Data flow: Inline local(Expr|Instruction)?(Flow|Taint)

Computing a full transitive closure is often bad; by inlining all calls we are
providing more context to the QL optimizer.
This commit is contained in:
Tom Hvitved
2022-01-31 14:28:45 +01:00
parent 56ac99039f
commit f2352d8272
13 changed files with 25 additions and 1 deletions

View File

@@ -74,12 +74,14 @@ private module ThisFlow {
* Holds if data can flow from `node1` to `node2` in zero or more
* local (intra-procedural) steps.
*/
pragma[inline]
predicate localFlow(Node node1, Node node2) { localFlowStep*(node1, node2) }
/**
* Holds if data can flow from `e1` to `e2` in zero or more
* local (intra-procedural) steps.
*/
pragma[inline]
predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
/**

View File

@@ -21,12 +21,14 @@ private import semmle.code.java.frameworks.JaxWS
* Holds if taint can flow from `src` to `sink` in zero or more
* local (intra-procedural) steps.
*/
pragma[inline]
predicate localTaint(DataFlow::Node src, DataFlow::Node sink) { localTaintStep*(src, sink) }
/**
* Holds if taint can flow from `src` to `sink` in zero or more
* local (intra-procedural) steps.
*/
pragma[inline]
predicate localExprTaint(Expr src, Expr sink) {
localTaint(DataFlow::exprNode(src), DataFlow::exprNode(sink))
}