Revert "C++: Remove the problematic taint tracking rule. It seems like we get the flows from dataflow already now."

This reverts commit 78b24b76a0.
This commit is contained in:
Mathias Vorreiter Pedersen
2020-09-16 14:25:42 +02:00
parent 0b97a4a182
commit 92d81edae6

View File

@@ -257,6 +257,15 @@ private predicate instructionTaintStep(Instruction i1, Instruction i2) {
i2.(ChiInstruction).getPartial() = i1.(WriteSideEffectInstruction) and
not i2.isResultConflated()
or
// Flow from an element to an array or union that contains it.
i2.(ChiInstruction).getPartial() = i1 and
not i2.isResultConflated() and
exists(Type t | i2.getResultLanguageType().hasType(t, false) |
t instanceof Union
or
t instanceof ArrayType
)
or
exists(BinaryInstruction bin |
bin = i2 and
predictableInstruction(i2.getAnOperand().getDef()) and