hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: fix constructor models

Browse Source
This commit is contained in:
Robert Marsh
2020-09-18 14:43:39 -07:00
parent 3a83cc71fe
commit c179a07fc7
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
View File

@@ -38,9 +38,11 @@ class StdSequenceContainerConstructor extends Constructor, TaintFunction {
input.isParameterDeref(getAValueTypeParameterIndex()) or
input.isParameter(getAnIteratorParameterIndex())
) and
output.isReturnValue()
or
output.isQualifierObject()
(
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
or
output.isQualifierObject()
)
}
}

10
cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
View File

@@ -48,7 +48,7 @@ class StdStringConstructor extends Constructor, TaintFunction {
input.isParameter(getAnIteratorParameterIndex())
) and
(
output.isReturnValue()
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
or
output.isQualifierObject()
)
@@ -383,9 +383,11 @@ class StdStringStreamConstructor extends Constructor, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// taint flow from any parameter of string type to the returned object
input.isParameterDeref(getAStringParameterIndex()) and
output.isReturnValue()
or
output.isQualifierObject()
(
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
or
output.isQualifierObject()
)
}
}