hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Data flow: Block flow at expectsContents nodes in parameterValueFlow

Browse Source
This commit is contained in:
Tom Hvitved
2024-04-03 14:54:36 +02:00
parent 137594cf36
commit 7871fb8ce6
2 changed files with 31 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ruby/ql/test/library-tests/dataflow/regressions/Regressions.expected
View File

@@ -1 +0,0 @@
| regressions.rb:2:1:2:9 | [post] call to reverse | regressions.rb:3:6:3:6 | x |

59
shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
View File

@@ -863,34 +863,37 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
*/
pragma[nomagic]
private predicate parameterValueFlowCand(ParamNode p, Node node, boolean read) {
p = node and
read = false
or
// local flow
exists(Node mid |
parameterValueFlowCand(p, mid, read) and
simpleLocalFlowStep(mid, node) and
validParameterAliasStep(mid, node)
)
or
// read
exists(Node mid |
parameterValueFlowCand(p, mid, false) and
readSet(mid, _, node) and
read = true
)
or
// flow through: no prior read
exists(ArgNode arg |
parameterValueFlowArgCand(p, arg, false) and
argumentValueFlowsThroughCand(arg, node, read)
)
or
// flow through: no read inside method
exists(ArgNode arg |
parameterValueFlowArgCand(p, arg, read) and
argumentValueFlowsThroughCand(arg, node, false)
)
(
p = node and
read = false
or
// local flow
exists(Node mid |
parameterValueFlowCand(p, mid, read) and
simpleLocalFlowStep(mid, node) and
validParameterAliasStep(mid, node)
)
or
// read
exists(Node mid |
parameterValueFlowCand(p, mid, false) and
readSet(mid, _, node) and
read = true
)
or
// flow through: no prior read
exists(ArgNode arg |
parameterValueFlowArgCand(p, arg, false) and
argumentValueFlowsThroughCand(arg, node, read)
)
or
// flow through: no read inside method
exists(ArgNode arg |
parameterValueFlowArgCand(p, arg, read) and
argumentValueFlowsThroughCand(arg, node, false)
)
) and
not expectsContentCached(node, _)
}
pragma[nomagic]