mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
Merge pull request #16647 from michaelnebel/csharp/idempotentsummarygeneration
C#: Make summary generation idempotent.
This commit is contained in:
Michael Nebel
@@ -10,8 +10,8 @@ private import semmle.code.csharp.frameworks.system.Collections
|
||||
private import semmle.code.csharp.frameworks.system.collections.Generic
|
||||
|
||||
/**
|
||||
* Gets a source declaration of callable `c` that has a body or has
|
||||
* a flow summary.
|
||||
* Gets a source declaration of callable `c` that has a body and is
|
||||
* defined in source.
|
||||
*/
|
||||
Callable getCallableForDataFlow(Callable c) {
|
||||
result = c.getUnboundDeclaration() and
|
||||
@@ -269,13 +269,19 @@ class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
|
||||
override DataFlowCallable getARuntimeTarget() {
|
||||
result.asCallable() = getCallableForDataFlow(dc.getADynamicTarget())
|
||||
or
|
||||
exists(Callable c, boolean static |
|
||||
result.asSummarizedCallable() = c and
|
||||
c = this.getATarget(static)
|
||||
// Only use summarized callables with generated summaries in case
|
||||
// we are not able to dispatch to a source declaration.
|
||||
exists(FlowSummary::SummarizedCallable sc, boolean static |
|
||||
result.asSummarizedCallable() = sc and
|
||||
sc = this.getATarget(static) and
|
||||
not (
|
||||
sc.applyGeneratedModel() and
|
||||
dc.getADynamicTarget().getUnboundDeclaration().getFile().fromSource()
|
||||
)
|
||||
|
|
||||
static = false
|
||||
or
|
||||
static = true and not c instanceof RuntimeCallable
|
||||
static = true and not sc instanceof RuntimeCallable
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -556,9 +556,9 @@ private predicate interpretNeutral(UnboundCallable c, string kind, string proven
|
||||
private class SummarizedCallableAdapter extends SummarizedCallable {
|
||||
SummarizedCallableAdapter() {
|
||||
exists(Provenance provenance | interpretSummary(this, _, _, _, provenance, _) |
|
||||
not this.hasBody()
|
||||
not this.fromSource()
|
||||
or
|
||||
this.hasBody() and provenance.isManual()
|
||||
this.fromSource() and provenance.isManual()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -200,31 +200,25 @@ namespace My.Qltest
|
||||
void M3()
|
||||
{
|
||||
var o1 = new object();
|
||||
Sink(MixedFlowArgs(o1, null));
|
||||
Sink(Library.MixedFlowArgs(o1, null));
|
||||
|
||||
var o2 = new object();
|
||||
Sink(MixedFlowArgs(null, o2));
|
||||
Sink(Library.MixedFlowArgs(null, o2));
|
||||
}
|
||||
|
||||
void M4()
|
||||
{
|
||||
var o1 = new object();
|
||||
Sink(GeneratedFlowWithGeneratedNeutral(o1));
|
||||
Sink(Library.GeneratedFlowWithGeneratedNeutral(o1));
|
||||
|
||||
var o2 = new object();
|
||||
Sink(GeneratedFlowWithManualNeutral(o2)); // no flow because the modelled method has a manual neutral summary model
|
||||
Sink(Library.GeneratedFlowWithManualNeutral(o2)); // no flow because the modelled method has a manual neutral summary model
|
||||
}
|
||||
|
||||
object GeneratedFlow(object o) => throw null;
|
||||
|
||||
object GeneratedFlowArgs(object o1, object o2) => throw null;
|
||||
|
||||
object MixedFlowArgs(object o1, object o2) => throw null;
|
||||
|
||||
object GeneratedFlowWithGeneratedNeutral(object o) => throw null;
|
||||
|
||||
object GeneratedFlowWithManualNeutral(object o) => throw null;
|
||||
|
||||
static void Sink(object o) { }
|
||||
}
|
||||
|
||||
@@ -268,4 +262,33 @@ namespace My.Qltest
|
||||
|
||||
static void Sink(object o) { }
|
||||
}
|
||||
|
||||
public class J
|
||||
{
|
||||
public virtual object Prop1 { get; }
|
||||
|
||||
public virtual void SetProp1(object o) => throw null;
|
||||
|
||||
public virtual object Prop2 { get; }
|
||||
|
||||
public virtual void SetProp2(object o) => throw null;
|
||||
|
||||
void M1()
|
||||
{
|
||||
var j = new object();
|
||||
SetProp1(j);
|
||||
// flow as there is a manual summary.
|
||||
Sink(this.Prop1);
|
||||
}
|
||||
|
||||
void M2()
|
||||
{
|
||||
var j = new object();
|
||||
SetProp2(j);
|
||||
// no flow as there is only a generated summary and source code is available.
|
||||
Sink(this.Prop2);
|
||||
}
|
||||
|
||||
static void Sink(object o) { }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
using System;
|
||||
|
||||
namespace My.Qltest
|
||||
{
|
||||
public class Library
|
||||
{
|
||||
public static object MixedFlowArgs(object o1, object o2) => throw null;
|
||||
|
||||
public static object GeneratedFlowWithGeneratedNeutral(object o) => throw null;
|
||||
|
||||
public static object GeneratedFlowWithManualNeutral(object o) => throw null;
|
||||
|
||||
public static object StepArgReturnGenerated(object x) => throw null;
|
||||
|
||||
public static object StepArgReturnGeneratedIgnored(object x) => throw null;
|
||||
}
|
||||
}
|
||||
Binary file not shown.
@@ -75,22 +75,27 @@ edges
|
||||
| ExternalFlow.cs:118:21:118:30 | call to method Reverse : null [element] : Object | ExternalFlow.cs:118:17:118:17 | access to local variable b : null [element] : Object | provenance | |
|
||||
| ExternalFlow.cs:118:29:118:29 | access to local variable a : null [element] : Object | ExternalFlow.cs:118:21:118:30 | call to method Reverse : null [element] : Object | provenance | MaD:17 |
|
||||
| ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | ExternalFlow.cs:120:18:120:21 | access to array element | provenance | |
|
||||
| ExternalFlow.cs:205:17:205:18 | access to local variable o2 : Object | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | provenance | |
|
||||
| ExternalFlow.cs:205:17:205:18 | access to local variable o2 : Object | ExternalFlow.cs:206:46:206:47 | access to local variable o2 : Object | provenance | |
|
||||
| ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:205:17:205:18 | access to local variable o2 : Object | provenance | |
|
||||
| ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | provenance | MaD:24 |
|
||||
| ExternalFlow.cs:211:17:211:18 | access to local variable o1 : Object | ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | provenance | |
|
||||
| ExternalFlow.cs:206:46:206:47 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | provenance | MaD:24 |
|
||||
| ExternalFlow.cs:211:17:211:18 | access to local variable o1 : Object | ExternalFlow.cs:212:60:212:61 | access to local variable o1 : Object | provenance | |
|
||||
| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:211:17:211:18 | access to local variable o1 : Object | provenance | |
|
||||
| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | provenance | MaD:25 |
|
||||
| ExternalFlow.cs:244:17:244:17 | access to local variable h : HC | ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | provenance | |
|
||||
| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:244:17:244:17 | access to local variable h : HC | provenance | |
|
||||
| ExternalFlow.cs:245:17:245:17 | access to local variable o : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o | provenance | |
|
||||
| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | provenance | MaD:27 |
|
||||
| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:245:17:245:17 | access to local variable o : HC | provenance | |
|
||||
| ExternalFlow.cs:262:13:262:13 | [post] access to parameter a : MyInlineArray [element] : Object | ExternalFlow.cs:263:30:263:30 | access to parameter a : MyInlineArray [element] : Object | provenance | |
|
||||
| ExternalFlow.cs:262:20:262:31 | object creation of type Object : Object | ExternalFlow.cs:262:13:262:13 | [post] access to parameter a : MyInlineArray [element] : Object | provenance | |
|
||||
| ExternalFlow.cs:263:17:263:17 | access to local variable b : Object | ExternalFlow.cs:264:18:264:18 | access to local variable b | provenance | |
|
||||
| ExternalFlow.cs:263:21:263:31 | call to method GetFirst : Object | ExternalFlow.cs:263:17:263:17 | access to local variable b : Object | provenance | |
|
||||
| ExternalFlow.cs:263:30:263:30 | access to parameter a : MyInlineArray [element] : Object | ExternalFlow.cs:263:21:263:31 | call to method GetFirst : Object | provenance | MaD:28 |
|
||||
| ExternalFlow.cs:212:60:212:61 | access to local variable o1 : Object | ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | provenance | MaD:25 |
|
||||
| ExternalFlow.cs:238:17:238:17 | access to local variable h : HC | ExternalFlow.cs:239:21:239:21 | access to local variable h : HC | provenance | |
|
||||
| ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | ExternalFlow.cs:238:17:238:17 | access to local variable h : HC | provenance | |
|
||||
| ExternalFlow.cs:239:17:239:17 | access to local variable o : HC | ExternalFlow.cs:240:18:240:18 | access to local variable o | provenance | |
|
||||
| ExternalFlow.cs:239:21:239:21 | access to local variable h : HC | ExternalFlow.cs:239:21:239:39 | call to method ExtensionMethod : HC | provenance | MaD:27 |
|
||||
| ExternalFlow.cs:239:21:239:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:239:17:239:17 | access to local variable o : HC | provenance | |
|
||||
| ExternalFlow.cs:256:13:256:13 | [post] access to parameter a : MyInlineArray [element] : Object | ExternalFlow.cs:257:30:257:30 | access to parameter a : MyInlineArray [element] : Object | provenance | |
|
||||
| ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | ExternalFlow.cs:256:13:256:13 | [post] access to parameter a : MyInlineArray [element] : Object | provenance | |
|
||||
| ExternalFlow.cs:257:17:257:17 | access to local variable b : Object | ExternalFlow.cs:258:18:258:18 | access to local variable b | provenance | |
|
||||
| ExternalFlow.cs:257:21:257:31 | call to method GetFirst : Object | ExternalFlow.cs:257:17:257:17 | access to local variable b : Object | provenance | |
|
||||
| ExternalFlow.cs:257:30:257:30 | access to parameter a : MyInlineArray [element] : Object | ExternalFlow.cs:257:21:257:31 | call to method GetFirst : Object | provenance | MaD:28 |
|
||||
| ExternalFlow.cs:278:17:278:17 | access to local variable j : Object | ExternalFlow.cs:279:22:279:22 | access to local variable j : Object | provenance | |
|
||||
| ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | ExternalFlow.cs:278:17:278:17 | access to local variable j : Object | provenance | |
|
||||
| ExternalFlow.cs:279:13:279:23 | [post] this access : J | ExternalFlow.cs:281:18:281:21 | this access : J | provenance | |
|
||||
| ExternalFlow.cs:279:22:279:22 | access to local variable j : Object | ExternalFlow.cs:279:13:279:23 | [post] this access : J | provenance | MaD:30 |
|
||||
| ExternalFlow.cs:281:18:281:21 | this access : J | ExternalFlow.cs:281:18:281:27 | access to property Prop1 | provenance | MaD:29 |
|
||||
nodes
|
||||
| ExternalFlow.cs:9:20:9:23 | access to local variable arg1 : Object | semmle.label | access to local variable arg1 : Object |
|
||||
| ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
@@ -186,24 +191,30 @@ nodes
|
||||
| ExternalFlow.cs:120:18:120:21 | access to array element | semmle.label | access to array element |
|
||||
| ExternalFlow.cs:205:17:205:18 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
|
||||
| ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
|
||||
| ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
|
||||
| ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
|
||||
| ExternalFlow.cs:206:46:206:47 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
|
||||
| ExternalFlow.cs:211:17:211:18 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
|
||||
| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | semmle.label | call to method GeneratedFlowWithGeneratedNeutral |
|
||||
| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
|
||||
| ExternalFlow.cs:244:17:244:17 | access to local variable h : HC | semmle.label | access to local variable h : HC |
|
||||
| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
|
||||
| ExternalFlow.cs:245:17:245:17 | access to local variable o : HC | semmle.label | access to local variable o : HC |
|
||||
| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
|
||||
| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
|
||||
| ExternalFlow.cs:246:18:246:18 | access to local variable o | semmle.label | access to local variable o |
|
||||
| ExternalFlow.cs:262:13:262:13 | [post] access to parameter a : MyInlineArray [element] : Object | semmle.label | [post] access to parameter a : MyInlineArray [element] : Object |
|
||||
| ExternalFlow.cs:262:20:262:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:263:17:263:17 | access to local variable b : Object | semmle.label | access to local variable b : Object |
|
||||
| ExternalFlow.cs:263:21:263:31 | call to method GetFirst : Object | semmle.label | call to method GetFirst : Object |
|
||||
| ExternalFlow.cs:263:30:263:30 | access to parameter a : MyInlineArray [element] : Object | semmle.label | access to parameter a : MyInlineArray [element] : Object |
|
||||
| ExternalFlow.cs:264:18:264:18 | access to local variable b | semmle.label | access to local variable b |
|
||||
| ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | semmle.label | call to method GeneratedFlowWithGeneratedNeutral |
|
||||
| ExternalFlow.cs:212:60:212:61 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
|
||||
| ExternalFlow.cs:238:17:238:17 | access to local variable h : HC | semmle.label | access to local variable h : HC |
|
||||
| ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
|
||||
| ExternalFlow.cs:239:17:239:17 | access to local variable o : HC | semmle.label | access to local variable o : HC |
|
||||
| ExternalFlow.cs:239:21:239:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
|
||||
| ExternalFlow.cs:239:21:239:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
|
||||
| ExternalFlow.cs:240:18:240:18 | access to local variable o | semmle.label | access to local variable o |
|
||||
| ExternalFlow.cs:256:13:256:13 | [post] access to parameter a : MyInlineArray [element] : Object | semmle.label | [post] access to parameter a : MyInlineArray [element] : Object |
|
||||
| ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:257:17:257:17 | access to local variable b : Object | semmle.label | access to local variable b : Object |
|
||||
| ExternalFlow.cs:257:21:257:31 | call to method GetFirst : Object | semmle.label | call to method GetFirst : Object |
|
||||
| ExternalFlow.cs:257:30:257:30 | access to parameter a : MyInlineArray [element] : Object | semmle.label | access to parameter a : MyInlineArray [element] : Object |
|
||||
| ExternalFlow.cs:258:18:258:18 | access to local variable b | semmle.label | access to local variable b |
|
||||
| ExternalFlow.cs:278:17:278:17 | access to local variable j : Object | semmle.label | access to local variable j : Object |
|
||||
| ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:279:13:279:23 | [post] this access : J | semmle.label | [post] this access : J |
|
||||
| ExternalFlow.cs:279:22:279:22 | access to local variable j : Object | semmle.label | access to local variable j : Object |
|
||||
| ExternalFlow.cs:281:18:281:21 | this access : J | semmle.label | this access : J |
|
||||
| ExternalFlow.cs:281:18:281:27 | access to property Prop1 | semmle.label | access to property Prop1 |
|
||||
subpaths
|
||||
| ExternalFlow.cs:84:29:84:32 | access to local variable objs : null [element] : Object | ExternalFlow.cs:84:35:84:35 | o : Object | ExternalFlow.cs:84:40:84:40 | access to parameter o : Object | ExternalFlow.cs:84:25:84:41 | call to method Map<Object,Object> : T[] [element] : Object |
|
||||
#select
|
||||
@@ -227,7 +238,8 @@ subpaths
|
||||
| ExternalFlow.cs:104:18:104:25 | access to field Field | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | ExternalFlow.cs:104:18:104:25 | access to field Field | $@ | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:246:18:246:18 | access to local variable o | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o | $@ | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | object creation of type HC : HC |
|
||||
| ExternalFlow.cs:264:18:264:18 | access to local variable b | ExternalFlow.cs:262:20:262:31 | object creation of type Object : Object | ExternalFlow.cs:264:18:264:18 | access to local variable b | $@ | ExternalFlow.cs:262:20:262:31 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:48 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:62 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:240:18:240:18 | access to local variable o | ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | ExternalFlow.cs:240:18:240:18 | access to local variable o | $@ | ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | object creation of type HC : HC |
|
||||
| ExternalFlow.cs:258:18:258:18 | access to local variable b | ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | ExternalFlow.cs:258:18:258:18 | access to local variable b | $@ | ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:281:18:281:27 | access to property Prop1 | ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | ExternalFlow.cs:281:18:281:27 | access to property Prop1 | $@ | ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
|
||||
@@ -27,16 +27,20 @@ extensions:
|
||||
- ["My.Qltest", "G", false, "GeneratedFlow", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "G", false, "GeneratedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "G", false, "GeneratedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "G", false, "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "G", false, "GeneratedFlowWithManualNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "Library", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "Library", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "Library", false, "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "Library", false, "GeneratedFlowWithManualNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "HE", false, "ExtensionMethod", "(My.Qltest.HI)", "", "Argument[0]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "I", false, "GetFirst", "(My.Qltest.MyInlineArray)", "", "Argument[0].Element", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "J", false, "get_Prop1", "()", "", "Argument[this]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "J", false, "SetProp1", "(System.Object)", "", "Argument[0]", "Argument[this]", "value", "manual"]
|
||||
- ["My.Qltest", "J", false, "get_Prop2", "()", "", "Argument[this]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "J", false, "SetProp2", "(System.Object)", "", "Argument[0]", "Argument[this]", "value", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/csharp-all
|
||||
extensible: neutralModel
|
||||
# "namespace", "type", "name", "signature", "kind", "provenance"
|
||||
data:
|
||||
- ["My.Qltest", "G", "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "summary", "df-generated"]
|
||||
- ["My.Qltest", "G", "GeneratedFlowWithManualNeutral", "(System.Object)", "summary", "manual"]
|
||||
- ["My.Qltest", "Library", "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "summary", "df-generated"]
|
||||
- ["My.Qltest", "Library", "GeneratedFlowWithManualNeutral", "(System.Object)", "summary", "manual"]
|
||||
|
||||
@@ -20,21 +20,6 @@ module TaintConfig implements DataFlow::ConfigSig {
|
||||
|
||||
module Taint = TaintTracking::Global<TaintConfig>;
|
||||
|
||||
/**
|
||||
* Emulate that methods with summaries do not have a body.
|
||||
* This is relevant for dataflow analysis using summaries with a generated like
|
||||
* provenance as generated summaries are only applied, if a
|
||||
* callable does not have a body.
|
||||
*/
|
||||
private class MethodsWithGeneratedModels extends Method {
|
||||
MethodsWithGeneratedModels() {
|
||||
this.hasFullyQualifiedName("My.Qltest", "G",
|
||||
["MixedFlowArgs", "GeneratedFlowWithGeneratedNeutral", "GeneratedFlowWithManualNeutral"])
|
||||
}
|
||||
|
||||
override predicate hasBody() { none() }
|
||||
}
|
||||
|
||||
from Taint::PathNode source, Taint::PathNode sink
|
||||
where Taint::flowPath(source, sink)
|
||||
select sink, source, sink, "$@", source, source.toString()
|
||||
|
||||
@@ -44,10 +44,10 @@ namespace My.Qltest
|
||||
new Sub().StepOverride("string");
|
||||
|
||||
object arg4 = new object();
|
||||
this.StepArgQualGenerated(arg4);
|
||||
|
||||
Library.StepArgReturnGenerated(arg4);
|
||||
|
||||
object arg5 = new object();
|
||||
this.StepArgQualGeneratedIgnored(arg5);
|
||||
Library.StepArgReturnGeneratedIgnored(arg5);
|
||||
}
|
||||
|
||||
object StepArgRes(object x) { return null; }
|
||||
@@ -56,10 +56,6 @@ namespace My.Qltest
|
||||
|
||||
void StepArgQual(object x) { }
|
||||
|
||||
void StepArgQualGenerated(object x) { }
|
||||
|
||||
void StepArgQualGeneratedIgnored(object x) { }
|
||||
|
||||
object StepQualRes() { return null; }
|
||||
|
||||
void StepQualArg(object @out) { }
|
||||
|
||||
@@ -11,12 +11,12 @@ summaryThroughStep
|
||||
| Steps.cs:41:29:41:29 | 0 | Steps.cs:41:13:41:30 | call to method StepGeneric | true |
|
||||
| Steps.cs:42:30:42:34 | false | Steps.cs:42:13:42:35 | call to method StepGeneric2<Boolean> | true |
|
||||
| Steps.cs:44:36:44:43 | "string" | Steps.cs:44:13:44:44 | call to method StepOverride | true |
|
||||
| Steps.cs:47:39:47:42 | access to local variable arg4 | Steps.cs:47:13:47:16 | [post] this access | false |
|
||||
| Steps.cs:47:44:47:47 | access to local variable arg4 | Steps.cs:47:13:47:48 | call to method StepArgReturnGenerated | false |
|
||||
summaryGetterStep
|
||||
| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:67:13:67:17 | field Field |
|
||||
| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:73:13:73:20 | property Property |
|
||||
| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:63:13:63:17 | field Field |
|
||||
| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:69:13:69:20 | property Property |
|
||||
| Steps.cs:36:13:36:16 | this access | Steps.cs:36:13:36:36 | call to method StepElementGetter | file://:0:0:0:0 | element |
|
||||
summarySetterStep
|
||||
| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:67:13:67:17 | field Field |
|
||||
| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:73:13:73:20 | property Property |
|
||||
| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:63:13:63:17 | field Field |
|
||||
| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:69:13:69:20 | property Property |
|
||||
| Steps.cs:38:36:38:36 | 0 | Steps.cs:38:13:38:16 | [post] this access | file://:0:0:0:0 | element |
|
||||
|
||||
@@ -18,13 +18,13 @@ extensions:
|
||||
- ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric2<S>", "(S)", "", "Argument[0]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "C+Base<T>", true, "StepOverride", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "C", false, "StepArgQualGenerated", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["My.Qltest", "C", false, "StepArgQualGeneratedIgnored", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
|
||||
- ["My.Qltest", "Library", false, "StepArgReturnGenerated", "(System.Object)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
|
||||
- ["My.Qltest", "Library", false, "StepArgReturnGeneratedIgnored", "(System.Object)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
|
||||
- addsTo:
|
||||
pack: codeql/csharp-all
|
||||
extensible: neutralModel
|
||||
# "namespace", "type", "name", "signature", "kind", "provenance"
|
||||
data:
|
||||
- ["My.Qltest", "C", "StepArgQualGenerated", "(System.Object)", "summary", "df-generated"]
|
||||
- ["My.Qltest", "C", "StepArgQualGeneratedIgnored", "(System.Object)", "summary", "manual"]
|
||||
- ["My.Qltest", "Library", "StepArgReturnGenerated", "(System.Object)", "summary", "df-generated"]
|
||||
- ["My.Qltest", "Library", "StepArgReturnGeneratedIgnored", "(System.Object)", "summary", "manual"]
|
||||
|
||||
|
||||
@@ -6,22 +6,6 @@ import semmle.code.csharp.dataflow.FlowSummary
|
||||
import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
|
||||
import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
|
||||
|
||||
/**
|
||||
* Emulate that methods with summaries do not have a body.
|
||||
* This is relevant for dataflow analysis using summaries with a generated like
|
||||
* provenance as generated summaries are only applied, if a
|
||||
* callable does not have a body.
|
||||
*/
|
||||
private class StepArgQualGenerated extends Method {
|
||||
StepArgQualGenerated() {
|
||||
exists(string name |
|
||||
this.hasFullyQualifiedName("My.Qltest", "C", name) and name.matches("StepArgQualGenerated%")
|
||||
)
|
||||
}
|
||||
|
||||
override predicate hasBody() { none() }
|
||||
}
|
||||
|
||||
query predicate summaryThroughStep(
|
||||
DataFlow::Node node1, DataFlow::Node node2, boolean preservesValue
|
||||
) {
|
||||
|
||||
@@ -575,3 +575,4 @@ public class Inheritance
|
||||
public override string Prop { get { return tainted; } }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user