hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Allow flow through (previously missing) summary taint steps.

Browse Source
This commit is contained in:
Geoffrey White
2024-03-01 13:19:10 +00:00
parent 2e5f7dc8fc
commit f649939d78
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -6,6 +6,7 @@ private import semmle.code.cpp.models.interfaces.SideEffect
private import DataFlowUtil
private import DataFlowPrivate
private import SsaInternals as Ssa
private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
/**
* Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
@@ -37,6 +38,9 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
)
or
any(Ssa::Indirection ind).isAdditionalTaintStep(nodeFrom, nodeTo)
or
// models-as-data summarized flow
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(nodeFrom, nodeTo, _)
}
/**

8
cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp
View File

@@ -129,7 +129,7 @@ void test_summaries() {
int a, b, c;
sink(madArg0ToReturn(0));
sink(madArg0ToReturn(source())); // $ MISSING: ir
sink(madArg0ToReturn(source())); // $ ir
sink(notASummary(source()));
sink(madArg0ToReturnValueFlow(0));
sink(madArg0ToReturnValueFlow(source())); // $ ir
@@ -158,7 +158,7 @@ void test_summaries() {
// test source + sinks + summaries together
madSinkArg0(madArg0ToReturn(remoteMadSource())); // $ MISSING: ir
madSinkArg0(madArg0ToReturn(remoteMadSource())); // $ ir
madSinkArg0(madArg0ToReturnValueFlow(remoteMadSource())); // $ ir
madSinkArg0(madArg0IndirectToReturn(remoteMadSourceIndirect())); // $ MISSING: ir*/
}
@@ -256,13 +256,13 @@ void test_class_members() {
mc3.madArg0ToField(source());
sink(mc3.val); // $ MISSING: ir
sink(source2().madSelfToReturn()); // $ MISSING: ir
sink(source2().madSelfToReturn()); // $ ir
sink(source2().notASummary());
mc4.val = source();
sink(mc4.madFieldToReturn()); // $ MISSING: ir
sink(source3().namespaceMadSelfToReturn()); // $ MISSING: ir
sink(source3().namespaceMadSelfToReturn()); // $ ir
// test class member sources + sinks + summaries together