hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Implement coverage tracking using dataflow nodes

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-08-10 11:38:01 +02:00
parent 5b55a83aaa
commit c48586ff80
1 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
java/ql/src/Telemetry/APIUsage.qll
View File

@@ -1,26 +1,48 @@
import java
private import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSummary
private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.FlowSources
string supportKind(Callable api) {
if api instanceof TaintPreservingCallable
then result = "taint-preserving"
else
if summaryModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _, _)
if summaryCall(api)
then result = "summary"
else
if sinkModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _)
if sink(api)
then result = "sink"
else
if sourceModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _)
if source(api)
then result = "source"
else result = "?"
}
private string packageName(Callable api) {
result = api.getCompilationUnit().getPackage().toString()
predicate summaryCall(Callable api) {
api instanceof SummarizedCallable
or
exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
TaintTracking::localAdditionalTaintStep(arg, _)
)
}
private string typeName(Callable api) {
result = api.getDeclaringType().getAnAncestor().getSourceDeclaration().toString()
predicate sink(Callable api) {
exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
sinkNode(arg, _)
)
}
predicate source(Callable api) {
exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
arg instanceof RemoteFlowSource
)
}