hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add a model for 'partial updating' and extend models appropriately.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2024-02-15 10:25:17 +01:00
parent 24a63ae94d
commit 7e9bf2a880
15 changed files with 118 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -6490,6 +6490,7 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
| taint.cpp:607:10:607:16 | call to _strinc | taint.cpp:609:8:609:12 | dest1 | |
| taint.cpp:607:18:607:23 | source | taint.cpp:607:10:607:16 | call to _strinc | TAINT |
| taint.cpp:607:26:607:31 | locale | taint.cpp:607:10:607:16 | call to _strinc | TAINT |
| taint.cpp:607:26:607:31 | locale | taint.cpp:607:26:607:31 | ref arg locale | TAINT |
| taint.cpp:607:26:607:31 | ref arg locale | taint.cpp:606:82:606:87 | locale | |
| taint.cpp:607:26:607:31 | ref arg locale | taint.cpp:611:25:611:30 | locale | |
| taint.cpp:608:7:608:11 | ref arg dest1 | taint.cpp:606:52:606:56 | dest1 | |
@@ -6501,6 +6502,7 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
| taint.cpp:611:10:611:16 | call to _strinc | taint.cpp:613:8:613:12 | dest2 | |
| taint.cpp:611:18:611:22 | clean | taint.cpp:611:10:611:16 | call to _strinc | TAINT |
| taint.cpp:611:25:611:30 | locale | taint.cpp:611:10:611:16 | call to _strinc | TAINT |
| taint.cpp:611:25:611:30 | locale | taint.cpp:611:25:611:30 | ref arg locale | TAINT |
| taint.cpp:611:25:611:30 | ref arg locale | taint.cpp:606:82:606:87 | locale | |
| taint.cpp:612:7:612:11 | ref arg dest2 | taint.cpp:606:65:606:69 | dest2 | |
| taint.cpp:612:7:612:11 | ref arg dest2 | taint.cpp:613:8:613:12 | dest2 | |

28
cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
View File

@@ -179,11 +179,11 @@ void test_map()
m14.insert(std::make_pair("b", source()));
m14.insert(std::make_pair("c", source()));
m14.insert(std::make_pair("d", "d"));
sink(m14.lower_bound("b")); // $ ast=179:33 ast=180:33 MISSING: ir=179:33 ir=180:33
sink(m14.upper_bound("b")); // $ ast=179:33 ast=180:33 MISSING: ir=179:33 ir=180:33
sink(m14.lower_bound("b")); // $ ast,ir=179:33 ast,ir=180:33
sink(m14.upper_bound("b")); // $ ast,ir=179:33 ast,ir=180:33
sink(m14.equal_range("b").first); // $ MISSING: ast,ir
sink(m14.equal_range("b").second); // $ MISSING: ast,ir
sink(m14.upper_bound("c")); // $ SPURIOUS: ast=179:33 ast=180:33
sink(m14.upper_bound("c")); // $ SPURIOUS: ast,ir=179:33 ast,ir=180:33
sink(m14.equal_range("c").second);
// swap
@@ -213,7 +213,7 @@ void test_map()
sink(m22); // $ ast,ir
m19.merge(m20);
m21.merge(m22);
sink(m19); // $ ast
sink(m19); // $ ast,ir
sink(m20);
sink(m21); // $ ast,ir
sink(m22); // $ ast,ir
@@ -222,11 +222,11 @@ void test_map()
std::map<char *, char *> m23;
m23.insert(std::pair<char *, char *>(source(), source()));
m23.insert(std::pair<char *, char *>(source(), source()));
sink(m23); // $ ast=223:49 ast=224:49 ir MISSING: ir=223:49 ir=224:49
sink(m23.erase(m23.begin())); // $ ast=223:49 ast=224:49 ir MISSING: ir=223:49 ir=224:49
sink(m23); // $ ast=223:49 ast=224:49 ir MISSING: ir=223:49 ir=224:49
sink(m23); // $ ast,ir=223:49 ast,ir=224:49
sink(m23.erase(m23.begin())); // $ ast,ir=223:49 ast,ir=224:49
sink(m23); // $ ast,ir=223:49 ast,ir=224:49
m23.clear();
sink(m23); // $ SPURIOUS: ast=223:49 ast=224:49 ir
sink(m23); // $ SPURIOUS: ast,ir=223:49 ast,ir=224:49
// emplace, emplace_hint
std::map<char *, char *> m24, m25;
@@ -362,7 +362,7 @@ void test_unordered_map()
sink(m22); // $ ast,ir
m19.merge(m20);
m21.merge(m22);
sink(m19); // $ ast MISSING: ir
sink(m19); // $ ast,ir
sink(m20);
sink(m21); // $ ast,ir
sink(m22); // $ ast,ir
@@ -371,11 +371,11 @@ void test_unordered_map()
std::unordered_map<char *, char *> m23;
m23.insert(std::pair<char *, char *>(source(), source()));
m23.insert(std::pair<char *, char *>(source(), source()));
sink(m23); // $ ast=372:49 ast=373:49 ir MISSING: ir=372:49 ir=373:49
sink(m23.erase(m23.begin())); // $ ast=372:49 ast=373:49 ir MISSING: ir=372:49 ir=373:49
sink(m23); // $ ast=372:49 ast=373:49 ir MISSING: ir=372:49 ir=373:49
sink(m23); // $ ast,ir=372:49 ast,ir=373:49
sink(m23.erase(m23.begin())); // $ ast,ir=372:49 ast,ir=373:49
sink(m23); // $ ast,ir=372:49 ast,ir=373:49
m23.clear();
sink(m23); // $ SPURIOUS: ast=372:49 ast=373:49 ir
sink(m23); // $ SPURIOUS: ast,ir=372:49 ast,ir=373:49
// emplace, emplace_hint
std::unordered_map<char *, char *> m24, m25;
@@ -395,7 +395,7 @@ void test_unordered_map()
sink(m26);
sink(m26.try_emplace("abc", source()).first);
sink(m26.try_emplace("abc", source()).second); // $ MISSING: ast,ir=396:30
sink(m26); // $ ast=396:30 ir MISSING: ir=396:30 SPURIOUS: ast=397:30
sink(m26); // $ ast,ir=396:30 SPURIOUS: ast,ir=397:30
sink(m27.try_emplace(m27.begin(), "abc", "def"));
sink(m27);
sink(m27.try_emplace(m27.begin(), "abc", source())); // $ ast,ir

24
cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp
View File

@@ -66,8 +66,8 @@ void test_set()
s11.insert("a");
s11.insert(source());
s11.insert("c");
sink(s11.lower_bound("b")); // $ ast MISSING: ir
sink(s11.upper_bound("b")); // $ ast MISSING: ir
sink(s11.lower_bound("b")); // $ ast,ir
sink(s11.upper_bound("b")); // $ ast,ir
sink(s11.equal_range("b").first); // $ MISSING: ast,ir
sink(s11.equal_range("b").second); // $ MISSING: ast,ir
@@ -98,7 +98,7 @@ void test_set()
sink(s19); // $ ast,ir
s16.merge(s17);
s18.merge(s19);
sink(s16); // $ ast MISSING: ir
sink(s16); // $ ast,ir
sink(s17);
sink(s18); // $ ast,ir
sink(s19); // $ ast,ir
@@ -107,11 +107,11 @@ void test_set()
std::set<char *> s20;
s20.insert(source());
s20.insert(source());
sink(s20); // $ ast=108:13 ast=109:13 ir MISSING: ir=108:13 ir=109:13
sink(s20.erase(s20.begin())); // $ ast=108:13 ast=109:13 ir MISSING: ir=108:13 ir=109:13
sink(s20); // $ ir ast=108:13 ast=109:13 MISSING: ir=108:13 ir=109:13
sink(s20); // $ ast,ir=108:13 ast,ir=109:13
sink(s20.erase(s20.begin())); // $ ast,ir=108:13 ast,ir=109:13
sink(s20); // $ ast,ir=108:13 ast,ir=109:13
s20.clear();
sink(s20); // $ SPURIOUS: ir ast=108:13 ast=109:13
sink(s20); // $ SPURIOUS: ast,ir=108:13 ast,ir=109:13
// emplace, emplace_hint
std::set<char *> s21, s22;
@@ -210,7 +210,7 @@ void test_unordered_set()
sink(s19); // $ ast,ir
s16.merge(s17);
s18.merge(s19);
sink(s16); // $ ast MISSING: ir
sink(s16); // $ ast,ir
sink(s17);
sink(s18); // $ ast,ir
sink(s19); // $ ast,ir
@@ -219,11 +219,11 @@ void test_unordered_set()
std::unordered_set<char *> s20;
s20.insert(source());
s20.insert(source());
sink(s20); // $ ir ast=220:13 ast=221:13 MISSING: ir=220:13 ir=221:13
sink(s20.erase(s20.begin())); // $ ast=220:13 ast=221:13 ir MISSING: ir=220:13 ir=221:13
sink(s20); // $ ast=220:13 ast=221:13 ir MISSING: ir=220:13 ir=221:13
sink(s20); // $ ast,ir=220:13 ast,ir=221:13
sink(s20.erase(s20.begin())); // $ ast,ir=220:13 ast,ir=221:13
sink(s20); // $ ast,ir=220:13 ast,ir=221:13
s20.clear();
sink(s20); // $ SPURIOUS: ast=220:13 ast=221:13 ir
sink(s20); // $ SPURIOUS: ast,ir=220:13 ast,ir=221:13
// emplace, emplace_hint
std::unordered_set<char *> s21, s22;