hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Implement coverage tracking using dataflow nodes

Browse Source
This commit is contained in:
Benjamin Muskalla
2021-08-10 11:38:01 +02:00
parent 5b55a83aaa
commit c48586ff80
1 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
java/ql/src/Telemetry/APIUsage.qll
View File

@@ -1,26 +1,48 @@
import java import java
private import semmle.code.java.dataflow.FlowSteps private import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.ExternalFlow private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.dataflow.FlowSummary
private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.TaintTracking
private import semmle.code.java.dataflow.FlowSources
string supportKind(Callable api) { string supportKind(Callable api) {
if api instanceof TaintPreservingCallable if api instanceof TaintPreservingCallable
then result = "taint-preserving" then result = "taint-preserving"
else else
if summaryModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _, _) if summaryCall(api)
then result = "summary" then result = "summary"
else else
if sinkModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _) if sink(api)
then result = "sink" then result = "sink"
else else
if sourceModel(packageName(api), typeName(api), _, api.getName(), _, _, _, _) if source(api)
then result = "source" then result = "source"
else result = "?" else result = "?"
} }
private string packageName(Callable api) { predicate summaryCall(Callable api) {
result = api.getCompilationUnit().getPackage().toString() api instanceof SummarizedCallable
or
exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
TaintTracking::localAdditionalTaintStep(arg, _)
)
} }
private string typeName(Callable api) { predicate sink(Callable api) {
result = api.getDeclaringType().getAnAncestor().getSourceDeclaration().toString() exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
sinkNode(arg, _)
)
}
predicate source(Callable api) {
exists(Call call, DataFlow::Node arg |
call.getCallee() = api and
[call.getAnArgument(), call.getQualifier()] = arg.asExpr() and
arg instanceof RemoteFlowSource
)
} }