hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into fix/path-injection-read-subkind

Browse Source
This commit is contained in:
MarkLee131
2026-05-07 18:11:45 +08:00
committed by GitHub
parent 33035dbfc8 e6f587e761
commit e8553c7449
65 changed files with 891 additions and 1034 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/mad_modelDiff.yml vendored
View File

@@ -70,7 +70,7 @@ jobs:
SHORTNAME=`basename $DATABASE`
python misc/scripts/models-as-data/generate_mad.py --language java --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
mkdir -p $MODELS/$SHORTNAME
mv java/ql/lib/ext/generated/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
mv java/ql/lib/ext/generated/modelgenerator/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
cd ..
}

2
.github/workflows/python-tooling.yml vendored
View File

@@ -5,7 +5,7 @@ on:
paths:
- "misc/bazel/**"
- "misc/codegen/**"
- "misc/scripts/models-as-data/bulk_generate_mad.py"
- "misc/scripts/models-as-data/*.py"
- "*.bazel*"
- .github/workflows/codegen.yml
- .pre-commit-config.yaml

4
actions/ql/lib/change-notes/2026-04-15-poisonable-steps-additions-alterations.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Altered 2 patterns in the `poisonable_steps` modelling. Extra sinks are detected in the following cases: scripts executed via python modules and `go run` in directories are detected as potential mechanisms of injection. For the go execution pattern, the pattern is updated to now ignore flags that occur between go and the specific command. This change may lead to more results being detected by the following queries: `actions/untrusted-checkout/high`, `actions/untrusted-checkout/critical`, `actions/untrusted-checkout-toctou/high`, `actions/untrusted-checkout-toctou/critical`, `actions/cache-poisoning/poisonable-step`, `actions/cache-poisoning/direct-cache` and `actions/artifact-poisoning/path-traversal`.

4
actions/ql/lib/ext/config/poisonable_steps.yml
View File

@@ -70,7 +70,7 @@ extensions:
- ["(source|sh|bash|zsh|fish)\\s+([^\\s]+)\\b", 2]
- ["(node)\\s+([^\\s]+)(\\.js|\\.ts)\\b", 2]
- ["(python[\\d\\.]*)\\s+([^\\s]+)\\.py\\b", 2]
- ["(python[\\d\\.]*)\\s+-m\\s+([A-Za-z_][\\w\\.]*)\\b", 2] # eg: pythonX -m anything(dir or file)
- ["(ruby)\\s+([^\\s]+)\\.rb\\b", 2]
- ["(go)\\s+(generate|run)\\s+([^\\s]+)\\.go\\b", 3]
- ["(go)\\s+(generate|run)(?:\\s+-[^\\s]+)*\\s+([^\\s]+)", 3]
- ["(dotnet)\\s+([^\\s]+)\\.csproj\\b", 2]

33
actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.md
View File

@@ -1,6 +1,35 @@
## Overview
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. Under certain conditions described below, attackers can take over a repository by opening malicious PRs from forks. The attacks can result in malicious code execution causing unauthorized changes to the repository or exfiltration of repository secrets and a compromise of connected systems.
## Workflow Security Model
In GitHub Actions, there is a distinction between unprivileged and privileged workflows. For example, a workflow with a `pull_request` trigger is unprivileged while a workflow with `pull_request_target` is privileged.
This is relevant especially for PRs from forks. Normal PRs can only be submitted by people who have write access to a repository, while PRs from forks can be submitted by anyone.
On a PR from a fork, an unprivileged `pull_request` workflow has only limited capabilities but a privileged `pull_request_target` workflow is much more dangerous. A privileged workflow:
* Runs in the context of the base repository
* Has access to organization and repository secrets (e.g., API keys, deployment tokens)
* Has a read/write `GITHUB_TOKEN` by default
* Can access private resources
Certain triggers automatically grant a workflow elevated privileges:
* `pull_request_target` as described above
* `workflow_run`: Triggered when another workflow completes.
* `issue_comment`: Triggered when a comment is made on an issue or PR.
## Attack Details
* A repository has a privileged workflow
* An attacker forks the repository and adds malicious code (e.g., in the build script)
* The attacker opens a PR from the fork, and, if needed, comments on the PR
* The workflow in the base repository checks out the forked code
* The workflow runs, (e.g. the build script etc.), which contains the malicious code
Please note that not only build scripts can be malicious code vectors. There is a large number of other possibilities. Some of them are listed in the [LOTP](https://boostsecurityio.github.io/lotp/) catalog.
## Recommendation
@@ -133,3 +162,5 @@ jobs:
## References
- GitHub Security Lab Research: [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
- Mitigating risks of untrusted checkout: [GitHub Docs](https://docs.github.com/en/enterprise-cloud@latest/actions/reference/security/secure-use#mitigating-the-risks-of-untrusted-code-checkout).
- Living Off the Pipeline: [LOTP](https://boostsecurityio.github.io/lotp/).

33
actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.md
View File

@@ -1,6 +1,35 @@
## Overview
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. Under certain conditions described below, attackers can take over a repository by opening malicious PRs from forks. The attacks can result in malicious code execution causing unauthorized changes to the repository or exfiltration of repository secrets and a compromise of connected systems.
## Workflow Security Model
In GitHub Actions, there is a distinction between unprivileged and privileged workflows. For example, a workflow with a `pull_request` trigger is unprivileged while a workflow with `pull_request_target` is privileged.
This is relevant especially for PRs from forks. Normal PRs can only be submitted by people who have write access to a repository, while PRs from forks can be submitted by anyone.
On a PR from a fork, an unprivileged `pull_request` workflow has only limited capabilities but a privileged `pull_request_target` workflow is much more dangerous. A privileged workflow:
* Runs in the context of the base repository
* Has access to organization and repository secrets (e.g., API keys, deployment tokens)
* Has a read/write `GITHUB_TOKEN` by default
* Can access private resources
Certain triggers automatically grant a workflow elevated privileges:
* `pull_request_target` as described above
* `workflow_run`: Triggered when another workflow completes.
* `issue_comment`: Triggered when a comment is made on an issue or PR.
## Attack Details
* A repository has a privileged workflow
* An attacker forks the repository and adds malicious code (e.g., in the build script)
* The attacker opens a PR from the fork, and, if needed, comments on the PR
* The workflow in the base repository checks out the forked code
* The workflow runs, (e.g. the build script etc.), which contains the malicious code
Please note that not only build scripts can be malicious code vectors. There is a large number of other possibilities. Some of them are listed in the [LOTP](https://boostsecurityio.github.io/lotp/) catalog.
## Recommendation
@@ -133,3 +162,5 @@ jobs:
## References
- GitHub Security Lab Research: [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
- Mitigating risks of untrusted checkout: [GitHub Docs](https://docs.github.com/en/enterprise-cloud@latest/actions/reference/security/secure-use#mitigating-the-risks-of-untrusted-code-checkout).
- Living Off the Pipeline: [LOTP](https://boostsecurityio.github.io/lotp/).

2
actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql
View File

@@ -1,5 +1,5 @@
/**
* @name Checkout of untrusted code in trusted context
* @name Checkout of untrusted code in privileged context without privileged context use
* @description Privileged workflows have read/write access to the base repository and access to secrets.
* By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
* that is able to push to the base repository and to access secrets.

33
actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.md
View File

@@ -1,6 +1,35 @@
## Overview
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. Under certain conditions described below, attackers can take over a repository by opening malicious PRs from forks. The attacks can result in malicious code execution causing unauthorized changes to the repository or exfiltration of repository secrets and a compromise of connected systems.
## Workflow Security Model
In GitHub Actions, there is a distinction between unprivileged and privileged workflows. For example, a workflow with a `pull_request` trigger is unprivileged while a workflow with `pull_request_target` is privileged.
This is relevant especially for PRs from forks. Normal PRs can only be submitted by people who have write access to a repository, while PRs from forks can be submitted by anyone.
On a PR from a fork, an unprivileged `pull_request` workflow has only limited capabilities but a privileged `pull_request_target` workflow is much more dangerous. A privileged workflow:
* Runs in the context of the base repository
* Has access to organization and repository secrets (e.g., API keys, deployment tokens)
* Has a read/write `GITHUB_TOKEN` by default
* Can access private resources
Certain triggers automatically grant a workflow elevated privileges:
* `pull_request_target` as described above
* `workflow_run`: Triggered when another workflow completes.
* `issue_comment`: Triggered when a comment is made on an issue or PR.
## Attack Details
* A repository has a privileged workflow
* An attacker forks the repository and adds malicious code (e.g., in the build script)
* The attacker opens a PR from the fork, and, if needed, comments on the PR
* The workflow in the base repository checks out the forked code
* The workflow runs, (e.g. the build script etc.), which contains the malicious code
Please note that not only build scripts can be malicious code vectors. There is a large number of other possibilities. Some of them are listed in the [LOTP](https://boostsecurityio.github.io/lotp/) catalog.
## Recommendation
@@ -133,3 +162,5 @@ jobs:
## References
- GitHub Security Lab Research: [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
- Mitigating risks of untrusted checkout: [GitHub Docs](https://docs.github.com/en/enterprise-cloud@latest/actions/reference/security/secure-use#mitigating-the-risks-of-untrusted-code-checkout).
- Living Off the Pipeline: [LOTP](https://boostsecurityio.github.io/lotp/).

4
actions/ql/src/change-notes/2026-04-15-untrusted-checkout-improvements-helpfile.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: fix
---
* Fixed help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Previously the messages were unclear as to why and how the vulnerabilities could occur.

4
actions/ql/src/change-notes/2026-04-15-untrusted-checkout-improvements-metadata.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Adjusted the name of `actions/untrusted-checkout/high` to more clearly describe which parts of the scenario are in a privileged context.

4
csharp/ql/consistency-queries/SsaConsistency.ql
View File

@@ -7,8 +7,8 @@ query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
// Local variables in C# must be initialized before every use, so uninitialized
// local variables should not have an SSA definition, as that would imply that
// the declaration is live (can reach a use without passing through a definition)
exists(ExplicitDefinition def |
d = def.getADefinition().(AssignableDefinitions::LocalVariableDefinition).getDeclaration()
exists(SsaExplicitWrite def |
d = def.getDefinition().(AssignableDefinitions::LocalVariableDefinition).getDeclaration()
|
not d = any(ForeachStmt fs).getVariableDeclExpr() and
not d = any(SpecificCatchClause scc).getVariableDeclExpr() and

4
csharp/ql/lib/change-notes/2026-05-01-ssa-replacement.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: deprecated
---
* The QL classes in the C# SSA library have been renamed to improve consistency between languages. Any custom QL code that makes use of SSA needs to be updated. The old classes have been deprecated and include more detailed migration instructions in their qldoc.

6
csharp/ql/lib/semmle/code/csharp/Assignable.qll
View File

@@ -500,11 +500,7 @@ class AssignableDefinition extends TAssignableDefinition {
*/
pragma[nomagic]
AssignableRead getAFirstRead() {
exists(ControlFlowNode cfn | cfn = result.getControlFlowNode() |
exists(Ssa::ExplicitDefinition def | result = def.getAFirstReadAtNode(cfn) |
this = def.getADefinition()
)
)
exists(SsaExplicitWrite def | result = Ssa::ssaGetAFirstUse(def) | this = def.getDefinition())
}
/** Gets a textual representation of this assignable definition. */

12
csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowReachability.qll
View File

@@ -26,17 +26,7 @@ private module ControlFlowInput implements InputSig<Location, ControlFlowNode, B
class Expr = CS::Expr;
class SourceVariable = Ssa::SourceVariable;
class SsaDefinition = Ssa::Definition;
class SsaExplicitWrite extends SsaDefinition instanceof Ssa::ExplicitDefinition {
Expr getValue() { result = super.getADefinition().getSource() }
}
class SsaPhiDefinition = Ssa::PhiNode;
class SsaUncertainWrite = Ssa::UncertainDefinition;
import Ssa
class GuardValue = Guards::GuardValue;

54
csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
View File

@@ -191,23 +191,7 @@ private module GuardsImpl = SharedGuards::Make<Location, Cfg, GuardsInput>;
class GuardValue = GuardsImpl::GuardValue;
private module LogicInput implements GuardsImpl::LogicInputSig {
class SsaDefinition extends Ssa::Definition {
Expr getARead() { super.getARead() = result }
}
class SsaExplicitWrite extends SsaDefinition instanceof Ssa::ExplicitDefinition {
Expr getValue() { result = super.getADefinition().getSource() }
}
class SsaPhiDefinition extends SsaDefinition instanceof Ssa::PhiNode {
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
super.hasInputFromBlock(inp, bb)
}
}
class SsaParameterInit extends SsaDefinition instanceof Ssa::ParameterDefinition {
Parameter getParameter() { result = super.getParameter() }
}
import Ssa
predicate additionalNullCheck(GuardsImpl::PreGuard guard, GuardValue val, Expr e, boolean isNull) {
// Comparison with a non-`null` value, for example `x?.Length > 0`
@@ -586,7 +570,7 @@ class AccessOrCallExpr extends Expr {
* An expression can have more than one SSA qualifier in the presence
* of control flow splitting.
*/
Ssa::Definition getAnSsaQualifier(ControlFlowNode cfn) { result = getAnSsaQualifier(this, cfn) }
SsaDefinition getAnSsaQualifier(ControlFlowNode cfn) { result = getAnSsaQualifier(this, cfn) }
}
private Declaration getDeclarationTarget(Expr e) {
@@ -594,22 +578,22 @@ private Declaration getDeclarationTarget(Expr e) {
result = e.(Call).getTarget()
}
private Ssa::Definition getAnSsaQualifier(Expr e, ControlFlowNode cfn) {
private SsaDefinition getAnSsaQualifier(Expr e, ControlFlowNode cfn) {
e = getATrackedAccess(result, cfn)
or
not e = getATrackedAccess(_, _) and
result = getAnSsaQualifier(e.(QualifiableExpr).getQualifier(), cfn)
}
private AssignableAccess getATrackedAccess(Ssa::Definition def, ControlFlowNode cfn) {
result = def.getAReadAtNode(cfn)
private AssignableAccess getATrackedAccess(SsaDefinition def, ControlFlowNode cfn) {
result = def.getARead() and cfn = result.getControlFlowNode()
or
result = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess() and
result = def.(SsaExplicitWrite).getDefinition().getTargetAccess() and
cfn = def.getControlFlowNode()
}
private predicate ssaMustHaveValue(Expr e, GuardValue v) {
exists(Ssa::Definition def, BasicBlock bb |
exists(SsaDefinition def, BasicBlock bb |
e = def.getARead() and
e.getBasicBlock() = bb and
Guards::ssaControls(def, bb, v)
@@ -841,14 +825,12 @@ module Internal {
)
or
e =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
any(SsaDefinition def |
forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
}
private predicate nullDef(Ssa::ExplicitDefinition def) {
nullValueImplied(def.getADefinition().getSource())
}
private predicate nullDef(SsaExplicitWrite def) { nullValueImplied(def.getValue()) }
predicate nonNullValueImplied(Expr e) {
nonNullValue(e)
@@ -856,14 +838,12 @@ module Internal {
exists(Expr e1 | nonNullValueImplied(e1) and nonNullValueImpliedUnary(e1, e))
or
e =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
any(SsaDefinition def |
forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
}
private predicate nonNullDef(Ssa::ExplicitDefinition def) {
nonNullValueImplied(def.getADefinition().getSource())
}
private predicate nonNullDef(SsaExplicitWrite def) { nonNullValueImplied(def.getValue()) }
/** A callable that always returns a non-`null` value. */
private class NonNullCallable extends Callable {
@@ -1120,7 +1100,7 @@ module Internal {
private predicate nodeIsGuardedBySameSubExprSsaDef0(
ControlFlowNode cfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
ControlFlowNode subCfn, BasicBlock subCfnBB, AccessOrCallExpr sub, GuardValue v,
Ssa::Definition def
SsaDefinition def
) {
nodeIsGuardedBySameSubExpr(cfn, guardedBB, guarded, g, sub, v) and
def = sub.getAnSsaQualifier(subCfn) and
@@ -1130,7 +1110,7 @@ module Internal {
pragma[nomagic]
private predicate nodeIsGuardedBySameSubExprSsaDef(
ControlFlowNode guardedCfn, AccessOrCallExpr guarded, Guard g, ControlFlowNode subCfn,
AccessOrCallExpr sub, GuardValue v, Ssa::Definition def
AccessOrCallExpr sub, GuardValue v, SsaDefinition def
) {
exists(BasicBlock guardedBB, BasicBlock subCfnBB |
nodeIsGuardedBySameSubExprSsaDef0(guardedCfn, guardedBB, guarded, g, subCfn, subCfnBB, sub,
@@ -1149,7 +1129,7 @@ module Internal {
cached
predicate isGuardedByExpr(AccessOrCallExpr guarded, Guard g, AccessOrCallExpr sub, GuardValue v) {
isGuardedByExpr0(guarded, g, sub, v) and
forall(ControlFlowNode subCfn, Ssa::Definition def |
forall(ControlFlowNode subCfn, SsaDefinition def |
nodeIsGuardedBySameSubExprSsaDef(_, guarded, g, subCfn, sub, v, def)
|
def = guarded.getAnSsaQualifier(_)
@@ -1161,7 +1141,7 @@ module Internal {
ControlFlowNodes::ElementNode guarded, Guard g, AccessOrCallExpr sub, GuardValue v
) {
nodeIsGuardedBySameSubExpr(guarded, _, _, g, sub, v) and
forall(ControlFlowNode subCfn, Ssa::Definition def |
forall(ControlFlowNode subCfn, SsaDefinition def |
nodeIsGuardedBySameSubExprSsaDef(guarded, _, g, subCfn, sub, v, def)
|
def =

74
csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
View File

@@ -67,8 +67,8 @@ class AlwaysNullExpr extends Expr {
exists(AlwaysNullExpr e1, AlwaysNullExpr e2 | G::Internal::nullValueImpliedBinary(e1, e2, this))
or
this =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
any(SsaDefinition def |
forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
or
exists(Callable target |
@@ -80,9 +80,7 @@ class AlwaysNullExpr extends Expr {
}
/** Holds if SSA definition `def` is always `null`. */
private predicate nullDef(Ssa::ExplicitDefinition def) {
def.getADefinition().getSource() instanceof AlwaysNullExpr
}
private predicate nullDef(SsaExplicitWrite def) { def.getValue() instanceof AlwaysNullExpr }
/** An expression that is never `null`. */
class NonNullExpr extends Expr {
@@ -94,8 +92,8 @@ class NonNullExpr extends Expr {
this instanceof G::NullGuardedExpr
or
this =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
any(SsaDefinition def |
forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
or
exists(Callable target |
@@ -108,10 +106,10 @@ class NonNullExpr extends Expr {
}
/** Holds if SSA definition `def` is never `null`. */
private predicate nonNullDef(Ssa::ExplicitDefinition def) {
def.getADefinition().getSource() instanceof NonNullExpr
private predicate nonNullDef(SsaExplicitWrite def) {
def.getValue() instanceof NonNullExpr
or
exists(AssignableDefinition ad | ad = def.getADefinition() |
exists(AssignableDefinition ad | ad = def.getDefinition() |
ad instanceof AssignableDefinitions::PatternDefinition
or
ad =
@@ -124,13 +122,11 @@ private predicate nonNullDef(Ssa::ExplicitDefinition def) {
}
/**
* Holds if `node` is a dereference `d` of SSA definition `def`.
* Holds if `d` is a dereference of SSA definition `def`.
*/
private predicate dereferenceAt(ControlFlowNode node, Ssa::Definition def, Dereference d) {
d = def.getAReadAtNode(node)
}
private predicate dereferenceAt(SsaDefinition def, Dereference d) { d = def.getARead() }
private predicate isMaybeNullArgument(Ssa::ParameterDefinition def, MaybeNullExpr arg) {
private predicate isMaybeNullArgument(SsaParameterInit def, MaybeNullExpr arg) {
exists(AssignableDefinitions::ImplicitParameterDefinition pdef, Parameter p |
p = def.getParameter()
|
@@ -182,7 +178,7 @@ private predicate hasMultipleParamsArguments(Call c) {
}
/** Holds if `def` is an SSA definition that may be `null`. */
private predicate defMaybeNull(Ssa::Definition def, ControlFlowNode node, string msg, Element reason) {
private predicate defMaybeNull(SsaDefinition def, ControlFlowNode node, string msg, Element reason) {
not nonNullDef(def) and
(
// A variable compared to `null` might be `null`
@@ -190,10 +186,10 @@ private predicate defMaybeNull(Ssa::Definition def, ControlFlowNode node, string
de.guardSuggestsMaybeNull(reason) and
msg = "as suggested by $@ null check" and
node = def.getControlFlowNode() and
not de = any(Ssa::PhiNode phi).getARead() and
not de = any(SsaPhiDefinition phi).getARead() and
// Don't use a check as reason if there is a `null` assignment
// or argument
not def.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof MaybeNullExpr and
not def.(SsaExplicitWrite).getValue() instanceof MaybeNullExpr and
not isMaybeNullArgument(def, _)
)
or
@@ -207,32 +203,32 @@ private predicate defMaybeNull(Ssa::Definition def, ControlFlowNode node, string
)
or
// If the source of a variable is `null` then the variable may be `null`
exists(AssignableDefinition adef | adef = def.(Ssa::ExplicitDefinition).getADefinition() |
exists(AssignableDefinition adef | adef = def.(SsaExplicitWrite).getDefinition() |
adef.getSource() = maybeNullExpr(node.asExpr()) and
reason = adef.getExpr() and
msg = "because of $@ assignment"
)
or
// A variable of nullable type may be null
exists(Dereference d | dereferenceAt(_, def, d) |
exists(Dereference d | dereferenceAt(def, d) |
node = def.getControlFlowNode() and
d.hasNullableType() and
not def instanceof Ssa::PhiNode and
not def instanceof SsaPhiDefinition and
reason = def.getSourceVariable().getAssignable() and
msg = "because it has a nullable type"
)
)
}
private Ssa::Definition getAPseudoInput(Ssa::Definition def) {
result = def.(Ssa::PhiNode).getAnInput()
private SsaDefinition getAPseudoInput(SsaDefinition def) {
result = def.(SsaPhiDefinition).getAnInput()
}
// `def.getAnUltimateDefinition()` includes inputs into uncertain
// definitions, but we only want inputs into pseudo nodes
private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
private SsaDefinition getAnUltimateDefinition(SsaDefinition def) {
result = getAPseudoInput*(def) and
not result instanceof Ssa::PhiNode
not result instanceof SsaPhiDefinition
}
/**
@@ -240,8 +236,8 @@ private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
* through an intermediate dereference that always throws a null reference
* exception.
*/
private predicate defReaches(Ssa::Definition def, ControlFlowNode cfn) {
exists(def.getAFirstReadAtNode(cfn))
private predicate defReaches(SsaDefinition def, ControlFlowNode cfn) {
Ssa::ssaGetAFirstUse(def).getControlFlowNode() = cfn
or
exists(ControlFlowNode mid | defReaches(def, mid) |
SsaImpl::adjacentReadPairSameVar(_, mid, cfn) and
@@ -250,11 +246,12 @@ private predicate defReaches(Ssa::Definition def, ControlFlowNode cfn) {
}
private module NullnessConfig implements ControlFlowReachability::ConfigSig {
predicate source(ControlFlowNode node, Ssa::Definition def) { defMaybeNull(def, node, _, _) }
predicate source(ControlFlowNode node, SsaDefinition def) { defMaybeNull(def, node, _, _) }
predicate sink(ControlFlowNode node, Ssa::Definition def) {
predicate sink(ControlFlowNode node, SsaDefinition def) {
exists(Dereference d |
dereferenceAt(node, def, d) and
dereferenceAt(def, d) and
node = d.getControlFlowNode() and
not d instanceof NonNullExpr
)
}
@@ -267,11 +264,12 @@ private module NullnessConfig implements ControlFlowReachability::ConfigSig {
private module NullnessFlow = ControlFlowReachability::Flow<NullnessConfig>;
predicate maybeNullDeref(Dereference d, Ssa::SourceVariable v, string msg, Element reason) {
exists(Ssa::Definition origin, Ssa::Definition ssa, ControlFlowNode src, ControlFlowNode sink |
exists(SsaDefinition origin, SsaDefinition ssa, ControlFlowNode src, ControlFlowNode sink |
defMaybeNull(origin, src, msg, reason) and
NullnessFlow::flow(src, origin, sink, ssa) and
ssa.getSourceVariable() = v and
dereferenceAt(sink, ssa, d) and
dereferenceAt(ssa, d) and
sink = d.getControlFlowNode() and
not d.isAlwaysNull(v)
)
}
@@ -322,9 +320,7 @@ class Dereference extends G::DereferenceableExpr {
not p.getAnnotatedType().isNullableRefType()
or
p.fromSource() and
exists(
Ssa::ParameterDefinition def, AssignableDefinitions::ImplicitParameterDefinition pdef
|
exists(SsaParameterInit def, AssignableDefinitions::ImplicitParameterDefinition pdef |
p = def.getParameter()
|
p.getUnboundDeclaration() = pdef.getParameter() and
@@ -334,9 +330,9 @@ class Dereference extends G::DereferenceableExpr {
)
}
private predicate isAlwaysNull0(Ssa::Definition def) {
forall(Ssa::Definition input | input = getAnUltimateDefinition(def) |
input.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof AlwaysNullExpr
private predicate isAlwaysNull0(SsaDefinition def) {
forall(SsaDefinition input | input = getAnUltimateDefinition(def) |
input.(SsaExplicitWrite).getValue() instanceof AlwaysNullExpr
) and
not nonNullDef(def) and
this = def.getARead() and
@@ -352,7 +348,7 @@ class Dereference extends G::DereferenceableExpr {
// Exclude fields and properties, as they may not have an accurate SSA representation
v.getAssignable() instanceof LocalScopeVariable and
(
forex(Ssa::Definition def0 | this = def0.getARead() | this.isAlwaysNull0(def0))
forex(SsaDefinition def0 | this = def0.getARead() | this.isAlwaysNull0(def0))
or
exists(G::GuardValue nv |
this.(G::GuardedExpr).mustHaveValue(nv) and

175
csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
View File

@@ -3,12 +3,14 @@
*/
import csharp
private import internal.SsaImpl as SsaImpl
import SsaImpl::Ssa_
/**
* Provides classes for working with static single assignment (SSA) form.
*/
module Ssa {
private import internal.SsaImpl as SsaImpl
import SsaImpl::Ssa_
pragma[nomagic]
private predicate assignableDefinitionLocalScopeVariable(
@@ -72,7 +74,7 @@ module Ssa {
* Gets an SSA definition that has this variable as its underlying
* source variable.
*/
Definition getAnSsaDefinition() { result.getSourceVariable() = this }
SsaDefinition getAnSsaDefinition() { result.getSourceVariable() = this }
}
/** Provides different types of `SourceVariable`s. */
@@ -148,11 +150,49 @@ module Ssa {
}
/**
* Gets a read of the source variable underlying the SSA definition `def`
* that can be reached from `def` without passing through any
* other SSA definition or read. Example:
*
* ```csharp
* int Field;
*
* void SetField(int i) {
* this.Field = i;
* Use(this.Field);
* if (i > 0)
* this.Field = i - 1;
* else if (i < 0)
* SetField(1);
* Use(this.Field);
* Use(this.Field);
* }
* ```
*
* - The read of `i` on line 4 can be reached from the explicit SSA
* definition (wrapping an implicit entry definition) on line 3.
* - The reads of `i` on lines 6 and 7 are not the first reads of any SSA
* definition.
* - The read of `this.Field` on line 5 can be reached from the explicit SSA
* definition on line 4.
* - The read of `this.Field` on line 10 can be reached from the phi node
* between lines 9 and 10.
* - The read of `this.Field` on line 11 is not the first read of any SSA
* definition.
*
* Subsequent reads can be found by following the steps defined by
* `AssignableRead.getANextRead()`.
*/
AssignableRead ssaGetAFirstUse(SsaDefinition def) { SsaImpl::firstReadSameVar(def, result) }
/**
* DEPRECATED: Use `SsaDefinition` instead.
*
* A static single assignment (SSA) definition. Either an explicit variable
* definition (`ExplicitDefinition`), an implicit variable definition
* (`ImplicitDefinition`), or a phi node (`PhiNode`).
*/
class Definition extends SsaImpl::Definition {
deprecated class Definition extends SsaImpl::Definition {
/** Gets the control flow node of this SSA definition. */
final ControlFlowNode getControlFlowNode() {
exists(BasicBlock bb, int i | this.definesAt(_, bb, i) | result = bb.getNode(0.maximum(i)))
@@ -193,9 +233,11 @@ module Ssa {
* - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
* node between lines 9 and 10.
*/
final AssignableRead getARead() { result = this.getAReadAtNode(_) }
final AssignableRead getARead() { result = SsaImpl::getAReadAtNode(this, _) }
/**
* DEPRECATED: Use `getARead()` instead.
*
* Gets a read of the source variable underlying this SSA definition at
* control flow node `cfn` that can be reached from this SSA definition
* without passing through any other SSA definitions. Example:
@@ -222,11 +264,13 @@ module Ssa {
* - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
* node between lines 9 and 10.
*/
final AssignableRead getAReadAtNode(ControlFlowNode cfn) {
deprecated final AssignableRead getAReadAtNode(ControlFlowNode cfn) {
result = SsaImpl::getAReadAtNode(this, cfn)
}
/**
* DEPRECATED: Use `ssaGetAFirstUse` instead.
*
* Gets a read of the source variable underlying this SSA definition that
* can be reached from this SSA definition without passing through any
* other SSA definition or read. Example:
@@ -260,9 +304,11 @@ module Ssa {
* Subsequent reads can be found by following the steps defined by
* `AssignableRead.getANextRead()`.
*/
final AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
deprecated final AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
/**
* DEPRECATED: Use `ssaGetAFirstUse` instead.
*
* Gets a read of the source variable underlying this SSA definition at
* control flow node `cfn` that can be reached from this SSA definition
* without passing through any other SSA definition or read. Example:
@@ -296,8 +342,8 @@ module Ssa {
* Subsequent reads can be found by following the steps defined by
* `AssignableRead.getANextRead()`.
*/
final AssignableRead getAFirstReadAtNode(ControlFlowNode cfn) {
SsaImpl::firstReadSameVar(this, cfn) and
deprecated final AssignableRead getAFirstReadAtNode(ControlFlowNode cfn) {
SsaImpl::firstReadSameVar(this, result) and
result.getControlFlowNode() = cfn
}
@@ -306,8 +352,8 @@ module Ssa {
* includes inputs to phi nodes and the prior definitions of uncertain writes.
*/
private Definition getAPhiInputOrPriorDefinition() {
result = this.(PhiNode).getAnInput() or
result = this.(UncertainDefinition).getPriorDefinition()
result = this.(SsaPhiDefinition).getAnInput() or
result = this.(SsaUncertainWrite).getPriorDefinition()
}
/**
@@ -341,7 +387,7 @@ module Ssa {
*/
final Definition getAnUltimateDefinition() {
result = this.getAPhiInputOrPriorDefinition*() and
not result instanceof PhiNode
not result instanceof SsaPhiDefinition
}
/**
@@ -353,37 +399,46 @@ module Ssa {
result.(ControlFlowElement).getControlFlowNode() = this.getControlFlowNode()
}
/** Gets the callable to which this SSA definition belongs. */
final Callable getEnclosingCallable() {
/**
* DEPRECATED: Use `getSourceVariable().getEnclosingCallable()` instead.
*
* Gets the callable to which this SSA definition belongs.
*/
deprecated final Callable getEnclosingCallable() {
result = this.getSourceVariable().getEnclosingCallable()
}
/**
* DEPRECATED.
*
* Holds if this SSA definition assigns to `out`/`ref` parameter `p`, and the
* parameter may remain unchanged throughout the rest of the enclosing callable.
*/
final predicate isLiveOutRefParameterDefinition(Parameter p) {
deprecated final predicate isLiveOutRefParameterDefinition(Parameter p) {
SsaImpl::isLiveOutRefParameterDefinition(this, p)
}
/** Gets the location of this SSA definition. */
override Location getLocation() { none() }
}
/**
* DEPRECATED: Use `SsaExplicitWrite` instead.
*
* An SSA definition that corresponds to an explicit assignable definition.
*/
class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
deprecated class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
AssignableDefinition ad;
ExplicitDefinition() { SsaImpl::explicitDefinition(this, _, ad) }
/**
* DEPRECATED: Use `SsaExplicitWrite.getDefinition()` instead.
*
* Gets an underlying assignable definition. The result is always unique,
* except for pathological `out`/`ref` assignments like `M(out x, out x)`,
* where there may be more than one underlying definition.
*/
final AssignableDefinition getADefinition() { result = SsaImpl::getADefinition(this) }
deprecated final AssignableDefinition getADefinition() {
result = SsaImpl::getADefinition(this)
}
/**
* DEPRECATED.
@@ -444,20 +499,18 @@ module Ssa {
}
override Element getElement() { result = ad.getElement() }
override string toString() { result = "SSA def(" + this.getSourceVariable() + ")" }
override Location getLocation() { result = ad.getLocation() }
}
/**
* DEPRECATED: Use `SsaParameterInit` or `SsaImplicitWrite` instead.
*
* An SSA definition that does not correspond to an explicit variable definition.
* Either an implicit initialization of a variable at the beginning of a callable
* (`ImplicitEntryDefinition`), an implicit definition via a call
* (`ImplicitCallDefinition`), or an implicit definition where the qualifier is
* updated (`ImplicitQualifierDefinition`).
*/
class ImplicitDefinition extends Definition, SsaImpl::WriteDefinition {
deprecated class ImplicitDefinition extends Definition, SsaImpl::WriteDefinition {
ImplicitDefinition() {
exists(BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) |
SsaImpl::implicitEntryDefinition(bb, v) and
@@ -471,11 +524,13 @@ module Ssa {
}
/**
* DEPRECATED: Use `SsaParameterInit` or `SsaImplicitEntryDefinition` instead.
*
* An SSA definition representing the implicit initialization of a variable
* at the beginning of a callable. Either a local scope variable captured by
* the callable or a field or property accessed inside the callable.
*/
class ImplicitEntryDefinition extends ImplicitDefinition {
deprecated class ImplicitEntryDefinition extends ImplicitDefinition {
ImplicitEntryDefinition() {
exists(BasicBlock bb, SourceVariable v |
this.definesAt(v, bb, -1) and
@@ -487,21 +542,14 @@ module Ssa {
final Callable getCallable() { result = this.getBasicBlock().getEnclosingCallable() }
override Element getElement() { result = this.getCallable() }
override string toString() {
if this.getSourceVariable().getAssignable() instanceof LocalScopeVariable
then result = "SSA capture def(" + this.getSourceVariable() + ")"
else result = "SSA entry def(" + this.getSourceVariable() + ")"
}
override Location getLocation() { result = this.getCallable().getLocation() }
}
deprecated class ImplicitParameterDefinition = ParameterDefinition;
/**
* DEPRECATED: Use `SsaParameterInit` instead.
*/
deprecated final class ImplicitParameterDefinition = SsaImpl::ParameterDefinitionImpl;
final class ParameterDefinition = SsaImpl::ParameterDefinitionImpl;
private class ExplicitParameterDefinition extends ExplicitDefinition,
deprecated private class ExplicitParameterDefinition extends ExplicitDefinition,
SsaImpl::ParameterDefinitionImpl
{
private Parameter p;
@@ -514,28 +562,20 @@ module Ssa {
override string toString() { result = SsaImpl::ParameterDefinitionImpl.super.toString() }
}
/**
* An SSA definition representing the default value of a parameter.
*/
class ParameterDefaultDefinition extends ExplicitDefinition {
private Parameter p;
override AssignableDefinitions::ParameterDefaultDefinition ad;
ParameterDefaultDefinition() { p = ad.getParameter() }
/** Gets the parameter that this entry definition represents. */
Parameter getParameter() { result = p }
override string toString() {
result = "SSA param_default(" + pragma[only_bind_out](this.getParameter()) + ")"
/** An SSA definition in a closure that captures a variable. */
class SsaCapturedDefinition extends SsaImplicitEntryDefinition {
SsaCapturedDefinition() {
this.getSourceVariable().getAssignable() instanceof LocalScopeVariable
}
override string toString() { result = "SSA capture def(" + this.getSourceVariable() + ")" }
}
/**
* An SSA definition representing the potential definition of a variable
* via a call.
*/
class ImplicitCallDefinition extends ImplicitDefinition {
class ImplicitCallDefinition extends SsaImplicitWrite {
private Call c;
ImplicitCallDefinition() {
@@ -562,18 +602,17 @@ module Ssa {
}
override string toString() { result = "SSA call def(" + this.getSourceVariable() + ")" }
override Location getLocation() { result = this.getCall().getLocation() }
}
/**
* An SSA definition representing the potential definition of a variable
* via an SSA definition for the qualifier.
*/
class ImplicitQualifierDefinition extends ImplicitDefinition, SsaImpl::WriteDefinition {
private Definition q;
class ImplicitQualifierDefinition extends SsaImplicitWrite {
private SsaDefinition q;
ImplicitQualifierDefinition() {
not this instanceof SsaImplicitEntryDefinition and
exists(BasicBlock bb, int i, SourceVariables::QualifiedFieldOrPropSourceVariable v |
this.definesAt(v, bb, i)
|
@@ -583,19 +622,19 @@ module Ssa {
}
/** Gets the SSA definition for the qualifier. */
final Definition getQualifierDefinition() { result = q }
final SsaDefinition getQualifierDefinition() { result = q }
override string toString() { result = "SSA qualifier def(" + this.getSourceVariable() + ")" }
override Location getLocation() { result = this.getQualifierDefinition().getLocation() }
}
/**
* DEPRECATED: Use `SsaPhiDefinition` instead.
*
* An SSA phi node, that is, a pseudo definition for a variable at a point
* in the flow graph where otherwise two or more definitions for the variable
* would be visible.
*/
class PhiNode extends Definition, SsaImpl::PhiNode {
deprecated class PhiNode extends Definition, SsaImpl::PhiNode {
/**
* Gets an input of this phi node. Example:
*
@@ -624,27 +663,17 @@ module Ssa {
predicate hasInputFromBlock(Definition inp, BasicBlock bb) {
inp = SsaImpl::phiHasInputFromBlock(this, bb)
}
override string toString() { result = "SSA phi(" + this.getSourceVariable() + ")" }
/*
* The location of a phi node is the same as the location of the first node
* in the basic block in which it is defined.
*
* Strictly speaking, the node is *before* the first node, but such a location
* does not exist in the source program.
*/
override Location getLocation() { result = this.getBasicBlock().getFirstNode().getLocation() }
}
/**
* DEPRECATED: Use `SsaUncertainWrite` instead.
*
* An SSA definition that represents an uncertain update of the underlying
* assignable. Either an explicit update that is uncertain (`ref` assignments
* need not be certain), an implicit non-local update via a call, or an
* uncertain update of the qualifier.
*/
class UncertainDefinition extends Definition, SsaImpl::UncertainWriteDefinition {
deprecated class UncertainDefinition extends Definition, SsaImpl::UncertainWriteDefinition {
/**
* Gets the immediately preceding definition. Since this update is uncertain,
* the value from the preceding definition might still be valid.

25
csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
View File

@@ -1,9 +1,20 @@
import csharp
private import csharp as CS
/**
* Provides a simple SSA implementation for local scope variables.
*/
module BaseSsa {
private import BaseSsaImpl
class SimpleLocalScopeVariable = BaseSsaImpl::SimpleLocalScopeVariable;
module Ssa = SsaImpl::MakeSsa<SsaInput>;
import Ssa
}
private module BaseSsaImpl {
private import CS
private import AssignableDefinitions
private import codeql.ssa.Ssa as SsaImplCommon
@@ -13,7 +24,7 @@ module BaseSsa {
predicate ref() { any() }
cached
predicate backref() { (exists(any(SsaDefinition def).getARead()) implies any()) }
predicate backref() { (exists(any(BaseSsa::SsaDefinition def).getARead()) implies any()) }
}
/**
@@ -112,11 +123,9 @@ module BaseSsa {
}
}
private module SsaImpl = SsaImplCommon::Make<Location, Cfg, SsaImplInput>;
private module SsaInput implements SsaImpl::SsaInputSig {
private import csharp as CS
module SsaImpl = SsaImplCommon::Make<Location, Cfg, SsaImplInput>;
module SsaInput implements SsaImpl::SsaInputSig {
class Expr = CS::Expr;
class Parameter = CS::Parameter;
@@ -139,8 +148,4 @@ module BaseSsa {
w.isParameterInit(v)
}
}
module Ssa = SsaImpl::MakeSsa<SsaInput>;
import Ssa
}

42
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
View File

@@ -270,10 +270,10 @@ module VariableCapture {
private predicate closureFlowStep(ControlFlowNodes::ExprNode e1, ControlFlowNodes::ExprNode e2) {
e1.getExpr() = LocalFlow::getALastEvalNode(e2.getExpr())
or
exists(Ssa::Definition def, AssignableDefinition adef |
exists(SsaDefinition def, AssignableDefinition adef |
LocalFlow::defAssigns(adef, _, _, e1) and
def.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() = adef and
exists(def.getAReadAtNode(e2))
def.getAnUltimateDefinition().(SsaExplicitWrite).getDefinition() = adef and
def.getARead().getControlFlowNode() = e2
)
}
@@ -600,8 +600,8 @@ module LocalFlow {
or
ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
or
exists(AssignableDefinition def, ControlFlowNode cfn, Ssa::ExplicitDefinition ssaDef |
ssaDef.getADefinition() = def and
exists(AssignableDefinition def, ControlFlowNode cfn, SsaExplicitWrite ssaDef |
ssaDef.getDefinition() = def and
ssaDef.getControlFlowNode() = cfn and
nodeFrom = TAssignableDefinitionNode(def, cfn) and
nodeTo.(SsaDefinitionNode).getDefinition() = ssaDef
@@ -1244,7 +1244,7 @@ class SsaNode extends NodeImpl, TSsaNode {
class SsaDefinitionNode extends SsaNode {
override SsaImpl::DataFlowIntegration::SsaDefinitionNode node;
Ssa::Definition getDefinition() { result = node.getDefinition() }
SsaDefinition getDefinition() { result = node.getDefinition() }
override ControlFlowNode getControlFlowNodeImpl() {
result = this.getDefinition().getControlFlowNode()
@@ -1302,12 +1302,6 @@ private module NearestLocationInputParamAfterCallable implements NearestLocation
}
private module ParameterNodes {
pragma[nomagic]
private predicate ssaParamDef(Ssa::ParameterDefinition ssaDef, Parameter p, Location l) {
p = ssaDef.getParameter() and
l = ssaDef.getLocation()
}
private module NearestLocationInputParamBeforeCallable implements NearestLocationInputSig {
class C = Parameter;
@@ -1358,11 +1352,9 @@ private module ParameterNodes {
}
/** Gets the SSA definition corresponding to this parameter, if any. */
Ssa::ParameterDefinition getSsaDefinition() {
exists(Parameter p, Location l |
l = this.getParameterLocation(p) and
ssaParamDef(result, p, l)
)
SsaParameterInit getSsaDefinition() {
result.getParameter() = parameter and
result.getBasicBlock() = callable.getABasicBlock()
}
override predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
@@ -1438,7 +1430,7 @@ private module ParameterNodes {
}
/** An implicit entry definition for a captured variable. */
class SsaCapturedEntryDefinition extends Ssa::ImplicitEntryDefinition {
deprecated class SsaCapturedEntryDefinition extends Ssa::ImplicitEntryDefinition {
private LocalScopeVariable v;
SsaCapturedEntryDefinition() { this.getSourceVariable().getAssignable() = v }
@@ -1613,7 +1605,7 @@ private module ReturnNodes {
OutRefReturnNode() {
exists(Parameter p |
this.getDefinition().isLiveOutRefParameterDefinition(p) and
SsaImpl::isLiveOutRefParameterDefinition(this.getDefinition(), p) and
kind.getPosition() = p.getPosition()
|
p.isOut() and kind instanceof OutReturnKind
@@ -2016,12 +2008,9 @@ private class FieldOrPropertyRead extends FieldOrPropertyAccess, AssignableRead
* SSA updates.
*/
predicate hasNonlocalValue() {
exists(Ssa::Definition def, Ssa::ImplicitDefinition idef |
exists(SsaDefinition def |
def.getARead() = this and
idef = def.getAnUltimateDefinition()
|
idef instanceof Ssa::ImplicitEntryDefinition or
idef instanceof Ssa::ImplicitCallDefinition
def.getAnUltimateDefinition() instanceof SsaImplicitWrite
)
}
}
@@ -2220,12 +2209,11 @@ private predicate readContentStep(Node node1, Content c, Node node2) {
c instanceof ElementContent
or
exists(
ForeachStmt fs, Ssa::ExplicitDefinition def,
AssignableDefinitions::LocalVariableDefinition defTo
ForeachStmt fs, SsaExplicitWrite def, AssignableDefinitions::LocalVariableDefinition defTo
|
node1.asExpr() = fs.getIterableExpr() and
defTo.getDeclaration() = fs.getVariableDeclExpr() and
def.getADefinition() = defTo and
def.getDefinition() = defTo and
node2.(SsaDefinitionNode).getDefinition() = def and
c instanceof ElementContent
)

165
csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
View File

@@ -9,7 +9,7 @@ private import semmle.code.csharp.controlflow.Guards as Guards
private import semmle.code.csharp.dataflow.internal.BaseSSA
private import semmle.code.csharp.internal.Location
private module SsaInput implements SsaImplCommon::InputSig<Location, BasicBlock> {
private module SsaImplInput implements SsaImplCommon::InputSig<Location, BasicBlock> {
class SourceVariable = Ssa::SourceVariable;
/**
@@ -41,15 +41,52 @@ private module SsaInput implements SsaImplCommon::InputSig<Location, BasicBlock>
}
}
import SsaImplCommon::Make<Location, Cfg, SsaInput> as Impl
import SsaImplCommon::Make<Location, Cfg, SsaImplInput> as Impl
private module SsaInput implements Impl::SsaInputSig {
private import csharp as CS
class Expr = CS::Expr;
class Parameter = CS::Parameter;
class VariableWrite extends AssignableDefinition {
Expr asExpr() { result = this.getExpr() }
Expr getValue() { result = this.getSource() }
predicate isParameterInit(Parameter p) { this.(ImplicitParameterDefinition).getParameter() = p }
}
predicate explicitWrite(VariableWrite w, BasicBlock bb, int i, SsaImplInput::SourceVariable v) {
exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
w = ad or
w = getASameOutRefDefAfter(v, ad)
)
or
exists(Parameter p |
implicitEntryDefinition(bb, v) and
i = -1 and
p = v.getAssignable() and
pragma[only_bind_out](p.getCallable()) = pragma[only_bind_out](v.getEnclosingCallable()) and
w.isParameterInit(p)
)
}
}
module Ssa_ = Impl::MakeSsa<SsaInput>;
class Definition = Impl::Definition;
class WriteDefinition = Impl::WriteDefinition;
private class SsaDefinitionToStringProxy extends Definition {
override string toString() { result = this.(SsaDefinition).toString() }
}
class UncertainWriteDefinition = Impl::UncertainWriteDefinition;
deprecated class WriteDefinition = Impl::WriteDefinition;
class PhiNode = Impl::PhiNode;
deprecated class UncertainWriteDefinition = Impl::UncertainWriteDefinition;
deprecated class PhiNode = Impl::PhiNode;
module Consistency = Impl::Consistency;
@@ -791,14 +828,6 @@ private module Cached {
)
}
cached
AssignableDefinition getADefinition(Ssa::ExplicitDefinition def) {
exists(Ssa::SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
result = ad or
result = getASameOutRefDefAfter(v, ad)
)
}
/**
* Holds if `call` may change the value of field or property `fp`. The actual
* update occurs in `setter`.
@@ -815,7 +844,7 @@ private module Cached {
predicate variableWriteQualifier(
BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
) {
SsaInput::variableWrite(bb, i, v.getQualifier(), certain) and
SsaImplInput::variableWrite(bb, i, v.getQualifier(), certain) and
// Eliminate corner case where a call definition can overlap with a
// qualifier definition: if method `M` updates field `F`, then a call
// to `M` is both an update of `x.M` and `x.M.M`, so the former call
@@ -824,41 +853,15 @@ private module Cached {
not updatesNamedFieldOrProp(bb, i, _, v, _)
}
cached
predicate explicitDefinition(WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad) {
exists(BasicBlock bb, int i |
def.definesAt(v, bb, i) and
variableDefinition(bb, i, v, ad)
)
}
cached
predicate isLiveAtEndOfBlock(Definition def, BasicBlock bb) {
Impl::ssaDefReachesEndOfBlock(bb, def, _)
}
cached
Definition phiHasInputFromBlock(Ssa::PhiNode phi, BasicBlock bb) {
Impl::phiHasInputFromBlock(phi, result, bb)
}
cached
AssignableRead getAReadAtNode(Definition def, ControlFlowNode cfn) {
exists(Ssa::SourceVariable v, BasicBlock bb, int i |
Impl::ssaDefReachesRead(v, def, bb, i) and
variableReadActual(bb, i, v) and
cfn = bb.getNode(i) and
result.getControlFlowNode() = cfn
)
}
/**
* Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
* Holds if the value defined at SSA definition `def` can reach a read `read`,
* without passing through any other read.
*/
cached
predicate firstReadSameVar(Definition def, ControlFlowNode cfn) {
exists(BasicBlock bb, int i | Impl::firstUse(def, bb, i, true) and cfn = bb.getNode(i))
predicate firstReadSameVar(Definition def, AssignableRead read) {
exists(BasicBlock bb, int i |
Impl::firstUse(def, bb, i, true) and read.getControlFlowNode() = bb.getNode(i)
)
}
/**
@@ -876,15 +879,14 @@ private module Cached {
)
}
/**
* Holds if the SSA definition `def` assigns to `out`/`ref` parameter `p`, and the
* parameter may remain unchanged throughout the rest of the enclosing callable.
*/
cached
Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
Impl::uncertainWriteDefinitionInput(def, result)
}
cached
predicate isLiveOutRefParameterDefinition(Ssa::Definition def, Parameter p) {
predicate isLiveOutRefParameterDefinition(SsaDefinition def, Parameter p) {
p.isOutOrRef() and
exists(Ssa::SourceVariable v, Ssa::Definition def0, BasicBlock bb, int i |
exists(Ssa::SourceVariable v, SsaDefinition def0, BasicBlock bb, int i |
v = def.getSourceVariable() and
p = v.getAssignable() and
def = def0.getAnUltimateDefinition() and
@@ -966,6 +968,43 @@ private module Cached {
import Cached
deprecated AssignableDefinition getADefinition(Ssa::ExplicitDefinition def) {
exists(Ssa::SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
result = ad or
result = getASameOutRefDefAfter(v, ad)
)
}
deprecated predicate explicitDefinition(
WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad
) {
exists(BasicBlock bb, int i |
def.definesAt(v, bb, i) and
variableDefinition(bb, i, v, ad)
)
}
deprecated predicate isLiveAtEndOfBlock(Definition def, BasicBlock bb) {
Impl::ssaDefReachesEndOfBlock(bb, def, _)
}
deprecated Definition phiHasInputFromBlock(Ssa::PhiNode phi, BasicBlock bb) {
Impl::phiHasInputFromBlock(phi, result, bb)
}
deprecated AssignableRead getAReadAtNode(Definition def, ControlFlowNode cfn) {
exists(Ssa::SourceVariable v, BasicBlock bb, int i |
Impl::ssaDefReachesRead(v, def, bb, i) and
variableReadActual(bb, i, v) and
cfn = bb.getNode(i) and
result.getControlFlowNode() = cfn
)
}
deprecated Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
Impl::uncertainWriteDefinitionInput(def, result)
}
private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInputSig {
private import codeql.util.Boolean
@@ -973,20 +1012,20 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
predicate hasCfgNode(BasicBlock bb, int i) { this = bb.getNode(i) }
}
Expr getARead(Definition def) { exists(getAReadAtNode(def, result)) }
Expr getARead(Definition def) { def.(SsaDefinition).getARead().getControlFlowNode() = result }
predicate ssaDefHasSource(WriteDefinition def) {
predicate ssaDefHasSource(Impl::WriteDefinition def) {
// exclude flow directly from RHS to SSA definition, as we instead want to
// go from RHS to matching assignable definition, and from there to SSA definition
def instanceof Ssa::ParameterDefinition
def instanceof SsaParameterInit
}
/**
* Allows for flow into uncertain defintions that are not call definitions,
* Allows for flow into uncertain definitions that are not call definitions,
* as we, conservatively, consider such definitions to be certain.
*/
predicate allowFlowIntoUncertainDef(UncertainWriteDefinition def) {
def instanceof Ssa::ExplicitDefinition
predicate allowFlowIntoUncertainDef(Impl::UncertainWriteDefinition def) {
def instanceof SsaExplicitWrite
or
def =
any(Ssa::ImplicitQualifierDefinition qdef |
@@ -1011,7 +1050,7 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
private module DataFlowIntegrationImpl = Impl::DataFlowIntegration<DataFlowIntegrationInput>;
private module MultiBodyNearestLocationInput implements NearestLocationInputSig {
deprecated private module MultiBodyNearestLocationInput implements NearestLocationInputSig {
class C = MultiBodyParameterDefinition;
predicate relevantLocations(MultiBodyParameterDefinition def, Location l1, Location l2) {
@@ -1025,7 +1064,7 @@ private module MultiBodyNearestLocationInput implements NearestLocationInputSig
}
pragma[nomagic]
private predicate implicitEntryDef(
deprecated private predicate implicitEntryDef(
Ssa::ImplicitEntryDefinition def, Ssa::SourceVariable v, Callable c
) {
v = def.getSourceVariable() and
@@ -1036,7 +1075,7 @@ private predicate implicitEntryDef(
* An SSA definition representing the implicit initialization of a parameter
* at the beginning of a callable.
*/
abstract class ParameterDefinitionImpl extends Ssa::Definition {
abstract deprecated class ParameterDefinitionImpl extends Ssa::Definition {
/** Gets the parameter that this definition represents. */
abstract Parameter getParameter();
@@ -1045,7 +1084,9 @@ abstract class ParameterDefinitionImpl extends Ssa::Definition {
}
}
class MultiBodyParameterDefinition extends ParameterDefinitionImpl, Ssa::ImplicitEntryDefinition {
deprecated class MultiBodyParameterDefinition extends ParameterDefinitionImpl,
Ssa::ImplicitEntryDefinition
{
private Parameter p;
MultiBodyParameterDefinition() {

2
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
View File

@@ -9,7 +9,7 @@ module Private {
class SsaVariable = SU::SsaVariable;
class SsaPhiNode = CS::Ssa::PhiNode;
class SsaPhiNode = CS::SsaPhiDefinition;
class Expr = CS::ControlFlowNodes::ExprNode;

4
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
View File

@@ -19,7 +19,7 @@ private module Impl {
}
/** Holds if SSA definition `def` equals `e + delta`. */
predicate ssaUpdateStep(ExplicitDefinition def, ExprNode e, int delta) {
predicate ssaUpdateStep(SsaExplicitWrite def, ExprNode e, int delta) {
exists(ControlFlowNode cfn | cfn = def.getControlFlowNode() |
e = cfn.(ExprNode::Assignment).getRightOperand() and
delta = 0 and
@@ -106,7 +106,7 @@ private module Impl {
* - `isEq = true` : `def == e + delta`
* - `isEq = false` : `def != e + delta`
*/
Guard eqFlowCond(Definition def, ExprNode e, int delta, boolean isEq, boolean testIsTrue) {
Guard eqFlowCond(SsaDefinition def, ExprNode e, int delta, boolean isEq, boolean testIsTrue) {
exists(boolean eqpolarity |
result.isEquality(ssaRead(def, delta), e, eqpolarity) and
testIsTrue = [false, true] and

42
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
View File

@@ -13,9 +13,9 @@ module Private {
class ConstantIntegerExpr = CU::ConstantIntegerExpr;
class SsaVariable = CS::Ssa::Definition;
class SsaVariable = CS::SsaDefinition;
class SsaPhiNode = CS::Ssa::PhiNode;
class SsaPhiNode = CS::SsaPhiDefinition;
class VarAccess = RU::ExprNode::AssignableAccess;
@@ -35,7 +35,7 @@ module Private {
class Expr = CS::ControlFlowNodes::ExprNode;
class VariableUpdate = CS::Ssa::ExplicitDefinition;
class VariableUpdate = CS::SsaExplicitWrite;
class Field = CS::Field;
@@ -122,46 +122,34 @@ private module Impl {
}
/** Returns the underlying variable update of the explicit SSA variable `v`. */
Ssa::ExplicitDefinition getExplicitSsaAssignment(Ssa::ExplicitDefinition v) { result = v }
SsaExplicitWrite getExplicitSsaAssignment(SsaExplicitWrite v) { result = v }
/** Returns the assignment of the variable update `def`. */
ExprNode getExprFromSsaAssignment(Ssa::ExplicitDefinition def) {
exists(AssignableDefinition adef |
adef = def.getADefinition() and
hasChild(adef.getExpr(), adef.getSource(), def.getControlFlowNode(), result)
)
or
exists(AssignableDefinitions::AssignOperationDefinition adef |
adef = def.getADefinition() and
result.getExpr() = adef.getSource()
)
}
ExprNode getExprFromSsaAssignment(SsaExplicitWrite def) { result.getExpr() = def.getValue() }
/** Holds if `def` can have any sign. */
predicate explicitSsaDefWithAnySign(Ssa::ExplicitDefinition def) {
not exists(def.getADefinition().getSource()) and
not def.getElement() instanceof MutatorOperation
predicate explicitSsaDefWithAnySign(SsaExplicitWrite def) {
not exists(def.getValue()) and
not def.getDefiningExpr() instanceof MutatorOperation
}
/** Returns the operand of the operation if `def` is a decrement. */
ExprNode getDecrementOperand(Ssa::ExplicitDefinition def) {
hasChild(def.getElement(), def.getElement().(DecrementOperation).getOperand(),
def.getControlFlowNode(), result)
ExprNode getDecrementOperand(SsaExplicitWrite def) {
result.getExpr() = def.getDefiningExpr().(DecrementOperation).getOperand()
}
/** Returns the operand of the operation if `def` is an increment. */
ExprNode getIncrementOperand(Ssa::ExplicitDefinition def) {
hasChild(def.getElement(), def.getElement().(IncrementOperation).getOperand(),
def.getControlFlowNode(), result)
ExprNode getIncrementOperand(SsaExplicitWrite def) {
result.getExpr() = def.getDefiningExpr().(IncrementOperation).getOperand()
}
/** Gets the variable underlying the implicit SSA variable `def`. */
Declaration getImplicitSsaDeclaration(Ssa::ImplicitDefinition def) {
Declaration getImplicitSsaDeclaration(SsaImplicitWrite def) {
result = def.getSourceVariable().getAssignable()
}
/** Holds if the variable underlying the implicit SSA variable `def` is not a field. */
predicate nonFieldImplicitSsaDefinition(Ssa::ImplicitDefinition def) {
predicate nonFieldImplicitSsaDefinition(SsaImplicitWrite def) {
not getImplicitSsaDeclaration(def) instanceof Field
}
@@ -245,7 +233,7 @@ private module Impl {
)
}
ExprNode getARead(Ssa::Definition v) { exists(v.getAReadAtNode(result)) }
ExprNode getARead(SsaDefinition v) { v.getARead().getControlFlowNode() = result }
Field getField(ExprNode fa) { result = fa.getExpr().(FieldAccess).getTarget() }

4
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
View File

@@ -5,9 +5,9 @@
private import csharp as CS
private import SsaReadPositionCommon
class SsaVariable = CS::Ssa::Definition;
class SsaVariable = CS::SsaDefinition;
class SsaPhiNode = CS::Ssa::PhiNode;
class SsaPhiNode = CS::SsaPhiDefinition;
class BasicBlock = CS::BasicBlock;

24
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
View File

@@ -10,24 +10,24 @@ private import ConstantUtils
private class ExprNode = ControlFlowNodes::ExprNode;
/** An SSA variable. */
class SsaVariable extends Definition {
class SsaVariable extends SsaDefinition {
/** Gets a read of this SSA variable. */
ExprNode getAUse() { exists(this.getAReadAtNode(result)) }
ExprNode getAUse() { this.getARead().getControlFlowNode() = result }
}
/** Gets a node that reads `src` via an SSA explicit definition. */
ExprNode getAnExplicitDefinitionRead(ExprNode src) {
exists(ExplicitDefinition def |
exists(def.getAReadAtNode(result)) and
hasChild(def.getElement(), def.getADefinition().getSource(), def.getControlFlowNode(), src)
exists(SsaExplicitWrite def |
def.getARead().getControlFlowNode() = result and
hasChild(def.getDefiningExpr(), def.getValue(), def.getControlFlowNode(), src)
)
}
/**
* Gets an expression that equals `v - delta`.
*/
ExprNode ssaRead(Definition v, int delta) {
exists(v.getAReadAtNode(result)) and delta = 0
ExprNode ssaRead(SsaDefinition v, int delta) {
v.getARead().getControlFlowNode() = result and delta = 0
or
exists(ExprNode::AddOperation add, int d1, ConstantIntegerExpr c |
result = add and
@@ -45,15 +45,15 @@ ExprNode ssaRead(Definition v, int delta) {
delta = d1 + c.getIntValue()
)
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PreIncrExpr) = result and delta = 0
v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PreIncrExpr) = result and delta = 0
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PreDecrExpr) = result and delta = 0
v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PreDecrExpr) = result and delta = 0
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PostIncrExpr) = result and delta = 1 // x++ === ++x - 1
v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PostIncrExpr) = result and delta = 1 // x++ === ++x - 1
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PostDecrExpr) = result and delta = -1 // x-- === --x + 1
v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PostDecrExpr) = result and delta = -1 // x-- === --x + 1
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::Assignment) = result and delta = 0
v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::Assignment) = result and delta = 0
or
result.(ExprNode::AssignExpr).getRightOperand() = ssaRead(v, delta)
}

2
csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
View File

@@ -20,7 +20,7 @@ import semmle.code.csharp.controlflow.Guards as Guards
import codeql.controlflow.queries.ConstantCondition as ConstCond
module ConstCondInput implements ConstCond::InputSig<BasicBlock> {
class SsaDefinition = Ssa::Definition;
class SsaDefinition = Ssa::SsaDefinition;
class GuardValue = Guards::GuardValue;

2
csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
View File

@@ -92,7 +92,7 @@ class RelevantDefinition extends AssignableDefinition {
private predicate isMaybeLive() {
exists(LocalVariable v | v = this.getTarget() |
// SSA definitions are only created for live variables
this = any(Ssa::ExplicitDefinition ssaDef).getADefinition()
this = any(SsaExplicitWrite ssaDef).getDefinition()
or
mayEscape(v)
or

7
csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql
View File

@@ -36,17 +36,16 @@ abstract class BadDynamicCall extends DynamicExpr {
}
private Type possibleTypeForRelevantSource(Variable v, int i, Expr source) {
exists(AssignableRead read, Ssa::Definition ssaDef, Ssa::ExplicitDefinition ultimateSsaDef |
exists(AssignableRead read, SsaDefinition ssaDef, SsaExplicitWrite ultimateSsaDef |
read = this.getARelevantVariableAccess(i) and
v = read.getTarget() and
result = source.getType() and
read = ssaDef.getARead() and
ultimateSsaDef = ssaDef.getAnUltimateDefinition()
|
ultimateSsaDef.getADefinition() =
any(AssignableDefinition def | source = def.getSource().stripImplicit())
ultimateSsaDef.getValue().stripImplicit() = source
or
ultimateSsaDef.getADefinition() =
ultimateSsaDef.getDefinition() =
any(AssignableDefinitions::ImplicitParameterDefinition p |
source = p.getParameter().getAnAssignedValue().stripImplicit()
)

9
csharp/ql/test/library-tests/csharp7/DefUse.ql
View File

@@ -1,13 +1,8 @@
import csharp
from AssignableDefinition def, AssignableRead read, Ssa::Definition ult, Ssa::Definition ssaDef
from AssignableDefinition def, AssignableRead read, SsaDefinition ult, SsaDefinition ssaDef
where
ssaDef.getAnUltimateDefinition() = ult and
(
ult.(Ssa::ExplicitDefinition).getADefinition() = def
or
ult.(Ssa::ParameterDefinition).getParameter() =
def.(AssignableDefinitions::ImplicitParameterDefinition).getParameter()
) and
ult.(SsaExplicitWrite).getDefinition() = def and
read = ssaDef.getARead()
select def, read

16
csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
View File

@@ -35,23 +35,23 @@
| CSharp7.cs:44:9:44:9 | access to parameter y | CSharp7.cs:44:9:44:13 | SSA def(y) |
| CSharp7.cs:44:13:44:13 | access to parameter x | CSharp7.cs:44:9:44:9 | access to parameter y |
| CSharp7.cs:47:10:47:10 | this | CSharp7.cs:49:9:49:24 | this access |
| CSharp7.cs:49:9:49:24 | SSA def(t1) | CSharp7.cs:51:18:51:19 | access to local variable t1 |
| CSharp7.cs:49:9:49:24 | [post] this access | CSharp7.cs:50:9:50:21 | this access |
| CSharp7.cs:49:9:49:24 | this access | CSharp7.cs:50:9:50:21 | this access |
| CSharp7.cs:49:22:49:23 | SSA def(t1) | CSharp7.cs:51:18:51:19 | access to local variable t1 |
| CSharp7.cs:49:22:49:23 | String t1 | CSharp7.cs:49:22:49:23 | SSA def(t1) |
| CSharp7.cs:49:22:49:23 | String t1 | CSharp7.cs:49:9:49:24 | SSA def(t1) |
| CSharp7.cs:50:9:50:21 | SSA def(t2) | CSharp7.cs:54:14:54:15 | access to local variable t2 |
| CSharp7.cs:50:9:50:21 | [post] this access | CSharp7.cs:52:9:52:17 | this access |
| CSharp7.cs:50:9:50:21 | this access | CSharp7.cs:52:9:52:17 | this access |
| CSharp7.cs:50:19:50:20 | SSA def(t2) | CSharp7.cs:54:14:54:15 | access to local variable t2 |
| CSharp7.cs:50:19:50:20 | String t2 | CSharp7.cs:50:19:50:20 | SSA def(t2) |
| CSharp7.cs:50:19:50:20 | String t2 | CSharp7.cs:50:9:50:21 | SSA def(t2) |
| CSharp7.cs:51:18:51:19 | access to local variable t1 | CSharp7.cs:51:13:51:14 | access to local variable t3 |
| CSharp7.cs:52:9:52:17 | SSA def(t1) | CSharp7.cs:53:14:53:15 | access to local variable t1 |
| CSharp7.cs:52:9:52:17 | [post] this access | CSharp7.cs:55:9:55:32 | this access |
| CSharp7.cs:52:9:52:17 | this access | CSharp7.cs:55:9:55:32 | this access |
| CSharp7.cs:52:15:52:16 | SSA def(t1) | CSharp7.cs:53:14:53:15 | access to local variable t1 |
| CSharp7.cs:52:15:52:16 | access to local variable t1 | CSharp7.cs:52:15:52:16 | SSA def(t1) |
| CSharp7.cs:52:15:52:16 | access to local variable t1 | CSharp7.cs:52:9:52:17 | SSA def(t1) |
| CSharp7.cs:53:14:53:15 | access to local variable t1 | CSharp7.cs:53:9:53:10 | access to local variable t3 |
| CSharp7.cs:54:14:54:15 | access to local variable t2 | CSharp7.cs:54:9:54:10 | access to local variable t3 |
| CSharp7.cs:55:30:55:31 | SSA def(t4) | CSharp7.cs:56:18:56:19 | access to local variable t4 |
| CSharp7.cs:55:30:55:31 | String t4 | CSharp7.cs:55:30:55:31 | SSA def(t4) |
| CSharp7.cs:55:9:55:32 | SSA def(t4) | CSharp7.cs:56:18:56:19 | access to local variable t4 |
| CSharp7.cs:55:30:55:31 | String t4 | CSharp7.cs:55:9:55:32 | SSA def(t4) |
| CSharp7.cs:56:18:56:19 | access to local variable t4 | CSharp7.cs:56:13:56:14 | access to local variable t5 |
| CSharp7.cs:60:7:60:12 | this | CSharp7.cs:60:7:60:12 | this access |
| CSharp7.cs:67:10:67:20 | this | CSharp7.cs:69:26:69:28 | this access |

7
csharp/ql/test/library-tests/dataflow/callablereturnsarg/Common.qll
View File

@@ -1,11 +1,12 @@
import csharp
private import semmle.code.csharp.controlflow.Guards
private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
private predicate outRefDef(DataFlow::ExprNode ne, int outRef) {
exists(Ssa::ExplicitDefinition def, Parameter outRefParameter |
exists(SsaExplicitWrite def, Parameter outRefParameter |
outRefParameter.isOutOrRef() and
ne.getExpr() = def.getADefinition().getSource() and
def.isLiveOutRefParameterDefinition(outRefParameter) and
ne.getExpr() = def.getValue() and
SsaImpl::isLiveOutRefParameterDefinition(def, outRefParameter) and
outRef = outRefParameter.getPosition()
)
}

8
csharp/ql/test/library-tests/dataflow/defuse/defUseEquivalence.ql
View File

@@ -12,6 +12,10 @@ predicate defReaches(
def.(AssignableDefinitions::ImplicitParameterDefinition).getParameter().getControlFlowNode()
].getASuccessor()
or
def.getTarget() = v and
cfn =
def.(AssignableDefinitions::ImplicitParameterDefinition).getEnclosingCallable().getEntryPoint()
or
exists(ControlFlowNode mid | defReaches(def, v, mid) |
not mid =
any(AssignableDefinition ad | ad.getTarget() = v and ad.isCertain())
@@ -29,8 +33,8 @@ predicate defUsePair(AssignableDefinition def, AssignableRead read) {
}
private LocalScopeVariableRead getAReachableUncertainRead(AssignableDefinition def) {
exists(Ssa::Definition ssaDef |
def = ssaDef.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition()
exists(SsaDefinition ssaDef |
def = ssaDef.getAnUltimateDefinition().(SsaExplicitWrite).getDefinition()
|
result = ssaDef.getARead()
)

4
csharp/ql/test/library-tests/dataflow/defuse/parameterUseEquivalence.ql
View File

@@ -23,8 +23,8 @@ predicate parameterUsePair(Parameter p, AssignableRead read) {
private LocalScopeVariableRead getAReachableUncertainRead(
AssignableDefinitions::ImplicitParameterDefinition p
) {
exists(Ssa::Definition ssaDef |
p.getParameter() = ssaDef.getAnUltimateDefinition().(Ssa::ParameterDefinition).getParameter()
exists(SsaDefinition ssaDef |
p.getParameter() = ssaDef.getAnUltimateDefinition().(SsaParameterInit).getParameter()
|
result = ssaDef.getARead()
)

12
csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
View File

@@ -25,14 +25,14 @@ predicate useUsePair(LocalScopeVariableRead read1, LocalScopeVariableRead read2)
private newtype TLocalScopeVariableReadOrSsaDef =
TLocalScopeVariableRead(LocalScopeVariableRead read) or
TSsaDefinition(Ssa::Definition ssaDef)
TSsaDefinition(SsaDefinition ssaDef)
private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableReadOrSsaDef prev) {
exists(LocalScopeVariableRead read | prev = TLocalScopeVariableRead(read) |
result = TLocalScopeVariableRead(read.getANextRead())
or
not exists(read.getANextRead()) and
exists(Ssa::Definition ssaDef, Ssa::PhiNode phi, BasicBlock bb |
exists(SsaDefinition ssaDef, SsaPhiDefinition phi, BasicBlock bb |
ssaDef.getARead() = read and
phi.getAnInput() = ssaDef and
phi.definesAt(_, bb, _) and
@@ -41,11 +41,11 @@ private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableRea
)
)
or
exists(Ssa::Definition ssaDef | prev = TSsaDefinition(ssaDef) |
result = TLocalScopeVariableRead(ssaDef.getAFirstRead())
exists(SsaDefinition ssaDef | prev = TSsaDefinition(ssaDef) |
result = TLocalScopeVariableRead(Ssa::ssaGetAFirstUse(ssaDef))
or
not exists(ssaDef.getAFirstRead()) and
exists(Ssa::PhiNode phi |
not exists(Ssa::ssaGetAFirstUse(ssaDef)) and
exists(SsaPhiDefinition phi |
phi.getAnInput() = ssaDef and
result = TSsaDefinition(phi)
)

114
csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
View File

@@ -530,8 +530,8 @@
| LocalDataFlow.cs:385:34:385:34 | SSA param(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:34:385:34 | s | LocalDataFlow.cs:385:34:385:34 | SSA param(s) |
| LocalDataFlow.cs:385:38:385:51 | "taint source" | LocalDataFlow.cs:385:38:385:51 | s = ... |
| LocalDataFlow.cs:385:38:385:51 | SSA param_default(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:38:385:51 | s = ... | LocalDataFlow.cs:385:38:385:51 | SSA param_default(s) |
| LocalDataFlow.cs:385:38:385:51 | SSA def(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:38:385:51 | s = ... | LocalDataFlow.cs:385:38:385:51 | SSA def(s) |
| SSA.cs:3:14:3:16 | this | SSA.cs:3:14:3:16 | this access |
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
@@ -629,29 +629,29 @@
| SSA.cs:58:16:58:33 | SSA def(ssaSink3) | SSA.cs:59:23:59:30 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:58:16:58:23 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:67:32:67:38 | access to parameter tainted |
| SSA.cs:59:23:59:30 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:63:23:63:30 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:59:9:59:31 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:63:9:63:31 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:67:9:67:12 | [post] this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:12 | this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:14 | [post] access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:14 | access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:28 | access to field SsaFieldSink0 | SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) |
| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:9:68:29 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:67:9:67:28 | access to field SsaFieldSink0 |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:77:20:77:26 | access to parameter tainted |
| SSA.cs:68:9:68:29 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:9:68:29 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
| SSA.cs:68:23:68:26 | [post] this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:26 | this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:28 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:69:15:69:18 | [post] this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:18 | this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:20 | [post] access to field S | SSA.cs:72:9:72:14 | access to field S |
@@ -661,15 +661,15 @@
| SSA.cs:72:9:72:14 | [post] access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:14 | access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 | SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:9:73:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:35:72:36 | "" | SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 |
| SSA.cs:73:9:73:29 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:9:73:29 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:26 | [post] this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:26 | this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:28 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:74:15:74:18 | [post] this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:18 | this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:20 | [post] access to field S | SSA.cs:80:9:80:14 | access to field S |
@@ -678,8 +678,8 @@
| SSA.cs:77:9:77:26 | SSA def(nonSink0) | SSA.cs:78:21:78:28 | access to local variable nonSink0 |
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:77:9:77:16 | access to local variable nonSink0 |
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:80:35:80:41 | access to parameter tainted |
| SSA.cs:78:21:78:28 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:21:78:28 | SSA def(nonSink0) |
| SSA.cs:78:9:78:29 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:9:78:29 | SSA def(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
@@ -690,11 +690,11 @@
| SSA.cs:80:9:80:14 | access to field S | SSA.cs:81:21:81:26 | access to field S |
| SSA.cs:80:35:80:41 | access to parameter tainted | SSA.cs:80:9:80:31 | access to field SsaFieldNonSink0 |
| SSA.cs:80:35:80:41 | access to parameter tainted | SSA.cs:83:35:83:41 | access to parameter tainted |
| SSA.cs:81:9:81:27 | SSA def(this.S) | SSA.cs:82:15:82:20 | access to field S |
| SSA.cs:81:9:81:27 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:82:15:82:37 | access to field SsaFieldNonSink0 |
| SSA.cs:81:21:81:24 | [post] this access | SSA.cs:82:15:82:18 | this access |
| SSA.cs:81:21:81:24 | this access | SSA.cs:82:15:82:18 | this access |
| SSA.cs:81:21:81:26 | SSA def(this.S) | SSA.cs:82:15:82:20 | access to field S |
| SSA.cs:81:21:81:26 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:82:15:82:37 | access to field SsaFieldNonSink0 |
| SSA.cs:81:21:81:26 | access to field S | SSA.cs:81:21:81:26 | SSA def(this.S) |
| SSA.cs:81:21:81:26 | access to field S | SSA.cs:81:9:81:27 | SSA def(this.S) |
| SSA.cs:82:15:82:18 | [post] this access | SSA.cs:83:9:83:12 | this access |
| SSA.cs:82:15:82:18 | this access | SSA.cs:83:9:83:12 | this access |
| SSA.cs:82:15:82:20 | [post] access to field S | SSA.cs:83:9:83:14 | access to field S |
@@ -731,10 +731,10 @@
| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:9:97:31 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:101:16:101:23 | access to local variable nonSink3 | SSA.cs:101:16:101:28 | SSA def(nonSink3) |
| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:101:27:101:28 | "" | SSA.cs:101:16:101:23 | access to local variable nonSink3 |
@@ -755,10 +755,10 @@
| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:9:110:31 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:117:13:117:16 | this access |
@@ -768,7 +768,7 @@
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:117:13:117:18 | access to field S |
| SSA.cs:114:9:114:28 | access to field SsaFieldSink1 | SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) |
| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:114:32:114:33 | "" | SSA.cs:114:9:114:28 | access to field SsaFieldSink1 |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
@@ -794,21 +794,21 @@
| SSA.cs:119:21:119:24 | this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:119:21:119:26 | access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:24 | this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:121:21:121:26 | access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:123:9:123:29 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
| SSA.cs:123:23:123:26 | [post] this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:26 | this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:28 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:124:15:124:18 | [post] this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:18 | this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:20 | [post] access to field S | SSA.cs:127:9:127:14 | access to field S |
@@ -822,7 +822,7 @@
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:130:13:130:18 | access to field S |
| SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 | SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:35:127:36 | "" | SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 |
| SSA.cs:128:13:128:22 | [post] access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
| SSA.cs:128:13:128:22 | access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
@@ -843,21 +843,21 @@
| SSA.cs:132:21:132:24 | this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:132:21:132:26 | access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:24 | this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:134:21:134:26 | access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:136:9:136:29 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
| SSA.cs:136:23:136:26 | [post] this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:26 | this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:28 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:144:34:144:34 | SSA param(t) | SSA.cs:146:13:146:13 | access to parameter t |
| SSA.cs:144:34:144:34 | t | SSA.cs:144:34:144:34 | SSA param(t) |
| SSA.cs:146:13:146:13 | access to parameter t | SSA.cs:146:13:146:13 | (...) ... |
@@ -874,8 +874,8 @@
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:21 | [input] SSA phi(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
| SSA.cs:154:13:154:21 | [input] SSA phi(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:25:155:25 | SSA def(t) |
| SSA.cs:155:13:155:26 | SSA def(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:13:155:26 | SSA def(t) |
| SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
| SSA.cs:166:28:166:31 | null | SSA.cs:166:19:166:24 | access to field S |
| SSA.cs:168:22:168:28 | SSA param(tainted) | SSA.cs:173:24:173:30 | access to parameter tainted |

114
csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
View File

@@ -642,8 +642,8 @@
| LocalDataFlow.cs:385:34:385:34 | SSA param(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:34:385:34 | s | LocalDataFlow.cs:385:34:385:34 | SSA param(s) |
| LocalDataFlow.cs:385:38:385:51 | "taint source" | LocalDataFlow.cs:385:38:385:51 | s = ... |
| LocalDataFlow.cs:385:38:385:51 | SSA param_default(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:38:385:51 | s = ... | LocalDataFlow.cs:385:38:385:51 | SSA param_default(s) |
| LocalDataFlow.cs:385:38:385:51 | SSA def(s) | LocalDataFlow.cs:387:15:387:15 | access to parameter s |
| LocalDataFlow.cs:385:38:385:51 | s = ... | LocalDataFlow.cs:385:38:385:51 | SSA def(s) |
| SSA.cs:3:14:3:16 | this | SSA.cs:3:14:3:16 | this access |
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
@@ -747,29 +747,29 @@
| SSA.cs:58:16:58:33 | SSA def(ssaSink3) | SSA.cs:59:23:59:30 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:58:16:58:23 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:67:32:67:38 | access to parameter tainted |
| SSA.cs:59:23:59:30 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
| SSA.cs:63:23:63:30 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
| SSA.cs:59:9:59:31 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:9:59:31 | SSA def(ssaSink3) |
| SSA.cs:63:9:63:31 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:9:63:31 | SSA def(nonSink0) |
| SSA.cs:67:9:67:12 | [post] this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:12 | this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:14 | [post] access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:14 | access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:28 | access to field SsaFieldSink0 | SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) |
| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:9:68:29 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:67:9:67:28 | access to field SsaFieldSink0 |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:77:20:77:26 | access to parameter tainted |
| SSA.cs:68:9:68:29 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:9:68:29 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
| SSA.cs:68:23:68:26 | [post] this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:26 | this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:28 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:9:68:29 | SSA def(this.S) |
| SSA.cs:69:15:69:18 | [post] this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:18 | this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:20 | [post] access to field S | SSA.cs:72:9:72:14 | access to field S |
@@ -779,15 +779,15 @@
| SSA.cs:72:9:72:14 | [post] access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:14 | access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 | SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:9:73:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:35:72:36 | "" | SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 |
| SSA.cs:73:9:73:29 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:9:73:29 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:26 | [post] this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:26 | this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:28 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:9:73:29 | SSA def(this.S) |
| SSA.cs:74:15:74:18 | [post] this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:18 | this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:20 | [post] access to field S | SSA.cs:80:9:80:14 | access to field S |
@@ -796,8 +796,8 @@
| SSA.cs:77:9:77:26 | SSA def(nonSink0) | SSA.cs:78:21:78:28 | access to local variable nonSink0 |
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:77:9:77:16 | access to local variable nonSink0 |
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:80:35:80:41 | access to parameter tainted |
| SSA.cs:78:21:78:28 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:21:78:28 | SSA def(nonSink0) |
| SSA.cs:78:9:78:29 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:9:78:29 | SSA def(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
@@ -808,11 +808,11 @@
| SSA.cs:80:9:80:14 | access to field S | SSA.cs:81:21:81:26 | access to field S |
| SSA.cs:80:35:80:41 | access to parameter tainted | SSA.cs:80:9:80:31 | access to field SsaFieldNonSink0 |
| SSA.cs:80:35:80:41 | access to parameter tainted | SSA.cs:83:35:83:41 | access to parameter tainted |
| SSA.cs:81:9:81:27 | SSA def(this.S) | SSA.cs:82:15:82:20 | access to field S |
| SSA.cs:81:9:81:27 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:82:15:82:37 | access to field SsaFieldNonSink0 |
| SSA.cs:81:21:81:24 | [post] this access | SSA.cs:82:15:82:18 | this access |
| SSA.cs:81:21:81:24 | this access | SSA.cs:82:15:82:18 | this access |
| SSA.cs:81:21:81:26 | SSA def(this.S) | SSA.cs:82:15:82:20 | access to field S |
| SSA.cs:81:21:81:26 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:82:15:82:37 | access to field SsaFieldNonSink0 |
| SSA.cs:81:21:81:26 | access to field S | SSA.cs:81:21:81:26 | SSA def(this.S) |
| SSA.cs:81:21:81:26 | access to field S | SSA.cs:81:9:81:27 | SSA def(this.S) |
| SSA.cs:82:15:82:18 | [post] this access | SSA.cs:83:9:83:12 | this access |
| SSA.cs:82:15:82:18 | this access | SSA.cs:83:9:83:12 | this access |
| SSA.cs:82:15:82:20 | [post] access to field S | SSA.cs:83:9:83:14 | access to field S |
@@ -851,10 +851,10 @@
| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
| SSA.cs:97:9:97:31 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:9:97:31 | SSA def(ssaSink4) |
| SSA.cs:101:16:101:23 | access to local variable nonSink3 | SSA.cs:101:16:101:28 | SSA def(nonSink3) |
| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:101:27:101:28 | "" | SSA.cs:101:16:101:23 | access to local variable nonSink3 |
@@ -877,10 +877,10 @@
| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
| SSA.cs:110:9:110:31 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:9:110:31 | SSA def(nonSink3) |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:117:13:117:16 | this access |
@@ -890,7 +890,7 @@
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:117:13:117:18 | access to field S |
| SSA.cs:114:9:114:28 | access to field SsaFieldSink1 | SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) |
| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:114:32:114:33 | "" | SSA.cs:114:9:114:28 | access to field SsaFieldSink1 |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
@@ -918,21 +918,21 @@
| SSA.cs:119:21:119:24 | this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:119:21:119:26 | access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:24 | this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:121:21:121:26 | access to field S | SSA.cs:123:23:123:28 | access to field S |
| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:123:9:123:29 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:9:123:29 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
| SSA.cs:123:23:123:26 | [post] this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:26 | this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:28 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:9:123:29 | SSA def(this.S) |
| SSA.cs:124:15:124:18 | [post] this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:18 | this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:20 | [post] access to field S | SSA.cs:127:9:127:14 | access to field S |
@@ -946,7 +946,7 @@
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:130:13:130:18 | access to field S |
| SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 | SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:127:35:127:36 | "" | SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 |
| SSA.cs:128:13:128:22 | [post] access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
| SSA.cs:128:13:128:22 | access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
@@ -969,21 +969,21 @@
| SSA.cs:132:21:132:24 | this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:132:21:132:26 | access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:24 | this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:134:21:134:26 | access to field S | SSA.cs:136:23:136:28 | access to field S |
| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:136:9:136:29 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:9:136:29 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
| SSA.cs:136:23:136:26 | [post] this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:26 | this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:28 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:9:136:29 | SSA def(this.S) |
| SSA.cs:144:34:144:34 | SSA param(t) | SSA.cs:146:13:146:13 | access to parameter t |
| SSA.cs:144:34:144:34 | t | SSA.cs:144:34:144:34 | SSA param(t) |
| SSA.cs:146:13:146:13 | (...) ... | SSA.cs:146:13:146:21 | ... == ... |
@@ -1002,8 +1002,8 @@
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:21 | [input] SSA phi(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
| SSA.cs:154:13:154:21 | [input] SSA phi(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:25:155:25 | SSA def(t) |
| SSA.cs:155:13:155:26 | SSA def(t) | SSA.cs:154:9:155:27 | SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:13:155:26 | SSA def(t) |
| SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
| SSA.cs:166:28:166:31 | null | SSA.cs:166:19:166:24 | access to field S |
| SSA.cs:168:22:168:28 | SSA param(tainted) | SSA.cs:173:24:173:30 | access to parameter tainted |

4
csharp/ql/test/library-tests/dataflow/ssa-large/countssa.ql
View File

@@ -2,6 +2,6 @@ import csharp
from int uses, int live
where
uses = strictcount(Ssa::ExplicitDefinition ssa, AssignableRead read | read = ssa.getARead()) and
live = strictcount(Ssa::ExplicitDefinition ssa, BasicBlock bb | ssa.isLiveAtEndOfBlock(bb))
uses = strictcount(SsaExplicitWrite ssa, AssignableRead read | read = ssa.getARead()) and
live = strictcount(SsaExplicitWrite ssa, BasicBlock bb | ssa.isLiveAtEndOfBlock(bb))
select uses, live

8
csharp/ql/test/library-tests/dataflow/ssa/BaseSsaConsistency.ql
View File

@@ -8,12 +8,8 @@ where
ar = ssaDef.getARead() and
def = ssaDef.getDefinition() and
v = def.getTarget() and
not exists(Ssa::ExplicitDefinition edef |
edef.getADefinition() = def and
edef.getARead() = ar
) and
not exists(Ssa::ParameterDefinition edef |
edef.getParameter() = def.(AssignableDefinitions::ImplicitParameterDefinition).getParameter() and
not exists(SsaExplicitWrite edef |
edef.getDefinition() = def and
edef.getARead() = ar
)
select ar, def

2
csharp/ql/test/library-tests/dataflow/ssa/DefAdjacentRead.expected
View File

@@ -83,6 +83,8 @@
| Fields.cs:93:19:93:23 | Field | Fields.cs:102:9:102:28 | ... = ... | Fields.cs:104:16:104:25 | access to field Field |
| Fields.cs:95:19:95:19 | f | Fields.cs:95:19:95:19 | f | Fields.cs:97:9:97:9 | access to parameter f |
| Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | f | Fields.cs:107:38:107:38 | access to parameter f |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:28:5:28 | access to parameter x |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:28:3:28 | access to parameter x |
| OutRef.cs:5:9:5:13 | Field | OutRef.cs:13:28:13:32 | access to field Field | OutRef.cs:15:13:15:17 | access to field Field |
| OutRef.cs:5:9:5:13 | Field | OutRef.cs:16:21:16:25 | access to field Field | OutRef.cs:17:13:17:17 | access to field Field |
| OutRef.cs:5:9:5:13 | Field | OutRef.cs:16:32:16:36 | access to field Field | OutRef.cs:17:13:17:17 | access to field Field |

5
csharp/ql/test/library-tests/dataflow/ssa/IsLiveOutRefParameterDefinition.ql
View File

@@ -1,7 +1,8 @@
import csharp
private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
from Ssa::SourceVariable v, Ssa::Definition def
from Ssa::SourceVariable v, SsaDefinition def
where
v = def.getSourceVariable() and
def.isLiveOutRefParameterDefinition(_)
SsaImpl::isLiveOutRefParameterDefinition(def, _)
select v, def

6
csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
View File

@@ -5,13 +5,13 @@
| DefUse.cs:6:14:6:14 | y | DefUse.cs:37:9:40:9 | SSA phi(y) | DefUse.cs:28:13:28:18 | SSA def(y) |
| DefUse.cs:6:14:6:14 | y | DefUse.cs:37:9:40:9 | SSA phi(y) | DefUse.cs:39:13:39:18 | SSA def(y) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:79:13:79:18 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:80:30:80:31 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:80:16:80:32 | SSA def(x1) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:97:13:97:18 | SSA def(x5) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:101:13:101:23 | SSA def(x5) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:30:3:30 | SSA param(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:34:3:35 | SSA param_default(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:34:3:35 | SSA def(s) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:42:3:42 | SSA param(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:46:3:46 | SSA param_default(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:46:3:46 | SSA def(i) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:10:9:13:24 | SSA phi(this.Field) | Example.cs:11:13:11:30 | SSA def(this.Field) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:10:9:13:24 | SSA phi(this.Field) | Example.cs:12:14:13:24 | SSA phi(this.Field) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:12:14:13:24 | SSA phi(this.Field) | Example.cs:8:9:8:22 | SSA def(this.Field) |

2
csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.ql
View File

@@ -1,6 +1,6 @@
import csharp
from Ssa::SourceVariable v, Ssa::PhiNode phi, Ssa::Definition input
from Ssa::SourceVariable v, SsaPhiDefinition phi, SsaDefinition input
where
phi.getAnInput() = input and
v = phi.getSourceVariable()

46
csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
View File

@@ -35,8 +35,8 @@
| Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) |
| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) |
| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:9:25:30 | SSA def(c) |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) |
| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) |
| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) |
| Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) |
@@ -58,8 +58,8 @@
| DefUse.cs:6:14:6:14 | y | DefUse.cs:37:9:40:9 | SSA phi(y) |
| DefUse.cs:6:14:6:14 | y | DefUse.cs:39:13:39:18 | SSA def(y) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:9:47:24 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:9:50:24 | SSA def(z) |
| DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) |
| DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) |
| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) |
@@ -67,12 +67,12 @@
| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:79:13:79:18 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:16:80:32 | SSA def(x1) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | SSA def(x2) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:84:9:86:17 | SSA def(x2) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | SSA def(x3) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | SSA def(x3) |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | SSA def(x4) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:91:9:93:17 | SSA def(x3) |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:91:9:93:17 | SSA def(x4) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:97:13:97:18 | SSA def(x5) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:101:13:101:23 | SSA def(x5) |
@@ -95,10 +95,10 @@
| DefUse.cs:188:13:188:18 | this.Field5 | DefUse.cs:188:13:188:22 | SSA def(this.Field5) |
| DefaultParam.cs:3:20:3:20 | b | DefaultParam.cs:3:20:3:20 | SSA param(b) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:30:3:30 | SSA param(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA param_default(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA def(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:42:3:42 | SSA param(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA param_default(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA def(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) |
| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | SSA param(i) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:8:9:8:22 | SSA def(this.Field) |
@@ -162,25 +162,25 @@
| Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | SSA param(f) |
| Fields.cs:115:20:115:29 | this.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
| Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | SSA param(x) |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:22:3:22 | SSA param(x) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | SSA def(i) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | SSA def(i) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:9:10:33 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:9:22:30 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:9:24:30 | SSA def(j) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:9:10:33 | SSA def(i) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:9:13:33 | SSA def(i) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:7:10:7:10 | SSA entry def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:21:19:25 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:9:13:33 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:9:16:37 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:9:19:39 | SSA def(this.Field) |
| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:32:19:38 | SSA def(t.Field) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:9:19:39 | SSA def(t.Field) |
| OutRef.cs:28:26:28:26 | i | OutRef.cs:30:9:30:13 | SSA def(i) |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | SSA param(j) |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:31:9:31:13 | SSA def(j) |
@@ -245,9 +245,9 @@
| Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) |
| Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
| Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
| Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) |
| Test.cs:5:15:5:20 | param1 | Test.cs:25:9:32:9 | SSA phi(param1) |

2
csharp/ql/test/library-tests/dataflow/ssa/SsaDef.ql
View File

@@ -1,5 +1,5 @@
import csharp
from Ssa::SourceVariable v, Ssa::Definition def
from Ssa::SourceVariable v, SsaDefinition def
where v = def.getSourceVariable()
select v, def

277
csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
View File

@@ -1,277 +0,0 @@
| Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:10:16:27:9 | Action a = ... |
| Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:17:17:17:21 | Int32 y = ... |
| Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:19:20:23:13 | Action b = ... |
| Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:19:24:23:13 | (...) => ... |
| Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:30:16:30:35 | Action c = ... |
| Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:52:16:52:43 | Action b = ... |
| Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:57:57:57:63 | strings |
| Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:60:27:60:38 | Func<String,Int32> e = ... |
| Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:65:45:65:51 | strings |
| Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:32:68:32 | s |
| Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:32:68:49 | (...) => ... |
| Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:69:9:69:62 | M |
| Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:25:69:25 | s |
| Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:73:67:73:73 | strings |
| Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:76:63:76:81 | Expression<Func<String,Int32>> e = ... |
| Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:28:81:28 | i |
| Capture.cs:81:34:81:36 | SSA def(i) | Capture.cs:81:34:81:36 | ...++ |
| Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:83:65:83:71 | strings |
| Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:86:64:86:73 | Expression<Func<String,Boolean>> e = ... |
| Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:86:68:86:73 | (...) => ... |
| Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:18:92:18 | d |
| Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | (...) => ... |
| Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... |
| Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | M1 |
| Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... |
| Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | M7 |
| Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:183:13:186:13 | M11 |
| Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:198:28:198:44 | MyEventHandler eh = ... |
| Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:33:198:44 | (...) => ... |
| Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:203:28:203:45 | MyEventHandler eh2 = ... |
| Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:34:203:45 | (...) => ... |
| Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:210:24:210:59 | Process p = ... |
| Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:212:30:212:71 | EventHandler exited = ... |
| Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:39:212:71 | (...) => ... |
| Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... |
| Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b |
| Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... |
| Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:9:25:30 | call to method Out |
| Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:9:25:30 | call to method Out |
| Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... |
| Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s |
| Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a |
| Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:37:49:37 | i |
| Consistency.cs:51:20:51:20 | SSA param(a) | Consistency.cs:51:20:51:20 | a |
| Consistency.cs:56:17:56:40 | SSA def(k) | Consistency.cs:56:17:56:40 | Int32 k = ... |
| Consistency.cs:57:9:57:13 | SSA def(k) | Consistency.cs:57:9:57:13 | ... = ... |
| Consistency.cs:58:9:58:13 | SSA def(k) | Consistency.cs:58:9:58:13 | ... = ... |
| DefUse.cs:3:26:3:26 | SSA param(w) | DefUse.cs:3:26:3:26 | w |
| DefUse.cs:5:13:5:17 | SSA def(x) | DefUse.cs:5:13:5:17 | Int32 x = ... |
| DefUse.cs:6:14:6:19 | SSA def(y) | DefUse.cs:6:14:6:19 | Int64 y = ... |
| DefUse.cs:13:13:13:18 | SSA def(y) | DefUse.cs:13:13:13:18 | ... = ... |
| DefUse.cs:18:13:18:18 | SSA def(y) | DefUse.cs:18:13:18:18 | ... = ... |
| DefUse.cs:19:13:19:18 | SSA def(w) | DefUse.cs:19:13:19:18 | ... = ... |
| DefUse.cs:28:13:28:18 | SSA def(y) | DefUse.cs:28:13:28:18 | ... = ... |
| DefUse.cs:29:13:29:18 | SSA def(w) | DefUse.cs:29:13:29:18 | ... = ... |
| DefUse.cs:39:13:39:18 | SSA def(y) | DefUse.cs:39:13:39:18 | ... = ... |
| DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:44:13:44:17 | Int32 z = ... |
| DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:47:9:47:24 | call to method outMethod |
| DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:9:50:24 | call to method refMethod |
| DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... |
| DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... |
| DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | ... = ... |
| DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | ... = ... |
| DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | TestClass tc = ... |
| DefUse.cs:79:13:79:18 | SSA def(x1) | DefUse.cs:79:13:79:18 | Int32 x1 = ... |
| DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:80:16:80:32 | call to method refMethod |
| DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:83:13:83:18 | Int32 x2 = ... |
| DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:84:9:86:17 | call to method refOutMethod |
| DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:89:13:89:18 | Int32 x3 = ... |
| DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:91:9:93:17 | call to method refOutMethod |
| DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:91:9:93:17 | call to method refOutMethod |
| DefUse.cs:97:13:97:18 | SSA def(x5) | DefUse.cs:97:13:97:18 | Int32 x5 = ... |
| DefUse.cs:101:13:101:23 | SSA def(x5) | DefUse.cs:101:13:101:23 | ... = ... |
| DefUse.cs:104:9:104:15 | SSA def(x5) | DefUse.cs:104:9:104:15 | ... += ... |
| DefUse.cs:114:47:114:52 | SSA def(i) | DefUse.cs:114:47:114:52 | ... = ... |
| DefUse.cs:116:47:116:51 | SSA def(i) | DefUse.cs:116:47:116:51 | ... = ... |
| DefUse.cs:118:45:118:45 | SSA param(i) | DefUse.cs:118:45:118:45 | i |
| DefUse.cs:118:61:118:65 | SSA def(j) | DefUse.cs:118:61:118:65 | ... = ... |
| DefUse.cs:118:68:118:72 | SSA def(i) | DefUse.cs:118:68:118:72 | ... = ... |
| DefUse.cs:128:19:128:19 | SSA param(i) | DefUse.cs:128:19:128:19 | i |
| DefUse.cs:134:22:134:22 | SSA param(d) | DefUse.cs:134:22:134:22 | d |
| DefUse.cs:142:68:142:69 | SSA param(ie) | DefUse.cs:142:68:142:69 | ie |
| DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:144:22:144:22 | String x |
| DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:155:9:155:18 | ... = ... |
| DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:160:10:160:16 | FieldM2 |
| DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:171:23:180:9 | Action a = ... |
| DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:184:9:184:18 | ... = ... |
| DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:186:9:190:9 | ... = ... |
| DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:188:13:188:22 | ... = ... |
| DefUse.cs:191:9:191:11 | SSA call def(this.Field5) | DefUse.cs:191:9:191:11 | delegate call |
| DefaultParam.cs:3:20:3:20 | SSA param(b) | DefaultParam.cs:3:20:3:20 | b |
| DefaultParam.cs:3:30:3:30 | SSA param(s) | DefaultParam.cs:3:30:3:30 | s |
| DefaultParam.cs:3:34:3:35 | SSA param_default(s) | DefaultParam.cs:3:34:3:35 | "" |
| DefaultParam.cs:3:42:3:42 | SSA param(i) | DefaultParam.cs:3:42:3:42 | i |
| DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:42:3:42 | i |
| DefaultParam.cs:3:46:3:46 | SSA param_default(i) | DefaultParam.cs:3:46:3:46 | 0 |
| DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:4:5:6:5 | {...} |
| Example.cs:6:23:6:23 | SSA param(i) | Example.cs:6:23:6:23 | i |
| Example.cs:8:9:8:22 | SSA def(this.Field) | Example.cs:8:9:8:22 | ... = ... |
| Example.cs:11:13:11:30 | SSA def(this.Field) | Example.cs:11:13:11:30 | ... = ... |
| Example.cs:13:13:13:23 | SSA call def(this.Field) | Example.cs:13:13:13:23 | call to method SetField |
| Example.cs:18:16:18:16 | SSA param(p) | Example.cs:18:16:18:16 | p |
| Example.cs:18:24:18:24 | SSA param(b) | Example.cs:18:24:18:24 | b |
| Example.cs:23:13:23:17 | SSA def(p) | Example.cs:23:13:23:17 | ... = ... |
| Fields.cs:16:17:16:17 | SSA entry def(this.xs) | Fields.cs:16:17:16:17 | F |
| Fields.cs:19:9:19:13 | SSA call def(this.xs) | Fields.cs:19:9:19:13 | call to method Upd |
| Fields.cs:20:9:20:14 | SSA def(x) | Fields.cs:20:9:20:14 | ... = ... |
| Fields.cs:22:13:22:17 | SSA call def(this.xs) | Fields.cs:22:13:22:17 | call to method Upd |
| Fields.cs:24:9:24:23 | SSA def(this.xs) | Fields.cs:24:9:24:23 | ... = ... |
| Fields.cs:28:17:28:17 | SSA entry def(Fields.stat) | Fields.cs:28:17:28:17 | G |
| Fields.cs:28:17:28:17 | SSA entry def(this.xs) | Fields.cs:28:17:28:17 | G |
| Fields.cs:30:13:30:28 | SSA def(f) | Fields.cs:30:13:30:28 | Fields f = ... |
| Fields.cs:30:13:30:28 | SSA qualifier def(f.xs) | Fields.cs:30:13:30:28 | Fields f = ... |
| Fields.cs:30:17:30:28 | SSA call def(Fields.stat) | Fields.cs:30:17:30:28 | object creation of type Fields |
| Fields.cs:34:9:34:16 | SSA call def(Fields.stat) | Fields.cs:34:9:34:16 | call to method F |
| Fields.cs:34:9:34:16 | SSA call def(f.xs) | Fields.cs:34:9:34:16 | call to method F |
| Fields.cs:34:9:34:16 | SSA call def(this.xs) | Fields.cs:34:9:34:16 | call to method F |
| Fields.cs:38:9:38:13 | SSA call def(Fields.stat) | Fields.cs:38:9:38:13 | call to method F |
| Fields.cs:38:9:38:13 | SSA call def(f.xs) | Fields.cs:38:9:38:13 | call to method F |
| Fields.cs:38:9:38:13 | SSA call def(this.xs) | Fields.cs:38:9:38:13 | call to method F |
| Fields.cs:42:9:42:23 | SSA def(this.xs) | Fields.cs:42:9:42:23 | ... = ... |
| Fields.cs:45:9:45:25 | SSA def(f.xs) | Fields.cs:45:9:45:25 | ... = ... |
| Fields.cs:47:9:47:14 | SSA def(z) | Fields.cs:47:9:47:14 | ... = ... |
| Fields.cs:49:13:49:28 | SSA def(f) | Fields.cs:49:13:49:28 | ... = ... |
| Fields.cs:49:13:49:28 | SSA qualifier def(f.xs) | Fields.cs:49:13:49:28 | ... = ... |
| Fields.cs:49:17:49:28 | SSA call def(Fields.stat) | Fields.cs:49:17:49:28 | object creation of type Fields |
| Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:51:9:51:20 | object creation of type Fields |
| Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:61:17:61:17 | H |
| Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:61:17:61:17 | H |
| Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:74:17:74:17 | I |
| Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:77:13:77:45 | Fields f = ... |
| Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:78:23:78:54 | Action a = ... |
| Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:27:78:54 | (...) => ... |
| Fields.cs:79:23:79:35 | SSA def(b) | Fields.cs:79:23:79:35 | Action b = ... |
| Fields.cs:80:9:80:25 | SSA def(f.xs) | Fields.cs:80:9:80:25 | ... = ... |
| Fields.cs:81:9:81:11 | SSA call def(f.xs) | Fields.cs:81:9:81:11 | delegate call |
| Fields.cs:83:9:83:25 | SSA def(f.xs) | Fields.cs:83:9:83:25 | ... = ... |
| Fields.cs:85:9:85:22 | SSA def(this.xs) | Fields.cs:85:9:85:22 | ... = ... |
| Fields.cs:86:9:86:47 | SSA call def(f.xs) | Fields.cs:86:9:86:47 | call to method Select<Int32,Int32> |
| Fields.cs:86:24:86:46 | SSA capture def(a) | Fields.cs:86:24:86:46 | (...) => ... |
| Fields.cs:87:9:87:22 | SSA def(this.xs) | Fields.cs:87:9:87:22 | ... = ... |
| Fields.cs:88:9:88:25 | SSA def(f.xs) | Fields.cs:88:9:88:25 | ... = ... |
| Fields.cs:89:24:89:46 | SSA capture def(b) | Fields.cs:89:24:89:46 | (...) => ... |
| Fields.cs:95:19:95:19 | SSA param(f) | Fields.cs:95:19:95:19 | f |
| Fields.cs:97:9:97:30 | SSA def(f.Field) | Fields.cs:97:9:97:30 | ... = ... |
| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) | Fields.cs:97:9:97:30 | ... = ... |
| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) | Fields.cs:97:9:97:30 | ... = ... |
| Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field.Field) | Fields.cs:97:9:97:30 | ... = ... |
| Fields.cs:102:9:102:28 | SSA def(this.Field) | Fields.cs:102:9:102:28 | ... = ... |
| Fields.cs:107:33:107:33 | SSA param(f) | Fields.cs:107:33:107:33 | f |
| Fields.cs:109:10:109:10 | SSA entry def(this.Field) | Fields.cs:109:10:109:10 | K |
| Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:114:9:114:22 | call to method SetField |
| Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:114:9:114:22 | call to method SetField |
| Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | call to method SetField |
| MultiImplementationA.cs:5:22:5:22 | SSA param(x) | MultiImplementationA.cs:5:16:5:16 | M |
| MultiImplementationB.cs:3:22:3:22 | SSA param(x) | MultiImplementationA.cs:5:16:5:16 | M |
| OutRef.cs:7:10:7:10 | SSA entry def(this.Field) | OutRef.cs:7:10:7:10 | M |
| OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:9:13:9:17 | Int32 j = ... |
| OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:10:9:10:33 | call to method OutRefM |
| OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:10:9:10:33 | call to method OutRefM |
| OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:13:9:13:33 | call to method OutRefM |
| OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:13:9:13:33 | call to method OutRefM |
| OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:16:9:16:37 | call to method OutRefM |
| OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:18:13:18:28 | OutRef t = ... |
| OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:18:13:18:28 | OutRef t = ... |
| OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:19:9:19:39 | call to method OutRefM |
| OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:19:9:19:39 | call to method OutRefM |
| OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:22:9:22:30 | call to method OutRefM2 |
| OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:24:9:24:30 | call to method OutRefM3 |
| OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:28:37:28:37 | j |
| OutRef.cs:30:9:30:13 | SSA def(i) | OutRef.cs:30:9:30:13 | ... = ... |
| OutRef.cs:31:9:31:13 | SSA def(j) | OutRef.cs:31:9:31:13 | ... = ... |
| OutRef.cs:34:38:34:38 | SSA param(j) | OutRef.cs:34:38:34:38 | j |
| OutRef.cs:36:9:36:13 | SSA def(i) | OutRef.cs:36:9:36:13 | ... = ... |
| OutRef.cs:39:24:39:24 | SSA param(b) | OutRef.cs:39:24:39:24 | b |
| OutRef.cs:39:35:39:35 | SSA param(j) | OutRef.cs:39:35:39:35 | j |
| OutRef.cs:42:13:42:17 | SSA def(j) | OutRef.cs:42:13:42:17 | ... = ... |
| Patterns.cs:7:16:7:23 | SSA def(o) | Patterns.cs:7:16:7:23 | Object o = ... |
| Patterns.cs:8:18:8:23 | SSA def(i1) | Patterns.cs:8:18:8:23 | Int32 i1 |
| Patterns.cs:12:23:12:31 | SSA def(s1) | Patterns.cs:12:23:12:31 | String s1 |
| Patterns.cs:24:18:24:23 | SSA def(i2) | Patterns.cs:24:18:24:23 | Int32 i2 |
| Patterns.cs:27:18:27:23 | SSA def(i3) | Patterns.cs:27:18:27:23 | Int32 i3 |
| Patterns.cs:30:18:30:26 | SSA def(s2) | Patterns.cs:30:18:30:26 | String s2 |
| Properties.cs:16:17:16:17 | SSA entry def(this.xs) | Properties.cs:16:17:16:17 | F |
| Properties.cs:19:9:19:13 | SSA call def(this.xs) | Properties.cs:19:9:19:13 | call to method Upd |
| Properties.cs:20:9:20:14 | SSA def(x) | Properties.cs:20:9:20:14 | ... = ... |
| Properties.cs:22:13:22:17 | SSA call def(this.xs) | Properties.cs:22:13:22:17 | call to method Upd |
| Properties.cs:24:9:24:23 | SSA def(this.xs) | Properties.cs:24:9:24:23 | ... = ... |
| Properties.cs:28:17:28:17 | SSA entry def(Properties.stat) | Properties.cs:28:17:28:17 | G |
| Properties.cs:28:17:28:17 | SSA entry def(this.xs) | Properties.cs:28:17:28:17 | G |
| Properties.cs:30:13:30:32 | SSA def(f) | Properties.cs:30:13:30:32 | Properties f = ... |
| Properties.cs:30:13:30:32 | SSA qualifier def(f.xs) | Properties.cs:30:13:30:32 | Properties f = ... |
| Properties.cs:30:17:30:32 | SSA call def(Properties.stat) | Properties.cs:30:17:30:32 | object creation of type Properties |
| Properties.cs:34:9:34:16 | SSA call def(Properties.stat) | Properties.cs:34:9:34:16 | call to method F |
| Properties.cs:34:9:34:16 | SSA call def(f.xs) | Properties.cs:34:9:34:16 | call to method F |
| Properties.cs:34:9:34:16 | SSA call def(this.xs) | Properties.cs:34:9:34:16 | call to method F |
| Properties.cs:38:9:38:13 | SSA call def(Properties.stat) | Properties.cs:38:9:38:13 | call to method F |
| Properties.cs:38:9:38:13 | SSA call def(f.xs) | Properties.cs:38:9:38:13 | call to method F |
| Properties.cs:38:9:38:13 | SSA call def(this.xs) | Properties.cs:38:9:38:13 | call to method F |
| Properties.cs:42:9:42:23 | SSA def(this.xs) | Properties.cs:42:9:42:23 | ... = ... |
| Properties.cs:45:9:45:25 | SSA def(f.xs) | Properties.cs:45:9:45:25 | ... = ... |
| Properties.cs:47:9:47:14 | SSA def(z) | Properties.cs:47:9:47:14 | ... = ... |
| Properties.cs:49:13:49:32 | SSA def(f) | Properties.cs:49:13:49:32 | ... = ... |
| Properties.cs:49:13:49:32 | SSA qualifier def(f.xs) | Properties.cs:49:13:49:32 | ... = ... |
| Properties.cs:49:17:49:32 | SSA call def(Properties.stat) | Properties.cs:49:17:49:32 | object creation of type Properties |
| Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:51:9:51:24 | object creation of type Properties |
| Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:61:17:61:17 | H |
| Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:61:17:61:17 | H |
| Properties.cs:61:23:61:23 | SSA param(i) | Properties.cs:61:23:61:23 | i |
| Properties.cs:63:16:63:18 | SSA def(i) | Properties.cs:63:16:63:18 | ...-- |
| Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:70:17:70:17 | I |
| Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:73:13:73:32 | Properties f = ... |
| Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:74:23:74:54 | Action a = ... |
| Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:27:74:54 | (...) => ... |
| Properties.cs:75:23:75:35 | SSA def(b) | Properties.cs:75:23:75:35 | Action b = ... |
| Properties.cs:76:9:76:25 | SSA def(f.xs) | Properties.cs:76:9:76:25 | ... = ... |
| Properties.cs:77:9:77:11 | SSA call def(f.xs) | Properties.cs:77:9:77:11 | delegate call |
| Properties.cs:79:9:79:25 | SSA def(f.xs) | Properties.cs:79:9:79:25 | ... = ... |
| Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:81:9:81:22 | ... = ... |
| Properties.cs:82:9:82:47 | SSA call def(f.xs) | Properties.cs:82:9:82:47 | call to method Select<Int32,Int32> |
| Properties.cs:82:24:82:46 | SSA capture def(a) | Properties.cs:82:24:82:46 | (...) => ... |
| Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:83:9:83:22 | ... = ... |
| Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:84:9:84:25 | ... = ... |
| Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:24:85:46 | (...) => ... |
| Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:37:106:37 | p |
| Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | K |
| Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:113:9:113:22 | call to method SetProps |
| Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:113:9:113:22 | call to method SetProps |
| Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | call to method SetProps |
| Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:5:15:5:20 | param1 |
| Test.cs:5:67:5:72 | SSA param(param2) | Test.cs:5:67:5:72 | param2 |
| Test.cs:7:9:7:17 | SSA def(this.field) | Test.cs:7:9:7:17 | ... = ... |
| Test.cs:8:13:8:17 | SSA def(x) | Test.cs:8:13:8:17 | Int32 x = ... |
| Test.cs:13:13:13:15 | SSA def(x) | Test.cs:13:13:13:15 | ...++ |
| Test.cs:14:13:14:19 | SSA def(y) | Test.cs:14:13:14:19 | ... = ... |
| Test.cs:14:17:14:19 | SSA def(x) | Test.cs:14:17:14:19 | ++... |
| Test.cs:15:13:15:17 | SSA def(z) | Test.cs:15:13:15:17 | ... = ... |
| Test.cs:19:13:19:17 | SSA def(y) | Test.cs:19:13:19:17 | ... = ... |
| Test.cs:20:13:20:18 | SSA def(y) | Test.cs:20:13:20:18 | ... += ... |
| Test.cs:21:13:21:22 | SSA def(this.field) | Test.cs:21:13:21:22 | ... = ... |
| Test.cs:22:13:22:17 | SSA def(z) | Test.cs:22:13:22:17 | ... = ... |
| Test.cs:27:17:27:24 | SSA def(param1) | Test.cs:27:17:27:24 | ...++ |
| Test.cs:31:13:31:18 | SSA def(y) | Test.cs:31:13:31:18 | ... -= ... |
| Test.cs:34:18:34:22 | SSA def(i) | Test.cs:34:18:34:22 | Int32 i = ... |
| Test.cs:34:33:34:35 | SSA def(i) | Test.cs:34:33:34:35 | ...++ |
| Test.cs:36:13:36:18 | SSA def(x) | Test.cs:36:13:36:18 | ... += ... |
| Test.cs:39:22:39:22 | SSA def(w) | Test.cs:39:22:39:22 | Int32 w |
| Test.cs:39:22:39:22 | SSA phi(param1) | Test.cs:39:22:39:22 | Int32 w |
| Test.cs:41:13:41:23 | SSA def(param1) | Test.cs:41:13:41:23 | ... += ... |
| Test.cs:46:10:46:10 | SSA entry def(this.field) | Test.cs:46:10:46:10 | g |
| Test.cs:46:16:46:18 | SSA param(in) | Test.cs:46:16:46:18 | in |
| Test.cs:50:13:50:20 | SSA def(out) | Test.cs:50:13:50:20 | ... = ... |
| Test.cs:54:13:54:20 | SSA def(out) | Test.cs:54:13:54:20 | ... = ... |
| Test.cs:57:9:57:17 | SSA def(this.field) | Test.cs:57:9:57:17 | ... = ... |
| Test.cs:62:16:62:16 | SSA param(x) | Test.cs:62:16:62:16 | x |
| Test.cs:68:45:68:45 | SSA def(e) | Test.cs:68:45:68:45 | DivideByZeroException e |
| Test.cs:76:24:76:25 | SSA param(b1) | Test.cs:76:24:76:25 | b1 |
| Test.cs:76:33:76:34 | SSA param(b2) | Test.cs:76:33:76:34 | b2 |
| Test.cs:76:42:76:43 | SSA param(b3) | Test.cs:76:42:76:43 | b3 |
| Test.cs:76:51:76:52 | SSA param(b4) | Test.cs:76:51:76:52 | b4 |
| Test.cs:76:60:76:61 | SSA param(b5) | Test.cs:76:60:76:61 | b5 |
| Test.cs:76:69:76:70 | SSA param(b6) | Test.cs:76:69:76:70 | b6 |
| Test.cs:78:13:78:17 | SSA def(x) | Test.cs:78:13:78:17 | Int32 x = ... |
| Test.cs:108:13:108:17 | SSA def(x) | Test.cs:108:13:108:17 | ... = ... |
| Tuples.cs:10:9:10:54 | SSA def(b) | Tuples.cs:10:9:10:54 | ... = ... |
| Tuples.cs:10:9:10:54 | SSA def(s) | Tuples.cs:10:9:10:54 | ... = ... |
| Tuples.cs:10:9:10:54 | SSA def(x) | Tuples.cs:10:9:10:54 | ... = ... |
| Tuples.cs:14:9:14:32 | SSA def(b) | Tuples.cs:14:9:14:32 | ... = ... |
| Tuples.cs:14:9:14:32 | SSA def(s) | Tuples.cs:14:9:14:32 | ... = ... |
| Tuples.cs:14:9:14:32 | SSA def(x) | Tuples.cs:14:9:14:32 | ... = ... |
| Tuples.cs:18:40:18:57 | SSA def(tuple) | Tuples.cs:18:40:18:57 | (Int32,(Boolean,String)) tuple = ... |
| Tuples.cs:20:9:20:34 | SSA def(this.Field) | Tuples.cs:20:9:20:34 | ... = ... |
| Tuples.cs:20:9:20:34 | SSA def(this.Property) | Tuples.cs:20:9:20:34 | ... = ... |
| Tuples.cs:23:9:23:37 | SSA def(x) | Tuples.cs:23:9:23:37 | ... = ... |
| Tuples.cs:25:13:25:28 | SSA def(t) | Tuples.cs:25:13:25:28 | Tuples t = ... |
| Tuples.cs:26:9:26:33 | SSA def(t.Field) | Tuples.cs:26:9:26:33 | ... = ... |
| Tuples.cs:26:9:26:33 | SSA def(this.Field) | Tuples.cs:26:9:26:33 | ... = ... |

4
csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.ql
View File

@@ -1,4 +0,0 @@
import csharp
from Ssa::Definition def
select def, def.getElement()

42
csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
View File

@@ -24,7 +24,7 @@
| Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... |
| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b |
| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | Consistency c |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:9:25:30 | SSA def(c) | Consistency.cs:25:29:25:29 | Consistency c |
| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... |
| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s |
| Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a |
@@ -43,21 +43,21 @@
| DefUse.cs:6:14:6:14 | y | DefUse.cs:28:13:28:18 | SSA def(y) | DefUse.cs:28:13:28:18 | ... = ... |
| DefUse.cs:6:14:6:14 | y | DefUse.cs:39:13:39:18 | SSA def(y) | DefUse.cs:39:13:39:18 | ... = ... |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:44:13:44:17 | Int32 z = ... |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:47:23:47:23 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:9:47:24 | SSA def(z) | DefUse.cs:47:23:47:23 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:9:50:24 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z |
| DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... |
| DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... |
| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | ... = ... |
| DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | ... = ... |
| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | TestClass tc = ... |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:79:13:79:18 | SSA def(x1) | DefUse.cs:79:13:79:18 | Int32 x1 = ... |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:16:80:32 | SSA def(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:83:13:83:18 | Int32 x2 = ... |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:85:15:85:16 | access to local variable x2 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:86:15:86:16 | access to local variable x2 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:84:9:86:17 | SSA def(x2) | DefUse.cs:85:15:85:16 | access to local variable x2 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:84:9:86:17 | SSA def(x2) | DefUse.cs:86:15:86:16 | access to local variable x2 |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:89:13:89:18 | Int32 x3 = ... |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:92:15:92:16 | access to local variable x3 |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:93:15:93:16 | access to local variable x4 |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:91:9:93:17 | SSA def(x3) | DefUse.cs:92:15:92:16 | access to local variable x3 |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:91:9:93:17 | SSA def(x4) | DefUse.cs:93:15:93:16 | access to local variable x4 |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:97:13:97:18 | SSA def(x5) | DefUse.cs:97:13:97:18 | Int32 x5 = ... |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:101:13:101:23 | SSA def(x5) | DefUse.cs:101:13:101:23 | ... = ... |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:104:9:104:15 | SSA def(x5) | DefUse.cs:104:9:104:15 | ... += ... |
@@ -77,9 +77,9 @@
| DefUse.cs:188:13:188:18 | this.Field5 | DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:188:13:188:22 | ... = ... |
| DefaultParam.cs:3:20:3:20 | b | DefaultParam.cs:3:20:3:20 | SSA param(b) | DefaultParam.cs:3:20:3:20 | b |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:30:3:30 | SSA param(s) | DefaultParam.cs:3:30:3:30 | s |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA param_default(s) | DefaultParam.cs:3:34:3:35 | s = ... |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA def(s) | DefaultParam.cs:3:34:3:35 | s = ... |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:42:3:42 | SSA param(i) | DefaultParam.cs:3:42:3:42 | i |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA param_default(i) | DefaultParam.cs:3:46:3:46 | i = ... |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA def(i) | DefaultParam.cs:3:46:3:46 | i = ... |
| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | SSA param(i) | Example.cs:6:23:6:23 | i |
| Example.cs:8:9:8:18 | this.Field | Example.cs:8:9:8:22 | SSA def(this.Field) | Example.cs:8:9:8:22 | ... = ... |
| Example.cs:8:9:8:18 | this.Field | Example.cs:11:13:11:30 | SSA def(this.Field) | Example.cs:11:13:11:30 | ... = ... |
@@ -105,18 +105,20 @@
| Fields.cs:97:9:97:15 | f.Field | Fields.cs:97:9:97:30 | SSA def(f.Field) | Fields.cs:97:9:97:30 | ... = ... |
| Fields.cs:102:9:102:18 | this.Field | Fields.cs:102:9:102:28 | SSA def(this.Field) | Fields.cs:102:9:102:28 | ... = ... |
| Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | SSA param(f) | Fields.cs:107:33:107:33 | f |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | SSA param(x) | MultiImplementationA.cs:5:22:5:22 | x |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:22:3:22 | SSA param(x) | MultiImplementationA.cs:5:22:5:22 | x |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:9:13:9:17 | Int32 j = ... |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:10:32:10:32 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:22:22:22:22 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:24:29:24:29 | access to local variable j |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:10:25:10:25 | Int32 i |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:13:21:13:21 | access to local variable i |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:13:28:13:32 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:16:21:16:25 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:16:32:16:36 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:19:21:19:25 | access to field Field |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:9:10:33 | SSA def(j) | OutRef.cs:10:32:10:32 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:9:22:30 | SSA def(j) | OutRef.cs:22:22:22:22 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:9:24:30 | SSA def(j) | OutRef.cs:24:29:24:29 | access to local variable j |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:9:10:33 | SSA def(i) | OutRef.cs:10:25:10:25 | Int32 i |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:9:13:33 | SSA def(i) | OutRef.cs:13:21:13:21 | access to local variable i |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:9:13:33 | SSA def(this.Field) | OutRef.cs:13:28:13:32 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:9:16:37 | SSA def(this.Field) | OutRef.cs:16:21:16:25 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:9:16:37 | SSA def(this.Field) | OutRef.cs:16:32:16:36 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:9:19:39 | SSA def(this.Field) | OutRef.cs:19:21:19:25 | access to field Field |
| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:18:13:18:28 | OutRef t = ... |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:19:32:19:38 | access to field Field |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:9:19:39 | SSA def(t.Field) | OutRef.cs:19:32:19:38 | access to field Field |
| OutRef.cs:28:26:28:26 | i | OutRef.cs:30:9:30:13 | SSA def(i) | OutRef.cs:30:9:30:13 | ... = ... |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:28:37:28:37 | j |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:31:9:31:13 | SSA def(j) | OutRef.cs:31:9:31:13 | ... = ... |

4
csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.ql
View File

@@ -1,5 +1,5 @@
import csharp
from Ssa::SourceVariable v, Ssa::ExplicitDefinition def
from Ssa::SourceVariable v, SsaExplicitWrite def
where v = def.getSourceVariable()
select v, def, def.getADefinition()
select v, def, def.getDefinition()

2
csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitParameterDef.ql
View File

@@ -1,5 +1,5 @@
import csharp
from Ssa::SourceVariable v, Ssa::ParameterDefinition def
from Ssa::SourceVariable v, SsaParameterInit def
where v = def.getSourceVariable()
select v, def, def.getParameter()

6
csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitQualifier.expected
View File

@@ -1,15 +1,11 @@
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:29:25:29 | SSA def(c) |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) | Consistency.cs:25:9:25:30 | SSA def(c) |
| Fields.cs:31:19:31:22 | f.xs | Fields.cs:30:13:30:28 | SSA qualifier def(f.xs) | Fields.cs:30:13:30:28 | SSA def(f) |
| Fields.cs:31:19:31:22 | f.xs | Fields.cs:49:13:49:28 | SSA qualifier def(f.xs) | Fields.cs:49:13:49:28 | SSA def(f) |
| Fields.cs:98:20:98:32 | f.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) | Fields.cs:97:9:97:30 | SSA def(f.Field) |
| Fields.cs:99:16:99:34 | f.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) |
| Fields.cs:100:16:100:40 | f.Field.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field.Field) | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:18:13:18:28 | SSA def(t) |
| Properties.cs:31:19:31:22 | f.xs | Properties.cs:30:13:30:32 | SSA qualifier def(f.xs) | Properties.cs:30:13:30:32 | SSA def(f) |
| Properties.cs:31:19:31:22 | f.xs | Properties.cs:49:13:49:32 | SSA qualifier def(f.xs) | Properties.cs:49:13:49:32 | SSA def(f) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |

46
csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
View File

@@ -35,10 +35,10 @@
| Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:213:29:213:34 | access to local variable exited |
| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:11:17:11:17 | access to parameter b |
| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:26:13:26:13 | access to local variable c |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:27:13:27:13 | access to local variable c |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:26:13:26:19 | access to field Field |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:27:13:27:19 | access to field Field |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:9:25:30 | SSA def(c) | Consistency.cs:26:13:26:13 | access to local variable c |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:9:25:30 | SSA def(c) | Consistency.cs:27:13:27:13 | access to local variable c |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) | Consistency.cs:26:13:26:19 | access to field Field |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) | Consistency.cs:27:13:27:19 | access to field Field |
| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:33:9:33:9 | access to parameter c |
| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:45:9:45:9 | access to local variable s |
| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:46:13:46:13 | access to local variable s |
@@ -63,9 +63,9 @@
| DefUse.cs:6:14:6:14 | y | DefUse.cs:28:13:28:18 | SSA def(y) | DefUse.cs:34:13:34:13 | access to local variable y |
| DefUse.cs:6:14:6:14 | y | DefUse.cs:37:9:40:9 | SSA phi(y) | DefUse.cs:42:13:42:13 | access to local variable y |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:45:13:45:13 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:48:13:48:13 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:9:47:24 | SSA def(z) | DefUse.cs:48:13:48:13 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:9:47:24 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:9:50:24 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z |
| DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:54:13:54:17 | access to field Field |
| DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:57:13:57:16 | access to property Prop |
| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:64:13:64:18 | access to field Field2 |
@@ -73,12 +73,12 @@
| DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:69:13:69:18 | access to field Field3 |
| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:68:9:68:10 | access to local variable tc |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:81:13:81:14 | access to local variable x1 |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:16:80:32 | SSA def(x1) | DefUse.cs:81:13:81:14 | access to local variable x1 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:85:15:85:16 | access to local variable x2 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:87:13:87:14 | access to local variable x2 |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:84:9:86:17 | SSA def(x2) | DefUse.cs:87:13:87:14 | access to local variable x2 |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:92:15:92:16 | access to local variable x3 |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:94:13:94:14 | access to local variable x3 |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:95:13:95:14 | access to local variable x4 |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:91:9:93:17 | SSA def(x3) | DefUse.cs:94:13:94:14 | access to local variable x3 |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:91:9:93:17 | SSA def(x4) | DefUse.cs:95:13:95:14 | access to local variable x4 |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:98:16:98:17 | access to local variable x5 |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:100:17:100:18 | access to local variable x5 |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:101:18:101:19 | access to local variable x5 |
@@ -198,22 +198,22 @@
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | SSA param(x) | MultiImplementationA.cs:5:28:5:28 | access to parameter x |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:22:3:22 | SSA param(x) | MultiImplementationB.cs:3:28:3:28 | access to parameter x |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:10:32:10:32 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:12:13:12:13 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:22:29:22:29 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:23:13:23:13 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:24:29:24:29 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:25:13:25:13 | access to local variable j |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:11:13:11:13 | access to local variable i |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:14:13:14:13 | access to local variable i |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:9:10:33 | SSA def(j) | OutRef.cs:12:13:12:13 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:9:10:33 | SSA def(j) | OutRef.cs:22:29:22:29 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:9:22:30 | SSA def(j) | OutRef.cs:23:13:23:13 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:9:22:30 | SSA def(j) | OutRef.cs:24:29:24:29 | access to local variable j |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:9:24:30 | SSA def(j) | OutRef.cs:25:13:25:13 | access to local variable j |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:9:10:33 | SSA def(i) | OutRef.cs:11:13:11:13 | access to local variable i |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:9:13:33 | SSA def(i) | OutRef.cs:14:13:14:13 | access to local variable i |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:7:10:7:10 | SSA entry def(this.Field) | OutRef.cs:13:28:13:32 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:15:13:15:17 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:16:32:16:36 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:17:13:17:17 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:20:13:20:17 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:9:13:33 | SSA def(this.Field) | OutRef.cs:15:13:15:17 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:9:13:33 | SSA def(this.Field) | OutRef.cs:16:32:16:36 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:9:16:37 | SSA def(this.Field) | OutRef.cs:17:13:17:17 | access to field Field |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:9:19:39 | SSA def(this.Field) | OutRef.cs:20:13:20:17 | access to field Field |
| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:19:32:19:32 | access to local variable t |
| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:21:13:21:13 | access to local variable t |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:19:32:19:38 | access to field Field |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:21:13:21:19 | access to field Field |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:9:19:39 | SSA def(t.Field) | OutRef.cs:21:13:21:19 | access to field Field |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:30:13:30:13 | access to parameter j |
| OutRef.cs:34:38:34:38 | j | OutRef.cs:34:38:34:38 | SSA param(j) | OutRef.cs:36:13:36:13 | access to parameter j |
| OutRef.cs:39:24:39:24 | b | OutRef.cs:39:24:39:24 | SSA param(b) | OutRef.cs:41:13:41:13 | access to parameter b |

2
csharp/ql/test/library-tests/dataflow/ssa/SsaRead.ql
View File

@@ -1,6 +1,6 @@
import csharp
from Ssa::SourceVariable v, Ssa::Definition def, AssignableRead read
from Ssa::SourceVariable v, SsaDefinition def, AssignableRead read
where
read = def.getARead() and
v = def.getSourceVariable()

62
csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
View File

@@ -35,8 +35,8 @@
| Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | SSA def(j) |
| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | SSA param(b) |
| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:15:17:15:21 | SSA def(i) |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | SSA def(c) |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) |
| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:9:25:30 | SSA def(c) | Consistency.cs:25:9:25:30 | SSA def(c) |
| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) | Consistency.cs:25:9:25:30 | SSA qualifier def(c.Field) |
| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | SSA def(c) |
| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | SSA def(s) |
| Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | SSA param(a) |
@@ -61,8 +61,8 @@
| DefUse.cs:6:14:6:14 | y | DefUse.cs:37:9:40:9 | SSA phi(y) | DefUse.cs:39:13:39:18 | SSA def(y) |
| DefUse.cs:6:14:6:14 | y | DefUse.cs:39:13:39:18 | SSA def(y) | DefUse.cs:39:13:39:18 | SSA def(y) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:44:13:44:17 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:47:23:47:23 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:23:50:23 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:9:47:24 | SSA def(z) | DefUse.cs:47:9:47:24 | SSA def(z) |
| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:9:50:24 | SSA def(z) | DefUse.cs:50:9:50:24 | SSA def(z) |
| DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | SSA def(this.Field) |
| DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | SSA def(this.Prop) |
| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | SSA def(this.Field2) |
@@ -70,13 +70,13 @@
| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | SSA def(tc) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:79:13:79:18 | SSA def(x1) | DefUse.cs:79:13:79:18 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:79:13:79:18 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:80:30:80:31 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:80:30:80:31 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:9:80:51 | SSA phi(x1) | DefUse.cs:80:16:80:32 | SSA def(x1) |
| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:16:80:32 | SSA def(x1) | DefUse.cs:80:16:80:32 | SSA def(x1) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:83:13:83:18 | SSA def(x2) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:85:15:85:16 | SSA def(x2) |
| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:84:9:86:17 | SSA def(x2) | DefUse.cs:84:9:86:17 | SSA def(x2) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:89:13:89:18 | SSA def(x3) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:92:15:92:16 | SSA def(x3) |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:93:15:93:16 | SSA def(x4) |
| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:91:9:93:17 | SSA def(x3) | DefUse.cs:91:9:93:17 | SSA def(x3) |
| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:91:9:93:17 | SSA def(x4) | DefUse.cs:91:9:93:17 | SSA def(x4) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:97:13:97:18 | SSA def(x5) | DefUse.cs:97:13:97:18 | SSA def(x5) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:97:13:97:18 | SSA def(x5) |
| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:9:102:9 | SSA phi(x5) | DefUse.cs:101:13:101:23 | SSA def(x5) |
@@ -101,13 +101,13 @@
| DefUse.cs:188:13:188:18 | this.Field5 | DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:188:13:188:22 | SSA def(this.Field5) |
| DefaultParam.cs:3:20:3:20 | b | DefaultParam.cs:3:20:3:20 | SSA param(b) | DefaultParam.cs:3:20:3:20 | SSA param(b) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:30:3:30 | SSA param(s) | DefaultParam.cs:3:30:3:30 | SSA param(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA param_default(s) | DefaultParam.cs:3:34:3:35 | SSA param_default(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:34:3:35 | SSA def(s) | DefaultParam.cs:3:34:3:35 | SSA def(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:30:3:30 | SSA param(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:34:3:35 | SSA param_default(s) |
| DefaultParam.cs:3:30:3:30 | s | DefaultParam.cs:3:42:3:42 | SSA phi(s) | DefaultParam.cs:3:34:3:35 | SSA def(s) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:42:3:42 | SSA param(i) | DefaultParam.cs:3:42:3:42 | SSA param(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA param_default(i) | DefaultParam.cs:3:46:3:46 | SSA param_default(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:46:3:46 | SSA def(i) | DefaultParam.cs:3:46:3:46 | SSA def(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:42:3:42 | SSA param(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:46:3:46 | SSA param_default(i) |
| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:4:5:6:5 | SSA phi(i) | DefaultParam.cs:3:46:3:46 | SSA def(i) |
| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | SSA param(i) | Example.cs:6:23:6:23 | SSA param(i) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:8:9:8:22 | SSA def(this.Field) | Example.cs:8:9:8:22 | SSA def(this.Field) |
| Example.cs:8:9:8:18 | this.Field | Example.cs:10:9:13:24 | SSA phi(this.Field) | Example.cs:8:9:8:22 | SSA def(this.Field) |
@@ -210,28 +210,28 @@
| Fields.cs:115:20:115:29 | this.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
| Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
| Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:114:9:114:22 | SSA call def(this.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | SSA param(x) | MultiImplementationA.cs:5:22:5:22 | SSA param(x) |
| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:22:3:22 | SSA param(x) | MultiImplementationB.cs:3:22:3:22 | SSA param(x) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:9:13:9:17 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:10:32:10:32 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:22:22:22:22 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:22:22:22:22 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:24:29:24:29 | SSA def(j) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:10:25:10:25 | SSA def(i) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:13:21:13:21 | SSA def(i) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:9:10:33 | SSA def(j) | OutRef.cs:10:9:10:33 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:9:22:30 | SSA def(j) | OutRef.cs:22:9:22:30 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:9:24:30 | SSA def(j) | OutRef.cs:22:9:22:30 | SSA def(j) |
| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:9:24:30 | SSA def(j) | OutRef.cs:24:9:24:30 | SSA def(j) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:9:10:33 | SSA def(i) | OutRef.cs:10:9:10:33 | SSA def(i) |
| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:9:13:33 | SSA def(i) | OutRef.cs:13:9:13:33 | SSA def(i) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:7:10:7:10 | SSA entry def(this.Field) | OutRef.cs:7:10:7:10 | SSA entry def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:13:28:13:32 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:16:21:16:25 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:19:21:19:25 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:9:13:33 | SSA def(this.Field) | OutRef.cs:13:9:13:33 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:9:16:37 | SSA def(this.Field) | OutRef.cs:16:9:16:37 | SSA def(this.Field) |
| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:9:19:39 | SSA def(this.Field) | OutRef.cs:19:9:19:39 | SSA def(this.Field) |
| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:18:13:18:28 | SSA def(t) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:19:32:19:38 | SSA def(t.Field) |
| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:9:19:39 | SSA def(t.Field) | OutRef.cs:19:9:19:39 | SSA def(t.Field) |
| OutRef.cs:28:26:28:26 | i | OutRef.cs:30:9:30:13 | SSA def(i) | OutRef.cs:30:9:30:13 | SSA def(i) |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:28:37:28:37 | SSA param(j) |
| OutRef.cs:28:37:28:37 | j | OutRef.cs:31:9:31:13 | SSA def(j) | OutRef.cs:31:9:31:13 | SSA def(j) |
@@ -333,11 +333,11 @@
| Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
| Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
| Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:113:9:113:22 | SSA call def(this.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
| Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:5:15:5:20 | SSA param(param1) |
| Test.cs:5:15:5:20 | param1 | Test.cs:25:9:32:9 | SSA phi(param1) | Test.cs:5:15:5:20 | SSA param(param1) |

2
csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.ql
View File

@@ -1,6 +1,6 @@
import csharp
from Ssa::SourceVariable v, Ssa::Definition def, Ssa::Definition u
from Ssa::SourceVariable v, SsaDefinition def, SsaDefinition u
where
u = def.getAnUltimateDefinition() and
v = def.getSourceVariable()

3
misc/scripts/models-as-data/generate_mad.py
View File

@@ -67,7 +67,8 @@ class Generator:
self.database = database or self.database
self.folder = folder or self.folder
self.generated_frameworks = os.path.join(
self.codeql_root, f"{self.language}/ql/lib/ext/generated/modelgenerator/{self.folder}"
self.codeql_root,
f"{self.language}/ql/lib/ext/generated/modelgenerator/{self.folder}",
)
self.workDir = tempfile.mkdtemp()
if self.ram is None:

12
rust/ql/test/library-tests/type-inference/associated_types.rs
View File

@@ -131,9 +131,9 @@ mod default_method_using_associated_type {
println!("{:?}", y);
let x5 = S2;
println!("{:?}", x5.m1()); // $ target=m1 type=x5.m1():A.S2
println!("{:?}", x5.m1()); // $ target=m1 type=x5.m1()@Wrapper<A>:S2
let x6 = S2;
println!("{:?}", x6.m2()); // $ target=m2 type=x6.m2():A.S2
println!("{:?}", x6.m2()); // $ target=m2 type=x6.m2()@Wrapper<A>:S2
}
}
@@ -400,10 +400,10 @@ mod generic_associated_type {
pub fn test() {
let s = S;
// Call to the method in `impl` block
let _g1 = s.put(1i32); // $ target=S::put type=_g1:A.i32
let _g1 = s.put(1i32); // $ target=S::put type=_g1@Wrapper<A>:i32
// Call to default implementation in `trait` block
let _g2 = s.put_two(true, false); // $ target=MyTraitAssoc2::put_two MISSING: type=_g2:A.bool
let _g2 = s.put_two(true, false); // $ target=MyTraitAssoc2::put_two MISSING: type=_g2@Wrapper<A>:bool
}
}
@@ -534,12 +534,12 @@ mod generic_associated_type_name_clash {
type Output = Result<Output, Output>;
fn get(&self) -> Self::Output {
Ok(self.0) // $ fieldof=ST type=Ok(...):Result type=Ok(...):T.Output type=Ok(...):E.Output
Ok(self.0) // $ fieldof=ST type=Ok(...)@Result<T>:Output type=Ok(...)@Result<E>:Output
}
}
pub fn test() {
let _y = ST(true).get(); // $ type=_y:Result type=_y:T.bool type=_y:E.bool target=get
let _y = ST(true).get(); // $ type=_y@Result<T>:bool type=_y@Result<E>:bool target=get
}
}

12
rust/ql/test/library-tests/type-inference/dereference.rs
View File

@@ -46,7 +46,7 @@ impl<T> S<T> {
fn explicit_monomorphic_dereference() {
// Dereference with method call
let a1 = MyIntPointer { value: 34i64 };
let _b1 = a1.deref(); // $ target=MyIntPointer::deref type=_b1:TRef.i64
let _b1 = a1.deref(); // $ target=MyIntPointer::deref type=_b1@&<TRef>:i64
// Dereference with overloaded dereference operator
let a2 = MyIntPointer { value: 34i64 };
@@ -60,7 +60,7 @@ fn explicit_monomorphic_dereference() {
fn explicit_polymorphic_dereference() {
// Explicit dereference with type parameter
let c1 = MySmartPointer { value: 'a' };
let _d1 = c1.deref(); // $ target=MySmartPointer::deref type=_d1:TRef.char
let _d1 = c1.deref(); // $ target=MySmartPointer::deref type=_d1@&<TRef>:char
// Explicit dereference with type parameter
let c2 = MySmartPointer { value: 'a' };
@@ -74,7 +74,7 @@ fn explicit_polymorphic_dereference() {
fn explicit_ref_dereference() {
// Explicit dereference with type parameter
let e1 = &'a';
let _f1 = e1.deref(); // $ target=deref type=_f1:TRef.char
let _f1 = e1.deref(); // $ target=deref type=_f1@&<TRef>:char
// Explicit dereference with type parameter
let e2 = &'a';
@@ -88,7 +88,7 @@ fn explicit_ref_dereference() {
fn explicit_box_dereference() {
// Explicit dereference with type parameter
let g1: Box<char> = Box::new('a'); // $ target=new
let _h1 = g1.deref(); // $ target=deref type=_h1:TRef.char
let _h1 = g1.deref(); // $ target=deref type=_h1@&<TRef>:char
// Explicit dereference with type parameter
let g2: Box<char> = Box::new('a'); // $ target=new
@@ -109,9 +109,9 @@ fn implicit_dereference() {
let _y = x.is_positive(); // $ target=is_positive type=_y:bool
let z = MySmartPointer { value: S(0i64) };
let z_ = z.foo(); // $ target=foo type=z_:TRef.i64
let z_ = z.foo(); // $ target=foo type=z_@&<TRef>:i64
let v = Vec::new(); // $ target=new type=v:T.i32
let v = Vec::new(); // $ target=new type=v@Vec<T>:i32
let mut x = MySmartPointer { value: v };
x.push(0); // $ target=push
}

172
rust/ql/test/library-tests/type-inference/main.rs
View File

@@ -34,7 +34,7 @@ mod field_access {
fn generic_field_access() {
// Explicit type argument
let x = GenericThing::<S> { a: S }; // $ certainType=x:A.S
let x = GenericThing::<S> { a: S }; // $ certainType=x@GenericThing<A>:S
println!("{:?}", x.a); // $ fieldof=GenericThing
// Implicit type argument
@@ -427,7 +427,7 @@ mod method_non_parametric_trait_impl {
let x = call_trait_m1(thing_s1); // $ type=x:S1 target=call_trait_m1
println!("{:?}", x);
let y = call_trait_m1(thing_s2); // $ type=y:MyThing type=y:A.S2 target=call_trait_m1
let y = call_trait_m1(thing_s2); // $ type=y:MyThing type=y@MyThing<A>:S2 target=call_trait_m1
println!("{:?}", y.a); // $ fieldof=MyThing
// First implementation
@@ -566,7 +566,7 @@ mod trait_default_self_type_parameter {
// The trait bound on `T` uses the default for `A` which contains `Self`
fn tp_uses_default<S: TraitWithSelfTp>(thing: S) -> i64 {
let _ms = thing.get_a(); // $ target=TraitWithSelfTp::get_a type=_ms:T.S
let _ms = thing.get_a(); // $ target=TraitWithSelfTp::get_a type=_ms@Option<T>:S
0
}
@@ -575,7 +575,7 @@ mod trait_default_self_type_parameter {
fn get_a_through_tp<S: SubTraitOfTraitWithSelfTp>(thing: &S) {
// `thing` is a `TraitWithSelfTp` through the trait hierarchy
let _ms = get_a(thing); // $ target=get_a type=_ms:T.S
let _ms = get_a(thing); // $ target=get_a type=_ms@Option<T>:S
}
struct MyStruct {
@@ -593,7 +593,7 @@ mod trait_default_self_type_parameter {
pub fn test() {
let s = MyStruct { value: 0 };
let _ms = get_a(&s); // $ target=get_a type=_ms:T.MyStruct
let _ms = get_a(&s); // $ target=get_a type=_ms@Option<T>:MyStruct
}
}
@@ -871,7 +871,7 @@ mod method_supertraits {
fn type_param_trait_to_supertrait<T: MyTrait3<S1>>(x: T) {
// Test that `MyTrait3` is a subtrait of `MyTrait1<MyThing<S1>>`
let a = x.m1(); // $ target=MyTrait1::m1 type=a:MyThing type=a:A.S1
let a = x.m1(); // $ target=MyTrait1::m1 type=a@MyThing<A>:S1
println!("{:?}", a);
}
@@ -898,7 +898,7 @@ mod method_supertraits {
let s = call_trait_m1(x); // $ type=s:S1 target=call_trait_m1
let x = MyThing2 { a: S2 };
let s = call_trait_m1(x); // $ type=s:MyThing type=s:A.S2 target=call_trait_m1
let s = call_trait_m1(x); // $ type=s@MyThing<A>:S2 target=call_trait_m1
}
}
@@ -1011,20 +1011,20 @@ mod type_aliases {
println!("{:?}", p1);
// Type can be only inferred from the type alias
let p2: MyPair = PairOption::PairNone(); // $ certainType=p2:Fst.S1 certainType=p2:Snd.S2
let p2: MyPair = PairOption::PairNone(); // $ certainType=p2@PairOption<Fst>:S1 certainType=p2@PairOption<Snd>:S2
println!("{:?}", p2);
// First type from alias, second from constructor
let p3: AnotherPair<_> = PairOption::PairSnd(S3); // $ certainType=p3:Fst.S2
let p3: AnotherPair<_> = PairOption::PairSnd(S3); // $ certainType=p3@PairOption<Fst>:S2
println!("{:?}", p3);
// First type from alias definition, second from argument to alias
let p3: AnotherPair<S3> = PairOption::PairNone(); // $ certainType=p3:Fst.S2 certainType=p3:Snd.S3
let p3: AnotherPair<S3> = PairOption::PairNone(); // $ certainType=p3@PairOption<Fst>:S2 certainType=p3@PairOption<Snd>:S3
println!("{:?}", p3);
g(PairOption::PairSnd(PairOption::PairSnd(S3))); // $ target=g
let x: S7<S2>; // $ certainType=x:Result $ certainType=x:E.S1 $ certainType=x:T.S4 $ certainType=x:T.T41.S2 $ certainType=x:T.T42.S5 $ certainType=x:T.T42.T5.S2
let x: S7<S2>; // $ certainType=x@Result<E>:S1 $ certainType=x@Result<T>:S4 $ certainType=x@Result<T>.S4<T41>:S2 $ certainType=x@Result<T>.S4<T42>:S5 $ certainType=x@Result<T>.S4<T42>.S5<T5>:S2
}
}
@@ -1068,7 +1068,7 @@ mod option_methods {
struct S;
pub fn f() {
let x1 = MyOption::<S>::new(); // $ certainType=x1:T.S target=new
let x1 = MyOption::<S>::new(); // $ certainType=x1@MyOption<T>:S target=new
println!("{:?}", x1);
let mut x2 = MyOption::new(); // $ target=new
@@ -1192,14 +1192,14 @@ mod method_call_type_conversion {
let x7 = S(&S2);
// Non-implicit dereference with nested borrow in order to test that the
// implicit dereference handling doesn't affect nested borrows.
let t = x7.m1(); // $ target=m1 type=t:& type=t:TRef.S2
let t = x7.m1(); // $ target=m1 type=t:& type=t@&<TRef>:S2
println!("{:?}", x7);
let x9: String = "Hello".to_string(); // $ certainType=x9:String target=to_string
// Implicit `String` -> `str` conversion happens via the `Deref` trait:
// https://doc.rust-lang.org/std/string/struct.String.html#deref.
let u = x9.parse::<u32>(); // $ target=parse type=u:T.u32
let u = x9.parse::<u32>(); // $ target=parse type=u@Result<T>:u32
let my_thing = &MyInt { a: 37 };
// implicit borrow of a `&`
@@ -1382,7 +1382,7 @@ mod builtins {
let z = x + y; // $ type=z:i32 target=add
let z = x.abs(); // $ target=abs $ type=z:i32
let c = 'c'; // $ certainType=c:char
let hello = "Hello"; // $ certainType=hello:TRef.str
let hello = "Hello"; // $ certainType=hello@&<TRef>:str
let f = 123.0f64; // $ certainType=f:f64
let t = true; // $ certainType=t:bool
let f = false; // $ certainType=f:bool
@@ -1403,8 +1403,8 @@ mod builtins {
}
}
let x = [1, 2, 3].my_method(); // $ target=my_method type=x:TRef.i32
let x = <[_; 3]>::my_method(&[1, 2, 3]); // $ target=my_method type=x:TRef.i32
let x = [1, 2, 3].my_method(); // $ target=my_method type=x@&<TRef>:i32
let x = <[_; 3]>::my_method(&[1, 2, 3]); // $ target=my_method type=x@&<TRef>:i32
let x = <[i32; 3]>::my_func(); // $ target=my_func type=x:i32
impl<T: Default> MyTrait<T> for [T] {
@@ -1418,8 +1418,8 @@ mod builtins {
}
let s: &[i32] = &[1, 2, 3];
let x = s.my_method(); // $ target=my_method type=x:TRef.i32
let x = <[_]>::my_method(s); // $ target=my_method type=x:TRef.i32
let x = s.my_method(); // $ target=my_method type=x@&<TRef>:i32
let x = <[_]>::my_method(s); // $ target=my_method type=x@&<TRef>:i32
let x = <[i32]>::my_func(); // $ target=my_func type=x:i32
impl<T: Default> MyTrait<T> for (T, i32) {
@@ -1433,8 +1433,8 @@ mod builtins {
}
let p = (42, 7);
let x = p.my_method(); // $ target=my_method type=x:TRef.i32
let x = <(_, _)>::my_method(&p); // $ target=my_method type=x:TRef.i32
let x = p.my_method(); // $ target=my_method type=x@&<TRef>:i32
let x = <(_, _)>::my_method(&p); // $ target=my_method type=x@&<TRef>:i32
let x = <(i32, i32)>::my_func(); // $ target=my_func type=x:i32
impl<T: Default> MyTrait<T> for &T {
@@ -1448,8 +1448,8 @@ mod builtins {
}
let r = &42;
let x = r.my_method(); // $ target=my_method type=x:TRef.i32
let x = <&_>::my_method(&r); // $ target=my_method type=x:TRef.i32
let x = r.my_method(); // $ target=my_method type=x@&<TRef>:i32
let x = <&_>::my_method(&r); // $ target=my_method type=x@&<TRef>:i32
let x = <&i32>::my_func(); // $ target=my_func type=x:i32
impl<T: Default> MyTrait<T> for *mut T {
@@ -1464,8 +1464,8 @@ mod builtins {
let mut v = 42;
let p: *mut i32 = &mut v;
let x = unsafe { p.my_method() }; // $ target=my_method type=x:TRef.i32
let x = unsafe { <*mut _>::my_method(&p) }; // $ target=my_method type=x:TRef.i32
let x = unsafe { p.my_method() }; // $ target=my_method type=x@&<TRef>:i32
let x = unsafe { <*mut _>::my_method(&p) }; // $ target=my_method type=x@&<TRef>:i32
let x = <*mut i32>::my_func(); // $ target=my_func type=x:i32
}
}
@@ -2046,7 +2046,7 @@ mod indexers {
}
pub fn f() {
let mut vec = MyVec::new(); // $ type=vec:T.S target=new
let mut vec = MyVec::new(); // $ type=vec@MyVec<T>:S target=new
vec.push(S); // $ target=push
vec[0].foo(); // $ target=MyVec::index target=foo
@@ -2262,24 +2262,24 @@ mod loops {
for i in [1, 2, 3].map(|x| x + 1) {} // $ target=map target=add type=i:i32
for i in [1, 2, 3].into_iter() {} // $ target=into_iter type=i:i32
let vals1 = [1u8, 2, 3]; // $ type=vals1:TArray.u8
let vals1 = [1u8, 2, 3]; // $ type=vals1@[;]<TArray>:u8
for u in vals1 {} // $ type=u:u8
let vals2 = [1u16; 3]; // $ type=vals2:TArray.u16
let vals2 = [1u16; 3]; // $ type=vals2@[;]<TArray>:u16
for u in vals2 {} // $ type=u:u16
let vals3: [u32; 3] = [1, 2, 3]; // $ certainType=vals3:TArray.u32
let vals3: [u32; 3] = [1, 2, 3]; // $ certainType=vals3@[;]<TArray>:u32
for u in vals3 {} // $ type=u:u32
let vals4: [u64; 3] = [1; 3]; // $ certainType=vals4:TArray.u64
let vals4: [u64; 3] = [1; 3]; // $ certainType=vals4@[;]<TArray>:u64
for u in vals4 {} // $ type=u:u64
let mut strings1 = ["foo", "bar", "baz"]; // $ type=strings1:TArray.TRef.str
for s in &strings1 {} // $ type=s:TRef.TRef.str
for s in &mut strings1 {} // $ type=s:TRefMut.TRef.str
for s in strings1 {} // $ type=s:TRef.str
let mut strings1 = ["foo", "bar", "baz"]; // $ type=strings1@[;]<TArray>.&<TRef>:str
for s in &strings1 {} // $ type=s@&<TRef>.&<TRef>:str
for s in &mut strings1 {} // $ type=s@&mut<TRefMut>.&<TRef>:str
for s in strings1 {} // $ type=s@&<TRef>:str
let strings2 = // $ type=strings2:TArray.String
let strings2 = // $ type=strings2@[;]<TArray>:String
[
String::from("foo"), // $ target=from
String::from("bar"), // $ target=from
@@ -2287,15 +2287,15 @@ mod loops {
];
for s in strings2 {} // $ type=s:String
let strings3 = // $ type=strings3:TRef.TArray.String
let strings3 = // $ type=strings3@&<TRef>.[;]<TArray>:String
&[
String::from("foo"), // $ target=from
String::from("bar"), // $ target=from
String::from("baz"), // $ target=from
];
for s in strings3 {} // $ type=s:TRef.String
for s in strings3 {} // $ type=s@&<TRef>:String
let callables = [MyCallable::new(), MyCallable::new(), MyCallable::new()]; // $ target=new $ type=callables:TArray.MyCallable
let callables = [MyCallable::new(), MyCallable::new(), MyCallable::new()]; // $ target=new $ type=callables@[;]<TArray>:MyCallable
for c // $ type=c:MyCallable
in callables
{
@@ -2305,13 +2305,13 @@ mod loops {
// for loops with ranges
for i in 0..10 {} // $ type=i:i32
for u in [0u8..10] {} // $ type=u:Range type=u:Idx.u8
let range = 0..10; // $ certainType=range:Range type=range:Idx.i32
for u in [0u8..10] {} // $ type=u:Range type=u@Range<Idx>:u8
let range = 0..10; // $ certainType=range:Range type=range@Range<Idx>:i32
for i in range {} // $ type=i:i32
let range_full = ..; // $ certainType=range_full:RangeFull
for i in &[1i64, 2i64, 3i64][range_full] {} // $ target=index MISSING: type=i:TRef.i64
for i in &[1i64, 2i64, 3i64][range_full] {} // $ target=index MISSING: type=i@&<TRef>:i64
let range1 = // $ certainType=range1:Range type=range1:Idx.u16
let range1 = // $ certainType=range1:Range type=range1@Range<Idx>:u16
std::ops::Range {
start: 0u16,
end: 10u16,
@@ -2320,39 +2320,39 @@ mod loops {
// for loops with containers
let vals3 = vec![1, 2, 3]; // $ type=vals3:Vec $ MISSING: type=vals3:T.i32
let vals3 = vec![1, 2, 3]; // $ type=vals3:Vec $ MISSING: type=vals3@Vec<T>:i32
for i in vals3 {} // $ MISSING: type=i:i32
let vals4a: Vec<u16> = [1u16, 2, 3].to_vec(); // $ certainType=vals4a:Vec certainType=vals4a:T.u16
let vals4a: Vec<u16> = [1u16, 2, 3].to_vec(); // $ certainType=vals4a@Vec<T>:u16
for u in vals4a {} // $ type=u:u16
let vals4b = [1u16, 2, 3].to_vec(); // $ MISSING: type=vals4b:Vec type=vals4b:T.u16
let vals4b = [1u16, 2, 3].to_vec(); // $ MISSING: type=vals4b:Vec type=vals4b@Vec<T>:u16
for u in vals4b {} // $ MISSING: type=u:u16
let vals5 = Vec::from([1u32, 2, 3]); // $ certainType=vals5:Vec target=from type=vals5:T.u32
let vals5 = Vec::from([1u32, 2, 3]); // $ target=from type=vals5@Vec<T>:u32
for u in vals5 {} // $ type=u:u32
let vals6: Vec<&u64> = [1u64, 2, 3].iter().collect(); // $ certainType=vals6:Vec certainType=vals6:T.TRef.u64
for u in vals6 {} // $ type=u:TRef.u64
let vals6: Vec<&u64> = [1u64, 2, 3].iter().collect(); // $ certainType=vals6@Vec<T>.&<TRef>:u64
for u in vals6 {} // $ type=u@&<TRef>:u64
let mut vals7 = Vec::new(); // $ target=new certainType=vals7:Vec type=vals7:T.u8
let mut vals7 = Vec::new(); // $ target=new type=vals7@Vec<T>:u8
vals7.push(1u8); // $ target=push
for u in vals7 {} // $ type=u:u8
let matrix1 = vec![vec![1, 2], vec![3, 4]]; // $ type=matrix1:Vec $ MISSING: type=matrix1:T.Vec type=matrix1:T.T.i32
let matrix1 = vec![vec![1, 2], vec![3, 4]]; // $ type=matrix1:Vec $ MISSING: type=matrix1@Vec<T>:Vec type=matrix1@Vec<T>.Vec<T>:i32
#[rustfmt::skip]
let _ = for row in matrix1 { // $ MISSING: type=row:Vec type=row:T.i32
let _ = for row in matrix1 { // $ MISSING: type=row:Vec type=row@Vec<T>:i32
for cell in row { // $ MISSING: type=cell:i32
}
};
let mut map1 = std::collections::HashMap::new(); // $ target=new type=map1:K.i32 type=map1:V.Box $ MISSING: type=map1:Hashmap type1=map1:V.T.TRef.str
let mut map1 = std::collections::HashMap::new(); // $ target=new type=map1@HashMap<K>:i32 type=map1@HashMap<V>.Box<T>.&<TRef>:str
map1.insert(1, Box::new("one")); // $ target=insert target=new
map1.insert(2, Box::new("two")); // $ target=insert target=new
for key in map1.keys() {} // $ target=keys type=key:TRef.i32
for value in map1.values() {} // $ target=values type=value:TRef.Box type=value:TRef.T.TRef.str
for (key, value) in map1.iter() {} // $ target=iter type=key:TRef.i32 type=value:TRef.Box type=value:TRef.T.TRef.str
for (key, value) in &map1 {} // $ type=key:TRef.i32 type=value:TRef.Box type=value:TRef.T.TRef.str
for key in map1.keys() {} // $ target=keys type=key@&<TRef>:i32
for value in map1.values() {} // $ target=values type=value@&<TRef>.Box<T>.&<TRef>:str
for (key, value) in map1.iter() {} // $ target=iter type=key@&<TRef>:i32 type=value@&<TRef>.Box<T>.&<TRef>:str
for (key, value) in &map1 {} // $ type=key@&<TRef>:i32 type=value@&<TRef>.Box<T>.&<TRef>:str
// while loops
@@ -2398,27 +2398,27 @@ mod explicit_type_args {
}
pub fn f() {
let x1: Option<S1<S2>> = S1::assoc_fun(); // $ certainType=x1:T.T.S2 target=assoc_fun
let x2 = S1::<S2>::assoc_fun(); // $ certainType=x2:T.T.S2 target=assoc_fun
let x3 = S3::assoc_fun(); // $ certainType=x3:T.T.S2 target=assoc_fun
let x4 = S1::<S2>::method(S1::default()); // $ target=method target=default certainType=x4:T.S2
let x5 = S3::method(S1::default()); // $ target=method target=default certainType=x5:T.S2
let x6 = S4::<S2>(Default::default()); // $ type=x6:T4.S2 target=default
let x7 = S4(S2); // $ type=x7:T4.S2
let x8 = S4(0); // $ type=x8:T4.i32
let x9 = S4(S2::default()); // $ type=x9:T4.S2 target=default
let x10 = S5::<S2> // $ certainType=x10:T5.S2
let x1: Option<S1<S2>> = S1::assoc_fun(); // $ certainType=x1@Option<T>.S1<T>:S2 target=assoc_fun
let x2 = S1::<S2>::assoc_fun(); // $ certainType=x2@Option<T>.S1<T>:S2 target=assoc_fun
let x3 = S3::assoc_fun(); // $ certainType=x3@Option<T>.S1<T>:S2 target=assoc_fun
let x4 = S1::<S2>::method(S1::default()); // $ target=method target=default certainType=x4@S1<T>:S2
let x5 = S3::method(S1::default()); // $ target=method target=default certainType=x5@S1<T>:S2
let x6 = S4::<S2>(Default::default()); // $ type=x6@S4<T4>:S2 target=default
let x7 = S4(S2); // $ type=x7@S4<T4>:S2
let x8 = S4(0); // $ type=x8@S4<T4>:i32
let x9 = S4(S2::default()); // $ type=x9@S4<T4>:S2 target=default
let x10 = S5::<S2> // $ certainType=x10@S5<T5>:S2
{
field: Default::default(), // $ target=default
};
let x11 = S5 { field: S2 }; // $ type=x11:T5.S2
let x12 = S5 { field: 0 }; // $ type=x12:T5.i32
let x13 = S5 // $ type=x13:T5.S2
let x11 = S5 { field: S2 }; // $ type=x11@S5<T5>:S2
let x12 = S5 { field: 0 }; // $ type=x12@S5<T5>:i32
let x13 = S5 // $ type=x13@S5<T5>:S2
{
field: S2::default(), // $ target=default
};
let x14 = foo::<i32>(Default::default()); // $ certainType=x14:i32 target=default target=foo
let x15 = S1::<S2>::default(); // $ certainType=x15:T.S2 target=default
let x15 = S1::<S2>::default(); // $ certainType=x15@S1<T>:S2 target=default
}
}
@@ -2454,11 +2454,11 @@ mod tuples {
// `a` and `b` to be inferred.
let a = Default::default(); // $ target=default type=a:i64
let b = Default::default(); // $ target=default type=b:bool
let pair = (a, b); // $ type=pair:T0.i64 type=pair:T1.bool
let pair = (a, b); // $ type=pair@(T_2)<T0>:i64 type=pair@(T_2)<T1>:bool
let i: i64 = pair.0; // $ fieldof=Tuple2
let j: bool = pair.1; // $ fieldof=Tuple2
let pair = [1, 1].into(); // $ type=pair:(T_2) type=pair:T0.i32 type=pair:T1.i32 target=into
let pair = [1, 1].into(); // $ type=pair@(T_2)<T0>:i32 type=pair@(T_2)<T1>:i32 target=into
match pair {
(0, 0) => print!("unexpected"),
_ => print!("expected"),
@@ -2572,7 +2572,7 @@ mod if_expr {
pub fn f(b: bool) -> Box<dyn MyTrait<i32>> {
let x = if b {
let y = Default::default(); // $ target=default
y // $ type=y:T.i32
y // $ type=y@S<T>:i32
} else {
S(2)
};
@@ -2648,14 +2648,14 @@ mod context_typed {
}
pub fn f() {
let x = None; // $ type=x:T.i32
let x = None; // $ type=x@Option<T>:i32
let x: Option<i32> = x;
let x = Option::<i32>::None; // $ type=x:T.i32
let x = Option::None::<i32>; // $ type=x:T.i32
let x = Option::<i32>::None; // $ type=x@Option<T>:i32
let x = Option::None::<i32>; // $ type=x@Option<T>:i32
fn pin_option<T>(opt: Option<T>, x: T) {}
let x = None; // $ type=x:T.i32
let x = None; // $ type=x@Option<T>:i32
pin_option(x, 0); // $ target=pin_option
enum MyEither<T1, T2> {
@@ -2663,33 +2663,33 @@ mod context_typed {
B { right: T2 },
}
let x = MyEither::A { left: 0 }; // $ type=x:T1.i32 type=x:T2.String
let x = MyEither::A { left: 0 }; // $ type=x@MyEither<T1>:i32 type=x@MyEither<T2>:String
let x: MyEither<i32, String> = x;
let x = MyEither::<_, String>::A { left: 0 }; // $ type=x:T1.i32 certainType=x:T2.String
let x = MyEither::<_, String>::A { left: 0 }; // $ type=x@MyEither<T1>:i32 certainType=x@MyEither<T2>:String
#[rustfmt::skip]
let x = MyEither::B::<i32, _> { // $ certainType=x:T1.i32 type=x:T2.String
let x = MyEither::B::<i32, _> { // $ certainType=x@MyEither<T1>:i32 type=x@MyEither<T2>:String
right: String::new(), // $ target=new
};
fn pin_my_either<T>(e: MyEither<T, String>, x: T) {}
#[rustfmt::skip]
let x = MyEither::B { // $ type=x:T1.i32 type=x:T2.String
let x = MyEither::B { // $ type=x@MyEither<T1>:i32 type=x@MyEither<T2>:String
right: String::new(), // $ target=new
};
pin_my_either(x, 0); // $ target=pin_my_either
let x = Result::Ok(0); // $ type=x:E.String
let x = Result::Ok(0); // $ type=x@Result<E>:String
let x: Result<i32, String> = x;
let x = Result::<i32, String>::Ok(0); // $ type=x:E.String
let x = Result::Ok::<i32, String>(0); // $ type=x:E.String
let x = Result::<i32, String>::Ok(0); // $ type=x@Result<E>:String
let x = Result::Ok::<i32, String>(0); // $ type=x@Result<E>:String
fn pin_result<T, E>(res: Result<T, E>, x: E) {}
let x = Result::Ok(0); // $ type=x:T.i32 type=x:E.bool
let x = Result::Ok(0); // $ type=x@Result<T>:i32 type=x@Result<E>:bool
pin_result(x, false); // $ target=pin_result
let mut x = Vec::new(); // $ type=x:T.i32 target=new
let mut x = Vec::new(); // $ type=x@Vec<T>:i32 target=new
x.push(0); // $ target=push
let y = Default::default(); // $ type=y:i32 target=default

36
rust/ql/test/library-tests/type-inference/pattern_matching.rs
View File

@@ -37,18 +37,18 @@ pub fn f() -> Option<()> {
let value3 = 42;
if let ref mesg = value3 {
let mesg = mesg; // $ type=mesg:TRef.i32
let mesg = mesg; // $ type=mesg@&<TRef>:i32
println!("{mesg}");
}
let value4 = Some(42);
if let Some(ref mesg) = value4 {
let mesg = mesg; // $ type=mesg:TRef.i32
let mesg = mesg; // $ type=mesg@&<TRef>:i32
println!("{mesg}");
}
let ref value5 = 42;
let x = value5; // $ type=x:TRef.i32
let x = value5; // $ type=x@&<TRef>:i32
let my_record_struct = MyRecordStruct {
value1: 42,
@@ -102,27 +102,27 @@ pub fn f() -> Option<()> {
) => {
let a = value1; // $ type=a:bool
let b = x; // $ type=b:i32
let c = y; // $ type=c:TRef.str
let c = y; // $ type=c@&<TRef>:str
();
}
_ => (),
}
let opt1 = Some(Default::default()); // $ type=opt1:T.i32 target=default
let opt1 = Some(Default::default()); // $ type=opt1@Option<T>:i32 target=default
#[rustfmt::skip]
let _ = if let Some::<i32>(x) = opt1
{
x; // $ type=x:i32
};
let opt2 = Some(Default::default()); // $ type=opt2:T.i32 target=default
let opt2 = Some(Default::default()); // $ type=opt2@Option<T>:i32 target=default
#[rustfmt::skip]
let _ = if let Option::Some::<i32>(x) = opt2
{
x; // $ type=x:i32
};
let opt3 = Some(Default::default()); // $ type=opt3:T.i32 target=default
let opt3 = Some(Default::default()); // $ type=opt3@Option<T>:i32 target=default
#[rustfmt::skip]
let _ = if let Option::<i32>::Some(x) = opt3
{
@@ -197,7 +197,7 @@ pub fn literal_patterns() {
let string_val = "hello";
match string_val {
"hello" => {
let hello_match = string_val; // $ certainType=hello_match:TRef.str
let hello_match = string_val; // $ certainType=hello_match@&<TRef>:str
println!("String literal: {}", hello_match);
}
_ => {}
@@ -230,7 +230,7 @@ pub fn identifier_patterns() {
// IdentPat with ref
match &value {
ref x => {
let ref_bound = x; // $ type=ref_bound:TRef.TRef.i32
let ref_bound = x; // $ type=ref_bound@&<TRef>.&<TRef>:i32
println!("Reference identifier: {:?}", ref_bound);
}
}
@@ -269,7 +269,7 @@ pub fn identifier_patterns() {
let mut ref_mut_val = 5i32;
match &mut ref_mut_val {
ref mut x => {
let ref_mut_bound = x; // $ type=ref_mut_bound:TRefMut.TRefMut.i32
let ref_mut_bound = x; // $ type=ref_mut_bound@&mut<TRefMut>.&mut<TRefMut>:i32
**ref_mut_bound += 1; // $ target=deref target=add_assign
println!("Ref mut pattern");
}
@@ -341,14 +341,14 @@ pub fn reference_patterns() {
match &mut mutable_value {
&mut ref x => {
let mut_ref_bound = x; // $ type=mut_ref_bound:TRef.i32
let mut_ref_bound = x; // $ type=mut_ref_bound@&<TRef>:i32
println!("Mutable ref pattern: {}", mut_ref_bound);
}
}
match &value {
ref x => {
let ref_pattern = x; // $ type=ref_pattern:TRef.TRef.i32
let ref_pattern = x; // $ type=ref_pattern@&<TRef>.&<TRef>:i32
println!("Reference pattern: {}", ref_pattern);
}
}
@@ -525,7 +525,7 @@ pub fn slice_patterns() {
// SlicePat - Slice patterns
match slice {
[] => {
let empty_slice = slice; // $ certainType=empty_slice:TRef.TSlice.i32
let empty_slice = slice; // $ certainType=empty_slice@&<TRef>.[]<TSlice>:i32
println!("Empty slice: {:?}", empty_slice);
}
[x] => {
@@ -540,7 +540,7 @@ pub fn slice_patterns() {
[first, middle @ .., last] => {
let slice_start = *first; // $ MISSING: type=slice_start:i32
let slice_end = *last; // $ MISSING: type=slice_end:i32
let slice_middle = middle; // $ MISSING: type=slice_middle:TRef.TSlice.i32
let slice_middle = middle; // $ MISSING: type=slice_middle@&<TRef>.[]<TSlice>:i32
println!(
"First: {}, last: {}, middle len: {}",
slice_start,
@@ -717,7 +717,7 @@ pub fn complex_nested_patterns() {
}
// Catch-all with identifier pattern
other => {
let other_complex = other; // $ type=other_complex:T0.Point type=other_complex:T1.MyOption
let other_complex = other; // $ type=other_complex@(T_2)<T0>:Point type=other_complex@(T_2)<T1>:MyOption
println!("Other complex data: {:?}", other_complex);
}
}
@@ -750,7 +750,7 @@ pub fn patterns_in_let_statements() {
// Let with reference pattern
let value = 42i32;
let ref ref_val = value;
let let_ref = ref_val; // $ certainType=let_ref:TRef.i32
let let_ref = ref_val; // $ certainType=let_ref@&<TRef>:i32
// Let with mutable pattern
let mut mut_val = 10i32;
@@ -779,13 +779,13 @@ pub fn patterns_in_function_parameters() {
// Call the functions to use them
let point = Point { x: 5, y: 10 };
let extracted = extract_point(point); // $ target=extract_point certainType=extracted:T0.i32 certainType=extracted:T1.i32
let extracted = extract_point(point); // $ target=extract_point certainType=extracted@(T_2)<T0>:i32 certainType=extracted@(T_2)<T1>:i32
let color = Color(200, 100, 50);
let red = extract_color(color); // $ target=extract_color certainType=red:u8
let tuple = (42i32, 3.14f64, true);
let tuple_extracted = extract_tuple(tuple); // $ target=extract_tuple certainType=tuple_extracted:T0.i32 certainType=tuple_extracted:T1.bool
let tuple_extracted = extract_tuple(tuple); // $ target=extract_tuple certainType=tuple_extracted@(T_2)<T0>:i32 certainType=tuple_extracted@(T_2)<T1>:bool
}
#[rustfmt::skip]

8
rust/ql/test/library-tests/type-inference/raw_pointer.rs
View File

@@ -12,7 +12,7 @@ fn raw_pointer_mut_deref(x: *mut bool) -> i32 {
fn raw_const_borrow() {
let a: i64 = 10;
let x = &raw const a; // $ type=x:TPtrConst.i64
let x = &raw const a; // $ type=x@*const<TPtrConst>:i64
unsafe {
let _y = *x; // $ type=_y:i64
}
@@ -20,7 +20,7 @@ fn raw_const_borrow() {
fn raw_mut_borrow() {
let mut a = 10i32;
let x = &raw mut a; // $ type=x:TPtrMut.i32
let x = &raw mut a; // $ type=x@*mut<TPtrMut>:i32
unsafe {
let _y = *x; // $ type=_y:i32
}
@@ -29,7 +29,7 @@ fn raw_mut_borrow() {
fn raw_mut_write(cond: bool) {
let a = 10i32;
// The type of `ptr_written` must be inferred from the write below.
let ptr_written = null_mut(); // $ target=null_mut type=ptr_written:TPtrMut.i32
let ptr_written = null_mut(); // $ target=null_mut type=ptr_written@*mut<TPtrMut>:i32
if cond {
unsafe {
// NOTE: This write is undefined behavior because `ptr_written` is a null pointer.
@@ -41,7 +41,7 @@ fn raw_mut_write(cond: bool) {
fn raw_type_from_deref(cond: bool) {
// The type of `ptr_read` must be inferred from the read below.
let ptr_read = null_mut(); // $ target=null_mut type=ptr_read:TPtrMut.i64
let ptr_read = null_mut(); // $ target=null_mut type=ptr_read@*mut<TPtrMut>:i64
if cond {
unsafe {
// NOTE: This read is undefined behavior because `ptr_read` is a null pointer.

4
rust/ql/test/library-tests/type-inference/regressions.rs
View File

@@ -149,7 +149,7 @@ mod regression5 {
fn foo() -> S2<S1> {
let x = S1.into(); // $ target=into
x // $ type=x:T2.S1
x // $ type=x@S2<T2>:S1
}
}
@@ -176,6 +176,6 @@ mod regression6 {
}
fn foo() {
let x = S(0) + S(1); // $ target=add1 $ SPURIOUS: target=add2 type=x:T.T.i32
let x = S(0) + S(1); // $ target=add1 $ SPURIOUS: target=add2 type=x@S<T>.S<T>:i32
}
}

11
rust/ql/test/library-tests/type-inference/type-inference.ql
View File

@@ -62,12 +62,10 @@ module ResolveTest implements TestSig {
module TypeTest implements TestSig {
string getARelevantTag() { result = ["type", "certainType"] }
predicate tagIsOptional(string expectedTag) { expectedTag = "type" }
predicate hasActualResult(Location location, string element, string tag, string value) { none() }
predicate hasOptionalResult(Location location, string element, string tag, string value) {
exists(AstNode n, TypePath path, Type t |
exists(AstNode n, TypePath path, Type t, string at |
t = TypeInference::inferType(n, path) and
(
tag = "type"
@@ -76,11 +74,8 @@ module TypeTest implements TestSig {
tag = "certainType"
) and
location = n.getLocation() and
(
if path.isEmpty()
then value = element + ":" + t
else value = element + ":" + path.toString() + "." + t.toString()
) and
(if path.isEmpty() then at = "" else at = "@" + TypePath::printTypePathVerbose(path)) and
value = element + at + ":" + t.toString() and
element = [n.toString(), n.(IdentPat).getName().getText()]
)
}

4
shared/ssa/codeql/ssa/Ssa.qll
View File

@@ -1054,7 +1054,7 @@ module Make<
/** A static single assignment (SSA) definition. */
class SsaDefinition extends FinalDefinition {
/** Gets a textual representation of this SSA definition. */
string toString() { result = super.toString() }
string toString() { result = "SSA def(" + this.getSourceVariable() + ")" }
/**
* Gets the control flow node of this SSA definition.
@@ -1207,6 +1207,8 @@ module Make<
* a phi definition for `x` is inserted just before the call `puts x`.
*/
class SsaPhiDefinition extends SsaDefinition instanceof PhiNode {
override string toString() { result = "SSA phi(" + this.getSourceVariable() + ")" }
/** Holds if `inp` is an input to this phi definition along the edge originating in `bb`. */
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
phiHasInputFromBlockCached(this, inp, bb)

29
shared/typeinference/codeql/typeinference/internal/TypeInference.qll
View File

@@ -275,7 +275,34 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
class TypePath = UnboundList;
/** Provides predicates for constructing `TypePath`s. */
module TypePath = UnboundList;
module TypePath {
import UnboundList
private string printTypeParameterVerbose(TypeParameter tp) {
exists(Type t |
t.getATypeParameter() = tp and
result = t.toString() + "<" + tp.toString() + ">"
)
}
/**
* Gets a verbose textual representation of `path`, which includes the names
* of the types that the type parameters belong to.
*
* For example, the verbose textual representation of the path `"T1.T2"` is
* `"S1<T1>.S2<T2>"`, provided that `T1` is a type parameter of `S1` and `T2`
* is a type parameter of `S2`.
*/
bindingset[path]
string printTypePathVerbose(TypePath path) {
result =
concat(int i, TypeParameter e |
e = path.getElement(i)
|
printTypeParameterVerbose(e), "." order by i
)
}
}
/**
* A class that has a type tree associated with it.

59
shared/util/codeql/util/test/InlineExpectationsTest.qll
View File

@@ -146,9 +146,9 @@ module Make<InlineExpectationsTestSig Impl> {
bindingset[expectedTag, actualTag]
default predicate tagMatches(string expectedTag, string actualTag) { expectedTag = actualTag }
/** Holds if expectations marked with `expectedTag` are optional. */
/** Holds if expectations marked with `expectedTag` are ignored. */
bindingset[expectedTag]
default predicate tagIsOptional(string expectedTag) { none() }
default predicate tagIsIgnored(string expectedTag) { none() }
/**
* Holds if expected value `expectedValue` matches actual value `actualValue`.
@@ -223,8 +223,7 @@ module Make<InlineExpectationsTestSig Impl> {
exists(ValidTestExpectation expectation |
not exists(ActualTestResult actualResult | expectation.matchesActualResult(actualResult)) and
expectation.getTag() = TestImpl::getARelevantTag() and
element = expectation and
not expectation.isOptional()
element = expectation
|
expectation instanceof GoodTestExpectation and
message = "Missing result: " + expectation.getExpectationText()
@@ -253,7 +252,8 @@ module Make<InlineExpectationsTestSig Impl> {
exists(TColumn column, string tags |
getAnExpectation(comment, column, _, tags, value) and
tag = tags.splitAt(",") and
knownFailure = getColumnString(column)
knownFailure = getColumnString(column) and
not TestImpl::tagIsIgnored(tag)
)
} or
TInvalidExpectation(Impl::ExpectationComment comment, string expectation) {
@@ -338,8 +338,6 @@ module Make<InlineExpectationsTestSig Impl> {
TestImpl::tagMatches(this.getTag(), actualResult.getTag()) and
TestImpl::valueMatches(this.getValue(), actualResult.getValue())
}
predicate isOptional() { TestImpl::tagIsOptional(tag) }
}
// Note: These next three classes correspond to all the possible values of type `TColumn`.
@@ -428,6 +426,12 @@ module Make<InlineExpectationsTestSig Impl> {
result = TestImpl1::getARelevantTag() or result = TestImpl2::getARelevantTag()
}
bindingset[expectedTag]
predicate tagIsIgnored(string expectedTag) {
TestImpl1::tagIsIgnored(expectedTag) or
TestImpl2::tagIsIgnored(expectedTag)
}
predicate hasActualResult(Impl::Location location, string element, string tag, string value) {
TestImpl1::hasActualResult(location, element, tag, value)
or
@@ -447,16 +451,13 @@ module Make<InlineExpectationsTestSig Impl> {
module MergeTests3<TestSig TestImpl1, TestSig TestImpl2, TestSig TestImpl3> implements TestSig {
private module M = MergeTests<MergeTests<TestImpl1, TestImpl2>, TestImpl3>;
bindingset[result]
string getARelevantTag() { result = M::getARelevantTag() }
predicate getARelevantTag = M::getARelevantTag/0;
predicate hasActualResult(Impl::Location location, string element, string tag, string value) {
M::hasActualResult(location, element, tag, value)
}
predicate tagIsIgnored = M::tagIsIgnored/1;
predicate hasOptionalResult(Impl::Location location, string element, string tag, string value) {
M::hasOptionalResult(location, element, tag, value)
}
predicate hasActualResult = M::hasActualResult/4;
predicate hasOptionalResult = M::hasOptionalResult/4;
}
/**
@@ -467,16 +468,13 @@ module Make<InlineExpectationsTestSig Impl> {
{
private module M = MergeTests<MergeTests3<TestImpl1, TestImpl2, TestImpl3>, TestImpl4>;
bindingset[result]
string getARelevantTag() { result = M::getARelevantTag() }
predicate getARelevantTag = M::getARelevantTag/0;
predicate hasActualResult(Impl::Location location, string element, string tag, string value) {
M::hasActualResult(location, element, tag, value)
}
predicate tagIsIgnored = M::tagIsIgnored/1;
predicate hasOptionalResult(Impl::Location location, string element, string tag, string value) {
M::hasOptionalResult(location, element, tag, value)
}
predicate hasActualResult = M::hasActualResult/4;
predicate hasOptionalResult = M::hasOptionalResult/4;
}
/**
@@ -489,16 +487,13 @@ module Make<InlineExpectationsTestSig Impl> {
private module M =
MergeTests<MergeTests4<TestImpl1, TestImpl2, TestImpl3, TestImpl4>, TestImpl5>;
bindingset[result]
string getARelevantTag() { result = M::getARelevantTag() }
predicate getARelevantTag = M::getARelevantTag/0;
predicate hasActualResult(Impl::Location location, string element, string tag, string value) {
M::hasActualResult(location, element, tag, value)
}
predicate tagIsIgnored = M::tagIsIgnored/1;
predicate hasOptionalResult(Impl::Location location, string element, string tag, string value) {
M::hasOptionalResult(location, element, tag, value)
}
predicate hasActualResult = M::hasActualResult/4;
predicate hasOptionalResult = M::hasOptionalResult/4;
}
/**
@@ -870,7 +865,7 @@ module TestPostProcessing {
}
bindingset[expectedTag]
predicate tagIsOptional(string expectedTag) {
predicate tagIsIgnored(string expectedTag) {
exists(getQueryKind()) and
(
// ignore irrelevant tags