hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 19:55:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Change the implementation on getAnInput and getAnOutput based on hvitveds recommendations.

Browse Source
This commit is contained in:
Michael Nebel
2022-03-25 15:58:00 +01:00
parent c2196a04aa
commit b0a24a7a44
2 changed files with 22 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
csharp/ql/src/Telemetry/ExternalApi.qll
View File

@@ -1,9 +1,11 @@
/** Provides classes and predicates related to handling APIs from external libraries. */
private import csharp
private import semmle.code.csharp.dispatch.Dispatch
private import semmle.code.csharp.dataflow.DataFlow
private import semmle.code.csharp.dataflow.ExternalFlow
private import semmle.code.csharp.dataflow.FlowSummary
private import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
private import semmle.code.csharp.dataflow.TaintTracking
@@ -57,20 +59,25 @@ class ExternalApi extends DataFlowDispatch::DataFlowCallable {
string getInfo() { result = this.getInfoPrefix() + "#" + this.getSignature() }
/** Gets a node that is an input to a call to this API. */
private DataFlow::Node getAnInput() {
exists(Call call | call.getTarget().getUnboundDeclaration() = this |
result.asExpr() = call.getAnArgument()
private ArgumentNode getAnInput() {
exists(DispatchCall call |
result.getCall().(DataFlowDispatch::NonDelegateDataFlowCall).getDispatchCall() = call
|
this = call.getADynamicTarget().getUnboundDeclaration()
or
this = call.getAStaticTarget().getUnboundDeclaration()
)
or
result.(ArgumentNode).getCall().getEnclosingCallable() = this
}
/** Gets a node that is an output from a call to this API. */
private DataFlow::Node getAnOutput() {
exists(Call call | call.getTarget().getUnboundDeclaration() = this | result.asExpr() = call)
or
result.(PostUpdateNode).getPreUpdateNode().(ArgumentNode).getCall().getEnclosingCallable() =
this
exists(DataFlowDispatch::NonDelegateDataFlowCall call, DataFlowImplCommon::ReturnKindExt ret |
result = ret.getAnOutNode(call)
|
this = call.getDispatchCall().getADynamicTarget().getUnboundDeclaration()
or
this = call.getDispatchCall().getAStaticTarget().getUnboundDeclaration()
)
}
/** Holds if this API has a supported summary. */
@@ -79,15 +86,15 @@ class ExternalApi extends DataFlowDispatch::DataFlowCallable {
defaultAdditionalTaintStep(this.getAnInput(), _)
}
/** Holds if this API is is a constructor without parameters */
/** Holds if this API is is a constructor without parameters. */
private predicate isParameterlessConstructor() {
this instanceof Constructor and this.getNumberOfParameters() = 0
}
/** Holds if this API is part of a common testing library or framework */
/** Holds if this API is part of a common testing library or framework. */
private predicate isTestLibrary() { this.getDeclaringType() instanceof TestLibrary }
/** Holds if this API is not worth supporting */
/** Holds if this API is not worth supporting. */
predicate isUninteresting() { this.isTestLibrary() or this.isParameterlessConstructor() }
/** Holds if this API is a known source. */

6
java/ql/src/Telemetry/ExternalApi.qll
View File

@@ -75,15 +75,15 @@ class ExternalApi extends Callable {
TaintTracking::localAdditionalTaintStep(this.getAnInput(), _)
}
/** Holds if this API is is a constructor without parameters */
/** Holds if this API is is a constructor without parameters. */
private predicate isParameterlessConstructor() {
this instanceof Constructor and this.getNumberOfParameters() = 0
}
/** Holds if this API is part of a common testing library or framework */
/** Holds if this API is part of a common testing library or framework. */
private predicate isTestLibrary() { this.getDeclaringType() instanceof TestLibrary }
/** Holds if this API is not worth supporting */
/** Holds if this API is not worth supporting. */
predicate isUninteresting() { this.isTestLibrary() or this.isParameterlessConstructor() }
/** Holds if this API is a known source. */