hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Type-based pruning for data flow

Browse Source
This commit is contained in:
Tom Hvitved
2019-11-25 12:04:47 +01:00
committed by Tom Hvitved
parent 54088248a1
commit abcb6b8aab
11 changed files with 749 additions and 1063 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
View File

@@ -7,6 +7,7 @@ private import DataFlowImplCommon::Public
private import ControlFlowReachability
private import DelegateDataFlow
private import semmle.code.csharp.Caching
private import semmle.code.csharp.Conversion
private import semmle.code.csharp.ExprOrStmtParent
private import semmle.code.csharp.Unification
private import semmle.code.csharp.controlflow.Guards
@@ -325,6 +326,23 @@ private Type getCSharpType(DotNet::Type t) {
result.matchesHandle(t)
}
pragma[noinline]
private TypeParameter getATypeParameterSubType(DataFlowType t) {
not t instanceof Gvn::TypeParameterGvnType and
exists(Type t0 | t = Gvn::getGlobalValueNumber(t0) | implicitConversionRestricted(result, t0))
}
pragma[noinline]
private DataFlowType getANonTypeParameterSubType(DataFlowType t) {
not t instanceof Gvn::TypeParameterGvnType and
not result instanceof Gvn::TypeParameterGvnType and
exists(Type t1, Type t2 |
implicitConversionRestricted(t1, t2) and
result = Gvn::getGlobalValueNumber(t1) and
t = Gvn::getGlobalValueNumber(t2)
)
}
/** A collection of cached types and predicates to be evaluated in the same stage. */
cached
private module Cached {
@@ -486,6 +504,28 @@ private module Cached {
t0 instanceof ObjectType
)
}
/**
* Holds if GVNs `t1` and `t2` may have a common sub type. Neither `t1` nor
* `t2` are allowed to be type parameters.
*/
cached
predicate commonSubType(DataFlowType t1, DataFlowType t2) {
not t1 instanceof Gvn::TypeParameterGvnType and
t1 = t2
or
getATypeParameterSubType(t1) = getATypeParameterSubType(t2)
or
getANonTypeParameterSubType(t1) = getANonTypeParameterSubType(t2)
}
cached
predicate commonSubTypeUnifiableLeft(DataFlowType t1, DataFlowType t2) {
exists(DataFlowType t |
Gvn::unifiable(t1, t) and
commonSubType(t, t2)
)
}
}
import Cached
@@ -596,7 +636,11 @@ private module ParameterNodes {
result = this.getUnderlyingNode().getEnclosingCallable()
}
override Type getType() { result = this.getUnderlyingNode().getType() }
override Type getType() {
// Taint tracking steps are allowed to change the type of the tracked object,
// so `result = this.getUnderlyingNode().getType()` is too restrictive
result instanceof ObjectType
}
override Location getLocation() { result = this.getUnderlyingNode().getLocation() }
@@ -939,7 +983,9 @@ private module ReturnNodes {
result = this.getUnderlyingNode().getEnclosingCallable()
}
override Type getType() { result = this.getUnderlyingNode().getType() }
override Type getType() {
result = this.getUnderlyingNode().getEnclosingCallable().getReturnType()
}
override Location getLocation() { result = this.getUnderlyingNode().getLocation() }
@@ -1130,7 +1176,11 @@ private module OutNodes {
override Callable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
override Type getType() { result = cfn.getElement().(Expr).getType() }
override Type getType() {
exists(ImplicitDelegateDataFlowCall c | c.getNode() = this |
result = c.getDelegateReturnType()
)
}
override Location getLocation() { result = cfn.getLocation() }
@@ -1329,15 +1379,34 @@ predicate readStep = readStepImpl/3;
/** Gets a string representation of a type returned by `getErasedRepr`. */
string ppReprType(DataFlowType t) { result = t.toString() }
private class DataFlowNullType extends DataFlowType {
DataFlowNullType() { this = Gvn::getGlobalValueNumber(any(NullType nt)) }
pragma[noinline]
predicate isConvertibleTo(DataFlowType t) {
defaultNullConversion(_, any(Type t0 | t = Gvn::getGlobalValueNumber(t0)))
}
}
/**
* Holds if `t1` and `t2` are compatible, that is, whether data can flow from
* a node of type `t1` to a node of type `t2`.
*
* Type-based pruning is disabled for now, so this is a stub implementation.
*/
bindingset[t1, t2]
pragma[inline]
predicate compatibleTypes(DataFlowType t1, DataFlowType t2) {
any() // stub implementation
commonSubType(t1, t2)
or
commonSubTypeUnifiableLeft(t1, t2)
or
commonSubTypeUnifiableLeft(t2, t1)
or
t1.(DataFlowNullType).isConvertibleTo(t2)
or
t2.(DataFlowNullType).isConvertibleTo(t1)
or
t1 instanceof Gvn::TypeParameterGvnType
or
t2 instanceof Gvn::TypeParameterGvnType
}
/**
@@ -1384,8 +1453,19 @@ private module PostUpdateNodes {
private import PostUpdateNodes
/** A node that performs a type cast. */
class CastNode extends ExprNode {
CastNode() { this.getExpr() instanceof CastExpr }
class CastNode extends Node {
CastNode() {
this.asExpr() instanceof Cast
or
exists(Ssa::ExplicitDefinition def |
def = this.(SsaDefinitionNode).getDefinition() and
def.getADefinition() instanceof AssignableDefinitions::PatternDefinition
)
or
readStep(_, _, this)
or
storeStep(this, _, _)
}
}
class DataFlowExpr = DotNet::Expr;

2
csharp/ql/test/library-tests/dataflow/fields/A.cs
View File

@@ -74,7 +74,7 @@ public class A
}
if (cc is C1)
{
Sink(((C1)cc).a); // no flow, stopped by cast to C2 (FALSE POSITIVE, no type pruning yet)
Sink(((C1)cc).a); // no flow, stopped by cast to C2
}
}

9
csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
View File

@@ -19,10 +19,7 @@ edges
| A.cs:57:16:57:16 | access to local variable a : A | A.cs:57:9:57:10 | [post] access to local variable c1 [a] : A |
| A.cs:58:12:58:13 | access to local variable c1 [a] : A | A.cs:60:22:60:22 | c [a] : A |
| A.cs:60:22:60:22 | c [a] : A | A.cs:64:19:64:23 | (...) ... [a] : A |
| A.cs:60:22:60:22 | c [a] : A | A.cs:69:18:69:22 | (...) ... [a] : A |
| A.cs:64:19:64:23 | (...) ... [a] : A | A.cs:64:18:64:26 | access to field a |
| A.cs:69:18:69:22 | (...) ... [a] : A | A.cs:77:19:77:24 | (...) ... [a] : A |
| A.cs:77:19:77:24 | (...) ... [a] : A | A.cs:77:18:77:27 | access to field a |
| A.cs:83:9:83:9 | [post] access to parameter b [c] : C | A.cs:88:12:88:12 | [post] access to local variable b [c] : C |
| A.cs:83:15:83:21 | object creation of type C : C | A.cs:83:9:83:9 | [post] access to parameter b [c] : C |
| A.cs:88:12:88:12 | [post] access to local variable b [c] : C | A.cs:89:14:89:14 | access to local variable b [c] : C |
@@ -131,7 +128,6 @@ edges
| F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:11:24:11:24 | access to local variable o : Object |
| F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:15:26:15:26 | access to local variable o : Object |
| F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:19:32:19:32 | access to local variable o : Object |
| F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:23:32:23:32 | access to local variable o : Object |
| F.cs:11:17:11:31 | call to method Create [Field1] : Object | F.cs:12:14:12:14 | access to local variable f [Field1] : Object |
| F.cs:11:24:11:24 | access to local variable o : Object | F.cs:11:17:11:31 | call to method Create [Field1] : Object |
| F.cs:12:14:12:14 | access to local variable f [Field1] : Object | F.cs:12:14:12:21 | access to field Field1 |
@@ -140,6 +136,7 @@ edges
| F.cs:17:14:17:14 | access to local variable f [Field2] : Object | F.cs:17:14:17:21 | access to field Field2 |
| F.cs:19:13:19:34 | object creation of type F [Field1] : Object | F.cs:20:14:20:14 | access to local variable f [Field1] : Object |
| F.cs:19:32:19:32 | access to local variable o : Object | F.cs:19:13:19:34 | object creation of type F [Field1] : Object |
| F.cs:19:32:19:32 | access to local variable o : Object | F.cs:23:32:23:32 | access to local variable o : Object |
| F.cs:20:14:20:14 | access to local variable f [Field1] : Object | F.cs:20:14:20:21 | access to field Field1 |
| F.cs:23:13:23:34 | object creation of type F [Field2] : Object | F.cs:25:14:25:14 | access to local variable f [Field2] : Object |
| F.cs:23:32:23:32 | access to local variable o : Object | F.cs:23:13:23:34 | object creation of type F [Field2] : Object |
@@ -205,9 +202,6 @@ nodes
| A.cs:60:22:60:22 | c [a] : A | semmle.label | c [a] : A |
| A.cs:64:18:64:26 | access to field a | semmle.label | access to field a |
| A.cs:64:19:64:23 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
| A.cs:69:18:69:22 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
| A.cs:77:18:77:27 | access to field a | semmle.label | access to field a |
| A.cs:77:19:77:24 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
| A.cs:83:9:83:9 | [post] access to parameter b [c] : C | semmle.label | [post] access to parameter b [c] : C |
| A.cs:83:15:83:21 | object creation of type C : C | semmle.label | object creation of type C : C |
| A.cs:88:12:88:12 | [post] access to local variable b [c] : C | semmle.label | [post] access to local variable b [c] : C |
@@ -384,7 +378,6 @@ nodes
| A.cs:24:14:24:17 | access to field c | A.cs:22:25:22:32 | object creation of type C2 : C2 | A.cs:24:14:24:17 | access to field c | $@ | A.cs:22:25:22:32 | object creation of type C2 : C2 | object creation of type C2 : C2 |
| A.cs:33:14:33:17 | access to field c | A.cs:31:29:31:36 | object creation of type C2 : C2 | A.cs:33:14:33:17 | access to field c | $@ | A.cs:31:29:31:36 | object creation of type C2 : C2 | object creation of type C2 : C2 |
| A.cs:64:18:64:26 | access to field a | A.cs:55:17:55:23 | object creation of type A : A | A.cs:64:18:64:26 | access to field a | $@ | A.cs:55:17:55:23 | object creation of type A : A | object creation of type A : A |
| A.cs:77:18:77:27 | access to field a | A.cs:55:17:55:23 | object creation of type A : A | A.cs:77:18:77:27 | access to field a | $@ | A.cs:55:17:55:23 | object creation of type A : A | object creation of type A : A |
| A.cs:89:14:89:16 | access to field c | A.cs:83:15:83:21 | object creation of type C : C | A.cs:89:14:89:16 | access to field c | $@ | A.cs:83:15:83:21 | object creation of type C : C | object creation of type C : C |
| A.cs:106:14:106:16 | access to field b | A.cs:98:30:98:36 | object creation of type B : B | A.cs:106:14:106:16 | access to field b | $@ | A.cs:98:30:98:36 | object creation of type B : B | object creation of type B : B |
| A.cs:106:14:106:16 | access to field b | A.cs:104:17:104:23 | object creation of type B : B | A.cs:106:14:106:16 | access to field b | $@ | A.cs:104:17:104:23 | object creation of type B : B | object creation of type B : B |

146
csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected
View File

@@ -1222,22 +1222,22 @@
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e : IEnumerable<String> |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : String[] | GlobalDataFlow.cs:426:71:426:71 | e |
@@ -1260,8 +1260,8 @@
| GlobalDataFlow.cs:80:84:80:84 | access to parameter x : String | GlobalDataFlow.cs:431:44:431:47 | delegate call : String |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
| GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 |
| GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 : IEnumerable<String> |
| GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:84:59:84:64 | access to local variable sink14 |
@@ -1388,8 +1388,6 @@
| GlobalDataFlow.cs:88:22:88:70 | call to method Aggregate : String | GlobalDataFlow.cs:89:15:89:20 | access to local variable sink17 : String |
| GlobalDataFlow.cs:88:39:88:40 | "" : String | GlobalDataFlow.cs:88:44:88:46 | acc |
| GlobalDataFlow.cs:88:39:88:40 | "" : String | GlobalDataFlow.cs:88:44:88:46 | acc : String |
| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:88:64:88:64 | x |
| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:88:64:88:64 | x : Func<String,String,String> |
| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : String | GlobalDataFlow.cs:88:64:88:64 | x |
| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : String | GlobalDataFlow.cs:88:64:88:64 | x : String |
| GlobalDataFlow.cs:88:44:88:46 | acc : String | GlobalDataFlow.cs:88:55:88:57 | access to parameter acc |
@@ -1430,8 +1428,6 @@
| GlobalDataFlow.cs:90:75:90:80 | access to local variable sink14 : IEnumerable<String> | GlobalDataFlow.cs:122:20:122:25 | access to local variable sink14 : IEnumerable<String> |
| GlobalDataFlow.cs:90:75:90:88 | call to method First : String | GlobalDataFlow.cs:90:92:90:94 | acc |
| GlobalDataFlow.cs:90:75:90:88 | call to method First : String | GlobalDataFlow.cs:90:92:90:94 | acc : String |
| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:90:112:90:112 | x |
| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:90:112:90:112 | x : Func<String,String,String> |
| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : String | GlobalDataFlow.cs:90:112:90:112 | x |
| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : String | GlobalDataFlow.cs:90:112:90:112 | x : String |
| GlobalDataFlow.cs:90:92:90:94 | acc : String | GlobalDataFlow.cs:90:103:90:105 | access to parameter acc |
@@ -1658,16 +1654,16 @@
| GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 : T | GlobalDataFlow.cs:114:57:114:64 | access to local variable nonSink0 : T |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<String> |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : T |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<T> |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<String> |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : T |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<T> |
| GlobalDataFlow.cs:112:25:112:70 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e |
| GlobalDataFlow.cs:112:25:112:70 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e : IEnumerable<String> |
| GlobalDataFlow.cs:112:25:112:70 | (...) ... : String[] | GlobalDataFlow.cs:426:71:426:71 | e |
@@ -1758,8 +1754,6 @@
| GlobalDataFlow.cs:120:20:120:64 | call to method Aggregate : String | GlobalDataFlow.cs:121:15:121:22 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:120:37:120:38 | "" : String | GlobalDataFlow.cs:120:42:120:44 | acc |
| GlobalDataFlow.cs:120:37:120:38 | "" : String | GlobalDataFlow.cs:120:42:120:44 | acc : String |
| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:120:58:120:58 | x |
| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:120:58:120:58 | x : Func<String,String,String> |
| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : String | GlobalDataFlow.cs:120:58:120:58 | x |
| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : String | GlobalDataFlow.cs:120:58:120:58 | x : String |
| GlobalDataFlow.cs:120:42:120:44 | acc : String | GlobalDataFlow.cs:120:53:120:55 | access to parameter acc |
@@ -1808,8 +1802,6 @@
| GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:130:23:130:30 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:139:28:139:35 | access to local variable nonSink0 |
| GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:139:28:139:35 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:124:61:124:61 | x |
| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:124:61:124:61 | x : Func<String,String,String> |
| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : String | GlobalDataFlow.cs:124:61:124:61 | x |
| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : String | GlobalDataFlow.cs:124:61:124:61 | x : String |
| GlobalDataFlow.cs:124:52:124:52 | s : String | GlobalDataFlow.cs:124:58:124:58 | access to parameter s |
@@ -2132,16 +2124,10 @@
| GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 : String |
| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : IEnumerable<String> |
| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : String |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : IEnumerable<String> |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : String |
| GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:167:20:167:27 | this access |
| GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:167:20:167:27 | this access : DataFlow |
| GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:169:9:169:31 | this access |
@@ -2296,54 +2282,20 @@
| GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:185:9:185:27 | SSA def(nonSink0) : String |
| GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:186:15:186:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:186:15:186:22 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String |
| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
@@ -2354,54 +2306,20 @@
| GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:197:22:197:32 | this access : DataFlow |
| GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:201:20:201:33 | this access |
| GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:201:20:201:33 | this access : DataFlow |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String |
| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
@@ -2944,12 +2862,12 @@
| GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String |
| GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) |
| GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String |
| GlobalDataFlow.cs:333:22:333:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:333:22:333:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
| GlobalDataFlow.cs:335:22:335:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:335:22:335:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
| GlobalDataFlow.cs:333:22:333:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:333:22:333:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
| GlobalDataFlow.cs:335:22:335:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
| GlobalDataFlow.cs:335:22:335:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
| GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:167:20:167:27 | call to method NonOut |
| GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:167:20:167:27 | call to method NonOut : String |
| GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> |
@@ -2962,10 +2880,10 @@
| GlobalDataFlow.cs:350:9:350:14 | SSA def(x) : String | GlobalDataFlow.cs:171:23:171:30 | SSA def(nonSink0) : String |
| GlobalDataFlow.cs:350:13:350:14 | "" : String | GlobalDataFlow.cs:350:9:350:14 | SSA def(x) |
| GlobalDataFlow.cs:350:13:350:14 | "" : String | GlobalDataFlow.cs:350:9:350:14 | SSA def(x) : String |
| GlobalDataFlow.cs:355:22:355:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
| GlobalDataFlow.cs:355:22:355:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : String |
| GlobalDataFlow.cs:356:22:356:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
| GlobalDataFlow.cs:356:22:356:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : String |
| GlobalDataFlow.cs:355:22:355:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
| GlobalDataFlow.cs:355:22:355:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : IEnumerable<String> |
| GlobalDataFlow.cs:356:22:356:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
| GlobalDataFlow.cs:356:22:356:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : IEnumerable<String> |
| GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
| GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
| GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
@@ -3328,10 +3246,10 @@
| GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:429:9:432:9 | SSA phi(i) : Int32 |
| GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:431:17:431:17 | access to local variable i |
| GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:431:17:431:17 | access to local variable i : Int32 |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven |
| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> |
| GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:80:79:80:79 | x |
| GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:80:79:80:79 | x : T |
| GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:112:84:112:84 | x |

1414
csharp/ql/test/library-tests/dataflow/global/TaintTrackingEdges.expected
View File

File diff suppressed because it is too large Load Diff

18
csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
View File

@@ -139,9 +139,9 @@ edges
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 |
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> |
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:135:29:135:33 | access to local variable sink3 : String |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> |
| GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:82:84:82:94 | [output] delegate creation of type Func<String,String> : T |
| GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:292:31:292:40 | sinkParam8 : IEnumerable<String> |
| GlobalDataFlow.cs:82:84:82:94 | [output] delegate creation of type Func<String,String> : T | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 |
@@ -169,7 +169,7 @@ edges
| GlobalDataFlow.cs:153:21:153:25 | call to method Out : String | GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |
| GlobalDataFlow.cs:156:20:156:24 | SSA def(sink7) : String | GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 |
| GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
| GlobalDataFlow.cs:163:22:163:43 | call to method TaintedParam : String | GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 |
| GlobalDataFlow.cs:179:35:179:48 | "taint source" : String | GlobalDataFlow.cs:180:21:180:26 | delegate call : String |
| GlobalDataFlow.cs:180:21:180:26 | delegate call : String | GlobalDataFlow.cs:181:15:181:19 | access to local variable sink9 |
@@ -208,8 +208,8 @@ edges
| GlobalDataFlow.cs:323:13:323:26 | "taint source" : String | GlobalDataFlow.cs:323:9:323:26 | SSA def(x) : String |
| GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String |
| GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:334:22:334:35 | "taint source" : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> |
| GlobalDataFlow.cs:359:41:359:41 | x : String | GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String |
| GlobalDataFlow.cs:359:41:359:41 | x : String | GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String |
| GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String | GlobalDataFlow.cs:53:15:53:15 | x : String |
@@ -332,7 +332,7 @@ nodes
| GlobalDataFlow.cs:78:19:78:23 | access to local variable sink2 : String | semmle.label | access to local variable sink2 : String |
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | semmle.label | SSA def(sink3) : String |
| GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 | semmle.label | access to local variable sink3 |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | semmle.label | call to method SelectEven : T |
| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | semmle.label | call to method SelectEven : IEnumerable<T> |
| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | semmle.label | (...) ... : IEnumerable<String> |
| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 | semmle.label | access to local variable sink13 |
| GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | semmle.label | (...) ... : IEnumerable<String> |
@@ -366,7 +366,7 @@ nodes
| GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 | semmle.label | access to local variable sink7 |
| GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | semmle.label | SSA def(sink8) : String |
| GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 | semmle.label | access to local variable sink8 |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | semmle.label | call to method OutYield : String |
| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | semmle.label | call to method OutYield : IEnumerable<String> |
| GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 | semmle.label | access to local variable sink12 |
| GlobalDataFlow.cs:163:22:163:43 | call to method TaintedParam : String | semmle.label | call to method TaintedParam : String |
| GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 | semmle.label | access to local variable sink23 |
@@ -417,7 +417,7 @@ nodes
| GlobalDataFlow.cs:323:13:323:26 | "taint source" : String | semmle.label | "taint source" : String |
| GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | semmle.label | SSA def(x) : String |
| GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | semmle.label | "taint source" : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | semmle.label | "taint source" : String |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | semmle.label | "taint source" : IEnumerable<String> |
| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | semmle.label | "taint source" : String |
| GlobalDataFlow.cs:359:41:359:41 | x : String | semmle.label | x : String |
| GlobalDataFlow.cs:359:41:359:41 | x : String | semmle.label | x : String |

14
csharp/ql/test/library-tests/dataflow/types/Types.cs
View File

@@ -19,26 +19,26 @@ class Types
static void M1()
{
new C().M(); // no flow
new C().CallM(); // no flow (FALSE POSITIVE)
new C().CallM(); // no flow
M2(new C()); // flow
M3(new C()); // no flow (FALSE POSITIVE)
M3(new C()); // no flow
M4(new C()); // flow
M5(new C()); // flow
M6(new C()); // flow
M7(new C()); // flow
M8(new C()); // no flow (FALSE POSITIVE)
M8(new C()); // no flow
M9(new C()); // flow
new D().M(); // flow
new D().CallM(); // flow
M2(new D()); // no flow (FALSE POSITIVE)
M2(new D()); // no flow
M3(new D()); // flow
M4(new D()); // no flow (FALSE POSITIVE)
M4(new D()); // no flow
M5(new D()); // flow
M6(new D()); // flow
M7(new D()); // flow
M8(new D()); // flow
M9(new D()); // no flow (FALSE POSITIVE)
M9(new D()); // no flow
object o = null; // flow
Sink(o);
@@ -97,7 +97,7 @@ class Types
{
void M3()
{
this.M2(new E1()); // no flow (FALSE POSITIVE)
this.M2(new E1()); // no flow
}
public override void M() { }

65
csharp/ql/test/library-tests/dataflow/types/Types.expected
View File

@@ -1,101 +1,71 @@
edges
| Types.cs:7:21:7:25 | this : C | Types.cs:7:32:7:35 | this access : C |
| Types.cs:7:21:7:25 | this : D | Types.cs:7:32:7:35 | this access : D |
| Types.cs:7:32:7:35 | this access : C | Types.cs:16:30:16:30 | this : C |
| Types.cs:7:32:7:35 | this access : D | Types.cs:16:30:16:30 | this : D |
| Types.cs:16:30:16:30 | this : C | Types.cs:16:42:16:45 | this access |
| Types.cs:16:30:16:30 | this : D | Types.cs:16:42:16:45 | this access |
| Types.cs:22:9:22:15 | object creation of type C : C | Types.cs:7:21:7:25 | this : C |
| Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:47:22:47:22 | a : C |
| Types.cs:24:12:24:18 | object creation of type C : C | Types.cs:53:22:53:22 | a : C |
| Types.cs:25:12:25:18 | object creation of type C : C | Types.cs:63:22:63:22 | a : C |
| Types.cs:26:12:26:18 | object creation of type C : C | Types.cs:65:25:65:25 | x : C |
| Types.cs:27:12:27:18 | object creation of type C : C | Types.cs:67:25:67:25 | x : C |
| Types.cs:28:12:28:18 | object creation of type C : C | Types.cs:69:25:69:25 | x : C |
| Types.cs:29:12:29:18 | object creation of type C : C | Types.cs:71:25:71:25 | x : C |
| Types.cs:30:12:30:18 | object creation of type C : C | Types.cs:77:22:77:22 | a : C |
| Types.cs:32:9:32:15 | object creation of type D : D | Types.cs:16:30:16:30 | this : D |
| Types.cs:33:9:33:15 | object creation of type D : D | Types.cs:7:21:7:25 | this : D |
| Types.cs:34:12:34:18 | object creation of type D : D | Types.cs:47:22:47:22 | a : D |
| Types.cs:35:12:35:18 | object creation of type D : D | Types.cs:53:22:53:22 | a : D |
| Types.cs:36:12:36:18 | object creation of type D : D | Types.cs:63:22:63:22 | a : D |
| Types.cs:37:12:37:18 | object creation of type D : D | Types.cs:65:25:65:25 | x : D |
| Types.cs:38:12:38:18 | object creation of type D : D | Types.cs:67:25:67:25 | x : D |
| Types.cs:39:12:39:18 | object creation of type D : D | Types.cs:69:25:69:25 | x : D |
| Types.cs:40:12:40:18 | object creation of type D : D | Types.cs:71:25:71:25 | x : D |
| Types.cs:41:12:41:18 | object creation of type D : D | Types.cs:77:22:77:22 | a : D |
| Types.cs:43:20:43:23 | null : null | Types.cs:44:14:44:14 | access to local variable o |
| Types.cs:47:22:47:22 | a : C | Types.cs:50:18:50:18 | access to local variable c |
| Types.cs:47:22:47:22 | a : D | Types.cs:50:18:50:18 | access to local variable c |
| Types.cs:53:22:53:22 | a : C | Types.cs:58:22:58:22 | access to local variable d |
| Types.cs:53:22:53:22 | a : D | Types.cs:58:22:58:22 | access to local variable d |
| Types.cs:47:22:47:22 | a : C | Types.cs:49:18:49:20 | SSA def(c) : C |
| Types.cs:49:18:49:20 | SSA def(c) : C | Types.cs:50:18:50:18 | access to local variable c |
| Types.cs:53:22:53:22 | a : D | Types.cs:57:18:57:20 | SSA def(d) : D |
| Types.cs:57:18:57:20 | SSA def(d) : D | Types.cs:58:22:58:22 | access to local variable d |
| Types.cs:63:22:63:22 | a : C | Types.cs:63:33:63:36 | (...) ... |
| Types.cs:63:22:63:22 | a : D | Types.cs:63:33:63:36 | (...) ... |
| Types.cs:65:25:65:25 | x : C | Types.cs:65:36:65:36 | access to parameter x |
| Types.cs:65:25:65:25 | x : D | Types.cs:65:36:65:36 | access to parameter x |
| Types.cs:67:25:67:25 | x : C | Types.cs:67:48:67:48 | access to parameter x |
| Types.cs:67:25:67:25 | x : D | Types.cs:67:48:67:48 | access to parameter x |
| Types.cs:69:25:69:25 | x : C | Types.cs:69:52:69:52 | access to parameter x |
| Types.cs:69:25:69:25 | x : D | Types.cs:69:52:69:52 | access to parameter x |
| Types.cs:71:25:71:25 | x : C | Types.cs:73:21:73:21 | (...) ... : C |
| Types.cs:71:25:71:25 | x : D | Types.cs:73:21:73:21 | (...) ... : D |
| Types.cs:73:21:73:21 | (...) ... : C | Types.cs:74:9:74:9 | access to local variable d : C |
| Types.cs:73:21:73:21 | (...) ... : D | Types.cs:74:9:74:9 | access to local variable d : D |
| Types.cs:74:9:74:9 | access to local variable d : C | Types.cs:16:30:16:30 | this : C |
| Types.cs:74:9:74:9 | access to local variable d : D | Types.cs:16:30:16:30 | this : D |
| Types.cs:77:22:77:22 | a : C | Types.cs:80:18:80:18 | access to local variable b |
| Types.cs:77:22:77:22 | a : D | Types.cs:80:18:80:18 | access to local variable b |
| Types.cs:90:22:90:22 | e : E1 | Types.cs:92:26:92:26 | access to parameter e : E1 |
| Types.cs:77:22:77:22 | a : C | Types.cs:79:18:79:25 | SSA def(b) : C |
| Types.cs:79:18:79:25 | SSA def(b) : C | Types.cs:80:18:80:18 | access to local variable b |
| Types.cs:90:22:90:22 | e : E2 | Types.cs:92:26:92:26 | access to parameter e : E2 |
| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | Types.cs:93:13:93:16 | this access [Field] : E1 |
| Types.cs:92:13:92:16 | [post] this access [Field] : E2 | Types.cs:93:13:93:16 | this access [Field] : E2 |
| Types.cs:92:26:92:26 | access to parameter e : E1 | Types.cs:92:13:92:16 | [post] this access [Field] : E1 |
| Types.cs:92:26:92:26 | access to parameter e : E2 | Types.cs:92:13:92:16 | [post] this access [Field] : E2 |
| Types.cs:93:13:93:16 | this access [Field] : E1 | Types.cs:113:34:113:34 | this [Field] : E1 |
| Types.cs:93:13:93:16 | this access [Field] : E2 | Types.cs:113:34:113:34 | this [Field] : E2 |
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:90:22:90:22 | e : E1 |
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:90:22:90:22 | e : E2 |
| Types.cs:113:34:113:34 | this [Field] : E1 | Types.cs:115:22:115:25 | this access [Field] : E1 |
| Types.cs:113:34:113:34 | this [Field] : E2 | Types.cs:115:22:115:25 | this access [Field] : E2 |
| Types.cs:115:22:115:25 | this access [Field] : E1 | Types.cs:115:22:115:31 | access to field Field |
| Types.cs:115:22:115:25 | this access [Field] : E2 | Types.cs:115:22:115:31 | access to field Field |
nodes
| Types.cs:7:21:7:25 | this : C | semmle.label | this : C |
| Types.cs:7:21:7:25 | this : D | semmle.label | this : D |
| Types.cs:7:32:7:35 | this access : C | semmle.label | this access : C |
| Types.cs:7:32:7:35 | this access : D | semmle.label | this access : D |
| Types.cs:16:30:16:30 | this : C | semmle.label | this : C |
| Types.cs:16:30:16:30 | this : D | semmle.label | this : D |
| Types.cs:16:42:16:45 | this access | semmle.label | this access |
| Types.cs:22:9:22:15 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:23:12:23:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:24:12:24:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:25:12:25:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:26:12:26:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:27:12:27:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:28:12:28:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:29:12:29:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:30:12:30:18 | object creation of type C : C | semmle.label | object creation of type C : C |
| Types.cs:32:9:32:15 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:33:9:33:15 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:34:12:34:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:35:12:35:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:36:12:36:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:37:12:37:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:38:12:38:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:39:12:39:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:40:12:40:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:41:12:41:18 | object creation of type D : D | semmle.label | object creation of type D : D |
| Types.cs:43:20:43:23 | null : null | semmle.label | null : null |
| Types.cs:44:14:44:14 | access to local variable o | semmle.label | access to local variable o |
| Types.cs:47:22:47:22 | a : C | semmle.label | a : C |
| Types.cs:47:22:47:22 | a : D | semmle.label | a : D |
| Types.cs:49:18:49:20 | SSA def(c) : C | semmle.label | SSA def(c) : C |
| Types.cs:50:18:50:18 | access to local variable c | semmle.label | access to local variable c |
| Types.cs:53:22:53:22 | a : C | semmle.label | a : C |
| Types.cs:53:22:53:22 | a : D | semmle.label | a : D |
| Types.cs:57:18:57:20 | SSA def(d) : D | semmle.label | SSA def(d) : D |
| Types.cs:58:22:58:22 | access to local variable d | semmle.label | access to local variable d |
| Types.cs:63:22:63:22 | a : C | semmle.label | a : C |
| Types.cs:63:22:63:22 | a : D | semmle.label | a : D |
| Types.cs:63:33:63:36 | (...) ... | semmle.label | (...) ... |
| Types.cs:65:25:65:25 | x : C | semmle.label | x : C |
| Types.cs:65:25:65:25 | x : D | semmle.label | x : D |
@@ -106,50 +76,33 @@ nodes
| Types.cs:69:25:69:25 | x : C | semmle.label | x : C |
| Types.cs:69:25:69:25 | x : D | semmle.label | x : D |
| Types.cs:69:52:69:52 | access to parameter x | semmle.label | access to parameter x |
| Types.cs:71:25:71:25 | x : C | semmle.label | x : C |
| Types.cs:71:25:71:25 | x : D | semmle.label | x : D |
| Types.cs:73:21:73:21 | (...) ... : C | semmle.label | (...) ... : C |
| Types.cs:73:21:73:21 | (...) ... : D | semmle.label | (...) ... : D |
| Types.cs:74:9:74:9 | access to local variable d : C | semmle.label | access to local variable d : C |
| Types.cs:74:9:74:9 | access to local variable d : D | semmle.label | access to local variable d : D |
| Types.cs:77:22:77:22 | a : C | semmle.label | a : C |
| Types.cs:77:22:77:22 | a : D | semmle.label | a : D |
| Types.cs:79:18:79:25 | SSA def(b) : C | semmle.label | SSA def(b) : C |
| Types.cs:80:18:80:18 | access to local variable b | semmle.label | access to local variable b |
| Types.cs:90:22:90:22 | e : E1 | semmle.label | e : E1 |
| Types.cs:90:22:90:22 | e : E2 | semmle.label | e : E2 |
| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | semmle.label | [post] this access [Field] : E1 |
| Types.cs:92:13:92:16 | [post] this access [Field] : E2 | semmle.label | [post] this access [Field] : E2 |
| Types.cs:92:26:92:26 | access to parameter e : E1 | semmle.label | access to parameter e : E1 |
| Types.cs:92:26:92:26 | access to parameter e : E2 | semmle.label | access to parameter e : E2 |
| Types.cs:93:13:93:16 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
| Types.cs:93:13:93:16 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | semmle.label | object creation of type E1 : E1 |
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | semmle.label | object creation of type E2 : E2 |
| Types.cs:113:34:113:34 | this [Field] : E1 | semmle.label | this [Field] : E1 |
| Types.cs:113:34:113:34 | this [Field] : E2 | semmle.label | this [Field] : E2 |
| Types.cs:115:22:115:25 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
| Types.cs:115:22:115:25 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
| Types.cs:115:22:115:31 | access to field Field | semmle.label | access to field Field |
#select
| Types.cs:22:9:22:15 | object creation of type C : C | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
| Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:50:18:50:18 | access to local variable c | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
| Types.cs:24:12:24:18 | object creation of type C : C | Types.cs:58:22:58:22 | access to local variable d | Types.cs:58:22:58:22 | access to local variable d | $@ | Types.cs:58:22:58:22 | access to local variable d | access to local variable d |
| Types.cs:25:12:25:18 | object creation of type C : C | Types.cs:63:33:63:36 | (...) ... | Types.cs:63:33:63:36 | (...) ... | $@ | Types.cs:63:33:63:36 | (...) ... | (...) ... |
| Types.cs:26:12:26:18 | object creation of type C : C | Types.cs:65:36:65:36 | access to parameter x | Types.cs:65:36:65:36 | access to parameter x | $@ | Types.cs:65:36:65:36 | access to parameter x | access to parameter x |
| Types.cs:27:12:27:18 | object creation of type C : C | Types.cs:67:48:67:48 | access to parameter x | Types.cs:67:48:67:48 | access to parameter x | $@ | Types.cs:67:48:67:48 | access to parameter x | access to parameter x |
| Types.cs:28:12:28:18 | object creation of type C : C | Types.cs:69:52:69:52 | access to parameter x | Types.cs:69:52:69:52 | access to parameter x | $@ | Types.cs:69:52:69:52 | access to parameter x | access to parameter x |
| Types.cs:29:12:29:18 | object creation of type C : C | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
| Types.cs:30:12:30:18 | object creation of type C : C | Types.cs:80:18:80:18 | access to local variable b | Types.cs:80:18:80:18 | access to local variable b | $@ | Types.cs:80:18:80:18 | access to local variable b | access to local variable b |
| Types.cs:32:9:32:15 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
| Types.cs:33:9:33:15 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
| Types.cs:34:12:34:18 | object creation of type D : D | Types.cs:50:18:50:18 | access to local variable c | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
| Types.cs:35:12:35:18 | object creation of type D : D | Types.cs:58:22:58:22 | access to local variable d | Types.cs:58:22:58:22 | access to local variable d | $@ | Types.cs:58:22:58:22 | access to local variable d | access to local variable d |
| Types.cs:36:12:36:18 | object creation of type D : D | Types.cs:63:33:63:36 | (...) ... | Types.cs:63:33:63:36 | (...) ... | $@ | Types.cs:63:33:63:36 | (...) ... | (...) ... |
| Types.cs:37:12:37:18 | object creation of type D : D | Types.cs:65:36:65:36 | access to parameter x | Types.cs:65:36:65:36 | access to parameter x | $@ | Types.cs:65:36:65:36 | access to parameter x | access to parameter x |
| Types.cs:38:12:38:18 | object creation of type D : D | Types.cs:67:48:67:48 | access to parameter x | Types.cs:67:48:67:48 | access to parameter x | $@ | Types.cs:67:48:67:48 | access to parameter x | access to parameter x |
| Types.cs:39:12:39:18 | object creation of type D : D | Types.cs:69:52:69:52 | access to parameter x | Types.cs:69:52:69:52 | access to parameter x | $@ | Types.cs:69:52:69:52 | access to parameter x | access to parameter x |
| Types.cs:40:12:40:18 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
| Types.cs:41:12:41:18 | object creation of type D : D | Types.cs:80:18:80:18 | access to local variable b | Types.cs:80:18:80:18 | access to local variable b | $@ | Types.cs:80:18:80:18 | access to local variable b | access to local variable b |
| Types.cs:43:20:43:23 | null : null | Types.cs:44:14:44:14 | access to local variable o | Types.cs:44:14:44:14 | access to local variable o | $@ | Types.cs:44:14:44:14 | access to local variable o | access to local variable o |
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |

16
csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
View File

@@ -1,13 +1,15 @@
edges
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:27:26:47 | ... + ... |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:50:26:66 | ... + ... |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:63:28:71 | access to local variable userInput |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:74:28:82 | access to local variable userInput |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:25:32:25:51 | access to property Text : String |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:27:26:47 | ... + ... |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:50:26:66 | ... + ... |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
nodes
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| CommandInjection.cs:25:32:25:51 | access to property Text : String | semmle.label | access to property Text : String |
| CommandInjection.cs:26:27:26:47 | ... + ... | semmle.label | ... + ... |
| CommandInjection.cs:26:50:26:66 | ... + ... | semmle.label | ... + ... |
| CommandInjection.cs:28:63:28:71 | access to local variable userInput | semmle.label | access to local variable userInput |

10
csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
View File

@@ -1,12 +1,16 @@
edges
| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:39:50:39:55 | access to local variable query1 |
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:38:21:38:40 | access to property Text : String |
| SqlInjection.cs:38:21:38:40 | access to property Text : String | SqlInjection.cs:39:50:39:55 | access to local variable query1 |
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:73:33:73:52 | access to property Text : String |
| SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
| SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
| SqlInjection.cs:87:21:87:29 | access to property Text : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 |
nodes
| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| SqlInjection.cs:38:21:38:40 | access to property Text : String | semmle.label | access to property Text : String |
| SqlInjection.cs:39:50:39:55 | access to local variable query1 | semmle.label | access to local variable query1 |
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| SqlInjection.cs:73:33:73:52 | access to property Text : String | semmle.label | access to property Text : String |
| SqlInjection.cs:74:56:74:61 | access to local variable query1 | semmle.label | access to local variable query1 |
| SqlInjection.cs:75:55:75:60 | access to local variable query1 | semmle.label | access to local variable query1 |
| SqlInjection.cs:87:21:87:29 | access to property Text : String | semmle.label | access to property Text : String |

20
csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.expected
View File

@@ -1,23 +1,33 @@
edges
| ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:18:13:18:30 | ... == ... |
| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:24:13:24:45 | call to method Equals |
| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:29:13:29:40 | ... == ... |
| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:46:13:46:46 | ... == ... |
| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:24:13:24:29 | access to property Value : String |
| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:29:13:29:29 | access to property Value : String |
| ConditionalBypass.cs:24:13:24:29 | access to property Value : String | ConditionalBypass.cs:24:13:24:45 | call to method Equals |
| ConditionalBypass.cs:29:13:29:29 | access to property Value : String | ConditionalBypass.cs:29:13:29:40 | ... == ... |
| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:46:13:46:29 | access to property HostName : String |
| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:51:13:51:29 | access to property HostName |
| ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:74:13:74:40 | ... == ... |
| ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:86:13:86:40 | ... == ... |
| ConditionalBypass.cs:46:13:46:29 | access to property HostName : String | ConditionalBypass.cs:46:13:46:46 | ... == ... |
| ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:74:13:74:29 | access to property Value : String |
| ConditionalBypass.cs:74:13:74:29 | access to property Value : String | ConditionalBypass.cs:74:13:74:40 | ... == ... |
| ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:86:13:86:29 | access to property Value : String |
| ConditionalBypass.cs:86:13:86:29 | access to property Value : String | ConditionalBypass.cs:86:13:86:40 | ... == ... |
nodes
| ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| ConditionalBypass.cs:18:13:18:30 | ... == ... | semmle.label | ... == ... |
| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
| ConditionalBypass.cs:24:13:24:29 | access to property Value : String | semmle.label | access to property Value : String |
| ConditionalBypass.cs:24:13:24:45 | call to method Equals | semmle.label | call to method Equals |
| ConditionalBypass.cs:29:13:29:29 | access to property Value : String | semmle.label | access to property Value : String |
| ConditionalBypass.cs:29:13:29:40 | ... == ... | semmle.label | ... == ... |
| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | semmle.label | call to method GetHostByAddress : IPHostEntry |
| ConditionalBypass.cs:46:13:46:29 | access to property HostName : String | semmle.label | access to property HostName : String |
| ConditionalBypass.cs:46:13:46:46 | ... == ... | semmle.label | ... == ... |
| ConditionalBypass.cs:51:13:51:29 | access to property HostName | semmle.label | access to property HostName |
| ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
| ConditionalBypass.cs:74:13:74:29 | access to property Value : String | semmle.label | access to property Value : String |
| ConditionalBypass.cs:74:13:74:40 | ... == ... | semmle.label | ... == ... |
| ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
| ConditionalBypass.cs:86:13:86:29 | access to property Value : String | semmle.label | access to property Value : String |
| ConditionalBypass.cs:86:13:86:40 | ... == ... | semmle.label | ... == ... |
#select
| ConditionalBypass.cs:19:13:19:33 | call to method login | ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:18:13:18:30 | ... == ... | Sensitive method may not be executed depending on $@, which flows from $@. | ConditionalBypass.cs:18:13:18:30 | ... == ... | this condition | ConditionalBypass.cs:14:26:14:48 | access to property QueryString | user input |