mirror of
https://github.com/github/codeql.git
synced 2025-12-24 04:36:35 +01:00
Add ConditionalExpr.getBranchExpr(boolean)
This commit is contained in:
@@ -36,7 +36,7 @@ predicate usefulUpcast(CastExpr e) {
|
||||
)
|
||||
or
|
||||
// Upcasts that are performed on an operand of a ternary expression.
|
||||
exists(ConditionalExpr ce | e = ce.getTrueExpr() or e = ce.getFalseExpr())
|
||||
exists(ConditionalExpr ce | e = ce.getBranchExpr(_))
|
||||
or
|
||||
// Upcasts to raw types.
|
||||
e.getType() instanceof RawType
|
||||
|
||||
@@ -16,10 +16,7 @@ class CharType extends PrimitiveType {
|
||||
CharType() { this.hasName("char") }
|
||||
}
|
||||
|
||||
private Type getABranchType(ConditionalExpr ce) {
|
||||
result = ce.getTrueExpr().getType() or
|
||||
result = ce.getFalseExpr().getType()
|
||||
}
|
||||
private Type getABranchType(ConditionalExpr ce) { result = ce.getBranchExpr(_).getType() }
|
||||
|
||||
from ConditionalExpr ce
|
||||
where
|
||||
|
||||
@@ -11,7 +11,7 @@ private predicate flowsInto(Expr e, Variable v) {
|
||||
or
|
||||
exists(CastExpr c | flowsInto(c, v) | e = c.getExpr())
|
||||
or
|
||||
exists(ConditionalExpr c | flowsInto(c, v) | e = c.getTrueExpr() or e = c.getFalseExpr())
|
||||
exists(ConditionalExpr c | flowsInto(c, v) | e = c.getBranchExpr(_))
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -148,9 +148,7 @@ predicate upcastToWiderType(Expr e) {
|
||||
or
|
||||
exists(Parameter p | p.getAnArgument() = e and t2 = p.getType())
|
||||
or
|
||||
exists(ConditionalExpr cond | cond.getTrueExpr() = e or cond.getFalseExpr() = e |
|
||||
t2 = cond.getType()
|
||||
)
|
||||
exists(ConditionalExpr cond | cond.getBranchExpr(_) | t2 = cond.getType())
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -45,9 +45,7 @@ predicate unboxed(BoxedExpr e) {
|
||||
or
|
||||
flowTarget(e).getType() instanceof PrimitiveType
|
||||
or
|
||||
exists(ConditionalExpr cond | cond instanceof PrimitiveExpr |
|
||||
cond.getTrueExpr() = e or cond.getFalseExpr() = e
|
||||
)
|
||||
exists(ConditionalExpr cond | cond instanceof PrimitiveExpr | cond.getBranchExpr(_) = e)
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -293,7 +293,7 @@ private module ControlFlowGraphImpl {
|
||||
exists(ConditionalExpr condexpr |
|
||||
condexpr.getCondition() = b
|
||||
or
|
||||
(condexpr.getTrueExpr() = b or condexpr.getFalseExpr() = b) and
|
||||
condexpr.getBranchExpr(_) = b and
|
||||
inBooleanContext(condexpr)
|
||||
)
|
||||
or
|
||||
@@ -706,8 +706,7 @@ private module ControlFlowGraphImpl {
|
||||
or
|
||||
// The last node of a `ConditionalExpr` is in either of its branches.
|
||||
exists(ConditionalExpr condexpr | condexpr = n |
|
||||
last(condexpr.getFalseExpr(), last, completion) or
|
||||
last(condexpr.getTrueExpr(), last, completion)
|
||||
last(condexpr.getBranchExpr(_), last, completion)
|
||||
)
|
||||
or
|
||||
exists(InstanceOfExpr ioe | ioe.isPattern() and ioe = n |
|
||||
@@ -915,14 +914,10 @@ private module ControlFlowGraphImpl {
|
||||
)
|
||||
or
|
||||
// Control flows to the corresponding branch depending on the boolean completion of the condition.
|
||||
exists(ConditionalExpr e |
|
||||
exists(ConditionalExpr e, boolean branch |
|
||||
last(e.getCondition(), n, completion) and
|
||||
completion = BooleanCompletion(true, _) and
|
||||
result = first(e.getTrueExpr())
|
||||
or
|
||||
last(e.getCondition(), n, completion) and
|
||||
completion = BooleanCompletion(false, _) and
|
||||
result = first(e.getFalseExpr())
|
||||
completion = BooleanCompletion(branch, _) and
|
||||
result = first(e.getBranchExpr(branch))
|
||||
)
|
||||
or
|
||||
exists(InstanceOfExpr ioe | ioe.isPattern() |
|
||||
|
||||
@@ -186,9 +186,7 @@ class CompileTimeConstantExpr extends Expr {
|
||||
ce = this and
|
||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||
|
|
||||
if condition = true
|
||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getStringValue()
|
||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getStringValue()
|
||||
result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getStringValue()
|
||||
)
|
||||
or
|
||||
exists(Variable v | this = v.getAnAccess() |
|
||||
@@ -297,9 +295,7 @@ class CompileTimeConstantExpr extends Expr {
|
||||
ce = this and
|
||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||
|
|
||||
if condition = true
|
||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getBooleanValue()
|
||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getBooleanValue()
|
||||
ce.getBranchExpr(condition).(CompileTimeConstantExpr).getBooleanValue()
|
||||
)
|
||||
or
|
||||
// Simple or qualified names where the variable is final and the initializer is a constant.
|
||||
@@ -382,9 +378,7 @@ class CompileTimeConstantExpr extends Expr {
|
||||
ce = this and
|
||||
condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
|
||||
|
|
||||
if condition = true
|
||||
then result = ce.getTrueExpr().(CompileTimeConstantExpr).getIntValue()
|
||||
else result = ce.getFalseExpr().(CompileTimeConstantExpr).getIntValue()
|
||||
result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getIntValue()
|
||||
)
|
||||
or
|
||||
// If a `Variable` is a `CompileTimeConstantExpr`, its value is its initializer.
|
||||
@@ -1186,8 +1180,7 @@ class ChooseExpr extends Expr {
|
||||
|
||||
/** Gets a result expression of this `switch` or conditional expression. */
|
||||
Expr getAResultExpr() {
|
||||
result = this.(ConditionalExpr).getTrueExpr() or
|
||||
result = this.(ConditionalExpr).getFalseExpr() or
|
||||
result = this.(ConditionalExpr).getBranchExpr(_) or
|
||||
result = this.(SwitchExpr).getAResult()
|
||||
}
|
||||
}
|
||||
@@ -1213,6 +1206,15 @@ class ConditionalExpr extends Expr, @conditionalexpr {
|
||||
*/
|
||||
Expr getFalseExpr() { result.isNthChildOf(this, 2) }
|
||||
|
||||
/**
|
||||
* Gets the expression that is evaluated by the specific branch of this
|
||||
* conditional expression. If `true` that is `getTrueExpr()`, if `false`
|
||||
* it is `getFalseExpr()`.
|
||||
*/
|
||||
Expr getBranchExpr(boolean branch) {
|
||||
if branch = true then result = getTrueExpr() else result = getFalseExpr()
|
||||
}
|
||||
|
||||
/** Gets a printable representation of this expression. */
|
||||
override string toString() { result = "...?...:..." }
|
||||
|
||||
|
||||
@@ -40,9 +40,7 @@ predicate implies_v1(Guard g1, boolean b1, Guard g2, boolean b2) {
|
||||
)
|
||||
or
|
||||
exists(ConditionalExpr cond, boolean branch, BooleanLiteral boollit, boolean boolval |
|
||||
cond.getTrueExpr() = boollit and branch = true
|
||||
or
|
||||
cond.getFalseExpr() = boollit and branch = false
|
||||
cond.getBranchExpr(branch) = boollit
|
||||
|
|
||||
cond = g1 and
|
||||
boolval = boollit.getBooleanValue() and
|
||||
@@ -50,9 +48,7 @@ predicate implies_v1(Guard g1, boolean b1, Guard g2, boolean b2) {
|
||||
(
|
||||
g2 = cond.getCondition() and b2 = branch.booleanNot()
|
||||
or
|
||||
g2 = cond.getTrueExpr() and b2 = b1
|
||||
or
|
||||
g2 = cond.getFalseExpr() and b2 = b1
|
||||
g2 = cond.getBranchExpr(_) and b2 = b1
|
||||
)
|
||||
)
|
||||
or
|
||||
@@ -216,9 +212,7 @@ private predicate hasPossibleUnknownValue(SsaVariable v) {
|
||||
* `ConditionalExpr`s.
|
||||
*/
|
||||
private Expr possibleValue(Expr e) {
|
||||
result = possibleValue(e.(ConditionalExpr).getTrueExpr())
|
||||
or
|
||||
result = possibleValue(e.(ConditionalExpr).getFalseExpr())
|
||||
result = possibleValue(e.(ConditionalExpr).getBranchExpr(_))
|
||||
or
|
||||
result = e and not e instanceof ConditionalExpr
|
||||
}
|
||||
@@ -316,9 +310,7 @@ private predicate conditionalAssign(SsaVariable v, Guard guard, boolean branch,
|
||||
v.(SsaExplicitUpdate).getDefiningExpr().(VariableAssign).getSource() = c and
|
||||
guard = c.getCondition()
|
||||
|
|
||||
branch = true and e = c.getTrueExpr()
|
||||
or
|
||||
branch = false and e = c.getFalseExpr()
|
||||
e = c.getBranchExpr(branch)
|
||||
)
|
||||
or
|
||||
exists(SsaExplicitUpdate upd, SsaPhiNode phi |
|
||||
|
||||
@@ -268,9 +268,7 @@ predicate exprModulus(Expr e, Bound b, int val, int mod) {
|
||||
private predicate condExprBranchModulus(
|
||||
ConditionalExpr cond, boolean branch, Bound b, int val, int mod
|
||||
) {
|
||||
exprModulus(cond.getTrueExpr(), b, val, mod) and branch = true
|
||||
or
|
||||
exprModulus(cond.getFalseExpr(), b, val, mod) and branch = false
|
||||
exprModulus(cond.getBranchExpr(branch), b, val, mod)
|
||||
}
|
||||
|
||||
private predicate addModulus(Expr add, boolean isLeft, Bound b, int val, int mod) {
|
||||
|
||||
@@ -438,13 +438,9 @@ private predicate varConditionallyNull(SsaExplicitUpdate v, ConditionBlock cond,
|
||||
v.getDefiningExpr().(VariableAssign).getSource() = condexpr and
|
||||
condexpr.getCondition() = cond.getCondition()
|
||||
|
|
||||
condexpr.getTrueExpr() = nullExpr() and
|
||||
condexpr.getBranchExpr(branch) = nullExpr() and
|
||||
branch = true and
|
||||
not condexpr.getFalseExpr() = nullExpr()
|
||||
or
|
||||
condexpr.getFalseExpr() = nullExpr() and
|
||||
branch = false and
|
||||
not condexpr.getTrueExpr() = nullExpr()
|
||||
not condexpr.getBranchExpr(branch.booleanNot()) = nullExpr()
|
||||
)
|
||||
or
|
||||
v.getDefiningExpr().(VariableAssign).getSource() = nullExpr() and
|
||||
|
||||
@@ -874,7 +874,5 @@ private predicate boundedConditionalExpr(
|
||||
ConditionalExpr cond, Bound b, boolean upper, boolean branch, int delta, boolean fromBackEdge,
|
||||
int origdelta, Reason reason
|
||||
) {
|
||||
branch = true and bounded(cond.getTrueExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
|
||||
or
|
||||
branch = false and bounded(cond.getFalseExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
|
||||
bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
|
||||
}
|
||||
|
||||
@@ -27,10 +27,9 @@ private predicate nonNullSsaFwdStep(SsaVariable v, SsaVariable phi) {
|
||||
}
|
||||
|
||||
private predicate nonNullDefStep(Expr e1, Expr e2) {
|
||||
exists(ConditionalExpr cond | cond = e2 |
|
||||
cond.getTrueExpr() = e1 and cond.getFalseExpr() instanceof NullLiteral
|
||||
or
|
||||
cond.getFalseExpr() = e1 and cond.getTrueExpr() instanceof NullLiteral
|
||||
exists(ConditionalExpr cond, boolean branch | cond = e2 |
|
||||
cond.getBranchExpr(branch) = e1 and
|
||||
cond.getBranchExpr(branch.booleanNot()) instanceof NullLiteral
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -7,10 +7,7 @@ import semmle.code.java.JDKAnnotations
|
||||
Expr valueFlow(Expr src) {
|
||||
result = src
|
||||
or
|
||||
exists(ConditionalExpr c | result = c |
|
||||
src = c.getTrueExpr() or
|
||||
src = c.getFalseExpr()
|
||||
)
|
||||
exists(ConditionalExpr c | result = c | src = c.getBranchExpr(_))
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user