mirror of
https://github.com/github/codeql.git
synced 2025-12-24 04:36:35 +01:00
Add ConditionalExpr.getBranchExpr(boolean)
This commit is contained in:
@@ -36,7 +36,7 @@ predicate usefulUpcast(CastExpr e) {
|
|||||||
)
|
)
|
||||||
or
|
or
|
||||||
// Upcasts that are performed on an operand of a ternary expression.
|
// Upcasts that are performed on an operand of a ternary expression.
|
||||||
exists(ConditionalExpr ce | e = ce.getTrueExpr() or e = ce.getFalseExpr())
|
exists(ConditionalExpr ce | e = ce.getBranchExpr(_))
|
||||||
or
|
or
|
||||||
// Upcasts to raw types.
|
// Upcasts to raw types.
|
||||||
e.getType() instanceof RawType
|
e.getType() instanceof RawType
|
||||||
|
|||||||
@@ -16,10 +16,7 @@ class CharType extends PrimitiveType {
|
|||||||
CharType() { this.hasName("char") }
|
CharType() { this.hasName("char") }
|
||||||
}
|
}
|
||||||
|
|
||||||
private Type getABranchType(ConditionalExpr ce) {
|
private Type getABranchType(ConditionalExpr ce) { result = ce.getBranchExpr(_).getType() }
|
||||||
result = ce.getTrueExpr().getType() or
|
|
||||||
result = ce.getFalseExpr().getType()
|
|
||||||
}
|
|
||||||
|
|
||||||
from ConditionalExpr ce
|
from ConditionalExpr ce
|
||||||
where
|
where
|
||||||
|
|||||||
@@ -11,7 +11,7 @@ private predicate flowsInto(Expr e, Variable v) {
|
|||||||
or
|
or
|
||||||
exists(CastExpr c | flowsInto(c, v) | e = c.getExpr())
|
exists(CastExpr c | flowsInto(c, v) | e = c.getExpr())
|
||||||
or
|
or
|
||||||
exists(ConditionalExpr c | flowsInto(c, v) | e = c.getTrueExpr() or e = c.getFalseExpr())
|
exists(ConditionalExpr c | flowsInto(c, v) | e = c.getBranchExpr(_))
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
@@ -148,9 +148,7 @@ predicate upcastToWiderType(Expr e) {
|
|||||||
or
|
or
|
||||||
exists(Parameter p | p.getAnArgument() = e and t2 = p.getType())
|
exists(Parameter p | p.getAnArgument() = e and t2 = p.getType())
|
||||||
or
|
or
|
||||||
exists(ConditionalExpr cond | cond.getTrueExpr() = e or cond.getFalseExpr() = e |
|
exists(ConditionalExpr cond | cond.getBranchExpr(_) | t2 = cond.getType())
|
||||||
t2 = cond.getType()
|
|
||||||
)
|
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -45,9 +45,7 @@ predicate unboxed(BoxedExpr e) {
|
|||||||
or
|
or
|
||||||
flowTarget(e).getType() instanceof PrimitiveType
|
flowTarget(e).getType() instanceof PrimitiveType
|
||||||
or
|
or
|
||||||
exists(ConditionalExpr cond | cond instanceof PrimitiveExpr |
|
exists(ConditionalExpr cond | cond instanceof PrimitiveExpr | cond.getBranchExpr(_) = e)
|
||||||
cond.getTrueExpr() = e or cond.getFalseExpr() = e
|
|
||||||
)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
@@ -293,7 +293,7 @@ private module ControlFlowGraphImpl {
|
|||||||
exists(ConditionalExpr condexpr |
|
exists(ConditionalExpr condexpr |
|
||||||
condexpr.getCondition() = b
|
condexpr.getCondition() = b
|
||||||
or
|
or
|
||||||
(condexpr.getTrueExpr() = b or condexpr.getFalseExpr() = b) and
|
condexpr.getBranchExpr(_) = b and
|
||||||
inBooleanContext(condexpr)
|
inBooleanContext(condexpr)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
@@ -706,8 +706,7 @@ private module ControlFlowGraphImpl {
|
|||||||
or
|
or
|
||||||
// The last node of a `ConditionalExpr` is in either of its branches.
|
// The last node of a `ConditionalExpr` is in either of its branches.
|
||||||
exists(ConditionalExpr condexpr | condexpr = n |
|
exists(ConditionalExpr condexpr | condexpr = n |
|
||||||
last(condexpr.getFalseExpr(), last, completion) or
|
last(condexpr.getBranchExpr(_), last, completion)
|
||||||
last(condexpr.getTrueExpr(), last, completion)
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(InstanceOfExpr ioe | ioe.isPattern() and ioe = n |
|
exists(InstanceOfExpr ioe | ioe.isPattern() and ioe = n |
|
||||||
@@ -915,14 +914,10 @@ private module ControlFlowGraphImpl {
|
|||||||
)
|
)
|
||||||
or
|
or
|
||||||
// Control flows to the corresponding branch depending on the boolean completion of the condition.
|
// Control flows to the corresponding branch depending on the boolean completion of the condition.
|
||||||
exists(ConditionalExpr e |
|
exists(ConditionalExpr e, boolean branch |
|
||||||
last(e.getCondition(), n, completion) and
|
last(e.getCondition(), n, completion) and
|
||||||
completion = BooleanCompletion(true, _) and
|
completion = BooleanCompletion(branch, _) and
|
||||||
result = first(e.getTrueExpr())
|
result = first(e.getBranchExpr(branch))
|
||||||
or
|
|
||||||
last(e.getCondition(), n, completion) and
|
|
||||||
completion = BooleanCompletion(false, _) and
|
|
||||||
result = first(e.getFalseExpr())
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(InstanceOfExpr ioe | ioe.isPattern() |
|
exists(InstanceOfExpr ioe | ioe.isPattern() |
|
||||||
|
|||||||
@@ -186,9 +186,7 @@ class CompileTimeConstantExpr extends Expr {
|
|||||||
ce = this and
|
ce = this and
|
||||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||||
|
|
|
|
||||||
if condition = true
|
result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getStringValue()
|
||||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getStringValue()
|
|
||||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getStringValue()
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(Variable v | this = v.getAnAccess() |
|
exists(Variable v | this = v.getAnAccess() |
|
||||||
@@ -297,9 +295,7 @@ class CompileTimeConstantExpr extends Expr {
|
|||||||
ce = this and
|
ce = this and
|
||||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||||
|
|
|
|
||||||
if condition = true
|
ce.getBranchExpr(condition).(CompileTimeConstantExpr).getBooleanValue()
|
||||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getBooleanValue()
|
|
||||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getBooleanValue()
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
// Simple or qualified names where the variable is final and the initializer is a constant.
|
// Simple or qualified names where the variable is final and the initializer is a constant.
|
||||||
@@ -382,9 +378,7 @@ class CompileTimeConstantExpr extends Expr {
|
|||||||
ce = this and
|
ce = this and
|
||||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||||
|
|
|
|
||||||
if condition = true
|
result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getIntValue()
|
||||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getIntValue()
|
|
||||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getIntValue()
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
// If a `Variable` is a `CompileTimeConstantExpr`, its value is its initializer.
|
// If a `Variable` is a `CompileTimeConstantExpr`, its value is its initializer.
|
||||||
@@ -1186,8 +1180,7 @@ class ChooseExpr extends Expr {
|
|||||||
|
|
||||||
/** Gets a result expression of this `switch` or conditional expression. */
|
/** Gets a result expression of this `switch` or conditional expression. */
|
||||||
Expr getAResultExpr() {
|
Expr getAResultExpr() {
|
||||||
result = this.(ConditionalExpr).getTrueExpr() or
|
result = this.(ConditionalExpr).getBranchExpr(_) or
|
||||||
result = this.(ConditionalExpr).getFalseExpr() or
|
|
||||||
result = this.(SwitchExpr).getAResult()
|
result = this.(SwitchExpr).getAResult()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -1213,6 +1206,15 @@ class ConditionalExpr extends Expr, @conditionalexpr {
|
|||||||
*/
|
*/
|
||||||
Expr getFalseExpr() { result.isNthChildOf(this, 2) }
|
Expr getFalseExpr() { result.isNthChildOf(this, 2) }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Gets the expression that is evaluated by the specific branch of this
|
||||||
|
* conditional expression. If `true` that is `getTrueExpr()`, if `false`
|
||||||
|
* it is `getFalseExpr()`.
|
||||||
|
*/
|
||||||
|
Expr getBranchExpr(boolean branch) {
|
||||||
|
if branch = true then result = getTrueExpr() else result = getFalseExpr()
|
||||||
|
}
|
||||||
|
|
||||||
/** Gets a printable representation of this expression. */
|
/** Gets a printable representation of this expression. */
|
||||||
override string toString() { result = "...?...:..." }
|
override string toString() { result = "...?...:..." }
|
||||||
|
|
||||||
|
|||||||
@@ -40,9 +40,7 @@ predicate implies_v1(Guard g1, boolean b1, Guard g2, boolean b2) {
|
|||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(ConditionalExpr cond, boolean branch, BooleanLiteral boollit, boolean boolval |
|
exists(ConditionalExpr cond, boolean branch, BooleanLiteral boollit, boolean boolval |
|
||||||
cond.getTrueExpr() = boollit and branch = true
|
cond.getBranchExpr(branch) = boollit
|
||||||
or
|
|
||||||
cond.getFalseExpr() = boollit and branch = false
|
|
||||||
|
|
|
|
||||||
cond = g1 and
|
cond = g1 and
|
||||||
boolval = boollit.getBooleanValue() and
|
boolval = boollit.getBooleanValue() and
|
||||||
@@ -50,9 +48,7 @@ predicate implies_v1(Guard g1, boolean b1, Guard g2, boolean b2) {
|
|||||||
(
|
(
|
||||||
g2 = cond.getCondition() and b2 = branch.booleanNot()
|
g2 = cond.getCondition() and b2 = branch.booleanNot()
|
||||||
or
|
or
|
||||||
g2 = cond.getTrueExpr() and b2 = b1
|
g2 = cond.getBranchExpr(_) and b2 = b1
|
||||||
or
|
|
||||||
g2 = cond.getFalseExpr() and b2 = b1
|
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
@@ -216,9 +212,7 @@ private predicate hasPossibleUnknownValue(SsaVariable v) {
|
|||||||
* `ConditionalExpr`s.
|
* `ConditionalExpr`s.
|
||||||
*/
|
*/
|
||||||
private Expr possibleValue(Expr e) {
|
private Expr possibleValue(Expr e) {
|
||||||
result = possibleValue(e.(ConditionalExpr).getTrueExpr())
|
result = possibleValue(e.(ConditionalExpr).getBranchExpr(_))
|
||||||
or
|
|
||||||
result = possibleValue(e.(ConditionalExpr).getFalseExpr())
|
|
||||||
or
|
or
|
||||||
result = e and not e instanceof ConditionalExpr
|
result = e and not e instanceof ConditionalExpr
|
||||||
}
|
}
|
||||||
@@ -316,9 +310,7 @@ private predicate conditionalAssign(SsaVariable v, Guard guard, boolean branch,
|
|||||||
v.(SsaExplicitUpdate).getDefiningExpr().(VariableAssign).getSource() = c and
|
v.(SsaExplicitUpdate).getDefiningExpr().(VariableAssign).getSource() = c and
|
||||||
guard = c.getCondition()
|
guard = c.getCondition()
|
||||||
|
|
|
|
||||||
branch = true and e = c.getTrueExpr()
|
e = c.getBranchExpr(branch)
|
||||||
or
|
|
||||||
branch = false and e = c.getFalseExpr()
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(SsaExplicitUpdate upd, SsaPhiNode phi |
|
exists(SsaExplicitUpdate upd, SsaPhiNode phi |
|
||||||
|
|||||||
@@ -268,9 +268,7 @@ predicate exprModulus(Expr e, Bound b, int val, int mod) {
|
|||||||
private predicate condExprBranchModulus(
|
private predicate condExprBranchModulus(
|
||||||
ConditionalExpr cond, boolean branch, Bound b, int val, int mod
|
ConditionalExpr cond, boolean branch, Bound b, int val, int mod
|
||||||
) {
|
) {
|
||||||
exprModulus(cond.getTrueExpr(), b, val, mod) and branch = true
|
exprModulus(cond.getBranchExpr(branch), b, val, mod)
|
||||||
or
|
|
||||||
exprModulus(cond.getFalseExpr(), b, val, mod) and branch = false
|
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate addModulus(Expr add, boolean isLeft, Bound b, int val, int mod) {
|
private predicate addModulus(Expr add, boolean isLeft, Bound b, int val, int mod) {
|
||||||
|
|||||||
@@ -438,13 +438,9 @@ private predicate varConditionallyNull(SsaExplicitUpdate v, ConditionBlock cond,
|
|||||||
v.getDefiningExpr().(VariableAssign).getSource() = condexpr and
|
v.getDefiningExpr().(VariableAssign).getSource() = condexpr and
|
||||||
condexpr.getCondition() = cond.getCondition()
|
condexpr.getCondition() = cond.getCondition()
|
||||||
|
|
|
|
||||||
condexpr.getTrueExpr() = nullExpr() and
|
condexpr.getBranchExpr(branch) = nullExpr() and
|
||||||
branch = true and
|
branch = true and
|
||||||
not condexpr.getFalseExpr() = nullExpr()
|
not condexpr.getBranchExpr(branch.booleanNot()) = nullExpr()
|
||||||
or
|
|
||||||
condexpr.getFalseExpr() = nullExpr() and
|
|
||||||
branch = false and
|
|
||||||
not condexpr.getTrueExpr() = nullExpr()
|
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
v.getDefiningExpr().(VariableAssign).getSource() = nullExpr() and
|
v.getDefiningExpr().(VariableAssign).getSource() = nullExpr() and
|
||||||
|
|||||||
@@ -874,7 +874,5 @@ private predicate boundedConditionalExpr(
|
|||||||
ConditionalExpr cond, Bound b, boolean upper, boolean branch, int delta, boolean fromBackEdge,
|
ConditionalExpr cond, Bound b, boolean upper, boolean branch, int delta, boolean fromBackEdge,
|
||||||
int origdelta, Reason reason
|
int origdelta, Reason reason
|
||||||
) {
|
) {
|
||||||
branch = true and bounded(cond.getTrueExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
|
bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
|
||||||
or
|
|
||||||
branch = false and bounded(cond.getFalseExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -27,10 +27,9 @@ private predicate nonNullSsaFwdStep(SsaVariable v, SsaVariable phi) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
private predicate nonNullDefStep(Expr e1, Expr e2) {
|
private predicate nonNullDefStep(Expr e1, Expr e2) {
|
||||||
exists(ConditionalExpr cond | cond = e2 |
|
exists(ConditionalExpr cond, boolean branch | cond = e2 |
|
||||||
cond.getTrueExpr() = e1 and cond.getFalseExpr() instanceof NullLiteral
|
cond.getBranchExpr(branch) = e1 and
|
||||||
or
|
cond.getBranchExpr(branch.booleanNot()) instanceof NullLiteral
|
||||||
cond.getFalseExpr() = e1 and cond.getTrueExpr() instanceof NullLiteral
|
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -7,10 +7,7 @@ import semmle.code.java.JDKAnnotations
|
|||||||
Expr valueFlow(Expr src) {
|
Expr valueFlow(Expr src) {
|
||||||
result = src
|
result = src
|
||||||
or
|
or
|
||||||
exists(ConditionalExpr c | result = c |
|
exists(ConditionalExpr c | result = c | src = c.getBranchExpr(_))
|
||||||
src = c.getTrueExpr() or
|
|
||||||
src = c.getFalseExpr()
|
|
||||||
)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
Reference in New Issue
Block a user