mirror of
https://github.com/github/codeql.git
synced 2026-04-24 08:15:14 +02:00
C++: Replace 'use_data' with 'read_data'.
This commit is contained in:
@@ -369,18 +369,18 @@ To set the stage, consider the following scenario:
|
||||
void read_data(const void *);
|
||||
void *malloc(size_t);
|
||||
|
||||
void get_input_and_use_data() {
|
||||
void get_input_and_read_data() {
|
||||
B b;
|
||||
b.a = (A *)malloc(sizeof(A));
|
||||
b.a->x = user_input();
|
||||
// ...
|
||||
use_data(&b);
|
||||
read_data(&b);
|
||||
free(b.a);
|
||||
}
|
||||
|
||||
We write a user-controlled value into the object ``b`` at the access path ``[a, x]``. Afterwards, ``b`` is passed to ``use_data`` which we assume we don't have the definition of in the database. We now want to track this user-input flowing into ``use_data``.
|
||||
We write a user-controlled value into the object ``b`` at the access path ``[a, x]``. Afterwards, ``b`` is passed to ``read_data`` which we assume we don't have the definition of in the database. We now want to track this user-input flowing into ``read_data``.
|
||||
|
||||
The dataflow library actually has a specific tool to handle this scenario, and thus we don't need to add any additional flow steps using ``isAdditionalFlowStep`` to handle this. Instead, we have to tell the dataflow library that ``use_data`` may implicitly read the data from the object that it has been passed. To do that, we implement ``allowImplicitRead`` in our dataflow module:
|
||||
The dataflow library actually has a specific tool to handle this scenario, and thus we don't need to add any additional flow steps using ``isAdditionalFlowStep`` to handle this. Instead, we have to tell the dataflow library that ``read_data`` may implicitly read the data from the object that it has been passed. To do that, we implement ``allowImplicitRead`` in our dataflow module:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
|
||||
Reference in New Issue
Block a user