @@ class FunctionNode extends ASTNode {
private int getOrder() { private int getOrder() {
this = this =
rank[result](FunctionNode node, Function function, string file, int line, int column | rank[result](FunctionNode node, Function function, string file, int line, int column |
node.getAST() = function and node.getAst() = function and
locationSortKeys(function, file, line, column) locationSortKeys(function, file, line, column)
| |
node order by file, line, column, getIdentityString(function) node order by file, line, column, getIdentityString(function)
@@ -856,7 +871,7 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
} }
/** Holds if `node` belongs to the output tree, and its property `key` has the given `value`. */ /** Holds if `node` belongs to the output tree, and its property `key` has the given `value`. */
query predicate nodes(PrintASTNode node, string key, string value) { query predicate nodes(PrintAstNode node, string key, string value) {
node.shouldPrint() and node.shouldPrint() and
value = node.getProperty(key) value = node.getProperty(key)
} }
@@ -865,7 +880,7 @@ query predicate nodes(PrintASTNode node, string key, string value) {
* Holds if `target` is a child of `source` in the AST, and property `key` of the edge has the * Holds if `target` is a child of `source` in the AST, and property `key` of the edge has the
* given `value`. * given `value`.
*/ */
query predicate edges(PrintASTNode source, PrintASTNode target, string key, string value) { query predicate edges(PrintAstNode source, PrintAstNode target, string key, string value) {
exists(int childIndex | exists(int childIndex |
source.shouldPrint() and source.shouldPrint() and
target.shouldPrint() and target.shouldPrint() and

4
cpp/ql/lib/semmle/code/cpp/XML.qll
View File

@@ -4,11 +4,11 @@
import semmle.files.FileSystem import semmle.files.FileSystem
private class TXMLLocatable = private class TXmlLocatable =
@xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters; @xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
/** An XML element that has a location. */ /** An XML element that has a location. */
class XMLLocatable extends @xmllocatable, TXMLLocatable { class XMLLocatable extends @xmllocatable, TXmlLocatable {
/** Gets the source location for this element. */ /** Gets the source location for this element. */
Location getLocation() { xmllocations(this, result) } Location getLocation() { xmllocations(this, result) }

6
cpp/ql/lib/semmle/code/cpp/controlflow/ControlFlowGraph.qll
View File

@@ -65,7 +65,7 @@ class ControlFlowNode extends Locatable, ControlFlowNodeBase {
* taken when this expression is true. * taken when this expression is true.
*/ */
ControlFlowNode getATrueSuccessor() { ControlFlowNode getATrueSuccessor() {
qlCFGTrueSuccessor(this, result) and qlCfgTrueSuccessor(this, result) and
result = this.getASuccessor() result = this.getASuccessor()
} }
@@ -74,7 +74,7 @@ class ControlFlowNode extends Locatable, ControlFlowNodeBase {
* taken when this expression is false. * taken when this expression is false.
*/ */
ControlFlowNode getAFalseSuccessor() { ControlFlowNode getAFalseSuccessor() {
qlCFGFalseSuccessor(this, result) and qlCfgFalseSuccessor(this, result) and
result = this.getASuccessor() result = this.getASuccessor()
} }
@@ -121,7 +121,7 @@ abstract class AdditionalControlFlowEdge extends ControlFlowNodeBase {
* `AdditionalControlFlowEdge`. Use this relation instead of `qlCFGSuccessor`. * `AdditionalControlFlowEdge`. Use this relation instead of `qlCFGSuccessor`.
*/ */
predicate successors_extended(ControlFlowNodeBase source, ControlFlowNodeBase target) { predicate successors_extended(ControlFlowNodeBase source, ControlFlowNodeBase target) {
qlCFGSuccessor(source, target) qlCfgSuccessor(source, target)
or or
source.(AdditionalControlFlowEdge).getAnEdgeTarget() = target source.(AdditionalControlFlowEdge).getAnEdgeTarget() = target
} }

10
cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
View File

@@ -33,8 +33,8 @@ class GuardCondition extends Expr {
or or
// the IR short-circuits if(!x) // the IR short-circuits if(!x)
// don't produce a guard condition for `y = !x` and other non-short-circuited cases // don't produce a guard condition for `y = !x` and other non-short-circuited cases
not exists(Instruction inst | this.getFullyConverted() = inst.getAST()) and not exists(Instruction inst | this.getFullyConverted() = inst.getAst()) and
exists(IRGuardCondition ir | this.(NotExpr).getOperand() = ir.getAST()) exists(IRGuardCondition ir | this.(NotExpr).getOperand() = ir.getAst())
} }
/** /**
@@ -146,8 +146,8 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
*/ */
private class GuardConditionFromShortCircuitNot extends GuardCondition, NotExpr { private class GuardConditionFromShortCircuitNot extends GuardCondition, NotExpr {
GuardConditionFromShortCircuitNot() { GuardConditionFromShortCircuitNot() {
not exists(Instruction inst | this.getFullyConverted() = inst.getAST()) and not exists(Instruction inst | this.getFullyConverted() = inst.getAst()) and
exists(IRGuardCondition ir | this.getOperand() = ir.getAST()) exists(IRGuardCondition ir | this.getOperand() = ir.getAst())
} }
override predicate controls(BasicBlock controlled, boolean testIsTrue) { override predicate controls(BasicBlock controlled, boolean testIsTrue) {
@@ -241,7 +241,7 @@ private class GuardConditionFromIR extends GuardCondition {
private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) { private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
exists(IRBlock irb | exists(IRBlock irb |
forex(IRGuardCondition inst | inst = ir | inst.controls(irb, testIsTrue)) and forex(IRGuardCondition inst | inst = ir | inst.controls(irb, testIsTrue)) and
irb.getAnInstruction().getAST().(ControlFlowNode).getBasicBlock() = controlled and irb.getAnInstruction().getAst().(ControlFlowNode).getBasicBlock() = controlled and
not isUnreachedBlock(irb) not isUnreachedBlock(irb)
) )
} }

19
cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll
View File

@@ -10,10 +10,13 @@ import SSAUtils
* The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA. * The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA.
* This class provides the standard SSA logic. * This class provides the standard SSA logic.
*/ */
library class StandardSSA extends SSAHelper { library class StandardSsa extends SsaHelper {
StandardSSA() { this = 0 } StandardSsa() { this = 0 }
} }
/** DEPRECATED: Alias for StandardSsa */
deprecated class StandardSSA = StandardSsa;
/** /**
* A definition of one or more SSA variables, including phi node definitions. * A definition of one or more SSA variables, including phi node definitions.
* An _SSA variable_, as defined in the literature, is effectively the pair of * An _SSA variable_, as defined in the literature, is effectively the pair of
@@ -27,22 +30,22 @@ library class StandardSSA extends SSAHelper {
* statically seen to be unreachable. * statically seen to be unreachable.
*/ */
class SsaDefinition extends ControlFlowNodeBase { class SsaDefinition extends ControlFlowNodeBase {
SsaDefinition() { exists(StandardSSA x | x.ssa_defn(_, this, _, _)) } SsaDefinition() { exists(StandardSsa x | x.ssa_defn(_, this, _, _)) }
/** /**
* Gets a variable corresponding to an SSA StackVariable defined by * Gets a variable corresponding to an SSA StackVariable defined by
* this definition. * this definition.
*/ */
StackVariable getAVariable() { exists(StandardSSA x | x.ssa_defn(result, this, _, _)) } StackVariable getAVariable() { exists(StandardSsa x | x.ssa_defn(result, this, _, _)) }
/** /**
* Gets a string representation of the SSA variable represented by the pair * Gets a string representation of the SSA variable represented by the pair
* `(this, v)`. * `(this, v)`.
*/ */
string toString(StackVariable v) { exists(StandardSSA x | result = x.toString(this, v)) } string toString(StackVariable v) { exists(StandardSsa x | result = x.toString(this, v)) }
/** Gets a use of the SSA variable represented by the pair `(this, v)`. */ /** Gets a use of the SSA variable represented by the pair `(this, v)`. */
VariableAccess getAUse(StackVariable v) { exists(StandardSSA x | result = x.getAUse(this, v)) } VariableAccess getAUse(StackVariable v) { exists(StandardSsa x | result = x.getAUse(this, v)) }
/** /**
* Gets the control-flow node for this definition. This will usually be the * Gets the control-flow node for this definition. This will usually be the
@@ -62,7 +65,7 @@ class SsaDefinition extends ControlFlowNodeBase {
BasicBlock getBasicBlock() { result.contains(this.getDefinition()) } BasicBlock getBasicBlock() { result.contains(this.getDefinition()) }
/** Holds if this definition is a phi node for variable `v`. */ /** Holds if this definition is a phi node for variable `v`. */
predicate isPhiNode(StackVariable v) { exists(StandardSSA x | x.phi_node(v, this)) } predicate isPhiNode(StackVariable v) { exists(StandardSsa x | x.phi_node(v, this)) }
/** Gets the location of this definition. */ /** Gets the location of this definition. */
Location getLocation() { result = this.(ControlFlowNode).getLocation() } Location getLocation() { result = this.(ControlFlowNode).getLocation() }
@@ -124,7 +127,7 @@ class SsaDefinition extends ControlFlowNodeBase {
/** Holds if `(this, v)` reaches the end of basic block `b`. */ /** Holds if `(this, v)` reaches the end of basic block `b`. */
predicate reachesEndOfBB(StackVariable v, BasicBlock b) { predicate reachesEndOfBB(StackVariable v, BasicBlock b) {
exists(StandardSSA x | x.ssaDefinitionReachesEndOfBB(v, this, b)) exists(StandardSsa x | x.ssaDefinitionReachesEndOfBB(v, this, b))
} }
/** /**

7
cpp/ql/lib/semmle/code/cpp/controlflow/SSAUtils.qll
View File

@@ -114,10 +114,10 @@ private predicate live_at_exit_of_bb(StackVariable v, BasicBlock b) {
/** Common SSA logic for standard SSA and range-analysis SSA. */ /** Common SSA logic for standard SSA and range-analysis SSA. */
cached cached
library class SSAHelper extends int { library class SsaHelper extends int {
/* 0 = StandardSSA, 1 = RangeSSA */ /* 0 = StandardSSA, 1 = RangeSSA */
cached cached
SSAHelper() { this in [0 .. 1] } SsaHelper() { this in [0 .. 1] }
/** /**
* Override to insert a custom phi node for variable `v` at the start of * Override to insert a custom phi node for variable `v` at the start of
@@ -311,3 +311,6 @@ library class SSAHelper extends int {
ssa_use(v, result, _, _) ssa_use(v, result, _, _)
} }
} }
/** DEPRECATED: Alias for SsaHelper */
deprecated class SSAHelper = SsaHelper;

15
cpp/ql/lib/semmle/code/cpp/controlflow/internal/CFG.qll
View File

@@ -1379,7 +1379,7 @@ private module Cached {
* true-successors and false-successors. * true-successors and false-successors.
*/ */
cached cached
predicate qlCFGSuccessor(Node n1, Node n2) { predicate qlCfgSuccessor(Node n1, Node n2) {
exists(Node memberNode, Pos memberPos | exists(Node memberNode, Pos memberPos |
subEdgeIncludingDestructors(any(Pos at | at.isAt()), n1, memberNode, memberPos) and subEdgeIncludingDestructors(any(Pos at | at.isAt()), n1, memberNode, memberPos) and
normalGroupMember(memberNode, memberPos, n2) normalGroupMember(memberNode, memberPos, n2)
@@ -1388,23 +1388,32 @@ private module Cached {
conditionalSuccessor(n1, _, n2) conditionalSuccessor(n1, _, n2)
} }
/** DEPRECATED: Alias for qlCfgSuccessor */
deprecated predicate qlCFGSuccessor = qlCfgSuccessor/2;
/** /**
* Holds if `n2` is a control-flow node such that the control-flow * Holds if `n2` is a control-flow node such that the control-flow
* edge `(n1, n2)` may be taken when `n1` is an expression that is true. * edge `(n1, n2)` may be taken when `n1` is an expression that is true.
*/ */
cached cached
predicate qlCFGTrueSuccessor(Node n1, Node n2) { predicate qlCfgTrueSuccessor(Node n1, Node n2) {
conditionalSuccessor(n1, true, n2) and conditionalSuccessor(n1, true, n2) and
not conditionalSuccessor(n1, false, n2) not conditionalSuccessor(n1, false, n2)
} }
/** DEPRECATED: Alias for qlCfgTrueSuccessor */
deprecated predicate qlCFGTrueSuccessor = qlCfgTrueSuccessor/2;
/** /**
* Holds if `n2` is a control-flow node such that the control-flow * Holds if `n2` is a control-flow node such that the control-flow
* edge `(n1, n2)` may be taken when `n1` is an expression that is false. * edge `(n1, n2)` may be taken when `n1` is an expression that is false.
*/ */
cached cached
predicate qlCFGFalseSuccessor(Node n1, Node n2) { predicate qlCfgFalseSuccessor(Node n1, Node n2) {
conditionalSuccessor(n1, false, n2) and conditionalSuccessor(n1, false, n2) and
not conditionalSuccessor(n1, true, n2) not conditionalSuccessor(n1, true, n2)
} }
/** DEPRECATED: Alias for qlCfgFalseSuccessor */
deprecated predicate qlCFGFalseSuccessor = qlCfgFalseSuccessor/2;
} }

12
cpp/ql/lib/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
View File

@@ -188,8 +188,8 @@ private predicate nonAnalyzableFunction(Function f) {
*/ */
private predicate impossibleFalseEdge(Expr condition, Node succ) { private predicate impossibleFalseEdge(Expr condition, Node succ) {
conditionAlwaysTrue(condition) and conditionAlwaysTrue(condition) and
qlCFGFalseSuccessor(condition, succ) and qlCfgFalseSuccessor(condition, succ) and
not qlCFGTrueSuccessor(condition, succ) not qlCfgTrueSuccessor(condition, succ)
} }
/** /**
@@ -197,8 +197,8 @@ private predicate impossibleFalseEdge(Expr condition, Node succ) {
*/ */
private predicate impossibleTrueEdge(Expr condition, Node succ) { private predicate impossibleTrueEdge(Expr condition, Node succ) {
conditionAlwaysFalse(condition) and conditionAlwaysFalse(condition) and
qlCFGTrueSuccessor(condition, succ) and qlCfgTrueSuccessor(condition, succ) and
not qlCFGFalseSuccessor(condition, succ) not qlCfgFalseSuccessor(condition, succ)
} }
/** /**
@@ -960,9 +960,9 @@ library class ConditionEvaluator extends ExprEvaluator {
ConditionEvaluator() { this = 0 } ConditionEvaluator() { this = 0 }
override predicate interesting(Expr e) { override predicate interesting(Expr e) {
qlCFGFalseSuccessor(e, _) qlCfgFalseSuccessor(e, _)
or or
qlCFGTrueSuccessor(e, _) qlCfgTrueSuccessor(e, _)
} }
} }

8
cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
View File

@@ -129,11 +129,11 @@ private class FromGlobalVarTaintTrackingCfg extends TaintTracking2::Configuratio
} }
private predicate readsVariable(LoadInstruction load, Variable var) { private predicate readsVariable(LoadInstruction load, Variable var) {
load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
} }
private predicate writesVariable(StoreInstruction store, Variable var) { private predicate writesVariable(StoreInstruction store, Variable var) {
store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var store.getDestinationAddress().(VariableAddressInstruction).getAstVariable() = var
} }
/** /**
@@ -489,9 +489,9 @@ module TaintedWithPath {
/** Gets the element that `pathNode` wraps, if any. */ /** Gets the element that `pathNode` wraps, if any. */
Element getElementFromPathNode(PathNode pathNode) { Element getElementFromPathNode(PathNode pathNode) {
exists(DataFlow::Node node | node = pathNode.(WrapPathNode).inner().getNode() | exists(DataFlow::Node node | node = pathNode.(WrapPathNode).inner().getNode() |
result = node.asInstruction().getAST() result = node.asInstruction().getAst()
or or
result = node.asOperand().getDef().getAST() result = node.asOperand().getDef().getAst()
) )
or or
result = pathNode.(EndpointPathNode).inner() result = pathNode.(EndpointPathNode).inner()

2
cpp/ql/lib/semmle/code/cpp/ir/dataflow/ResolveCall.qll
View File

@@ -17,7 +17,7 @@ private import semmle.code.cpp.ir.IR
*/ */
Function resolveCall(Call call) { Function resolveCall(Call call) {
exists(CallInstruction callInstruction | exists(CallInstruction callInstruction |
callInstruction.getAST() = call and callInstruction.getAst() = call and
result = viableCallable(callInstruction) result = viableCallable(callInstruction)
) )
} }

4
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
View File

@@ -116,12 +116,12 @@ private module VirtualDispatch {
/** Holds if `addressInstr` is an instruction that produces the address of `var`. */ /** Holds if `addressInstr` is an instruction that produces the address of `var`. */
private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) { private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
// Access directly to the global variable // Access directly to the global variable
addressInstr.(VariableAddressInstruction).getASTVariable() = var addressInstr.(VariableAddressInstruction).getAstVariable() = var
or or
// Access to a field on a global union // Access to a field on a global union
exists(FieldAddressInstruction fa | exists(FieldAddressInstruction fa |
fa = addressInstr and fa = addressInstr and
fa.getObjectAddress().(VariableAddressInstruction).getASTVariable() = var and fa.getObjectAddress().(VariableAddressInstruction).getAstVariable() = var and
fa.getField().getDeclaringType() instanceof Union fa.getField().getDeclaringType() instanceof Union
) )
} }

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this * Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation. * variable as part of the AST-to-IR translation.
*/ */
Language::AST getAST() { none() } Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets an identifier string for the variable. This identifier is unique * Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/** /**
* Gets the source location of this variable. * Gets the source location of this variable.
*/ */
final Language::Location getLocation() { result = getAST().getLocation() } final Language::Location getLocation() { result = getAst().getLocation() }
/** /**
* Gets the IR for the function that references this variable. * Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() } final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var } final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() { final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString() result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type } final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast } final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() } override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
} }
/** Gets a textual representation of this element. */ /** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() } final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/** /**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what * Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() { string getResultId() {
this.shouldGenerateDumpStrings() and this.shouldGenerateDumpStrings() and
result = result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank() this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
} }
/** /**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/** /**
* Gets the AST that caused this instruction to be generated. * Gets the AST that caused this instruction to be generated.
*/ */
final Language::AST getAST() { result = Construction::getInstructionAST(this) } final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets the location of the source code for this instruction. * Gets the location of the source code for this instruction.
*/ */
final Language::Location getLocation() { result = this.getAST().getLocation() } final Language::Location getLocation() { result = this.getAst().getLocation() }
/** /**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a * Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/** /**
* Gets the AST variable that this instruction's IR variable refers to, if one exists. * Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/ */
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() } final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
} }
/** /**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage. * of `TOperand` that are used in this stage.
*/ */
private class TStageOperand = private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand; TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/** /**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as * A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here // Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def)) exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or or
exists(Instruction use | this = nonSSAMemoryOperand(use, _)) exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or or
exists(Instruction use, Instruction def, IRBlock predecessorBlock | exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand { class MemoryOperand extends Operand {
cached cached
MemoryOperand() { MemoryOperand() {
this instanceof TNonSSAMemoryOperand or this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or this instanceof TPhiOperand or
this instanceof TChiOperand this instanceof TChiOperand
} }
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() { NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached cached
NonPhiMemoryOperand() { NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag) this = nonSsaMemoryOperand(useInstr, tag)
or or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements // count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0 // separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1 count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or or
instr instanceof ConstantInstruction and instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1 count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast unique( | | instr.getIRVariable().getAst()) = ast
} }
private predicate initializeParameterValueNumber( private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var instr.getIRVariable().getAst() = var
} }
private predicate constantValueNumber( private predicate constantValueNumber(

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
View File

@@ -2,12 +2,12 @@ private import AliasConfigurationInternal
private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR
private import cpp private import cpp
private import AliasAnalysis private import AliasAnalysis
private import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SimpleSSA as UnaliasedSSA private import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SimpleSSA as UnaliasedSsa
private newtype TAllocation = private newtype TAllocation =
TVariableAllocation(IRVariable var) { TVariableAllocation(IRVariable var) {
// Only model variables that were not already handled in unaliased SSA. // Only model variables that were not already handled in unaliased SSA.
not UnaliasedSSA::canReuseSSAForVariable(var) not UnaliasedSsa::canReuseSsaForVariable(var)
} or } or
TIndirectParameterAllocation(IRAutomaticVariable var) { TIndirectParameterAllocation(IRAutomaticVariable var) {
exists(InitializeIndirectionInstruction instr | instr.getIRVariable() = var) exists(InitializeIndirectionInstruction instr | instr.getIRVariable() = var)

14
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
View File

@@ -133,7 +133,10 @@ abstract class MemoryLocation extends TMemoryLocation {
*/ */
predicate isAlwaysAllocatedOnStack() { none() } predicate isAlwaysAllocatedOnStack() { none() }
final predicate canReuseSSA() { none() } final predicate canReuseSsa() { none() }
/** DEPRECATED: Alias for canReuseSsa */
deprecated predicate canReuseSSA() { canReuseSsa() }
} }
/** /**
@@ -569,13 +572,16 @@ private Overlap getVariableMemoryLocationOverlap(
* Holds if the def/use information for the result of `instr` can be reused from the previous * Holds if the def/use information for the result of `instr` can be reused from the previous
* iteration of the IR. * iteration of the IR.
*/ */
predicate canReuseSSAForOldResult(Instruction instr) { OldSSA::canReuseSSAForMemoryResult(instr) } predicate canReuseSsaForOldResult(Instruction instr) { OldSSA::canReuseSsaForMemoryResult(instr) }
/** DEPRECATED: Alias for canReuseSsaForOldResult */
deprecated predicate canReuseSSAForOldResult = canReuseSsaForOldResult/1;
bindingset[result, b] bindingset[result, b]
private boolean unbindBool(boolean b) { result != b.booleanNot() } private boolean unbindBool(boolean b) { result != b.booleanNot() }
MemoryLocation getResultMemoryLocation(Instruction instr) { MemoryLocation getResultMemoryLocation(Instruction instr) {
not canReuseSSAForOldResult(instr) and not canReuseSsaForOldResult(instr) and
exists(MemoryAccessKind kind, boolean isMayAccess | exists(MemoryAccessKind kind, boolean isMayAccess |
kind = instr.getResultMemoryAccess() and kind = instr.getResultMemoryAccess() and
(if instr.hasResultMayMemoryAccess() then isMayAccess = true else isMayAccess = false) and (if instr.hasResultMayMemoryAccess() then isMayAccess = true else isMayAccess = false) and
@@ -608,7 +614,7 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
} }
MemoryLocation getOperandMemoryLocation(MemoryOperand operand) { MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
not canReuseSSAForOldResult(operand.getAnyDef()) and not canReuseSsaForOldResult(operand.getAnyDef()) and
exists(MemoryAccessKind kind, boolean isMayAccess | exists(MemoryAccessKind kind, boolean isMayAccess |
kind = operand.getMemoryAccess() and kind = operand.getMemoryAccess() and
(if operand.hasMayReadMemoryAccess() then isMayAccess = true else isMayAccess = false) and (if operand.hasMayReadMemoryAccess() then isMayAccess = true else isMayAccess = false) and

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandInternal.qll
View File

@@ -1,2 +1,2 @@
private import semmle.code.cpp.ir.implementation.internal.TOperand private import semmle.code.cpp.ir.implementation.internal.TOperand
import AliasedSSAOperands import AliasedSsaOperands

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll
View File

@@ -2,7 +2,7 @@ private import SSAConstructionInternal
private import OldIR private import OldIR
private import Alias private import Alias
private import SSAConstruction private import SSAConstruction
private import DebugSSA private import DebugSsa
bindingset[offset] bindingset[offset]
private string getKeySuffixForOffset(int offset) { private string getKeySuffixForOffset(int offset) {

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll
View File

@@ -1,2 +1,2 @@
private import SSAConstruction as SSA private import SSAConstruction as SSA
import SSA::SSAConsistency import SSA::SsaConsistency

51
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
View File

@@ -112,7 +112,7 @@ private module Cached {
exists(Alias::getResultMemoryLocation(oldInstruction)) exists(Alias::getResultMemoryLocation(oldInstruction))
or or
// This result was already modeled by a previous iteration of SSA. // This result was already modeled by a previous iteration of SSA.
Alias::canReuseSSAForOldResult(oldInstruction) Alias::canReuseSsaForOldResult(oldInstruction)
} }
cached cached
@@ -182,7 +182,7 @@ private module Cached {
* unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the * unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the
* true definition. * true definition.
*/ */
private Instruction getNewDefinitionFromOldSSA(OldIR::MemoryOperand oldOperand, Overlap overlap) { private Instruction getNewDefinitionFromOldSsa(OldIR::MemoryOperand oldOperand, Overlap overlap) {
exists(Overlap originalOverlap | exists(Overlap originalOverlap |
originalOverlap = oldOperand.getDefinitionOverlap() and originalOverlap = oldOperand.getDefinitionOverlap() and
( (
@@ -191,7 +191,7 @@ private module Cached {
or or
exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap | exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap |
phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and
result = getNewDefinitionFromOldSSA(phiOperand, phiOperandOverlap) and result = getNewDefinitionFromOldSsa(phiOperand, phiOperandOverlap) and
overlap = overlap =
combineOverlap(pragma[only_bind_out](phiOperandOverlap), combineOverlap(pragma[only_bind_out](phiOperandOverlap),
pragma[only_bind_out](originalOverlap)) pragma[only_bind_out](originalOverlap))
@@ -233,7 +233,7 @@ private module Cached {
) )
or or
exists(OldIR::NonPhiMemoryOperand oldOperand | exists(OldIR::NonPhiMemoryOperand oldOperand |
result = getNewDefinitionFromOldSSA(oldOperand, overlap) and result = getNewDefinitionFromOldSsa(oldOperand, overlap) and
oldOperand.getUse() = instruction and oldOperand.getUse() = instruction and
tag = oldOperand.getOperandTag() tag = oldOperand.getOperandTag()
) )
@@ -307,13 +307,13 @@ private module Cached {
* Gets the new definition instruction for the operand of `instr` that flows from the block * Gets the new definition instruction for the operand of `instr` that flows from the block
* `newPredecessorBlock`, based on that operand's definition in the old IR. * `newPredecessorBlock`, based on that operand's definition in the old IR.
*/ */
private Instruction getNewPhiOperandDefinitionFromOldSSA( private Instruction getNewPhiOperandDefinitionFromOldSsa(
Instruction instr, IRBlock newPredecessorBlock, Overlap overlap Instruction instr, IRBlock newPredecessorBlock, Overlap overlap
) { ) {
exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand | exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand |
oldPhi = getOldInstruction(instr) and oldPhi = getOldInstruction(instr) and
oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and
result = getNewDefinitionFromOldSSA(oldOperand, overlap) result = getNewDefinitionFromOldSsa(oldOperand, overlap)
) )
} }
@@ -333,7 +333,7 @@ private module Cached {
overlap = Alias::getOverlap(actualDefLocation, useLocation) overlap = Alias::getOverlap(actualDefLocation, useLocation)
) )
or or
result = getNewPhiOperandDefinitionFromOldSSA(instr, newPredecessorBlock, overlap) result = getNewPhiOperandDefinitionFromOldSsa(instr, newPredecessorBlock, overlap)
} }
cached cached
@@ -412,17 +412,17 @@ private module Cached {
} }
cached cached
Language::AST getInstructionAST(Instruction instr) { Language::AST getInstructionAst(Instruction instr) {
result = getOldInstruction(instr).getAST() result = getOldInstruction(instr).getAst()
or or
exists(RawIR::Instruction blockStartInstr | exists(RawIR::Instruction blockStartInstr |
instr = phiInstruction(blockStartInstr, _) and instr = phiInstruction(blockStartInstr, _) and
result = blockStartInstr.getAST() result = blockStartInstr.getAst()
) )
or or
exists(RawIR::Instruction primaryInstr | exists(RawIR::Instruction primaryInstr |
instr = chiInstruction(primaryInstr) and instr = chiInstruction(primaryInstr) and
result = primaryInstr.getAST() result = primaryInstr.getAst()
) )
or or
exists(IRFunctionBase irFunc | exists(IRFunctionBase irFunc |
@@ -430,6 +430,12 @@ private module Cached {
) )
} }
/** DEPRECATED: Alias for getInstructionAst */
cached
deprecated Language::AST getInstructionAST(Instruction instr) {
result = getInstructionAst(instr)
}
cached cached
Language::LanguageType getInstructionResultType(Instruction instr) { Language::LanguageType getInstructionResultType(Instruction instr) {
result = instr.(RawIR::Instruction).getResultLanguageType() result = instr.(RawIR::Instruction).getResultLanguageType()
@@ -975,35 +981,41 @@ module DefUse {
} }
} }
predicate canReuseSSAForMemoryResult(Instruction instruction) { predicate canReuseSsaForMemoryResult(Instruction instruction) {
exists(OldInstruction oldInstruction | exists(OldInstruction oldInstruction |
oldInstruction = getOldInstruction(instruction) and oldInstruction = getOldInstruction(instruction) and
( (
// The previous iteration said it was reusable, so we should mark it as reusable as well. // The previous iteration said it was reusable, so we should mark it as reusable as well.
Alias::canReuseSSAForOldResult(oldInstruction) Alias::canReuseSsaForOldResult(oldInstruction)
or or
// The current alias analysis says it is reusable. // The current alias analysis says it is reusable.
Alias::getResultMemoryLocation(oldInstruction).canReuseSSA() Alias::getResultMemoryLocation(oldInstruction).canReuseSsa()
) )
) )
or or
exists(Alias::MemoryLocation defLocation | exists(Alias::MemoryLocation defLocation |
// This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well. // This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well.
instruction = phiInstruction(_, defLocation) and instruction = phiInstruction(_, defLocation) and
defLocation.canReuseSSA() defLocation.canReuseSsa()
) )
// We don't support reusing SSA for any location that could create a `Chi` instruction. // We don't support reusing SSA for any location that could create a `Chi` instruction.
} }
/** DEPRECATED: Alias for canReuseSsaForMemoryResult */
deprecated predicate canReuseSSAForMemoryResult = canReuseSsaForMemoryResult/1;
/** /**
* Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the * Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the
* `DebugSSA` module, which is then imported by PrintSSA. * `DebugSSA` module, which is then imported by PrintSSA.
*/ */
module DebugSSA { module DebugSsa {
import PhiInsertion import PhiInsertion
import DefUse import DefUse
} }
/** DEPRECATED: Alias for DebugSsa */
deprecated module DebugSSA = DebugSsa;
import CachedForDebugging import CachedForDebugging
cached cached
@@ -1038,7 +1050,7 @@ private module CachedForDebugging {
private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) { private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
result.getEnclosingFunction() = var.getEnclosingFunction() and result.getEnclosingFunction() = var.getEnclosingFunction() and
result.getAST() = var.getAST() and result.getAst() = var.getAst() and
result.getTag() = var.getTag() result.getTag() = var.getTag()
} }
@@ -1061,7 +1073,7 @@ private module CachedForDebugging {
int maxValue() { result = 2147483647 } int maxValue() { result = 2147483647 }
} }
module SSAConsistency { module SsaConsistency {
/** /**
* Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis. * Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
*/ */
@@ -1114,6 +1126,9 @@ module SSAConsistency {
} }
} }
/** DEPRECATED: Alias for SsaConsistency */
deprecated module SSAConsistency = SsaConsistency;
/** /**
* Provides the portion of the parameterized IR interface that is used to construct the SSA stages * Provides the portion of the parameterized IR interface that is used to construct the SSA stages
* of the IR. The raw stage of the IR does not expose these predicates. * of the IR. The raw stage of the IR does not expose these predicates.

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionInternal.qll
View File

@@ -2,7 +2,7 @@ import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as OldIR
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.ReachableBlock as Reachability import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.ReachableBlock as Reachability
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.Dominance as Dominance import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.reachability.Dominance as Dominance
import semmle.code.cpp.ir.implementation.aliased_ssa.IR as NewIR import semmle.code.cpp.ir.implementation.aliased_ssa.IR as NewIR
import semmle.code.cpp.ir.implementation.internal.TInstruction::AliasedSSAInstructions as SSAInstructions import semmle.code.cpp.ir.implementation.internal.TInstruction::AliasedSsaInstructions as SSAInstructions
import semmle.code.cpp.ir.internal.IRCppLanguage as Language import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import AliasedSSA as Alias import AliasedSSA as Alias
import semmle.code.cpp.ir.implementation.internal.TOperand::AliasedSSAOperands as SSAOperands import semmle.code.cpp.ir.implementation.internal.TOperand::AliasedSsaOperands as SSAOperands

56
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll
View File

@@ -19,24 +19,24 @@ newtype TInstruction =
) { ) {
IRConstruction::Raw::hasInstruction(tag1, tag2) IRConstruction::Raw::hasInstruction(tag1, tag2)
} or } or
TUnaliasedSSAPhiInstruction( TUnaliasedSsaPhiInstruction(
TRawInstruction blockStartInstr, UnaliasedSSA::SSA::MemoryLocation memoryLocation TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
) { ) {
UnaliasedSSA::SSA::hasPhiInstruction(blockStartInstr, memoryLocation) UnaliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
} or } or
TUnaliasedSSAChiInstruction(TRawInstruction primaryInstruction) { none() } or TUnaliasedSsaChiInstruction(TRawInstruction primaryInstruction) { none() } or
TUnaliasedSSAUnreachedInstruction(IRFunctionBase irFunc) { TUnaliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
UnaliasedSSA::SSA::hasUnreachedInstruction(irFunc) UnaliasedSsa::SSA::hasUnreachedInstruction(irFunc)
} or } or
TAliasedSSAPhiInstruction( TAliasedSsaPhiInstruction(
TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation
) { ) {
AliasedSSA::SSA::hasPhiInstruction(blockStartInstr, memoryLocation) AliasedSSA::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
} or } or
TAliasedSSAChiInstruction(TRawInstruction primaryInstruction) { TAliasedSsaChiInstruction(TRawInstruction primaryInstruction) {
AliasedSSA::SSA::hasChiInstruction(primaryInstruction) AliasedSSA::SSA::hasChiInstruction(primaryInstruction)
} or } or
TAliasedSSAUnreachedInstruction(IRFunctionBase irFunc) { TAliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
AliasedSSA::SSA::hasUnreachedInstruction(irFunc) AliasedSSA::SSA::hasUnreachedInstruction(irFunc)
} }
@@ -46,58 +46,64 @@ newtype TInstruction =
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via * These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias. * a class alias.
*/ */
module UnaliasedSSAInstructions { module UnaliasedSsaInstructions {
class TPhiInstruction = TUnaliasedSSAPhiInstruction; class TPhiInstruction = TUnaliasedSsaPhiInstruction;
TPhiInstruction phiInstruction( TPhiInstruction phiInstruction(
TRawInstruction blockStartInstr, UnaliasedSSA::SSA::MemoryLocation memoryLocation TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
) { ) {
result = TUnaliasedSSAPhiInstruction(blockStartInstr, memoryLocation) result = TUnaliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
} }
TRawInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) { none() } TRawInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) { none() }
class TChiInstruction = TUnaliasedSSAChiInstruction; class TChiInstruction = TUnaliasedSsaChiInstruction;
TChiInstruction chiInstruction(TRawInstruction primaryInstruction) { TChiInstruction chiInstruction(TRawInstruction primaryInstruction) {
result = TUnaliasedSSAChiInstruction(primaryInstruction) result = TUnaliasedSsaChiInstruction(primaryInstruction)
} }
class TUnreachedInstruction = TUnaliasedSSAUnreachedInstruction; class TUnreachedInstruction = TUnaliasedSsaUnreachedInstruction;
TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) { TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) {
result = TUnaliasedSSAUnreachedInstruction(irFunc) result = TUnaliasedSsaUnreachedInstruction(irFunc)
} }
} }
/** DEPRECATED: Alias for UnaliasedSsaInstructions */
deprecated module UnaliasedSSAInstructions = UnaliasedSsaInstructions;
/** /**
* Provides wrappers for the constructors of each branch of `TInstruction` that is used by the * Provides wrappers for the constructors of each branch of `TInstruction` that is used by the
* aliased SSA stage. * aliased SSA stage.
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via * These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias. * a class alias.
*/ */
module AliasedSSAInstructions { module AliasedSsaInstructions {
class TPhiInstruction = TAliasedSSAPhiInstruction or TUnaliasedSSAPhiInstruction; class TPhiInstruction = TAliasedSsaPhiInstruction or TUnaliasedSsaPhiInstruction;
TPhiInstruction phiInstruction( TPhiInstruction phiInstruction(
TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation TRawInstruction blockStartInstr, AliasedSSA::SSA::MemoryLocation memoryLocation
) { ) {
result = TAliasedSSAPhiInstruction(blockStartInstr, memoryLocation) result = TAliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
} }
TPhiInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) { TPhiInstruction reusedPhiInstruction(TRawInstruction blockStartInstr) {
result = TUnaliasedSSAPhiInstruction(blockStartInstr, _) result = TUnaliasedSsaPhiInstruction(blockStartInstr, _)
} }
class TChiInstruction = TAliasedSSAChiInstruction; class TChiInstruction = TAliasedSsaChiInstruction;
TChiInstruction chiInstruction(TRawInstruction primaryInstruction) { TChiInstruction chiInstruction(TRawInstruction primaryInstruction) {
result = TAliasedSSAChiInstruction(primaryInstruction) result = TAliasedSsaChiInstruction(primaryInstruction)
} }
class TUnreachedInstruction = TAliasedSSAUnreachedInstruction; class TUnreachedInstruction = TAliasedSsaUnreachedInstruction;
TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) { TUnreachedInstruction unreachedInstruction(IRFunctionBase irFunc) {
result = TAliasedSSAUnreachedInstruction(irFunc) result = TAliasedSsaUnreachedInstruction(irFunc)
} }
} }
/** DEPRECATED: Alias for AliasedSsaInstructions */
deprecated module AliasedSSAInstructions = AliasedSsaInstructions;

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstructionInternal.qll
View File

@@ -1,4 +1,4 @@
import semmle.code.cpp.ir.internal.IRCppLanguage as Language import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as IRConstruction import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as IRConstruction
import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SSAConstruction as UnaliasedSSA import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SSAConstruction as UnaliasedSsa
import semmle.code.cpp.ir.implementation.aliased_ssa.internal.SSAConstruction as AliasedSSA import semmle.code.cpp.ir.implementation.aliased_ssa.internal.SSAConstruction as AliasedSSA

38
cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TOperand.qll
View File

@@ -31,7 +31,7 @@ private module Internal {
TNoOperand() { none() } or TNoOperand() { none() } or
// Can be "removed" later when there's unreachable code // Can be "removed" later when there's unreachable code
// These operands can be reused across all three stages. They just get different defs. // These operands can be reused across all three stages. They just get different defs.
TNonSSAMemoryOperand(Raw::Instruction useInstr, MemoryOperandTag tag) { TNonSsaMemoryOperand(Raw::Instruction useInstr, MemoryOperandTag tag) {
// Has no definition in raw but will get definitions later // Has no definition in raw but will get definitions later
useInstr.getOpcode().hasOperand(tag) useInstr.getOpcode().hasOperand(tag)
} or } or
@@ -49,11 +49,11 @@ private module Internal {
// important that we use the same definition of "is variable aliased" across // important that we use the same definition of "is variable aliased" across
// the phases. // the phases.
TAliasedPhiOperand( TAliasedPhiOperand(
TAliasedSSAPhiInstruction useInstr, Aliased::IRBlock predecessorBlock, Overlap overlap TAliasedSsaPhiInstruction useInstr, Aliased::IRBlock predecessorBlock, Overlap overlap
) { ) {
exists(AliasedConstruction::getPhiOperandDefinition(useInstr, predecessorBlock, overlap)) exists(AliasedConstruction::getPhiOperandDefinition(useInstr, predecessorBlock, overlap))
} or } or
TAliasedChiOperand(TAliasedSSAChiInstruction useInstr, ChiOperandTag tag) { any() } TAliasedChiOperand(TAliasedSsaChiInstruction useInstr, ChiOperandTag tag) { any() }
} }
/** /**
@@ -72,13 +72,21 @@ private module Shared {
result = Internal::TRegisterOperand(useInstr, tag, defInstr) result = Internal::TRegisterOperand(useInstr, tag, defInstr)
} }
class TNonSSAMemoryOperand = Internal::TNonSSAMemoryOperand; class TNonSsaMemoryOperand = Internal::TNonSsaMemoryOperand;
/** DEPRECATED: Alias for TNonSsaMemoryOperand */
deprecated class TNonSSAMemoryOperand = TNonSsaMemoryOperand;
/** /**
* Returns the non-Phi memory operand with the specified parameters. * Returns the non-Phi memory operand with the specified parameters.
*/ */
TNonSSAMemoryOperand nonSSAMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) { TNonSsaMemoryOperand nonSsaMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) {
result = Internal::TNonSSAMemoryOperand(useInstr, tag) result = Internal::TNonSsaMemoryOperand(useInstr, tag)
}
/** DEPRECATED: Alias for nonSsaMemoryOperand */
deprecated TNonSSAMemoryOperand nonSSAMemoryOperand(TRawInstruction useInstr, MemoryOperandTag tag) {
result = nonSsaMemoryOperand(useInstr, tag)
} }
} }
@@ -95,7 +103,7 @@ module RawOperands {
class TChiOperand = Internal::TNoOperand; class TChiOperand = Internal::TNoOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand; class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/** /**
* Returns the Phi operand with the specified parameters. * Returns the Phi operand with the specified parameters.
@@ -126,14 +134,14 @@ module RawOperands {
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via * These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias. * a class alias.
*/ */
module UnaliasedSSAOperands { module UnaliasedSsaOperands {
import Shared import Shared
class TPhiOperand = Internal::TUnaliasedPhiOperand; class TPhiOperand = Internal::TUnaliasedPhiOperand;
class TChiOperand = Internal::TNoOperand; class TChiOperand = Internal::TNoOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand; class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/** /**
* Returns the Phi operand with the specified parameters. * Returns the Phi operand with the specified parameters.
@@ -159,20 +167,23 @@ module UnaliasedSSAOperands {
TChiOperand chiOperand(Unaliased::Instruction useInstr, ChiOperandTag tag) { none() } TChiOperand chiOperand(Unaliased::Instruction useInstr, ChiOperandTag tag) { none() }
} }
/** DEPRECATED: Alias for UnaliasedSsaOperands */
deprecated module UnaliasedSSAOperands = UnaliasedSsaOperands;
/** /**
* Provides wrappers for the constructors of each branch of `TOperand` that is used by the * Provides wrappers for the constructors of each branch of `TOperand` that is used by the
* asliased SSA stage. * asliased SSA stage.
* These wrappers are not parameterized because it is not possible to invoke an IPA constructor via * These wrappers are not parameterized because it is not possible to invoke an IPA constructor via
* a class alias. * a class alias.
*/ */
module AliasedSSAOperands { module AliasedSsaOperands {
import Shared import Shared
class TPhiOperand = Internal::TAliasedPhiOperand or Internal::TUnaliasedPhiOperand; class TPhiOperand = Internal::TAliasedPhiOperand or Internal::TUnaliasedPhiOperand;
class TChiOperand = Internal::TAliasedChiOperand; class TChiOperand = Internal::TAliasedChiOperand;
class TNonPhiMemoryOperand = TNonSSAMemoryOperand or TChiOperand; class TNonPhiMemoryOperand = TNonSsaMemoryOperand or TChiOperand;
/** /**
* Returns the Phi operand with the specified parameters. * Returns the Phi operand with the specified parameters.
@@ -202,7 +213,10 @@ module AliasedSSAOperands {
/** /**
* Returns the Chi operand with the specified parameters. * Returns the Chi operand with the specified parameters.
*/ */
TChiOperand chiOperand(TAliasedSSAChiInstruction useInstr, ChiOperandTag tag) { TChiOperand chiOperand(TAliasedSsaChiInstruction useInstr, ChiOperandTag tag) {
result = Internal::TAliasedChiOperand(useInstr, tag) result = Internal::TAliasedChiOperand(useInstr, tag)
} }
} }
/** DEPRECATED: Alias for AliasedSsaOperands */
deprecated module AliasedSSAOperands = AliasedSsaOperands;

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this * Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation. * variable as part of the AST-to-IR translation.
*/ */
Language::AST getAST() { none() } Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets an identifier string for the variable. This identifier is unique * Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/** /**
* Gets the source location of this variable. * Gets the source location of this variable.
*/ */
final Language::Location getLocation() { result = getAST().getLocation() } final Language::Location getLocation() { result = getAst().getLocation() }
/** /**
* Gets the IR for the function that references this variable. * Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() } final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var } final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() { final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString() result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type } final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast } final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() } override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
} }
/** Gets a textual representation of this element. */ /** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() } final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/** /**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what * Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() { string getResultId() {
this.shouldGenerateDumpStrings() and this.shouldGenerateDumpStrings() and
result = result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank() this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
} }
/** /**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/** /**
* Gets the AST that caused this instruction to be generated. * Gets the AST that caused this instruction to be generated.
*/ */
final Language::AST getAST() { result = Construction::getInstructionAST(this) } final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets the location of the source code for this instruction. * Gets the location of the source code for this instruction.
*/ */
final Language::Location getLocation() { result = this.getAST().getLocation() } final Language::Location getLocation() { result = this.getAst().getLocation() }
/** /**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a * Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/** /**
* Gets the AST variable that this instruction's IR variable refers to, if one exists. * Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/ */
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() } final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
} }
/** /**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage. * of `TOperand` that are used in this stage.
*/ */
private class TStageOperand = private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand; TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/** /**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as * A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here // Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def)) exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or or
exists(Instruction use | this = nonSSAMemoryOperand(use, _)) exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or or
exists(Instruction use, Instruction def, IRBlock predecessorBlock | exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand { class MemoryOperand extends Operand {
cached cached
MemoryOperand() { MemoryOperand() {
this instanceof TNonSSAMemoryOperand or this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or this instanceof TPhiOperand or
this instanceof TChiOperand this instanceof TChiOperand
} }
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() { NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached cached
NonPhiMemoryOperand() { NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag) this = nonSsaMemoryOperand(useInstr, tag)
or or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements // count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0 // separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1 count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or or
instr instanceof ConstantInstruction and instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1 count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast unique( | | instr.getIRVariable().getAst()) = ast
} }
private predicate initializeParameterValueNumber( private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var instr.getIRVariable().getAst() = var
} }
private predicate constantValueNumber( private predicate constantValueNumber(

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
View File

@@ -48,7 +48,7 @@ module Raw {
cached cached
predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag, CppType type) { predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag, CppType type) {
exists(TranslatedElement element | exists(TranslatedElement element |
element.getAST() = ast and element.getAst() = ast and
func = element.getFunction() and func = element.getFunction() and
element.hasTempVariable(tag, type) element.hasTempVariable(tag, type)
) )
@@ -75,7 +75,7 @@ module Raw {
tag = getInstructionTag(instruction) and tag = getInstructionTag(instruction) and
( (
result = element.getInstructionVariable(tag) or result = element.getInstructionVariable(tag) or
result.(IRStringLiteral).getAST() = element.getInstructionStringLiteral(tag) result.(IRStringLiteral).getAst() = element.getInstructionStringLiteral(tag)
) )
) )
} }
@@ -339,7 +339,7 @@ Instruction getInstructionBackEdgeSuccessor(Instruction instruction, EdgeKind ki
// such a `goto` creates a back edge. // such a `goto` creates a back edge.
exists(TranslatedElement s, GotoStmt goto | exists(TranslatedElement s, GotoStmt goto |
not isStrictlyForwardGoto(goto) and not isStrictlyForwardGoto(goto) and
goto = s.getAST() and goto = s.getAst() and
exists(InstructionTag tag | exists(InstructionTag tag |
result = s.getInstructionSuccessor(tag, kind) and result = s.getInstructionSuccessor(tag, kind) and
instruction = s.getInstruction(tag) instruction = s.getInstruction(tag)
@@ -352,8 +352,13 @@ private predicate isStrictlyForwardGoto(GotoStmt goto) {
goto.getLocation().isBefore(goto.getTarget().getLocation()) goto.getLocation().isBefore(goto.getTarget().getLocation())
} }
Locatable getInstructionAST(TStageInstruction instr) { Locatable getInstructionAst(TStageInstruction instr) {
result = getInstructionTranslatedElement(instr).getAST() result = getInstructionTranslatedElement(instr).getAst()
}
/** DEPRECATED: Alias for getInstructionAst */
deprecated Locatable getInstructionAST(TStageInstruction instr) {
result = getInstructionAst(instr)
} }
CppType getInstructionResultType(TStageInstruction instr) { CppType getInstructionResultType(TStageInstruction instr) {

25
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
View File

@@ -175,7 +175,10 @@ abstract class TranslatedSideEffects extends TranslatedElement {
/** Gets the expression whose side effects are being modeled. */ /** Gets the expression whose side effects are being modeled. */
abstract Expr getExpr(); abstract Expr getExpr();
final override Locatable getAST() { result = getExpr() } final override Locatable getAst() { result = getExpr() }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = getExpr().getEnclosingFunction() } final override Function getFunction() { result = getExpr().getEnclosingFunction() }
@@ -522,7 +525,10 @@ class TranslatedArgumentExprSideEffect extends TranslatedArgumentSideEffect,
this = TTranslatedArgumentExprSideEffect(call, arg, index, sideEffectOpcode) this = TTranslatedArgumentExprSideEffect(call, arg, index, sideEffectOpcode)
} }
final override Locatable getAST() { result = arg } final override Locatable getAst() { result = arg }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Type getIndirectionType() { final override Type getIndirectionType() {
result = arg.getUnspecifiedType().(DerivedType).getBaseType() result = arg.getUnspecifiedType().(DerivedType).getBaseType()
@@ -553,7 +559,10 @@ class TranslatedStructorQualifierSideEffect extends TranslatedArgumentSideEffect
index = -1 index = -1
} }
final override Locatable getAST() { result = call } final override Locatable getAst() { result = call }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Type getIndirectionType() { result = call.getTarget().getDeclaringType() } final override Type getIndirectionType() { result = call.getTarget().getDeclaringType() }
@@ -574,7 +583,10 @@ class TranslatedCallSideEffect extends TranslatedSideEffect, TTranslatedCallSide
TranslatedCallSideEffect() { this = TTranslatedCallSideEffect(expr, sideEffectOpcode) } TranslatedCallSideEffect() { this = TTranslatedCallSideEffect(expr, sideEffectOpcode) }
override Locatable getAST() { result = expr } override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Expr getPrimaryExpr() { result = expr } override Expr getPrimaryExpr() { result = expr }
@@ -612,7 +624,10 @@ class TranslatedAllocationSideEffect extends TranslatedSideEffect, TTranslatedAl
TranslatedAllocationSideEffect() { this = TTranslatedAllocationSideEffect(expr) } TranslatedAllocationSideEffect() { this = TTranslatedAllocationSideEffect(expr) }
override Locatable getAST() { result = expr } override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Expr getPrimaryExpr() { result = expr } override Expr getPrimaryExpr() { result = expr }

5
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCondition.qll
View File

@@ -19,7 +19,10 @@ abstract class TranslatedCondition extends TranslatedElement {
final override string toString() { result = expr.toString() } final override string toString() { result = expr.toString() }
final override Locatable getAST() { result = expr } final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final ConditionContext getConditionContext() { result = getParent() } final ConditionContext getConditionContext() { result = getParent() }

24
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
View File

@@ -14,7 +14,7 @@ private import TranslatedInitialization
* `entry`. * `entry`.
*/ */
TranslatedDeclarationEntry getTranslatedDeclarationEntry(DeclarationEntry entry) { TranslatedDeclarationEntry getTranslatedDeclarationEntry(DeclarationEntry entry) {
result.getAST() = entry result.getAst() = entry
} }
/** /**
@@ -37,7 +37,10 @@ abstract class TranslatedDeclarationEntry extends TranslatedElement, TTranslated
final override string toString() { result = entry.toString() } final override string toString() { result = entry.toString() }
final override Locatable getAST() { result = entry } final override Locatable getAst() { result = entry }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
} }
/** /**
@@ -223,7 +226,10 @@ class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
final override string toString() { result = "init: " + entry.toString() } final override string toString() { result = "init: " + entry.toString() }
final override Locatable getAST() { result = entry } final override Locatable getAst() { result = entry }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override LocalVariable getVariable() { result = var } final override LocalVariable getVariable() { result = var }
@@ -254,7 +260,10 @@ class TranslatedRangeBasedForVariableDeclaration extends TranslatedLocalVariable
override string toString() { result = var.toString() } override string toString() { result = var.toString() }
override Locatable getAST() { result = var } override Locatable getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = forStmt.getEnclosingFunction() } override Function getFunction() { result = forStmt.getEnclosingFunction() }
@@ -262,7 +271,7 @@ class TranslatedRangeBasedForVariableDeclaration extends TranslatedLocalVariable
} }
TranslatedConditionDecl getTranslatedConditionDecl(ConditionDeclExpr expr) { TranslatedConditionDecl getTranslatedConditionDecl(ConditionDeclExpr expr) {
result.getAST() = expr result.getAst() = expr
} }
/** /**
@@ -280,7 +289,10 @@ class TranslatedConditionDecl extends TranslatedLocalVariableDeclaration, TTrans
override string toString() { result = "decl: " + conditionDeclExpr.toString() } override string toString() { result = "decl: " + conditionDeclExpr.toString() }
override Locatable getAST() { result = conditionDeclExpr } override Locatable getAst() { result = conditionDeclExpr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = conditionDeclExpr.getEnclosingFunction() } override Function getFunction() { result = conditionDeclExpr.getEnclosingFunction() }

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
View File

@@ -31,7 +31,7 @@ IRUserVariable getIRUserVariable(Function func, Variable var) {
} }
IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) { IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
result.getAST() = ast and result.getAst() = ast and
result.getTag() = tag result.getTag() = tag
} }
@@ -730,7 +730,10 @@ abstract class TranslatedElement extends TTranslatedElement {
/** /**
* Gets the AST node being translated. * Gets the AST node being translated.
*/ */
abstract Locatable getAST(); abstract Locatable getAst();
/** DEPRECATED: Alias for getAst */
deprecated Locatable getAST() { result = getAst() }
/** /**
* Get the first instruction to be executed in the evaluation of this element. * Get the first instruction to be executed in the evaluation of this element.
@@ -929,16 +932,16 @@ abstract class TranslatedElement extends TTranslatedElement {
*/ */
final IRTempVariable getTempVariable(TempVariableTag tag) { final IRTempVariable getTempVariable(TempVariableTag tag) {
exists(Locatable ast | exists(Locatable ast |
result.getAST() = ast and result.getAst() = ast and
result.getTag() = tag and result.getTag() = tag and
hasTempVariableAndAST(tag, ast) hasTempVariableAndAst(tag, ast)
) )
} }
pragma[noinline] pragma[noinline]
private predicate hasTempVariableAndAST(TempVariableTag tag, Locatable ast) { private predicate hasTempVariableAndAst(TempVariableTag tag, Locatable ast) {
hasTempVariable(tag, _) and hasTempVariable(tag, _) and
ast = getAST() ast = getAst()
} }
/** /**

9
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
View File

@@ -74,7 +74,10 @@ abstract class TranslatedExpr extends TranslatedElement {
expr.isGLValueCategory() expr.isGLValueCategory()
} }
final override Locatable getAST() { result = expr } final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = expr.getEnclosingFunction() } final override Function getFunction() { result = expr.getEnclosingFunction() }
@@ -1709,7 +1712,7 @@ abstract class TranslatedAllocationSize extends TranslatedExpr, TTranslatedAlloc
} }
TranslatedAllocationSize getTranslatedAllocationSize(NewOrNewArrayExpr newExpr) { TranslatedAllocationSize getTranslatedAllocationSize(NewOrNewArrayExpr newExpr) {
result.getAST() = newExpr result.getAst() = newExpr
} }
/** /**
@@ -1875,7 +1878,7 @@ class TranslatedAllocatorCall extends TTranslatedAllocatorCall, TranslatedDirect
} }
TranslatedAllocatorCall getTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) { TranslatedAllocatorCall getTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) {
result.getAST() = newExpr result.getAst() = newExpr
} }
/** /**

59
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll
View File

@@ -15,7 +15,7 @@ private import VarArgs
/** /**
* Gets the `TranslatedFunction` that represents function `func`. * Gets the `TranslatedFunction` that represents function `func`.
*/ */
TranslatedFunction getTranslatedFunction(Function func) { result.getAST() = func } TranslatedFunction getTranslatedFunction(Function func) { result.getAst() = func }
/** /**
* Gets the size, in bytes, of the variable used to represent the `...` parameter in a varargs * Gets the size, in bytes, of the variable used to represent the `...` parameter in a varargs
@@ -65,7 +65,10 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
final override string toString() { result = func.toString() } final override string toString() { result = func.toString() }
final override Locatable getAST() { result = func } final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
/** /**
* Gets the function being translated. * Gets the function being translated.
@@ -344,7 +347,7 @@ TranslatedThisParameter getTranslatedThisParameter(Function func) { result.getFu
/** /**
* Gets the `TranslatedPositionalParameter` that represents parameter `param`. * Gets the `TranslatedPositionalParameter` that represents parameter `param`.
*/ */
TranslatedPositionalParameter getTranslatedParameter(Parameter param) { result.getAST() = param } TranslatedPositionalParameter getTranslatedParameter(Parameter param) { result.getAst() = param }
/** /**
* Gets the `TranslatedEllipsisParameter` for function `func`, if one exists. * Gets the `TranslatedEllipsisParameter` for function `func`, if one exists.
@@ -457,7 +460,10 @@ class TranslatedThisParameter extends TranslatedParameter, TTranslatedThisParame
final override string toString() { result = "this" } final override string toString() { result = "this" }
final override Locatable getAST() { result = func } final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = func } final override Function getFunction() { result = func }
@@ -489,7 +495,10 @@ class TranslatedPositionalParameter extends TranslatedParameter, TTranslatedPara
final override string toString() { result = param.toString() } final override string toString() { result = param.toString() }
final override Locatable getAST() { result = param } final override Locatable getAst() { result = param }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { final override Function getFunction() {
result = param.getFunction() or result = param.getFunction() or
@@ -526,7 +535,10 @@ class TranslatedEllipsisParameter extends TranslatedParameter, TTranslatedEllips
final override string toString() { result = "..." } final override string toString() { result = "..." }
final override Locatable getAST() { result = func } final override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = func } final override Function getFunction() { result = func }
@@ -544,7 +556,7 @@ class TranslatedEllipsisParameter extends TranslatedParameter, TTranslatedEllips
} }
private TranslatedConstructorInitList getTranslatedConstructorInitList(Function func) { private TranslatedConstructorInitList getTranslatedConstructorInitList(Function func) {
result.getAST() = func result.getAst() = func
} }
/** /**
@@ -561,7 +573,10 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
override string toString() { result = "ctor init: " + func.toString() } override string toString() { result = "ctor init: " + func.toString() }
override Locatable getAST() { result = func } override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override TranslatedElement getChild(int id) { override TranslatedElement getChild(int id) {
exists(ConstructorFieldInit fieldInit | exists(ConstructorFieldInit fieldInit |
@@ -611,7 +626,7 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
} }
private TranslatedDestructorDestructionList getTranslatedDestructorDestructionList(Function func) { private TranslatedDestructorDestructionList getTranslatedDestructorDestructionList(Function func) {
result.getAST() = func result.getAst() = func
} }
/** /**
@@ -629,7 +644,10 @@ class TranslatedDestructorDestructionList extends TranslatedElement,
override string toString() { result = "dtor destruction: " + func.toString() } override string toString() { result = "dtor destruction: " + func.toString() }
override Locatable getAST() { result = func } override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override TranslatedElement getChild(int id) { override TranslatedElement getChild(int id) {
exists(DestructorFieldDestruction fieldDestruction | exists(DestructorFieldDestruction fieldDestruction |
@@ -667,14 +685,17 @@ class TranslatedDestructorDestructionList extends TranslatedElement,
} }
} }
TranslatedReadEffects getTranslatedReadEffects(Function func) { result.getAST() = func } TranslatedReadEffects getTranslatedReadEffects(Function func) { result.getAst() = func }
class TranslatedReadEffects extends TranslatedElement, TTranslatedReadEffects { class TranslatedReadEffects extends TranslatedElement, TTranslatedReadEffects {
Function func; Function func;
TranslatedReadEffects() { this = TTranslatedReadEffects(func) } TranslatedReadEffects() { this = TTranslatedReadEffects(func) }
override Locatable getAST() { result = func } override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = func } override Function getFunction() { result = func }
@@ -718,11 +739,11 @@ class TranslatedReadEffects extends TranslatedElement, TTranslatedReadEffects {
} }
private TranslatedThisReadEffect getTranslatedThisReadEffect(Function func) { private TranslatedThisReadEffect getTranslatedThisReadEffect(Function func) {
result.getAST() = func result.getAst() = func
} }
private TranslatedParameterReadEffect getTranslatedParameterReadEffect(Parameter param) { private TranslatedParameterReadEffect getTranslatedParameterReadEffect(Parameter param) {
result.getAST() = param result.getAst() = param
} }
abstract class TranslatedReadEffect extends TranslatedElement { abstract class TranslatedReadEffect extends TranslatedElement {
@@ -758,7 +779,10 @@ class TranslatedThisReadEffect extends TranslatedReadEffect, TTranslatedThisRead
TranslatedThisReadEffect() { this = TTranslatedThisReadEffect(func) } TranslatedThisReadEffect() { this = TTranslatedThisReadEffect(func) }
override Locatable getAST() { result = func } override Locatable getAst() { result = func }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override Function getFunction() { result = func } override Function getFunction() { result = func }
@@ -781,7 +805,10 @@ class TranslatedParameterReadEffect extends TranslatedReadEffect, TTranslatedPar
TranslatedParameterReadEffect() { this = TTranslatedParameterReadEffect(param) } TranslatedParameterReadEffect() { this = TTranslatedParameterReadEffect(param) }
override Locatable getAST() { result = param } override Locatable getAst() { result = param }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
override string toString() { result = "read effect: " + param.toString() } override string toString() { result = "read effect: " + param.toString() }

35
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
View File

@@ -139,7 +139,10 @@ abstract class TranslatedInitialization extends TranslatedElement, TTranslatedIn
final override Function getFunction() { result = expr.getEnclosingFunction() } final override Function getFunction() { result = expr.getEnclosingFunction() }
final override Locatable getAST() { result = expr } final override Locatable getAst() { result = expr }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
/** /**
* Gets the expression that is doing the initialization. * Gets the expression that is doing the initialization.
@@ -461,11 +464,11 @@ class TranslatedConstructorInitialization extends TranslatedDirectInitialization
TranslatedFieldInitialization getTranslatedFieldInitialization( TranslatedFieldInitialization getTranslatedFieldInitialization(
ClassAggregateLiteral initList, Field field ClassAggregateLiteral initList, Field field
) { ) {
result.getAST() = initList and result.getField() = field result.getAst() = initList and result.getField() = field
} }
TranslatedFieldInitialization getTranslatedConstructorFieldInitialization(ConstructorFieldInit init) { TranslatedFieldInitialization getTranslatedConstructorFieldInitialization(ConstructorFieldInit init) {
result.getAST() = init result.getAst() = init
} }
/** /**
@@ -478,7 +481,10 @@ abstract class TranslatedFieldInitialization extends TranslatedElement {
final override string toString() { result = ast.toString() + "." + field.toString() } final override string toString() { result = ast.toString() + "." + field.toString() }
final override Locatable getAST() { result = ast } final override Locatable getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = ast.getEnclosingFunction() } final override Function getFunction() { result = ast.getEnclosingFunction() }
@@ -622,7 +628,10 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
result = initList.toString() + "[" + getElementIndex().toString() + "]" result = initList.toString() + "[" + getElementIndex().toString() + "]"
} }
final override Locatable getAST() { result = initList } final override Locatable getAst() { result = initList }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = initList.getEnclosingFunction() } final override Function getFunction() { result = initList.getEnclosingFunction() }
@@ -802,7 +811,10 @@ class TranslatedElementValueInitialization extends TranslatedElementInitializati
abstract class TranslatedStructorCallFromStructor extends TranslatedElement, StructorCallContext { abstract class TranslatedStructorCallFromStructor extends TranslatedElement, StructorCallContext {
FunctionCall call; FunctionCall call;
final override Locatable getAST() { result = call } final override Locatable getAst() { result = call }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override TranslatedElement getChild(int id) { final override TranslatedElement getChild(int id) {
id = 0 and id = 0 and
@@ -864,7 +876,7 @@ abstract class TranslatedConstructorCallFromConstructor extends TranslatedStruct
} }
TranslatedConstructorCallFromConstructor getTranslatedConstructorBaseInit(ConstructorBaseInit init) { TranslatedConstructorCallFromConstructor getTranslatedConstructorBaseInit(ConstructorBaseInit init) {
result.getAST() = init result.getAst() = init
} }
/** /**
@@ -904,7 +916,7 @@ class TranslatedConstructorBaseInit extends TranslatedConstructorCallFromConstru
TranslatedDestructorBaseDestruction getTranslatedDestructorBaseDestruction( TranslatedDestructorBaseDestruction getTranslatedDestructorBaseDestruction(
DestructorBaseDestruction destruction DestructorBaseDestruction destruction
) { ) {
result.getAST() = destruction result.getAst() = destruction
} }
/** /**
@@ -928,7 +940,10 @@ class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstr
TranslatedConstructorBareInit() { this = TTranslatedConstructorBareInit(init) } TranslatedConstructorBareInit() { this = TTranslatedConstructorBareInit(init) }
override Locatable getAST() { result = init } override Locatable getAst() { result = init }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override string toString() { result = "construct base (no constructor)" } final override string toString() { result = "construct base (no constructor)" }
@@ -948,5 +963,5 @@ class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstr
} }
TranslatedConstructorBareInit getTranslatedConstructorBareInit(ConstructorInit init) { TranslatedConstructorBareInit getTranslatedConstructorBareInit(ConstructorInit init) {
result.getAST() = init result.getAst() = init
} }

7
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
View File

@@ -11,7 +11,7 @@ private import TranslatedExpr
private import TranslatedFunction private import TranslatedFunction
private import TranslatedInitialization private import TranslatedInitialization
TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAST() = stmt } TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAst() = stmt }
abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt { abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
Stmt stmt; Stmt stmt;
@@ -20,7 +20,10 @@ abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
final override string toString() { result = stmt.toString() } final override string toString() { result = stmt.toString() }
final override Locatable getAST() { result = stmt } final override Locatable getAst() { result = stmt }
/** DEPRECATED: Alias for getAst */
deprecated override Locatable getAST() { result = getAst() }
final override Function getFunction() { result = stmt.getEnclosingFunction() } final override Function getFunction() { result = stmt.getEnclosingFunction() }
} }

17
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
View File

@@ -55,7 +55,10 @@ class IRVariable extends TIRVariable {
* Gets the AST node that declared this variable, or that introduced this * Gets the AST node that declared this variable, or that introduced this
* variable as part of the AST-to-IR translation. * variable as part of the AST-to-IR translation.
*/ */
Language::AST getAST() { none() } Language::AST getAst() { none() }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets an identifier string for the variable. This identifier is unique * Gets an identifier string for the variable. This identifier is unique
@@ -66,7 +69,7 @@ class IRVariable extends TIRVariable {
/** /**
* Gets the source location of this variable. * Gets the source location of this variable.
*/ */
final Language::Location getLocation() { result = getAST().getLocation() } final Language::Location getLocation() { result = getAst().getLocation() }
/** /**
* Gets the IR for the function that references this variable. * Gets the IR for the function that references this variable.
@@ -90,7 +93,10 @@ class IRUserVariable extends IRVariable, TIRUserVariable {
final override string toString() { result = getVariable().toString() } final override string toString() { result = getVariable().toString() }
final override Language::AST getAST() { result = var } final override Language::AST getAst() { result = var }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
final override string getUniqueId() { final override string getUniqueId() {
result = getVariable().toString() + " " + getVariable().getLocation().toString() result = getVariable().toString() + " " + getVariable().getLocation().toString()
@@ -157,7 +163,10 @@ class IRGeneratedVariable extends IRVariable {
final override Language::LanguageType getLanguageType() { result = type } final override Language::LanguageType getLanguageType() { result = type }
final override Language::AST getAST() { result = ast } final override Language::AST getAst() { result = ast }
/** DEPRECATED: Alias for getAst */
deprecated override Language::AST getAST() { result = getAst() }
override string toString() { result = getBaseString() + getLocationString() } override string toString() { result = getBaseString() + getLocationString() }

16
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
View File

@@ -41,7 +41,7 @@ class Instruction extends Construction::TStageInstruction {
} }
/** Gets a textual representation of this element. */ /** Gets a textual representation of this element. */
final string toString() { result = this.getOpcode().toString() + ": " + this.getAST().toString() } final string toString() { result = this.getOpcode().toString() + ": " + this.getAst().toString() }
/** /**
* Gets a string showing the result, opcode, and operands of the instruction, equivalent to what * Gets a string showing the result, opcode, and operands of the instruction, equivalent to what
@@ -136,7 +136,7 @@ class Instruction extends Construction::TStageInstruction {
string getResultId() { string getResultId() {
this.shouldGenerateDumpStrings() and this.shouldGenerateDumpStrings() and
result = result =
this.getResultPrefix() + this.getAST().getLocation().getStartLine() + "_" + this.getLineRank() this.getResultPrefix() + this.getAst().getLocation().getStartLine() + "_" + this.getLineRank()
} }
/** /**
@@ -208,12 +208,15 @@ class Instruction extends Construction::TStageInstruction {
/** /**
* Gets the AST that caused this instruction to be generated. * Gets the AST that caused this instruction to be generated.
*/ */
final Language::AST getAST() { result = Construction::getInstructionAST(this) } final Language::AST getAst() { result = Construction::getInstructionAst(this) }
/** DEPRECATED: Alias for getAst */
deprecated Language::AST getAST() { result = getAst() }
/** /**
* Gets the location of the source code for this instruction. * Gets the location of the source code for this instruction.
*/ */
final Language::Location getLocation() { result = this.getAST().getLocation() } final Language::Location getLocation() { result = this.getAst().getLocation() }
/** /**
* Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a * Gets the `Expr` whose result is computed by this instruction, if any. The `Expr` may be a
@@ -459,7 +462,10 @@ class VariableInstruction extends Instruction {
/** /**
* Gets the AST variable that this instruction's IR variable refers to, if one exists. * Gets the AST variable that this instruction's IR variable refers to, if one exists.
*/ */
final Language::Variable getASTVariable() { result = var.(IRUserVariable).getVariable() } final Language::Variable getAstVariable() { result = var.(IRUserVariable).getVariable() }
/** DEPRECATED: Alias for getAstVariable */
deprecated Language::Variable getASTVariable() { result = getAstVariable() }
} }
/** /**

10
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
View File

@@ -18,7 +18,7 @@ private import internal.OperandInternal
* of `TOperand` that are used in this stage. * of `TOperand` that are used in this stage.
*/ */
private class TStageOperand = private class TStageOperand =
TRegisterOperand or TNonSSAMemoryOperand or TPhiOperand or TChiOperand; TRegisterOperand or TNonSsaMemoryOperand or TPhiOperand or TChiOperand;
/** /**
* A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as * A known location. Testing `loc instanceof KnownLocation` will account for non existing locations, as
@@ -38,7 +38,7 @@ class Operand extends TStageOperand {
// Ensure that the operand does not refer to instructions from earlier stages that are unreachable here // Ensure that the operand does not refer to instructions from earlier stages that are unreachable here
exists(Instruction use, Instruction def | this = registerOperand(use, _, def)) exists(Instruction use, Instruction def | this = registerOperand(use, _, def))
or or
exists(Instruction use | this = nonSSAMemoryOperand(use, _)) exists(Instruction use | this = nonSsaMemoryOperand(use, _))
or or
exists(Instruction use, Instruction def, IRBlock predecessorBlock | exists(Instruction use, Instruction def, IRBlock predecessorBlock |
this = phiOperand(use, def, predecessorBlock, _) or this = phiOperand(use, def, predecessorBlock, _) or
@@ -209,7 +209,7 @@ class Operand extends TStageOperand {
class MemoryOperand extends Operand { class MemoryOperand extends Operand {
cached cached
MemoryOperand() { MemoryOperand() {
this instanceof TNonSSAMemoryOperand or this instanceof TNonSsaMemoryOperand or
this instanceof TPhiOperand or this instanceof TPhiOperand or
this instanceof TChiOperand this instanceof TChiOperand
} }
@@ -249,7 +249,7 @@ class NonPhiOperand extends Operand {
NonPhiOperand() { NonPhiOperand() {
this = registerOperand(useInstr, tag, _) or this = registerOperand(useInstr, tag, _) or
this = nonSSAMemoryOperand(useInstr, tag) or this = nonSsaMemoryOperand(useInstr, tag) or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }
@@ -299,7 +299,7 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, TNonPhiMemoryOpe
cached cached
NonPhiMemoryOperand() { NonPhiMemoryOperand() {
this = nonSSAMemoryOperand(useInstr, tag) this = nonSsaMemoryOperand(useInstr, tag)
or or
this = chiOperand(useInstr, tag) this = chiOperand(useInstr, tag)
} }

6
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll
View File

@@ -99,7 +99,7 @@ private predicate filteredNumberableInstruction(Instruction instr) {
// count rather than strictcount to handle missing AST elements // count rather than strictcount to handle missing AST elements
// separate instanceof and inline casts to avoid failed casts with a count of 0 // separate instanceof and inline casts to avoid failed casts with a count of 0
instr instanceof VariableAddressInstruction and instr instanceof VariableAddressInstruction and
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1 count(instr.(VariableAddressInstruction).getIRVariable().getAst()) != 1
or or
instr instanceof ConstantInstruction and instr instanceof ConstantInstruction and
count(instr.getResultIRType()) != 1 count(instr.getResultIRType()) != 1
@@ -121,7 +121,7 @@ private predicate variableAddressValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
unique( | | instr.getIRVariable().getAST()) = ast unique( | | instr.getIRVariable().getAst()) = ast
} }
private predicate initializeParameterValueNumber( private predicate initializeParameterValueNumber(
@@ -131,7 +131,7 @@ private predicate initializeParameterValueNumber(
// The underlying AST element is used as value-numbering key instead of the // The underlying AST element is used as value-numbering key instead of the
// `IRVariable` to work around a problem where a variable or expression with // `IRVariable` to work around a problem where a variable or expression with
// multiple types gives rise to multiple `IRVariable`s. // multiple types gives rise to multiple `IRVariable`s.
instr.getIRVariable().getAST() = var instr.getIRVariable().getAst() = var
} }
private predicate constantValueNumber( private predicate constantValueNumber(

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandInternal.qll
View File

@@ -1,2 +1,2 @@
private import semmle.code.cpp.ir.implementation.internal.TOperand private import semmle.code.cpp.ir.implementation.internal.TOperand
import UnaliasedSSAOperands import UnaliasedSsaOperands

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll
View File

@@ -2,7 +2,7 @@ private import SSAConstructionInternal
private import OldIR private import OldIR
private import Alias private import Alias
private import SSAConstruction private import SSAConstruction
private import DebugSSA private import DebugSsa
bindingset[offset] bindingset[offset]
private string getKeySuffixForOffset(int offset) { private string getKeySuffixForOffset(int offset) {

2
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
View File

@@ -1,2 +1,2 @@
private import SSAConstruction as SSA private import SSAConstruction as SSA
import SSA::SSAConsistency import SSA::SsaConsistency

51
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
View File

@@ -112,7 +112,7 @@ private module Cached {
exists(Alias::getResultMemoryLocation(oldInstruction)) exists(Alias::getResultMemoryLocation(oldInstruction))
or or
// This result was already modeled by a previous iteration of SSA. // This result was already modeled by a previous iteration of SSA.
Alias::canReuseSSAForOldResult(oldInstruction) Alias::canReuseSsaForOldResult(oldInstruction)
} }
cached cached
@@ -182,7 +182,7 @@ private module Cached {
* unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the * unreachable, this predicate will recurse through any degenerate `Phi` instructions to find the
* true definition. * true definition.
*/ */
private Instruction getNewDefinitionFromOldSSA(OldIR::MemoryOperand oldOperand, Overlap overlap) { private Instruction getNewDefinitionFromOldSsa(OldIR::MemoryOperand oldOperand, Overlap overlap) {
exists(Overlap originalOverlap | exists(Overlap originalOverlap |
originalOverlap = oldOperand.getDefinitionOverlap() and originalOverlap = oldOperand.getDefinitionOverlap() and
( (
@@ -191,7 +191,7 @@ private module Cached {
or or
exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap | exists(OldIR::PhiInputOperand phiOperand, Overlap phiOperandOverlap |
phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and phiOperand = getDegeneratePhiOperand(oldOperand.getAnyDef()) and
result = getNewDefinitionFromOldSSA(phiOperand, phiOperandOverlap) and result = getNewDefinitionFromOldSsa(phiOperand, phiOperandOverlap) and
overlap = overlap =
combineOverlap(pragma[only_bind_out](phiOperandOverlap), combineOverlap(pragma[only_bind_out](phiOperandOverlap),
pragma[only_bind_out](originalOverlap)) pragma[only_bind_out](originalOverlap))
@@ -233,7 +233,7 @@ private module Cached {
) )
or or
exists(OldIR::NonPhiMemoryOperand oldOperand | exists(OldIR::NonPhiMemoryOperand oldOperand |
result = getNewDefinitionFromOldSSA(oldOperand, overlap) and result = getNewDefinitionFromOldSsa(oldOperand, overlap) and
oldOperand.getUse() = instruction and oldOperand.getUse() = instruction and
tag = oldOperand.getOperandTag() tag = oldOperand.getOperandTag()
) )
@@ -307,13 +307,13 @@ private module Cached {
* Gets the new definition instruction for the operand of `instr` that flows from the block * Gets the new definition instruction for the operand of `instr` that flows from the block
* `newPredecessorBlock`, based on that operand's definition in the old IR. * `newPredecessorBlock`, based on that operand's definition in the old IR.
*/ */
private Instruction getNewPhiOperandDefinitionFromOldSSA( private Instruction getNewPhiOperandDefinitionFromOldSsa(
Instruction instr, IRBlock newPredecessorBlock, Overlap overlap Instruction instr, IRBlock newPredecessorBlock, Overlap overlap
) { ) {
exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand | exists(OldIR::PhiInstruction oldPhi, OldIR::PhiInputOperand oldOperand |
oldPhi = getOldInstruction(instr) and oldPhi = getOldInstruction(instr) and
oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and oldOperand = oldPhi.getInputOperand(getOldBlock(newPredecessorBlock)) and
result = getNewDefinitionFromOldSSA(oldOperand, overlap) result = getNewDefinitionFromOldSsa(oldOperand, overlap)
) )
} }
@@ -333,7 +333,7 @@ private module Cached {
overlap = Alias::getOverlap(actualDefLocation, useLocation) overlap = Alias::getOverlap(actualDefLocation, useLocation)
) )
or or
result = getNewPhiOperandDefinitionFromOldSSA(instr, newPredecessorBlock, overlap) result = getNewPhiOperandDefinitionFromOldSsa(instr, newPredecessorBlock, overlap)
} }
cached cached
@@ -412,17 +412,17 @@ private module Cached {
} }
cached cached
Language::AST getInstructionAST(Instruction instr) { Language::AST getInstructionAst(Instruction instr) {
result = getOldInstruction(instr).getAST() result = getOldInstruction(instr).getAst()
or or
exists(RawIR::Instruction blockStartInstr | exists(RawIR::Instruction blockStartInstr |
instr = phiInstruction(blockStartInstr, _) and instr = phiInstruction(blockStartInstr, _) and
result = blockStartInstr.getAST() result = blockStartInstr.getAst()
) )
or or
exists(RawIR::Instruction primaryInstr | exists(RawIR::Instruction primaryInstr |
instr = chiInstruction(primaryInstr) and instr = chiInstruction(primaryInstr) and
result = primaryInstr.getAST() result = primaryInstr.getAst()
) )
or or
exists(IRFunctionBase irFunc | exists(IRFunctionBase irFunc |
@@ -430,6 +430,12 @@ private module Cached {
) )
} }
/** DEPRECATED: Alias for getInstructionAst */
cached
deprecated Language::AST getInstructionAST(Instruction instr) {
result = getInstructionAst(instr)
}
cached cached
Language::LanguageType getInstructionResultType(Instruction instr) { Language::LanguageType getInstructionResultType(Instruction instr) {
result = instr.(RawIR::Instruction).getResultLanguageType() result = instr.(RawIR::Instruction).getResultLanguageType()
@@ -975,35 +981,41 @@ module DefUse {
} }
} }
predicate canReuseSSAForMemoryResult(Instruction instruction) { predicate canReuseSsaForMemoryResult(Instruction instruction) {
exists(OldInstruction oldInstruction | exists(OldInstruction oldInstruction |
oldInstruction = getOldInstruction(instruction) and oldInstruction = getOldInstruction(instruction) and
( (
// The previous iteration said it was reusable, so we should mark it as reusable as well. // The previous iteration said it was reusable, so we should mark it as reusable as well.
Alias::canReuseSSAForOldResult(oldInstruction) Alias::canReuseSsaForOldResult(oldInstruction)
or or
// The current alias analysis says it is reusable. // The current alias analysis says it is reusable.
Alias::getResultMemoryLocation(oldInstruction).canReuseSSA() Alias::getResultMemoryLocation(oldInstruction).canReuseSsa()
) )
) )
or or
exists(Alias::MemoryLocation defLocation | exists(Alias::MemoryLocation defLocation |
// This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well. // This is a `Phi` for a reusable location, so the result of the `Phi` is reusable as well.
instruction = phiInstruction(_, defLocation) and instruction = phiInstruction(_, defLocation) and
defLocation.canReuseSSA() defLocation.canReuseSsa()
) )
// We don't support reusing SSA for any location that could create a `Chi` instruction. // We don't support reusing SSA for any location that could create a `Chi` instruction.
} }
/** DEPRECATED: Alias for canReuseSsaForMemoryResult */
deprecated predicate canReuseSSAForMemoryResult = canReuseSsaForMemoryResult/1;
/** /**
* Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the * Expose some of the internal predicates to PrintSSA.qll. We do this by publically importing those modules in the
* `DebugSSA` module, which is then imported by PrintSSA. * `DebugSSA` module, which is then imported by PrintSSA.
*/ */
module DebugSSA { module DebugSsa {
import PhiInsertion import PhiInsertion
import DefUse import DefUse
} }
/** DEPRECATED: Alias for DebugSsa */
deprecated module DebugSSA = DebugSsa;
import CachedForDebugging import CachedForDebugging
cached cached
@@ -1038,7 +1050,7 @@ private module CachedForDebugging {
private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) { private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
result.getEnclosingFunction() = var.getEnclosingFunction() and result.getEnclosingFunction() = var.getEnclosingFunction() and
result.getAST() = var.getAST() and result.getAst() = var.getAst() and
result.getTag() = var.getTag() result.getTag() = var.getTag()
} }
@@ -1061,7 +1073,7 @@ private module CachedForDebugging {
int maxValue() { result = 2147483647 } int maxValue() { result = 2147483647 }
} }
module SSAConsistency { module SsaConsistency {
/** /**
* Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis. * Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
*/ */
@@ -1114,6 +1126,9 @@ module SSAConsistency {
} }
} }
/** DEPRECATED: Alias for SsaConsistency */
deprecated module SSAConsistency = SsaConsistency;
/** /**
* Provides the portion of the parameterized IR interface that is used to construct the SSA stages * Provides the portion of the parameterized IR interface that is used to construct the SSA stages
* of the IR. The raw stage of the IR does not expose these predicates. * of the IR. The raw stage of the IR does not expose these predicates.

4
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionInternal.qll
View File

@@ -3,7 +3,7 @@ import semmle.code.cpp.ir.implementation.raw.internal.reachability.ReachableBloc
import semmle.code.cpp.ir.implementation.raw.internal.reachability.Dominance as Dominance import semmle.code.cpp.ir.implementation.raw.internal.reachability.Dominance as Dominance
import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as NewIR import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as NewIR
import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as RawStage import semmle.code.cpp.ir.implementation.raw.internal.IRConstruction as RawStage
import semmle.code.cpp.ir.implementation.internal.TInstruction::UnaliasedSSAInstructions as SSAInstructions import semmle.code.cpp.ir.implementation.internal.TInstruction::UnaliasedSsaInstructions as SSAInstructions
import semmle.code.cpp.ir.internal.IRCppLanguage as Language import semmle.code.cpp.ir.internal.IRCppLanguage as Language
import SimpleSSA as Alias import SimpleSSA as Alias
import semmle.code.cpp.ir.implementation.internal.TOperand::UnaliasedSSAOperands as SSAOperands import semmle.code.cpp.ir.implementation.internal.TOperand::UnaliasedSsaOperands as SSAOperands

15
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll
View File

@@ -41,11 +41,14 @@ predicate isVariableModeled(Allocation var) {
* subsequent iterations will recompute SSA for any variable that we assumed did not escape, but * subsequent iterations will recompute SSA for any variable that we assumed did not escape, but
* actually would have escaped if we had used a sound escape analysis. * actually would have escaped if we had used a sound escape analysis.
*/ */
predicate canReuseSSAForVariable(IRAutomaticVariable var) { predicate canReuseSsaForVariable(IRAutomaticVariable var) {
isVariableModeled(var) and isVariableModeled(var) and
not allocationEscapes(var) not allocationEscapes(var)
} }
/** DEPRECATED: Alias for canReuseSsaForVariable */
deprecated predicate canReuseSSAForVariable = canReuseSsaForVariable/1;
private newtype TMemoryLocation = MkMemoryLocation(Allocation var) { isVariableModeled(var) } private newtype TMemoryLocation = MkMemoryLocation(Allocation var) { isVariableModeled(var) }
private MemoryLocation getMemoryLocation(Allocation var) { result.getAllocation() = var } private MemoryLocation getMemoryLocation(Allocation var) { result.getAllocation() = var }
@@ -69,10 +72,16 @@ class MemoryLocation extends TMemoryLocation {
final string getUniqueId() { result = var.getUniqueId() } final string getUniqueId() { result = var.getUniqueId() }
final predicate canReuseSSA() { canReuseSSAForVariable(var) } final predicate canReuseSsa() { canReuseSsaForVariable(var) }
/** DEPRECATED: Alias for canReuseSsa */
deprecated predicate canReuseSSA() { canReuseSsa() }
} }
predicate canReuseSSAForOldResult(Instruction instr) { none() } predicate canReuseSsaForOldResult(Instruction instr) { none() }
/** DEPRECATED: Alias for canReuseSsaForOldResult */
deprecated predicate canReuseSSAForOldResult = canReuseSsaForOldResult/1;
/** /**
* Represents a set of `MemoryLocation`s that cannot overlap with * Represents a set of `MemoryLocation`s that cannot overlap with

19
cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeSSA.qll
View File

@@ -29,8 +29,8 @@ private import RangeAnalysisUtils
* The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA. * The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA.
* This class provides the range-analysis SSA logic. * This class provides the range-analysis SSA logic.
*/ */
library class RangeSSA extends SSAHelper { library class RangeSsa extends SsaHelper {
RangeSSA() { this = 1 } RangeSsa() { this = 1 }
/** /**
* Add a phi node on the out-edge of a guard. * Add a phi node on the out-edge of a guard.
@@ -40,6 +40,9 @@ library class RangeSSA extends SSAHelper {
} }
} }
/** DEPRECATED: Alias for RangeSsa */
deprecated class RangeSSA = RangeSsa;
private predicate guard_defn(VariableAccess v, Expr guard, BasicBlock b, boolean branch) { private predicate guard_defn(VariableAccess v, Expr guard, BasicBlock b, boolean branch) {
guardCondition(guard, v, branch) and guardCondition(guard, v, branch) and
guardSuccessor(guard, branch, b) guardSuccessor(guard, branch, b)
@@ -67,22 +70,22 @@ private predicate guardSuccessor(Expr guard, boolean branch, BasicBlock succ) {
* nodes. * nodes.
*/ */
class RangeSsaDefinition extends ControlFlowNodeBase { class RangeSsaDefinition extends ControlFlowNodeBase {
RangeSsaDefinition() { exists(RangeSSA x | x.ssa_defn(_, this, _, _)) } RangeSsaDefinition() { exists(RangeSsa x | x.ssa_defn(_, this, _, _)) }
/** /**
* Gets a variable corresponding to a SSA StackVariable defined by * Gets a variable corresponding to a SSA StackVariable defined by
* this definition. * this definition.
*/ */
StackVariable getAVariable() { exists(RangeSSA x | x.ssa_defn(result, this, _, _)) } StackVariable getAVariable() { exists(RangeSsa x | x.ssa_defn(result, this, _, _)) }
/** /**
* A string representation of the SSA variable represented by the pair * A string representation of the SSA variable represented by the pair
* `(this, v)`. * `(this, v)`.
*/ */
string toString(StackVariable v) { exists(RangeSSA x | result = x.toString(this, v)) } string toString(StackVariable v) { exists(RangeSsa x | result = x.toString(this, v)) }
/** Gets a use of the SSA variable represented by the pair `(this, v)`. */ /** Gets a use of the SSA variable represented by the pair `(this, v)`. */
VariableAccess getAUse(StackVariable v) { exists(RangeSSA x | result = x.getAUse(this, v)) } VariableAccess getAUse(StackVariable v) { exists(RangeSsa x | result = x.getAUse(this, v)) }
/** Gets the control flow node for this definition. */ /** Gets the control flow node for this definition. */
ControlFlowNode getDefinition() { result = this } ControlFlowNode getDefinition() { result = this }
@@ -91,7 +94,7 @@ class RangeSsaDefinition extends ControlFlowNodeBase {
BasicBlock getBasicBlock() { result.contains(this.getDefinition()) } BasicBlock getBasicBlock() { result.contains(this.getDefinition()) }
/** Whether this definition is a phi node for variable `v`. */ /** Whether this definition is a phi node for variable `v`. */
predicate isPhiNode(StackVariable v) { exists(RangeSSA x | x.phi_node(v, this)) } predicate isPhiNode(StackVariable v) { exists(RangeSsa x | x.phi_node(v, this)) }
/** /**
* DEPRECATED: Use isGuardPhi/4 instead * DEPRECATED: Use isGuardPhi/4 instead
@@ -172,6 +175,6 @@ class RangeSsaDefinition extends ControlFlowNodeBase {
* Holds if this definition of the variable `v` reached the end of the basic block `b`. * Holds if this definition of the variable `v` reached the end of the basic block `b`.
*/ */
predicate reachesEndOfBB(StackVariable v, BasicBlock b) { predicate reachesEndOfBB(StackVariable v, BasicBlock b) {
exists(RangeSSA x | x.ssaDefinitionReachesEndOfBB(v, this, b)) exists(RangeSsa x | x.ssaDefinitionReachesEndOfBB(v, this, b))
} }
} }

4
cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
View File

@@ -89,7 +89,7 @@ private ControlFlowNode getControlFlowEntry(ControlFlowNode node) {
* graph so that we can use the dominator tree to find the most recent * graph so that we can use the dominator tree to find the most recent
* side-effect. * side-effect.
*/ */
private predicate sideEffectCFG(ControlFlowNode src, ControlFlowNode dst) { private predicate sideEffectCfg(ControlFlowNode src, ControlFlowNode dst) {
src.getASuccessor() = dst src.getASuccessor() = dst
or or
// Add an edge from the entry point to any node that might have a side // Add an edge from the entry point to any node that might have a side
@@ -103,7 +103,7 @@ private predicate sideEffectCFG(ControlFlowNode src, ControlFlowNode dst) {
* the side-effect CFG. * the side-effect CFG.
*/ */
private predicate iDomEffect(ControlFlowNode dominator, ControlFlowNode node) = private predicate iDomEffect(ControlFlowNode dominator, ControlFlowNode node) =
idominance(functionEntry/1, sideEffectCFG/2)(_, dominator, node) idominance(functionEntry/1, sideEffectCfg/2)(_, dominator, node)
/** /**
* Gets the most recent side effect. To be more precise, `result` is a * Gets the most recent side effect. To be more precise, `result` is a

6
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
View File

@@ -34,7 +34,7 @@ class ReturnStackAllocatedMemoryConfig extends MustFlowConfiguration {
exists(VariableAddressInstruction var, Function func | exists(VariableAddressInstruction var, Function func |
var = source.asInstruction() and var = source.asInstruction() and
func = var.getEnclosingFunction() and func = var.getEnclosingFunction() and
var.getASTVariable() instanceof StackVariable and var.getAstVariable() instanceof StackVariable and
// Pointer-to-member types aren't properly handled in the dbscheme. // Pointer-to-member types aren't properly handled in the dbscheme.
not var.getResultType() instanceof PointerToMemberType and not var.getResultType() instanceof PointerToMemberType and
// Rule out FPs caused by extraction errors. // Rule out FPs caused by extraction errors.
@@ -84,5 +84,5 @@ where
// Only raise an alert if we're returning from the _same_ callable as the on that // Only raise an alert if we're returning from the _same_ callable as the on that
// declared the stack variable. // declared the stack variable.
var.getEnclosingFunction() = sink.getNode().getEnclosingCallable() var.getEnclosingFunction() = sink.getNode().getEnclosingCallable()
select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAST(), select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAst(),
var.getAST().toString() var.getAst().toString()

4
cpp/ql/src/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql
View File

@@ -19,7 +19,7 @@ import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.ir.IR import semmle.code.cpp.ir.IR
predicate instructionHasVariable(VariableAddressInstruction vai, StackVariable var, Function f) { predicate instructionHasVariable(VariableAddressInstruction vai, StackVariable var, Function f) {
var = vai.getASTVariable() and var = vai.getAstVariable() and
f = vai.getEnclosingFunction() and f = vai.getEnclosingFunction() and
// Pointer-to-member types aren't properly handled in the dbscheme. // Pointer-to-member types aren't properly handled in the dbscheme.
not vai.getResultType() instanceof PointerToMemberType and not vai.getResultType() instanceof PointerToMemberType and
@@ -108,7 +108,7 @@ predicate inheritanceConversionTypes(
/** Gets the HashCons value of an address computed by `instr`, if any. */ /** Gets the HashCons value of an address computed by `instr`, if any. */
TGlobalAddress globalAddress(Instruction instr) { TGlobalAddress globalAddress(Instruction instr) {
result = TGlobalVariable(instr.(VariableAddressInstruction).getASTVariable()) result = TGlobalVariable(instr.(VariableAddressInstruction).getAstVariable())
or or
not instr instanceof LoadInstruction and not instr instanceof LoadInstruction and
result = globalAddress(instr.(CopyInstruction).getSourceValue()) result = globalAddress(instr.(CopyInstruction).getSourceValue())

2
cpp/ql/src/Likely Bugs/RedundantNullCheckSimple.ql
View File

@@ -52,7 +52,7 @@ predicate explicitNullTestOfInstruction(Instruction checked, Instruction bool) {
pragma[noinline] pragma[noinline]
predicate candidateResult(LoadInstruction checked, ValueNumber value, IRBlock dominator) { predicate candidateResult(LoadInstruction checked, ValueNumber value, IRBlock dominator) {
explicitNullTestOfInstruction(checked, _) and explicitNullTestOfInstruction(checked, _) and
not checked.getAST().isInMacroExpansion() and not checked.getAst().isInMacroExpansion() and
value.getAnInstruction() = checked and value.getAnInstruction() = checked and
dominator.dominates(checked.getBlock()) dominator.dominates(checked.getBlock())
} }

6
cpp/ql/src/Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.ql
View File

@@ -11,7 +11,7 @@
import cpp import cpp
import ExternalAPIs import ExternalAPIs
from ExternalAPIUsedWithUntrustedData externalAPI from ExternalApiUsedWithUntrustedData externalApi
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses, select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc numberOfUntrustedSources desc

26
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll
View File

@@ -9,28 +9,31 @@ private import semmle.code.cpp.models.interfaces.Taint
import ExternalAPIsSpecific import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) } UntrustedExternalApiDataNode() { any(UntrustedDataToExternalApiConfig c).hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { DataFlow::Node getAnUntrustedSource() {
any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this) any(UntrustedDataToExternalApiConfig c).hasFlow(result, this)
} }
} }
private newtype TExternalAPI = /** DEPRECATED: Alias for UntrustedExternalApiDataNode */
TExternalAPIParameter(Function f, int index) { deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
exists(UntrustedExternalAPIDataNode n |
private newtype TExternalApi =
TExternalApiParameter(Function f, int index) {
exists(UntrustedExternalApiDataNode n |
f = n.getExternalFunction() and f = n.getExternalFunction() and
index = n.getIndex() index = n.getIndex()
) )
} }
/** An external API which is used with untrusted data. */ /** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI { class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */ /** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() { UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex()) this = TExternalApiParameter(result.getExternalFunction(), result.getIndex())
} }
/** Gets the number of untrusted sources used with this external API. */ /** Gets the number of untrusted sources used with this external API. */
@@ -43,8 +46,11 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Function f, int index, string indexString | exists(Function f, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index if index = -1 then indexString = "qualifier" else indexString = "param " + index
| |
this = TExternalAPIParameter(f, index) and this = TExternalApiParameter(f, index) and
result = f.toString() + " [" + indexString + "]" result = f.toString() + " [" + indexString + "]"
) )
} }
} }
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

20
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll
View File

@@ -8,11 +8,11 @@ import semmle.code.cpp.models.interfaces.DataFlow
import SafeExternalAPIFunction import SafeExternalAPIFunction
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node { class ExternalApiDataNode extends DataFlow::Node {
Call call; Call call;
int i; int i;
ExternalAPIDataNode() { ExternalApiDataNode() {
// Argument to call to a function // Argument to call to a function
( (
this.asExpr() = call.getArgument(i) this.asExpr() = call.getArgument(i)
@@ -27,7 +27,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
not f instanceof DataFlowFunction and not f instanceof DataFlowFunction and
not f instanceof TaintFunction and not f instanceof TaintFunction and
// Not a call to a known safe external API // Not a call to a known safe external API
not f instanceof SafeExternalAPIFunction not f instanceof SafeExternalApiFunction
) )
} }
@@ -41,9 +41,12 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getFunctionDescription() { result = this.getExternalFunction().toString() } string getFunctionDescription() { result = this.getExternalFunction().toString() }
} }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */ /** DEPRECATED: Alias for ExternalApiDataNode */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration { deprecated class ExternalAPIDataNode = ExternalApiDataNode;
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
override predicate isSource(DataFlow::Node source) { override predicate isSource(DataFlow::Node source) {
exists(RemoteFlowSourceFunction remoteFlow | exists(RemoteFlowSourceFunction remoteFlow |
@@ -52,5 +55,8 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
) )
} }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode } override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
} }
/** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;

6
cpp/ql/src/Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.ql
View File

@@ -11,7 +11,7 @@
import cpp import cpp
import ir.ExternalAPIs import ir.ExternalAPIs
from ExternalAPIUsedWithUntrustedData externalAPI from ExternalApiUsedWithUntrustedData externalApi
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses, select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc numberOfUntrustedSources desc

4
cpp/ql/src/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.ql
View File

@@ -15,8 +15,8 @@ import ir.ExternalAPIs
import semmle.code.cpp.security.FlowSources import semmle.code.cpp.security.FlowSources
import DataFlow::PathGraph import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink) where config.hasFlowPath(source, sink)
select sink, source, sink, select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() + "Call to " + sink.getNode().(ExternalApiDataNode).getExternalFunction().toString() +
" with untrusted data from $@.", source, source.getNode().(RemoteFlowSource).getSourceType() " with untrusted data from $@.", source, source.getNode().(RemoteFlowSource).getSourceType()

9
cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll
View File

@@ -8,11 +8,14 @@ private import semmle.code.cpp.models.interfaces.SideEffect
/** /**
* A `Function` that is considered a "safe" external API from a security perspective. * A `Function` that is considered a "safe" external API from a security perspective.
*/ */
abstract class SafeExternalAPIFunction extends Function { } abstract class SafeExternalApiFunction extends Function { }
/** DEPRECATED: Alias for SafeExternalApiFunction */
deprecated class SafeExternalAPIFunction = SafeExternalApiFunction;
/** The default set of "safe" external APIs. */ /** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction { private class DefaultSafeExternalApiFunction extends SafeExternalApiFunction {
DefaultSafeExternalAPIFunction() { DefaultSafeExternalApiFunction() {
// If a function does not write to any of its arguments, we consider it safe to // If a function does not write to any of its arguments, we consider it safe to
// pass untrusted data to it. This means that string functions such as `strcmp` // pass untrusted data to it. This means that string functions such as `strcmp`
// and `strlen`, as well as memory functions such as `memcmp`, are considered safe. // and `strlen`, as well as memory functions such as `memcmp`, are considered safe.

4
cpp/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.ql
View File

@@ -14,8 +14,8 @@ import semmle.code.cpp.dataflow.TaintTracking
import ExternalAPIs import ExternalAPIs
import DataFlow::PathGraph import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink) where config.hasFlowPath(source, sink)
select sink, source, sink, select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() + "Call to " + sink.getNode().(ExternalApiDataNode).getExternalFunction().toString() +
" with untrusted data from $@.", source, source.toString() " with untrusted data from $@.", source, source.toString()

26
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll
View File

@@ -9,28 +9,31 @@ private import semmle.code.cpp.models.interfaces.Taint
import ExternalAPIsSpecific import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode { class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) } UntrustedExternalApiDataNode() { any(UntrustedDataToExternalApiConfig c).hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { DataFlow::Node getAnUntrustedSource() {
any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this) any(UntrustedDataToExternalApiConfig c).hasFlow(result, this)
} }
} }
private newtype TExternalAPI = /** DEPRECATED: Alias for UntrustedExternalApiDataNode */
TExternalAPIParameter(Function f, int index) { deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
exists(UntrustedExternalAPIDataNode n |
private newtype TExternalApi =
TExternalApiParameter(Function f, int index) {
exists(UntrustedExternalApiDataNode n |
f = n.getExternalFunction() and f = n.getExternalFunction() and
index = n.getIndex() index = n.getIndex()
) )
} }
/** An external API which is used with untrusted data. */ /** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI { class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */ /** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() { UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex()) this = TExternalApiParameter(result.getExternalFunction(), result.getIndex())
} }
/** Gets the number of untrusted sources used with this external API. */ /** Gets the number of untrusted sources used with this external API. */
@@ -43,8 +46,11 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Function f, int index, string indexString | exists(Function f, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index if index = -1 then indexString = "qualifier" else indexString = "param " + index
| |
this = TExternalAPIParameter(f, index) and this = TExternalApiParameter(f, index) and
result = f.toString() + " [" + indexString + "]" result = f.toString() + " [" + indexString + "]"
) )
} }
} }
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

20
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIsSpecific.qll
View File

@@ -8,11 +8,11 @@ private import semmle.code.cpp.models.interfaces.DataFlow
import SafeExternalAPIFunction import SafeExternalAPIFunction
/** A node representing untrusted data being passed to an external API. */ /** A node representing untrusted data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node { class ExternalApiDataNode extends DataFlow::Node {
Call call; Call call;
int i; int i;
ExternalAPIDataNode() { ExternalApiDataNode() {
// Argument to call to a function // Argument to call to a function
( (
this.asExpr() = call.getArgument(i) this.asExpr() = call.getArgument(i)
@@ -27,7 +27,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
not f instanceof DataFlowFunction and not f instanceof DataFlowFunction and
not f instanceof TaintFunction and not f instanceof TaintFunction and
// Not a call to a known safe external API // Not a call to a known safe external API
not f instanceof SafeExternalAPIFunction not f instanceof SafeExternalApiFunction
) )
} }
@@ -41,11 +41,17 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getFunctionDescription() { result = this.getExternalFunction().toString() } string getFunctionDescription() { result = this.getExternalFunction().toString() }
} }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */ /** DEPRECATED: Alias for ExternalApiDataNode */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration { deprecated class ExternalAPIDataNode = ExternalApiDataNode;
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfigIR" }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfigIR" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode } override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
} }
/** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;

9
cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll
View File

@@ -8,11 +8,14 @@ private import semmle.code.cpp.models.interfaces.SideEffect
/** /**
* A `Function` that is considered a "safe" external API from a security perspective. * A `Function` that is considered a "safe" external API from a security perspective.
*/ */
abstract class SafeExternalAPIFunction extends Function { } abstract class SafeExternalApiFunction extends Function { }
/** DEPRECATED: Alias for SafeExternalApiFunction */
deprecated class SafeExternalAPIFunction = SafeExternalApiFunction;
/** The default set of "safe" external APIs. */ /** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction { private class DefaultSafeExternalApiFunction extends SafeExternalApiFunction {
DefaultSafeExternalAPIFunction() { DefaultSafeExternalApiFunction() {
// If a function does not write to any of its arguments, we consider it safe to // If a function does not write to any of its arguments, we consider it safe to
// pass untrusted data to it. This means that string functions such as `strcmp` // pass untrusted data to it. This means that string functions such as `strcmp`
// and `strlen`, as well as memory functions such as `memcmp`, are considered safe. // and `strlen`, as well as memory functions such as `memcmp`, are considered safe.

8
cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View File

@@ -18,15 +18,15 @@ import semmle.code.cpp.security.FunctionWithWrappers
import semmle.code.cpp.security.TaintTracking import semmle.code.cpp.security.TaintTracking
import TaintedWithPath import TaintedWithPath
class SQLLikeFunction extends FunctionWithWrappers { class SqlLikeFunction extends FunctionWithWrappers {
SQLLikeFunction() { sqlArgument(this.getName(), _) } SqlLikeFunction() { sqlArgument(this.getName(), _) }
override predicate interestingArg(int arg) { sqlArgument(this.getName(), arg) } override predicate interestingArg(int arg) { sqlArgument(this.getName(), arg) }
} }
class Configuration extends TaintTrackingConfiguration { class Configuration extends TaintTrackingConfiguration {
override predicate isSink(Element tainted) { override predicate isSink(Element tainted) {
exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _)) exists(SqlLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
} }
override predicate isBarrier(Expr e) { override predicate isBarrier(Expr e) {
@@ -43,7 +43,7 @@ class Configuration extends TaintTrackingConfiguration {
} }
from from
SQLLikeFunction runSql, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode, SqlLikeFunction runSql, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode,
string taintCause, string callChain string taintCause, string callChain
where where
runSql.outermostWrapperFunctionCall(taintedArg, callChain) and runSql.outermostWrapperFunctionCall(taintedArg, callChain) and

8
cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
View File

@@ -46,8 +46,8 @@ class EnvData extends SystemData {
/** /**
* Data originating from a call to `mysql_get_client_info()`. * Data originating from a call to `mysql_get_client_info()`.
*/ */
class SQLClientInfo extends SystemData { class SqlClientInfo extends SystemData {
SQLClientInfo() { this.(FunctionCall).getTarget().hasName("mysql_get_client_info") } SqlClientInfo() { this.(FunctionCall).getTarget().hasName("mysql_get_client_info") }
override Expr getAnExpr() { result = this } override Expr getAnExpr() { result = this }
} }
@@ -63,8 +63,8 @@ private predicate sqlConnectInfo(FunctionCall source, VariableAccess use) {
/** /**
* Data passed into an SQL connect function. * Data passed into an SQL connect function.
*/ */
class SQLConnectInfo extends SystemData { class SqlConnectInfo extends SystemData {
SQLConnectInfo() { sqlConnectInfo(this, _) } SqlConnectInfo() { sqlConnectInfo(this, _) }
override Expr getAnExpr() { sqlConnectInfo(this, result) } override Expr getAnExpr() { sqlConnectInfo(this, result) }
} }

4
cpp/ql/src/jsf/4.10 Classes/AV Rule 97.ql
View File

@@ -27,13 +27,13 @@ predicate containsArray(Type t) {
) )
} }
predicate functionAPIViolation(MemberFunction f) { predicate functionApiViolation(MemberFunction f) {
f.isPublic() and f.isPublic() and
containsArray(f.getAParameter().getType()) containsArray(f.getAParameter().getType())
} }
from MemberFunction m from MemberFunction m
where where
functionAPIViolation(m) and functionApiViolation(m) and
not m.getDeclaringType() instanceof Struct not m.getDeclaringType() instanceof Struct
select m, "Raw arrays should not be used in interfaces. A container class should be used instead." select m, "Raw arrays should not be used in interfaces. A container class should be used instead."

4
cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 186.ql
View File

@@ -12,13 +12,13 @@
import cpp import cpp
// whether f is to be considered an API entry point, and hence reachable by default // whether f is to be considered an API entry point, and hence reachable by default
predicate isAPI(Function f) { predicate isApi(Function f) {
f.hasName("main") or f.hasName("main") or
f.(MemberFunction).hasSpecifier("public") f.(MemberFunction).hasSpecifier("public")
} }
predicate unusedFunction(Function f) { predicate unusedFunction(Function f) {
not isAPI(f) and not isApi(f) and
not exists(FunctionCall c | c.getTarget() = f) and not exists(FunctionCall c | c.getTarget() = f) and
not exists(Access acc | acc.getTarget() = f) and not exists(Access acc | acc.getTarget() = f) and
f.hasDefinition() f.hasDefinition()

2
cpp/ql/src/printAst.ql
View File

@@ -16,7 +16,7 @@ import definitions
*/ */
external string selectedSourceFile(); external string selectedSourceFile();
class Cfg extends PrintASTConfiguration { class Cfg extends PrintAstConfiguration {
/** /**
* Holds if the AST for `func` should be printed. * Holds if the AST for `func` should be printed.
* Print All functions from the selected file. * Print All functions from the selected file.

7
cpp/ql/test/TestUtilities/dataflow/FlowTestCommon.qll
View File

@@ -42,8 +42,8 @@ class IRFlowTest extends InlineExpectationsTest {
} }
} }
class ASTFlowTest extends InlineExpectationsTest { class AstFlowTest extends InlineExpectationsTest {
ASTFlowTest() { this = "ASTFlowTest" } AstFlowTest() { this = "ASTFlowTest" }
override string getARelevantTag() { result = "ast" } override string getARelevantTag() { result = "ast" }
@@ -69,3 +69,6 @@ class ASTFlowTest extends InlineExpectationsTest {
) )
} }
} }
/** DEPRECATED: Alias for AstFlowTest */
deprecated class ASTFlowTest = AstFlowTest;

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql
View File

@@ -67,8 +67,8 @@ class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
} }
} }
class ASTTaintTrackingTest extends InlineExpectationsTest { class AstTaintTrackingTest extends InlineExpectationsTest {
ASTTaintTrackingTest() { this = "ASTTaintTrackingTest" } AstTaintTrackingTest() { this = "ASTTaintTrackingTest" }
override string getARelevantTag() { result = "ast" } override string getARelevantTag() { result = "ast" }

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql
View File

@@ -55,8 +55,8 @@ class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
} }
} }
class ASTTaintTrackingTest extends InlineExpectationsTest { class AstTaintTrackingTest extends InlineExpectationsTest {
ASTTaintTrackingTest() { this = "ASTTaintTrackingTest" } AstTaintTrackingTest() { this = "ASTTaintTrackingTest" }
override string getARelevantTag() { result = "ast" } override string getARelevantTag() { result = "ast" }

4
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/globals/global.ql
View File

@@ -27,8 +27,8 @@ class IRGlobalDefaultTaintTrackingTest extends InlineExpectationsTest {
} }
} }
class ASTGlobalDefaultTaintTrackingTest extends InlineExpectationsTest { class AstGlobalDefaultTaintTrackingTest extends InlineExpectationsTest {
ASTGlobalDefaultTaintTrackingTest() { this = "ASTGlobalDefaultTaintTrackingTest" } AstGlobalDefaultTaintTrackingTest() { this = "ASTGlobalDefaultTaintTrackingTest" }
override string getARelevantTag() { result = "ast" } override string getARelevantTag() { result = "ast" }

10
cpp/ql/test/library-tests/dataflow/dataflow-tests/test.ql
View File

@@ -1,6 +1,6 @@
import TestUtilities.dataflow.FlowTestCommon import TestUtilities.dataflow.FlowTestCommon
module ASTTest { module AstTest {
private import semmle.code.cpp.dataflow.DataFlow private import semmle.code.cpp.dataflow.DataFlow
/** /**
@@ -18,8 +18,8 @@ module ASTTest {
} }
/** Common data flow configuration to be used by tests. */ /** Common data flow configuration to be used by tests. */
class ASTTestAllocationConfig extends DataFlow::Configuration { class AstTestAllocationConfig extends DataFlow::Configuration {
ASTTestAllocationConfig() { this = "ASTTestAllocationConfig" } AstTestAllocationConfig() { this = "ASTTestAllocationConfig" }
override predicate isSource(DataFlow::Node source) { override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source" source.asExpr().(FunctionCall).getTarget().getName() = "source"
@@ -100,10 +100,10 @@ module IRTest {
} }
private predicate readsVariable(LoadInstruction load, Variable var) { private predicate readsVariable(LoadInstruction load, Variable var) {
load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
} }
private predicate writesVariable(StoreInstruction store, Variable var) { private predicate writesVariable(StoreInstruction store, Variable var) {
store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var store.getDestinationAddress().(VariableAddressInstruction).getAstVariable() = var
} }
} }

7
cpp/ql/test/library-tests/dataflow/fields/ASTConfiguration.qll
View File

@@ -1,8 +1,8 @@
private import semmle.code.cpp.dataflow.DataFlow private import semmle.code.cpp.dataflow.DataFlow
private import DataFlow private import DataFlow
class ASTConf extends Configuration { class AstConf extends Configuration {
ASTConf() { this = "ASTFieldFlowConf" } AstConf() { this = "ASTFieldFlowConf" }
override predicate isSource(Node src) { override predicate isSource(Node src) {
src.asExpr() instanceof NewExpr src.asExpr() instanceof NewExpr
@@ -30,3 +30,6 @@ class ASTConf extends Configuration {
b.asExpr().(AddressOfExpr).getOperand() = a.asExpr() b.asExpr().(AddressOfExpr).getOperand() = a.asExpr()
} }
} }
/** DEPRECATED: Alias for AstConf */
deprecated class ASTConf = AstConf;

19
cpp/ql/test/library-tests/dataflow/fields/Nodes.qll
View File

@@ -3,7 +3,7 @@ private import semmle.code.cpp.dataflow.DataFlow as AST
private import cpp private import cpp
private newtype TNode = private newtype TNode =
TASTNode(AST::DataFlow::Node n) or TAstNode(AST::DataFlow::Node n) or
TIRNode(IR::DataFlow::Node n) TIRNode(IR::DataFlow::Node n)
class Node extends TNode { class Node extends TNode {
@@ -11,23 +11,32 @@ class Node extends TNode {
IR::DataFlow::Node asIR() { none() } IR::DataFlow::Node asIR() { none() }
AST::DataFlow::Node asAST() { none() } AST::DataFlow::Node asAst() { none() }
/** DEPRECATED: Alias for asAst */
deprecated AST::DataFlow::Node asAST() { result = asAst() }
Location getLocation() { none() } Location getLocation() { none() }
} }
class ASTNode extends Node, TASTNode { class AstNode extends Node, TAstNode {
AST::DataFlow::Node n; AST::DataFlow::Node n;
ASTNode() { this = TASTNode(n) } AstNode() { this = TAstNode(n) }
override string toString() { result = n.toString() } override string toString() { result = n.toString() }
override AST::DataFlow::Node asAST() { result = n } override AST::DataFlow::Node asAst() { result = n }
/** DEPRECATED: Alias for asAst */
deprecated override AST::DataFlow::Node asAST() { result = asAst() }
override Location getLocation() { result = n.getLocation() } override Location getLocation() { result = n.getLocation() }
} }
/** DEPRECATED: Alias for AstNode */
deprecated class ASTNode = AstNode;
class IRNode extends Node, TIRNode { class IRNode extends Node, TIRNode {
IR::DataFlow::Node n; IR::DataFlow::Node n;

2
cpp/ql/test/library-tests/dataflow/fields/flow.ql
View File

@@ -1,6 +1,6 @@
import TestUtilities.dataflow.FlowTestCommon import TestUtilities.dataflow.FlowTestCommon
module ASTTest { module AstTest {
private import ASTConfiguration private import ASTConfiguration
} }

6
cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
View File

@@ -7,8 +7,8 @@ import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as IR
import semmle.code.cpp.dataflow.DataFlow::DataFlow as AST import semmle.code.cpp.dataflow.DataFlow::DataFlow as AST
import Nodes import Nodes
class ASTPartialDefNode extends ASTNode { class AstPartialDefNode extends AstNode {
ASTPartialDefNode() { exists(n.asPartialDefinition()) } AstPartialDefNode() { exists(n.asPartialDefinition()) }
override string toString() { result = n.asPartialDefinition().toString() } override string toString() { result = n.asPartialDefinition().toString() }
} }
@@ -29,7 +29,7 @@ where
msg = "IR only" msg = "IR only"
or or
exists(AST::Node astNode, Expr partial | exists(AST::Node astNode, Expr partial |
node.asAST() = astNode and node.asAst() = astNode and
partial = astNode.asPartialDefinition() and partial = astNode.asPartialDefinition() and
not exists(IR::Node otherNode | otherNode.asPartialDefinition() = partial) not exists(IR::Node otherNode | otherNode.asPartialDefinition() = partial)
) and ) and

2
cpp/ql/test/library-tests/dataflow/fields/path-flow.ql
View File

@@ -7,6 +7,6 @@ import ASTConfiguration
import cpp import cpp
import DataFlow::PathGraph import DataFlow::PathGraph
from DataFlow::PathNode src, DataFlow::PathNode sink, ASTConf conf from DataFlow::PathNode src, DataFlow::PathNode sink, AstConf conf
where conf.hasFlowPath(src, sink) where conf.hasFlowPath(src, sink)
select sink, src, sink, sink + " flows from $@", src, src.toString() select sink, src, sink, sink + " flows from $@", src, src.toString()

6
cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql
View File

@@ -1,10 +1,10 @@
import TestUtilities.dataflow.FlowTestCommon import TestUtilities.dataflow.FlowTestCommon
module ASTTest { module AstTest {
private import semmle.code.cpp.dataflow.TaintTracking private import semmle.code.cpp.dataflow.TaintTracking
class ASTSmartPointerTaintConfig extends TaintTracking::Configuration { class AstSmartPointerTaintConfig extends TaintTracking::Configuration {
ASTSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" } AstSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" }
override predicate isSource(DataFlow::Node source) { override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source" source.asExpr().(FunctionCall).getTarget().getName() = "source"

6
cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
View File

@@ -38,13 +38,13 @@ module TaintModels {
} }
} }
module ASTTest { module AstTest {
private import semmle.code.cpp.dataflow.TaintTracking private import semmle.code.cpp.dataflow.TaintTracking
private import semmle.code.cpp.models.interfaces.Taint private import semmle.code.cpp.models.interfaces.Taint
/** Common data flow configuration to be used by tests. */ /** Common data flow configuration to be used by tests. */
class ASTTestAllocationConfig extends TaintTracking::Configuration { class AstTestAllocationConfig extends TaintTracking::Configuration {
ASTTestAllocationConfig() { this = "ASTTestAllocationConfig" } AstTestAllocationConfig() { this = "ASTTestAllocationConfig" }
override predicate isSource(DataFlow::Node source) { override predicate isSource(DataFlow::Node source) {
source.asExpr().(FunctionCall).getTarget().getName() = "source" source.asExpr().(FunctionCall).getTarget().getName() = "source"

4
cpp/ql/test/library-tests/depends_initializers/InitializerCFG.ql
View File

@@ -1,7 +1,7 @@
import cpp import cpp
Function getCFGFunction(Initializer i) { result = i.getASuccessor*() } Function getCfgFunction(Initializer i) { result = i.getASuccessor*() }
from Initializer i, string f from Initializer i, string f
where if exists(getCFGFunction(i)) then f = getCFGFunction(i).toString() else f = "" where if exists(getCfgFunction(i)) then f = getCfgFunction(i).toString() else f = ""
select i, f select i, f

2
cpp/ql/test/library-tests/ir/ir/PrintAST.ql
View File

@@ -6,6 +6,6 @@ private import cpp
private import semmle.code.cpp.PrintAST private import semmle.code.cpp.PrintAST
private import PrintConfig private import PrintConfig
private class PrintConfig extends PrintASTConfiguration { private class PrintConfig extends PrintAstConfiguration {
override predicate shouldPrintFunction(Function func) { shouldDumpFunction(func) } override predicate shouldPrintFunction(Function func) { shouldDumpFunction(func) }
} }

6
cpp/ql/test/library-tests/ir/points_to/points_to.ql
View File

@@ -40,7 +40,7 @@ module Raw {
} }
} }
module UnaliasedSSA { module UnaliasedSsa {
private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR
private import semmle.code.cpp.ir.implementation.aliased_ssa.internal.AliasedSSA private import semmle.code.cpp.ir.implementation.aliased_ssa.internal.AliasedSSA
@@ -49,8 +49,8 @@ module UnaliasedSSA {
result = getOperandMemoryLocation(instr.getAnOperand()) result = getOperandMemoryLocation(instr.getAnOperand())
} }
class UnaliasedSSAPointsToTest extends InlineExpectationsTest { class UnaliasedSsaPointsToTest extends InlineExpectationsTest {
UnaliasedSSAPointsToTest() { this = "UnaliasedSSAPointsToTest" } UnaliasedSsaPointsToTest() { this = "UnaliasedSSAPointsToTest" }
override string getARelevantTag() { result = "ussa" } override string getARelevantTag() { result = "ussa" }

67
csharp/ql/lib/semmle/code/asp/WebConfig.qll
View File

@@ -7,67 +7,88 @@ import csharp
/** /**
* A `Web.config` file. * A `Web.config` file.
*/ */
class WebConfigXML extends XMLFile { class WebConfigXml extends XMLFile {
WebConfigXML() { this.getName().matches("%Web.config") } WebConfigXml() { this.getName().matches("%Web.config") }
} }
/** DEPRECATED: Alias for WebConfigXml */
deprecated class WebConfigXML = WebConfigXml;
/** A `<configuration>` tag in an ASP.NET configuration file. */ /** A `<configuration>` tag in an ASP.NET configuration file. */
class ConfigurationXMLElement extends XMLElement { class ConfigurationXmlElement extends XMLElement {
ConfigurationXMLElement() { this.getName().toLowerCase() = "configuration" } ConfigurationXmlElement() { this.getName().toLowerCase() = "configuration" }
} }
/** DEPRECATED: Alias for ConfigurationXmlElement */
deprecated class ConfigurationXMLElement = ConfigurationXmlElement;
/** A `<location>` tag in an ASP.NET configuration file. */ /** A `<location>` tag in an ASP.NET configuration file. */
class LocationXMLElement extends XMLElement { class LocationXmlElement extends XMLElement {
LocationXMLElement() { LocationXmlElement() {
this.getParent() instanceof ConfigurationXMLElement and this.getParent() instanceof ConfigurationXmlElement and
this.getName().toLowerCase() = "location" this.getName().toLowerCase() = "location"
} }
} }
/** DEPRECATED: Alias for LocationXmlElement */
deprecated class LocationXMLElement = LocationXmlElement;
/** A `<system.web>` tag in an ASP.NET configuration file. */ /** A `<system.web>` tag in an ASP.NET configuration file. */
class SystemWebXMLElement extends XMLElement { class SystemWebXmlElement extends XMLElement {
SystemWebXMLElement() { SystemWebXmlElement() {
( (
this.getParent() instanceof ConfigurationXMLElement this.getParent() instanceof ConfigurationXmlElement
or or
this.getParent() instanceof LocationXMLElement this.getParent() instanceof LocationXmlElement
) and ) and
this.getName().toLowerCase() = "system.web" this.getName().toLowerCase() = "system.web"
} }
} }
/** DEPRECATED: Alias for SystemWebXmlElement */
deprecated class SystemWebXMLElement = SystemWebXmlElement;
/** A `<system.webServer>` tag in an ASP.NET configuration file. */ /** A `<system.webServer>` tag in an ASP.NET configuration file. */
class SystemWebServerXMLElement extends XMLElement { class SystemWebServerXmlElement extends XMLElement {
SystemWebServerXMLElement() { SystemWebServerXmlElement() {
( (
this.getParent() instanceof ConfigurationXMLElement this.getParent() instanceof ConfigurationXmlElement
or or
this.getParent() instanceof LocationXMLElement this.getParent() instanceof LocationXmlElement
) and ) and
this.getName().toLowerCase() = "system.webserver" this.getName().toLowerCase() = "system.webserver"
} }
} }
/** DEPRECATED: Alias for SystemWebServerXmlElement */
deprecated class SystemWebServerXMLElement = SystemWebServerXmlElement;
/** A `<customErrors>` tag in an ASP.NET configuration file. */ /** A `<customErrors>` tag in an ASP.NET configuration file. */
class CustomErrorsXMLElement extends XMLElement { class CustomErrorsXmlElement extends XMLElement {
CustomErrorsXMLElement() { CustomErrorsXmlElement() {
this.getParent() instanceof SystemWebXMLElement and this.getParent() instanceof SystemWebXmlElement and
this.getName().toLowerCase() = "customerrors" this.getName().toLowerCase() = "customerrors"
} }
} }
/** DEPRECATED: Alias for CustomErrorsXmlElement */
deprecated class CustomErrorsXMLElement = CustomErrorsXmlElement;
/** A `<httpRuntime>` tag in an ASP.NET configuration file. */ /** A `<httpRuntime>` tag in an ASP.NET configuration file. */
class HttpRuntimeXMLElement extends XMLElement { class HttpRuntimeXmlElement extends XMLElement {
HttpRuntimeXMLElement() { HttpRuntimeXmlElement() {
this.getParent() instanceof SystemWebXMLElement and this.getParent() instanceof SystemWebXmlElement and
this.getName().toLowerCase() = "httpruntime" this.getName().toLowerCase() = "httpruntime"
} }
} }
/** DEPRECATED: Alias for HttpRuntimeXmlElement */
deprecated class HttpRuntimeXMLElement = HttpRuntimeXmlElement;
/** A `<forms>` tag under `<system.web><authentication>` in an ASP.NET configuration file. */ /** A `<forms>` tag under `<system.web><authentication>` in an ASP.NET configuration file. */
class FormsElement extends XMLElement { class FormsElement extends XMLElement {
FormsElement() { FormsElement() {
this = any(SystemWebXMLElement sw).getAChild("authentication").getAChild("forms") this = any(SystemWebXmlElement sw).getAChild("authentication").getAChild("forms")
} }
/** /**
@@ -85,7 +106,7 @@ class FormsElement extends XMLElement {
/** A `<httpCookies>` tag in an ASP.NET configuration file. */ /** A `<httpCookies>` tag in an ASP.NET configuration file. */
class HttpCookiesElement extends XMLElement { class HttpCookiesElement extends XMLElement {
HttpCookiesElement() { this = any(SystemWebXMLElement sw).getAChild("httpCookies") } HttpCookiesElement() { this = any(SystemWebXmlElement sw).getAChild("httpCookies") }
/** /**
* Gets attribute's `httpOnlyCookies` value. * Gets attribute's `httpOnlyCookies` value.

4
csharp/ql/lib/semmle/code/csharp/XML.qll
View File

@@ -4,11 +4,11 @@
import semmle.files.FileSystem import semmle.files.FileSystem
private class TXMLLocatable = private class TXmlLocatable =
@xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters; @xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
/** An XML element that has a location. */ /** An XML element that has a location. */
class XMLLocatable extends @xmllocatable, TXMLLocatable { class XMLLocatable extends @xmllocatable, TXmlLocatable {
/** Gets the source location for this element. */ /** Gets the source location for this element. */
Location getLocation() { xmllocations(this, result) } Location getLocation() { xmllocations(this, result) }

8
csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
View File

@@ -1000,7 +1000,7 @@ module Internal {
// The predicates in this module should be evaluated in the same stage as the CFG // The predicates in this module should be evaluated in the same stage as the CFG
// construction stage. This is to avoid recomputation of pre-basic-blocks and // construction stage. This is to avoid recomputation of pre-basic-blocks and
// pre-SSA predicates // pre-SSA predicates
private module PreCFG { private module PreCfg {
private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
private import semmle.code.csharp.controlflow.internal.PreSsa private import semmle.code.csharp.controlflow.internal.PreSsa
@@ -1414,7 +1414,7 @@ module Internal {
} }
cached cached
private module CachedWithCFG { private module CachedWithCfg {
private import semmle.code.csharp.Caching private import semmle.code.csharp.Caching
cached cached
@@ -1719,10 +1719,10 @@ module Internal {
} }
} }
import CachedWithCFG import CachedWithCfg
} }
import PreCFG import PreCfg
private predicate interestingDescendantCandidate(Expr e) { private predicate interestingDescendantCandidate(Expr e) {
guardControls(e, _, _) guardControls(e, _, _)

59
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
View File

@@ -12,15 +12,18 @@ private import semmle.code.csharp.dataflow.FlowSummary
/** /**
* A callable that is considered a "safe" external API from a security perspective. * A callable that is considered a "safe" external API from a security perspective.
*/ */
abstract class SafeExternalAPICallable extends Callable { } abstract class SafeExternalApiCallable extends Callable { }
private class SummarizedCallableSafe extends SafeExternalAPICallable { /** DEPRECATED: Alias for SafeExternalApiCallable */
deprecated class SafeExternalAPICallable = SafeExternalApiCallable;
private class SummarizedCallableSafe extends SafeExternalApiCallable {
SummarizedCallableSafe() { this instanceof SummarizedCallable } SummarizedCallableSafe() { this instanceof SummarizedCallable }
} }
/** The default set of "safe" external APIs. */ /** The default set of "safe" external APIs. */
private class DefaultSafeExternalAPICallable extends SafeExternalAPICallable { private class DefaultSafeExternalApiCallable extends SafeExternalApiCallable {
DefaultSafeExternalAPICallable() { DefaultSafeExternalApiCallable() {
this instanceof EqualsMethod or this instanceof EqualsMethod or
this instanceof IEquatableEqualsMethod or this instanceof IEquatableEqualsMethod or
this = any(SystemObjectClass s).getEqualsMethod() or this = any(SystemObjectClass s).getEqualsMethod() or
@@ -36,11 +39,11 @@ private class DefaultSafeExternalAPICallable extends SafeExternalAPICallable {
} }
/** A node representing data being passed to an external API. */ /** A node representing data being passed to an external API. */
class ExternalAPIDataNode extends DataFlow::Node { class ExternalApiDataNode extends DataFlow::Node {
Call call; Call call;
int i; int i;
ExternalAPIDataNode() { ExternalApiDataNode() {
( (
// Argument to call // Argument to call
this.asExpr() = call.getArgument(i) this.asExpr() = call.getArgument(i)
@@ -59,7 +62,7 @@ class ExternalAPIDataNode extends DataFlow::Node {
m.fromSource() m.fromSource()
) and ) and
// Not a call to a known safe external API // Not a call to a known safe external API
not call.getTarget().getUnboundDeclaration() instanceof SafeExternalAPICallable not call.getTarget().getUnboundDeclaration() instanceof SafeExternalApiCallable
} }
/** Gets the called API callable. */ /** Gets the called API callable. */
@@ -72,38 +75,47 @@ class ExternalAPIDataNode extends DataFlow::Node {
string getCallableDescription() { result = this.getCallable().getQualifiedName() } string getCallableDescription() { result = this.getCallable().getQualifiedName() }
} }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */ /** DEPRECATED: Alias for ExternalApiDataNode */
class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration { deprecated class ExternalAPIDataNode = ExternalApiDataNode;
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode } override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
} }
/** A node representing untrusted data being passed to an external API. */ /** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
class UntrustedExternalAPIDataNode extends ExternalAPIDataNode { deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;
private UntrustedDataToExternalAPIConfig c;
UntrustedExternalAPIDataNode() { c.hasFlow(_, this) } /** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
private UntrustedDataToExternalApiConfig c;
UntrustedExternalApiDataNode() { c.hasFlow(_, this) }
/** Gets a source of untrusted data which is passed to this external API data node. */ /** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { c.hasFlow(result, this) } DataFlow::Node getAnUntrustedSource() { c.hasFlow(result, this) }
} }
private newtype TExternalAPI = /** DEPRECATED: Alias for UntrustedExternalApiDataNode */
TExternalAPIParameter(Callable m, int index) { deprecated class UntrustedExternalAPIDataNode = UntrustedExternalApiDataNode;
exists(UntrustedExternalAPIDataNode n |
private newtype TExternalApi =
TExternalApiParameter(Callable m, int index) {
exists(UntrustedExternalApiDataNode n |
m = n.getCallable().getUnboundDeclaration() and m = n.getCallable().getUnboundDeclaration() and
index = n.getIndex() index = n.getIndex()
) )
} }
/** An external API which is used with untrusted data. */ /** An external API which is used with untrusted data. */
class ExternalAPIUsedWithUntrustedData extends TExternalAPI { class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a possibly untrusted use of this external API. */ /** Gets a possibly untrusted use of this external API. */
UntrustedExternalAPIDataNode getUntrustedDataNode() { UntrustedExternalApiDataNode getUntrustedDataNode() {
this = TExternalAPIParameter(result.getCallable().getUnboundDeclaration(), result.getIndex()) this = TExternalApiParameter(result.getCallable().getUnboundDeclaration(), result.getIndex())
} }
/** Gets the number of untrusted sources used with this external API. */ /** Gets the number of untrusted sources used with this external API. */
@@ -116,10 +128,13 @@ class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
exists(Callable m, int index, string indexString | exists(Callable m, int index, string indexString |
if index = -1 then indexString = "qualifier" else indexString = "param " + index if index = -1 then indexString = "qualifier" else indexString = "param " + index
| |
this = TExternalAPIParameter(m, index) and this = TExternalApiParameter(m, index) and
result = result =
m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes() + " [" + indexString + m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes() + " [" + indexString +
"]" "]"
) )
} }
} }
/** DEPRECATED: Alias for ExternalApiUsedWithUntrustedData */
deprecated class ExternalAPIUsedWithUntrustedData = ExternalApiUsedWithUntrustedData;

7
csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View File

@@ -117,12 +117,15 @@ class SearchRequestFilterSink extends Sink {
* *
* This will match the encoding methods provided by the AntiXSS library. * This will match the encoding methods provided by the AntiXSS library.
*/ */
class LDAPEncodeSanitizer extends Sanitizer { class LdapEncodeSanitizer extends Sanitizer {
LDAPEncodeSanitizer() { LdapEncodeSanitizer() {
this.getExpr().(MethodCall).getTarget().getName().regexpMatch("(?i)LDAP.*Encode.*") this.getExpr().(MethodCall).getTarget().getName().regexpMatch("(?i)LDAP.*Encode.*")
} }
} }
/** DEPRECATED: Alias for LdapEncodeSanitizer */
deprecated class LDAPEncodeSanitizer = LdapEncodeSanitizer;
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { } private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { } private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }

4
csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
View File

@@ -28,10 +28,10 @@ abstract class Sink extends DataFlow::ExprNode {
abstract string getReason(); abstract string getReason();
} }
private class InsecureXMLSink extends Sink { private class InsecureXmlSink extends Sink {
private string reason; private string reason;
InsecureXMLSink() { InsecureXmlSink() {
exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(reason) | exists(InsecureXML::InsecureXmlProcessing r | r.isUnsafe(reason) |
this.getExpr() = r.getAnArgument() this.getExpr() = r.getAnArgument()
) )

2
csharp/ql/src/Security Features/CWE-011/ASPNetDebug.ql
View File

@@ -17,7 +17,7 @@
import csharp import csharp
import semmle.code.asp.WebConfig import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute debugAttribute from SystemWebXmlElement web, XMLAttribute debugAttribute
where where
debugAttribute = web.getAChild("compilation").getAttribute("debug") and debugAttribute = web.getAChild("compilation").getAttribute("debug") and
not debugAttribute.getValue().toLowerCase() = "false" not debugAttribute.getValue().toLowerCase() = "false"

2
csharp/ql/src/Security Features/CWE-016/ASPNetMaxRequestLength.ql
View File

@@ -14,7 +14,7 @@
import csharp import csharp
import semmle.code.asp.WebConfig import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute maxReqLength from SystemWebXmlElement web, XMLAttribute maxReqLength
where where
maxReqLength = maxReqLength =
web.getAChild(any(string s | s.toLowerCase() = "httpruntime")) web.getAChild(any(string s | s.toLowerCase() = "httpruntime"))

2
csharp/ql/src/Security Features/CWE-016/ASPNetPagesValidateRequest.ql
View File

@@ -13,7 +13,7 @@
import csharp import csharp
import semmle.code.asp.WebConfig import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute requestvalidateAttribute from SystemWebXmlElement web, XMLAttribute requestvalidateAttribute
where where
requestvalidateAttribute = web.getAChild("pages").getAttribute("validateRequest") and requestvalidateAttribute = web.getAChild("pages").getAttribute("validateRequest") and
requestvalidateAttribute.getValue().toLowerCase() = "false" requestvalidateAttribute.getValue().toLowerCase() = "false"

6
csharp/ql/src/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql
View File

@@ -11,7 +11,7 @@
import csharp import csharp
import semmle.code.csharp.security.dataflow.ExternalAPIsQuery import semmle.code.csharp.security.dataflow.ExternalAPIsQuery
from ExternalAPIUsedWithUntrustedData externalAPI from ExternalApiUsedWithUntrustedData externalApi
select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses, select externalApi, count(externalApi.getUntrustedDataNode()) as numberOfUses,
externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by externalApi.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
numberOfUntrustedSources desc numberOfUntrustedSources desc

4
csharp/ql/src/Security Features/CWE-020/UntrustedDataToExternalAPI.ql
View File

@@ -14,8 +14,8 @@ import semmle.code.csharp.dataflow.TaintTracking
import semmle.code.csharp.security.dataflow.ExternalAPIsQuery import semmle.code.csharp.security.dataflow.ExternalAPIsQuery
import DataFlow::PathGraph import DataFlow::PathGraph
from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink from UntrustedDataToExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink) where config.hasFlowPath(source, sink)
select sink, source, sink, select sink, source, sink,
"Call to " + sink.getNode().(ExternalAPIDataNode).getCallableDescription() + "Call to " + sink.getNode().(ExternalApiDataNode).getCallableDescription() +
" with untrusted data from $@.", source, source.toString() " with untrusted data from $@.", source, source.toString()

2
csharp/ql/src/Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql
View File

@@ -24,7 +24,7 @@ class Application_Error extends Method {
} }
} }
from CustomErrorsXMLElement customError from CustomErrorsXmlElement customError
where where
// `<customErrors>` must be set to "off" to be dangerous // `<customErrors>` must be set to "off" to be dangerous
customError.getAttributeValue("mode").toLowerCase() = "off" and customError.getAttributeValue("mode").toLowerCase() = "off" and

4
csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql
View File

@@ -19,7 +19,7 @@ import semmle.code.csharp.frameworks.system.Web
/** /**
* Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header. * Holds if the `Web.config` file `webConfig` adds an `X-Frame-Options` header.
*/ */
predicate hasWebConfigXFrameOptions(WebConfigXML webConfig) { predicate hasWebConfigXFrameOptions(WebConfigXml webConfig) {
// Looking for an entry in `webConfig` that looks like this: // Looking for an entry in `webConfig` that looks like this:
// ```xml // ```xml
// <system.webServer> // <system.webServer>
@@ -52,7 +52,7 @@ predicate hasCodeXFrameOptions() {
) )
} }
from WebConfigXML webConfig from WebConfigXml webConfig
where where
not hasWebConfigXFrameOptions(webConfig) and not hasWebConfigXFrameOptions(webConfig) and
not hasCodeXFrameOptions() not hasCodeXFrameOptions()

2
csharp/ql/src/Security Features/CWE-548/ASPNetDirectoryListing.ql
View File

@@ -13,7 +13,7 @@
import csharp import csharp
import semmle.code.asp.WebConfig import semmle.code.asp.WebConfig
from SystemWebServerXMLElement ws, XMLAttribute a from SystemWebServerXmlElement ws, XMLAttribute a
where where
ws.getAChild("directoryBrowse").getAttribute("enabled") = a and ws.getAChild("directoryBrowse").getAttribute("enabled") = a and
a.getValue() = "true" a.getValue() = "true"

2
csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
View File

@@ -27,7 +27,7 @@ where
) )
or or
// header checking is disabled in a configuration file // header checking is disabled in a configuration file
exists(HttpRuntimeXMLElement e, XMLAttribute a | exists(HttpRuntimeXmlElement e, XMLAttribute a |
a = e.getAttribute("enableHeaderChecking") and a = e.getAttribute("enableHeaderChecking") and
a.getValue().toLowerCase() = "false" and a.getValue().toLowerCase() = "false" and
a = l a = l

Some files were not shown because too many files have changed in this diff Show More