Shared, rust: Add option to disable reads steps as taint steps in model generator

This commit is contained in:
Simon Friis Vindum
2026-01-12 10:21:27 +01:00
parent 9cdf63e175
commit 8bfce6b284
2 changed files with 6 additions and 0 deletions

View File

@@ -113,6 +113,8 @@ module ModelGeneratorCommonInput implements
c.(SingletonContentSet).getContent() instanceof ElementContent
}
predicate applyReadStepsAsTaintSteps() { none() }
string partialModelRow(Callable api, int i) { i = 0 and result = api.getCanonicalPath() }
string partialNeutralModelRow(Callable api, int i) { result = partialModelRow(api, i) }

View File

@@ -115,6 +115,9 @@ signature module ModelGeneratorCommonInputSig<LocationSig Location, InputSig<Loc
*/
predicate containerContent(Lang::ContentSet c);
/** Holds if read steps should heuristically be applied as taint steps. */
default predicate applyReadStepsAsTaintSteps() { any() }
/**
* Gets the parameter position of the return kind, if any.
*/
@@ -1061,6 +1064,7 @@ module MakeModelGeneratorFactory<
private predicate isRelevantTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(DataFlow::ContentSet f |
DataFlow::readStep(node1, f, node2) and
applyReadStepsAsTaintSteps() and
// Partially restrict the content types used for intermediate steps.
(not exists(getUnderlyingContentType(f)) or isRelevantTypeInContent(f))
)