C#: Data-flow pruning based on call contexts

This commit is contained in:
Tom Hvitved
2019-10-16 13:35:50 +02:00
parent 853cbd8728
commit c57015af7d
2 changed files with 50 additions and 46 deletions

View File

@@ -3,10 +3,12 @@ private import cil
private import dotnet
private import DataFlowPublic
private import DataFlowDispatch
private import DataFlowImplCommon::Public
private import ControlFlowReachability
private import DelegateDataFlow
private import semmle.code.csharp.Caching
private import semmle.code.csharp.ExprOrStmtParent
private import semmle.code.csharp.controlflow.Guards
private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
private import semmle.code.csharp.dispatch.Dispatch
private import semmle.code.csharp.frameworks.EntityFramework
@@ -439,6 +441,22 @@ private module Cached {
c.(FieldLikeContent).getField() = node2.asExpr().(FieldLikeRead).getTarget()
)
}
/**
* Holds if the node `n` is unreachable when the call context is `call`.
*/
cached
predicate isUnreachableInCall(Node n, DataFlowCall call) {
exists(
SsaDefinitionNode paramNode, Ssa::ExplicitDefinition param, Guard guard,
ControlFlow::SuccessorTypes::BooleanSuccessor bs
|
viableConstantBooleanParamArg(paramNode, bs.getValue().booleanNot(), call) and
paramNode.getDefinition() = param and
param.getARead() = guard and
guard.controlsBlock(n.getControlFlowNode().getBasicBlock(), bs)
)
}
}
import Cached
@@ -1358,4 +1376,31 @@ class DataFlowType = DotNet::Type;
class DataFlowLocation = Location;
predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
/** Holds if `e` is an expression that always has the same Boolean value `val`. */
private predicate constantBooleanExpr(Expr e, boolean val) {
e = any(AbstractValues::BooleanValue bv | val = bv.getValue()).getAnExpr()
or
exists(Ssa::ExplicitDefinition def, Expr src |
e = def.getARead() and
src = def.getADefinition().getSource() and
constantBooleanExpr(src, val)
)
}
/** An argument that always has the same Boolean value. */
private class ConstantBooleanArgumentNode extends ExprNode {
ConstantBooleanArgumentNode() { constantBooleanExpr(this.(ArgumentNode).asExpr(), _) }
/** Gets the Boolean value of this expression. */
boolean getBooleanValue() { constantBooleanExpr(this.getExpr(), result) }
}
pragma[noinline]
private predicate viableConstantBooleanParamArg(
SsaDefinitionNode paramNode, boolean b, DataFlowCall call
) {
exists(ConstantBooleanArgumentNode arg |
viableParamArg(call, paramNode, arg) and
b = arg.getBooleanValue()
)
}

View File

@@ -4,11 +4,8 @@ edges
| CallSensitivityFlow.cs:35:41:35:41 | o | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o |
| CallSensitivityFlow.cs:43:45:43:45 | o | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 |
| CallSensitivityFlow.cs:56:46:56:46 | o | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 |
| CallSensitivityFlow.cs:72:24:72:35 | object creation of type Object | CallSensitivityFlow.cs:19:39:19:39 | o |
| CallSensitivityFlow.cs:73:25:73:36 | object creation of type Object | CallSensitivityFlow.cs:27:40:27:40 | o |
| CallSensitivityFlow.cs:74:26:74:37 | object creation of type Object | CallSensitivityFlow.cs:35:41:35:41 | o |
| CallSensitivityFlow.cs:75:30:75:41 | object creation of type Object | CallSensitivityFlow.cs:43:45:43:45 | o |
| CallSensitivityFlow.cs:76:26:76:37 | object creation of type Object | CallSensitivityFlow.cs:76:14:76:45 | call to method FlowThrough |
| CallSensitivityFlow.cs:56:46:56:46 | o | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 |
| CallSensitivityFlow.cs:56:46:56:46 | o | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 |
| CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object | CallSensitivityFlow.cs:19:39:19:39 | o |
| CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object | CallSensitivityFlow.cs:27:40:27:40 | o |
| CallSensitivityFlow.cs:80:26:80:37 | object creation of type Object | CallSensitivityFlow.cs:35:41:35:41 | o |
@@ -18,19 +15,11 @@ edges
| CallSensitivityFlow.cs:84:31:84:42 | object creation of type Object | CallSensitivityFlow.cs:56:46:56:46 | o |
| CallSensitivityFlow.cs:85:26:85:37 | object creation of type Object | CallSensitivityFlow.cs:85:14:85:44 | call to method FlowThrough |
| CallSensitivityFlow.cs:87:31:87:42 | object creation of type Object | CallSensitivityFlow.cs:56:46:56:46 | o |
| CallSensitivityFlow.cs:95:24:95:35 | object creation of type Object | CallSensitivityFlow.cs:19:39:19:39 | o |
| CallSensitivityFlow.cs:96:25:96:36 | object creation of type Object | CallSensitivityFlow.cs:27:40:27:40 | o |
| CallSensitivityFlow.cs:97:26:97:37 | object creation of type Object | CallSensitivityFlow.cs:35:41:35:41 | o |
| CallSensitivityFlow.cs:98:30:98:41 | object creation of type Object | CallSensitivityFlow.cs:43:45:43:45 | o |
| CallSensitivityFlow.cs:99:26:99:37 | object creation of type Object | CallSensitivityFlow.cs:99:14:99:41 | call to method FlowThrough |
| CallSensitivityFlow.cs:101:24:101:35 | object creation of type Object | CallSensitivityFlow.cs:19:39:19:39 | o |
| CallSensitivityFlow.cs:102:25:102:36 | object creation of type Object | CallSensitivityFlow.cs:27:40:27:40 | o |
| CallSensitivityFlow.cs:103:26:103:37 | object creation of type Object | CallSensitivityFlow.cs:35:41:35:41 | o |
| CallSensitivityFlow.cs:104:30:104:41 | object creation of type Object | CallSensitivityFlow.cs:43:45:43:45 | o |
| CallSensitivityFlow.cs:105:26:105:37 | object creation of type Object | CallSensitivityFlow.cs:105:14:105:41 | call to method FlowThrough |
| CallSensitivityFlow.cs:113:26:113:37 | object creation of type Object | CallSensitivityFlow.cs:124:43:124:43 | o |
| CallSensitivityFlow.cs:114:27:114:38 | object creation of type Object | CallSensitivityFlow.cs:133:44:133:44 | o |
| CallSensitivityFlow.cs:115:32:115:43 | object creation of type Object | CallSensitivityFlow.cs:142:49:142:49 | o |
| CallSensitivityFlow.cs:117:26:117:37 | object creation of type Object | CallSensitivityFlow.cs:124:43:124:43 | o |
| CallSensitivityFlow.cs:118:27:118:38 | object creation of type Object | CallSensitivityFlow.cs:133:44:133:44 | o |
| CallSensitivityFlow.cs:119:32:119:43 | object creation of type Object | CallSensitivityFlow.cs:142:49:142:49 | o |
@@ -38,9 +27,7 @@ edges
| CallSensitivityFlow.cs:133:44:133:44 | o | CallSensitivityFlow.cs:137:22:137:22 | access to parameter o |
| CallSensitivityFlow.cs:142:49:142:49 | o | CallSensitivityFlow.cs:152:18:152:19 | access to local variable o3 |
| CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:189:40:189:40 | o |
| CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:199:40:199:40 | o |
| CallSensitivityFlow.cs:189:40:189:40 | o | CallSensitivityFlow.cs:192:18:192:18 | access to parameter o |
| CallSensitivityFlow.cs:199:40:199:40 | o | CallSensitivityFlow.cs:203:22:203:22 | access to parameter o |
nodes
| CallSensitivityFlow.cs:19:39:19:39 | o | semmle.label | o |
| CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | semmle.label | access to parameter o |
@@ -51,13 +38,9 @@ nodes
| CallSensitivityFlow.cs:43:45:43:45 | o | semmle.label | o |
| CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | semmle.label | access to local variable o3 |
| CallSensitivityFlow.cs:56:46:56:46 | o | semmle.label | o |
| CallSensitivityFlow.cs:56:46:56:46 | o | semmle.label | o |
| CallSensitivityFlow.cs:56:46:56:46 | o | semmle.label | o |
| CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | semmle.label | access to local variable o3 |
| CallSensitivityFlow.cs:72:24:72:35 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:73:25:73:36 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:74:26:74:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:75:30:75:41 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:76:14:76:45 | call to method FlowThrough | semmle.label | call to method FlowThrough |
| CallSensitivityFlow.cs:76:26:76:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:80:26:80:37 | object creation of type Object | semmle.label | object creation of type Object |
@@ -68,21 +51,12 @@ nodes
| CallSensitivityFlow.cs:85:14:85:44 | call to method FlowThrough | semmle.label | call to method FlowThrough |
| CallSensitivityFlow.cs:85:26:85:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:87:31:87:42 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:95:24:95:35 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:96:25:96:36 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:97:26:97:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:98:30:98:41 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:99:14:99:41 | call to method FlowThrough | semmle.label | call to method FlowThrough |
| CallSensitivityFlow.cs:99:26:99:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:101:24:101:35 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:102:25:102:36 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:103:26:103:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:104:30:104:41 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:105:14:105:41 | call to method FlowThrough | semmle.label | call to method FlowThrough |
| CallSensitivityFlow.cs:105:26:105:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:113:26:113:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:114:27:114:38 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:115:32:115:43 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:117:26:117:37 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:118:27:118:38 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:119:32:119:43 | object creation of type Object | semmle.label | object creation of type Object |
@@ -95,14 +69,8 @@ nodes
| CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | semmle.label | object creation of type Object |
| CallSensitivityFlow.cs:189:40:189:40 | o | semmle.label | o |
| CallSensitivityFlow.cs:192:18:192:18 | access to parameter o | semmle.label | access to parameter o |
| CallSensitivityFlow.cs:199:40:199:40 | o | semmle.label | o |
| CallSensitivityFlow.cs:203:22:203:22 | access to parameter o | semmle.label | access to parameter o |
#select
| CallSensitivityFlow.cs:72:24:72:35 | object creation of type Object | CallSensitivityFlow.cs:72:24:72:35 | object creation of type Object | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | $@ | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:73:25:73:36 | object creation of type Object | CallSensitivityFlow.cs:73:25:73:36 | object creation of type Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | $@ | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:74:26:74:37 | object creation of type Object | CallSensitivityFlow.cs:74:26:74:37 | object creation of type Object | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | $@ | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | [cond (line 35): true] access to parameter o |
| CallSensitivityFlow.cs:75:30:75:41 | object creation of type Object | CallSensitivityFlow.cs:75:30:75:41 | object creation of type Object | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | $@ | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:76:26:76:37 | object creation of type Object | CallSensitivityFlow.cs:76:26:76:37 | object creation of type Object | CallSensitivityFlow.cs:76:14:76:45 | call to method FlowThrough | $@ | CallSensitivityFlow.cs:76:14:76:45 | call to method FlowThrough | call to method FlowThrough |
| CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object | CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | $@ | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object | CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | $@ | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:80:26:80:37 | object creation of type Object | CallSensitivityFlow.cs:80:26:80:37 | object creation of type Object | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | $@ | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | [cond (line 35): true] access to parameter o |
@@ -112,21 +80,12 @@ nodes
| CallSensitivityFlow.cs:84:31:84:42 | object creation of type Object | CallSensitivityFlow.cs:84:31:84:42 | object creation of type Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | $@ | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:85:26:85:37 | object creation of type Object | CallSensitivityFlow.cs:85:26:85:37 | object creation of type Object | CallSensitivityFlow.cs:85:14:85:44 | call to method FlowThrough | $@ | CallSensitivityFlow.cs:85:14:85:44 | call to method FlowThrough | call to method FlowThrough |
| CallSensitivityFlow.cs:87:31:87:42 | object creation of type Object | CallSensitivityFlow.cs:87:31:87:42 | object creation of type Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | $@ | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:95:24:95:35 | object creation of type Object | CallSensitivityFlow.cs:95:24:95:35 | object creation of type Object | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | $@ | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:96:25:96:36 | object creation of type Object | CallSensitivityFlow.cs:96:25:96:36 | object creation of type Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | $@ | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:97:26:97:37 | object creation of type Object | CallSensitivityFlow.cs:97:26:97:37 | object creation of type Object | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | $@ | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | [cond (line 35): true] access to parameter o |
| CallSensitivityFlow.cs:98:30:98:41 | object creation of type Object | CallSensitivityFlow.cs:98:30:98:41 | object creation of type Object | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | $@ | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:99:26:99:37 | object creation of type Object | CallSensitivityFlow.cs:99:26:99:37 | object creation of type Object | CallSensitivityFlow.cs:99:14:99:41 | call to method FlowThrough | $@ | CallSensitivityFlow.cs:99:14:99:41 | call to method FlowThrough | call to method FlowThrough |
| CallSensitivityFlow.cs:101:24:101:35 | object creation of type Object | CallSensitivityFlow.cs:101:24:101:35 | object creation of type Object | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | $@ | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:102:25:102:36 | object creation of type Object | CallSensitivityFlow.cs:102:25:102:36 | object creation of type Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | $@ | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:103:26:103:37 | object creation of type Object | CallSensitivityFlow.cs:103:26:103:37 | object creation of type Object | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | $@ | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | [cond (line 35): true] access to parameter o |
| CallSensitivityFlow.cs:104:30:104:41 | object creation of type Object | CallSensitivityFlow.cs:104:30:104:41 | object creation of type Object | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | $@ | CallSensitivityFlow.cs:53:14:53:15 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:105:26:105:37 | object creation of type Object | CallSensitivityFlow.cs:105:26:105:37 | object creation of type Object | CallSensitivityFlow.cs:105:14:105:41 | call to method FlowThrough | $@ | CallSensitivityFlow.cs:105:14:105:41 | call to method FlowThrough | call to method FlowThrough |
| CallSensitivityFlow.cs:113:26:113:37 | object creation of type Object | CallSensitivityFlow.cs:113:26:113:37 | object creation of type Object | CallSensitivityFlow.cs:128:22:128:22 | access to parameter o | $@ | CallSensitivityFlow.cs:128:22:128:22 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:114:27:114:38 | object creation of type Object | CallSensitivityFlow.cs:114:27:114:38 | object creation of type Object | CallSensitivityFlow.cs:137:22:137:22 | access to parameter o | $@ | CallSensitivityFlow.cs:137:22:137:22 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:115:32:115:43 | object creation of type Object | CallSensitivityFlow.cs:115:32:115:43 | object creation of type Object | CallSensitivityFlow.cs:152:18:152:19 | access to local variable o3 | $@ | CallSensitivityFlow.cs:152:18:152:19 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:117:26:117:37 | object creation of type Object | CallSensitivityFlow.cs:117:26:117:37 | object creation of type Object | CallSensitivityFlow.cs:128:22:128:22 | access to parameter o | $@ | CallSensitivityFlow.cs:128:22:128:22 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:118:27:118:38 | object creation of type Object | CallSensitivityFlow.cs:118:27:118:38 | object creation of type Object | CallSensitivityFlow.cs:137:22:137:22 | access to parameter o | $@ | CallSensitivityFlow.cs:137:22:137:22 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:119:32:119:43 | object creation of type Object | CallSensitivityFlow.cs:119:32:119:43 | object creation of type Object | CallSensitivityFlow.cs:152:18:152:19 | access to local variable o3 | $@ | CallSensitivityFlow.cs:152:18:152:19 | access to local variable o3 | access to local variable o3 |
| CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:192:18:192:18 | access to parameter o | $@ | CallSensitivityFlow.cs:192:18:192:18 | access to parameter o | access to parameter o |
| CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:175:21:175:32 | object creation of type Object | CallSensitivityFlow.cs:203:22:203:22 | access to parameter o | $@ | CallSensitivityFlow.cs:203:22:203:22 | access to parameter o | access to parameter o |