hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'replace-ast-with-ir-use-usedataflow' into fix-ssa-flow

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2022-11-21 20:57:24 +00:00
parent 23d6eb67c3 7658df9ebd
commit fc3d6a1847
613 changed files with 52159 additions and 20666 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj
View File

@@ -11,11 +11,12 @@
<ItemGroup>
<PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
<PackageReference Include="xunit" Version="2.4.1" />
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.1">
<PackageReference Include="xunit" Version="2.4.2" />
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
</ItemGroup>
<ItemGroup>

2
cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj
View File

@@ -17,7 +17,7 @@
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build" Version="16.11.0" />
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
</ItemGroup>
<ItemGroup>

6
cpp/ql/lib/change-notes/2022-11-14-deprecate-ast-gvn.md Normal file
View File

@@ -0,0 +1,6 @@
---
category: deprecated
---
* Deprecated `semmle.code.cpp.valuenumbering.GlobalValueNumberingImpl`. Use `semmle.code.cpp.valuenumbering.GlobalValueNumbering`, which exposes the same API.

4
cpp/ql/lib/change-notes/2022-11-17-deleted-deps.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Deleted the deprecated `getName` and `getShortName` predicates from the `Folder` class.

114
cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

12
cpp/ql/lib/semmle/code/cpp/File.qll
View File

@@ -189,18 +189,6 @@ class Folder extends Container, @folder {
* Gets the URL of this folder.
*/
deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
/**
* DEPRECATED: use `getAbsolutePath` instead.
* Gets the name of this folder.
*/
deprecated string getName() { folders(underlyingElement(this), result) }
/**
* DEPRECATED: use `getBaseName` instead.
* Gets the last part of the folder name.
*/
deprecated string getShortName() { result = this.getBaseName() }
}
/**

114
cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl2.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl3.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl4.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImplLocal.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

114
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
View File

@@ -147,6 +147,12 @@ abstract class Configuration extends string {
*/
FlowFeature getAFeature() { none() }
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
predicate sourceGrouping(Node source, string sourceGroup) { none() }
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
predicate sinkGrouping(Node sink, string sinkGroup) { none() }
/**
* Holds if data may flow from `source` to `sink` for this configuration.
*/
@@ -158,7 +164,7 @@ abstract class Configuration extends string {
* The corresponding paths are generated from the end-points and the graph
* included in the module `PathGraph`.
*/
predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
predicate hasFlowPath(PathNode source, PathNode sink) { hasFlowPath(source, sink, this) }
/**
* Holds if data may flow from some source to `sink` for this configuration.
@@ -2712,6 +2718,18 @@ private newtype TPathNode =
state = sink.getState() and
config = sink.getConfiguration()
)
} or
TPathNodeSourceGroup(string sourceGroup, Configuration config) {
exists(PathNodeImpl source |
sourceGroup = source.getSourceGroup() and
config = source.getConfiguration()
)
} or
TPathNodeSinkGroup(string sinkGroup, Configuration config) {
exists(PathNodeSink sink |
sinkGroup = sink.getSinkGroup() and
config = sink.getConfiguration()
)
}
/**
@@ -2920,6 +2938,22 @@ abstract private class PathNodeImpl extends TPathNode {
)
}
string getSourceGroup() {
this.isSource() and
this.getConfiguration().sourceGrouping(this.getNodeEx().asNode(), result)
}
predicate isFlowSource() {
this.isSource() and not exists(this.getSourceGroup())
or
this instanceof PathNodeSourceGroup
}
predicate isFlowSink() {
this = any(PathNodeSink sink | not exists(sink.getSinkGroup())) or
this instanceof PathNodeSinkGroup
}
private string ppAp() {
this instanceof PathNodeSink and result = ""
or
@@ -2959,7 +2993,9 @@ abstract private class PathNodeImpl extends TPathNode {
/** Holds if `n` can reach a sink. */
private predicate directReach(PathNodeImpl n) {
n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
n instanceof PathNodeSink or
n instanceof PathNodeSinkGroup or
directReach(n.getANonHiddenSuccessor())
}
/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
@@ -3015,6 +3051,12 @@ class PathNode instanceof PathNodeImpl {
/** Holds if this node is a source. */
final predicate isSource() { super.isSource() }
/** Holds if this node is a grouping of source nodes. */
final predicate isSourceGroup(string group) { this = TPathNodeSourceGroup(group, _) }
/** Holds if this node is a grouping of sink nodes. */
final predicate isSinkGroup(string group) { this = TPathNodeSinkGroup(group, _) }
}
/**
@@ -3136,9 +3178,66 @@ private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override PathNodeImpl getASuccessorImpl() {
result = TPathNodeSinkGroup(this.getSinkGroup(), config)
}
override predicate isSource() { sourceNode(node, state, config) }
string getSinkGroup() { config.sinkGrouping(node.asNode(), result) }
}
private class PathNodeSourceGroup extends PathNodeImpl, TPathNodeSourceGroup {
string sourceGroup;
Configuration config;
PathNodeSourceGroup() { this = TPathNodeSourceGroup(sourceGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() {
result.getSourceGroup() = sourceGroup and
result.getConfiguration() = config
}
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
string sinkGroup;
Configuration config;
PathNodeSinkGroup() { this = TPathNodeSinkGroup(sinkGroup, config) }
override NodeEx getNodeEx() { none() }
override FlowState getState() { none() }
override Configuration getConfiguration() { result = config }
override PathNodeImpl getASuccessorImpl() { none() }
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
override predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
}
}
private predicate pathNode(
@@ -3495,6 +3594,15 @@ private module Subpaths {
* Will only have results if `configuration` has non-empty sources and
* sinks.
*/
private predicate hasFlowPath(
PathNodeImpl flowsource, PathNodeImpl flowsink, Configuration configuration
) {
flowsource.isFlowSource() and
flowsource.getConfiguration() = configuration and
(flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
flowsink.isFlowSink()
}
private predicate flowsTo(
PathNodeImpl flowsource, PathNodeSink flowsink, Node source, Node sink,
Configuration configuration

4
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View File

@@ -506,7 +506,9 @@ predicate nodeHasInstruction(Node node, Instruction instr, int indirectionIndex)
predicate readStep(Node node1, Content c, Node node2) {
exists(FieldAddress fa1, Operand operand, int numberOfLoads, int indirectionIndex2 |
nodeHasOperand(node2, operand, indirectionIndex2) and
nodeHasOperand(node1, fa1.getObjectAddressOperand(), _) and
// The `1` here matches the `node2.getIndirectionIndex() = 1` conjunct
// in `storeStep`.
nodeHasOperand(node1, fa1.getObjectAddressOperand(), 1) and
numberOfLoadsFromOperand(fa1, operand, numberOfLoads)
|
exists(FieldContent fc | fc = c |

52
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
View File

@@ -81,6 +81,14 @@ int getMaxIndirectionsForType(Type type) {
result = countIndirectionsForCppType(getTypeForGLValue(type))
}
private class PointerOrReferenceType extends Cpp::DerivedType {
PointerOrReferenceType() {
this instanceof Cpp::PointerType
or
this instanceof Cpp::ReferenceType
}
}
/**
* Gets the maximum number of indirections a value of type `type` can have.
*
@@ -88,12 +96,9 @@ int getMaxIndirectionsForType(Type type) {
* (i.e., `countIndirections(e.getUnspecifiedType())`).
*/
private int countIndirections(Type t) {
result =
1 +
countIndirections([t.(Cpp::PointerType).getBaseType(), t.(Cpp::ReferenceType).getBaseType()])
result = 1 + countIndirections(t.(PointerOrReferenceType).getBaseType())
or
not t instanceof Cpp::PointerType and
not t instanceof Cpp::ReferenceType and
not t instanceof PointerOrReferenceType and
result = 0
}
@@ -139,8 +144,41 @@ predicate isModifiableByCall(ArgumentOperand operand) {
type = getLanguageType(operand) and
call.getArgumentOperand(index) = operand and
if index = -1
then not call.getStaticCallTarget() instanceof Cpp::ConstMemberFunction
else not SideEffects::isConstPointerLike(any(Type t | type.hasType(t, _)))
then
// A qualifier is "modifiable" if:
// 1. the member function is not const specified, or
// 2. the member funtion is `const` specified, but returns a pointer or reference
// type that is non-const.
//
// To see why this is necessary, consider the following function:
// ```
// struct C {
// void* data_;
// void* data() const { return data; }
// };
// ...
// C c;
// memcpy(c.data(), source, 16)
// ```
// the data pointed to by `c.data_` is potentially modified by the call to `memcpy` even though
// `C::data` has a const specifier. So we further place the restriction that the type returned
// by `call` should not be of the form `const T*` (for some deeply const type `T`).
if call.getStaticCallTarget() instanceof Cpp::ConstMemberFunction
then
exists(PointerOrReferenceType resultType |
resultType = call.getResultType() and
not resultType.isDeeplyConstBelow()
)
else any()
else
// An argument is modifiable if it's a non-const pointer or reference type.
exists(Type t, boolean isGLValue | type.hasType(t, isGLValue) |
// If t is a glvalue it means that t is always a pointer-like type.
isGLValue = true
or
t instanceof PointerOrReferenceType and
not SideEffects::isConstPointerLike(t)
)
)
}

8
cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
View File

@@ -1,4 +1,8 @@
/**
* DEPRECATED: This library has been replaced with a newer version which
* provides better performance and precision. Use
* `semmle.code.cpp.valuenumbering.GlobalValueNumbering` instead.
*
* Provides an implementation of Global Value Numbering.
* See https://en.wikipedia.org/wiki/Global_value_numbering
*
@@ -221,7 +225,7 @@ private newtype GvnBase =
* expression with this `GVN` and using its `toString` and `getLocation`
* methods.
*/
class GVN extends GvnBase {
deprecated class GVN extends GvnBase {
GVN() { this instanceof GvnBase }
/** Gets an expression that has this GVN. */
@@ -503,7 +507,7 @@ private predicate mk_Deref(GVN p, ControlFlowNode dominator, PointerDereferenceE
/** Gets the global value number of expression `e`. */
cached
GVN globalValueNumber(Expr e) {
deprecated GVN globalValueNumber(Expr e) {
exists(int val, Type t |
mk_IntConst(val, t, e) and
result = GVN_IntConst(val, t)

31
cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
View File

@@ -20,21 +20,29 @@ import cpp
import semmle.code.cpp.dataflow.DataFlow
import DataFlow::PathGraph
Type getFullyConvertedType(DataFlow::Node node) {
result = node.asExpr().getFullyConverted().getUnspecifiedType()
}
class CastToPointerArithFlow extends DataFlow::Configuration {
CastToPointerArithFlow() { this = "CastToPointerArithFlow" }
override predicate isSource(DataFlow::Node node) {
override predicate isSource(DataFlow::Node node, DataFlow::FlowState state) {
not node.asExpr() instanceof Conversion and
exists(Type baseType1, Type baseType2 |
hasBaseType(node.asExpr(), baseType1) and
hasBaseType(node.asExpr().getConversion*(), baseType2) and
introducesNewField(baseType1, baseType2)
)
) and
getFullyConvertedType(node).getName() = state
}
override predicate isSink(DataFlow::Node node) {
exists(PointerAddExpr pae | pae.getAnOperand() = node.asExpr()) or
exists(ArrayExpr ae | ae.getArrayBase() = node.asExpr())
override predicate isSink(DataFlow::Node node, DataFlow::FlowState state) {
(
exists(PointerAddExpr pae | pae.getAnOperand() = node.asExpr()) or
exists(ArrayExpr ae | ae.getArrayBase() = node.asExpr())
) and
getFullyConvertedType(node).getName() = state
}
}
@@ -64,10 +72,15 @@ predicate introducesNewField(Class derived, Class base) {
)
}
from DataFlow::PathNode source, DataFlow::PathNode sink, CastToPointerArithFlow cfg
pragma[nomagic]
predicate hasFullyConvertedType(DataFlow::PathNode node, Type t) {
getFullyConvertedType(node.getNode()) = t
}
from DataFlow::PathNode source, DataFlow::PathNode sink, CastToPointerArithFlow cfg, Type t
where
cfg.hasFlowPath(source, sink) and
source.getNode().asExpr().getFullyConverted().getUnspecifiedType() =
sink.getNode().asExpr().getFullyConverted().getUnspecifiedType()
cfg.hasFlowPath(pragma[only_bind_into](source), pragma[only_bind_into](sink)) and
hasFullyConvertedType(source, t) and
hasFullyConvertedType(sink, t)
select sink, source, sink, "This pointer arithmetic may be done with the wrong type because of $@.",
source, "this cast"

4
cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
View File

@@ -35,10 +35,6 @@ postHasUniquePre
uniquePostUpdate
postIsInSameCallable
reverseRead
| dispatch.cpp:168:3:168:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
| dispatch.cpp:173:37:173:38 | Unary | Origin of readStep is missing a PostUpdateNode. |
| dispatch.cpp:174:37:174:38 | Unary | Origin of readStep is missing a PostUpdateNode. |
| test.cpp:488:21:488:21 | s | Origin of readStep is missing a PostUpdateNode. |
argHasPostUpdate
postWithInFlow
| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |

2
cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
View File

@@ -87,7 +87,7 @@ Top *identity(Top *top) {
void callIdentityFunctions(Top *top, Bottom *bottom) {
identity(bottom)->isSink(source()); // $ MISSING: ast,ir
identity(top)->isSink(source()); // now flow
identity(top)->isSink(source()); // no flow
}
using SinkFunctionType = void (*)(int);

209
cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
View File

@@ -39,215 +39,6 @@ uniquePostUpdate
| struct_init.c:41:16:41:20 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
postIsInSameCallable
reverseRead
| A.cpp:49:10:49:10 | b | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:65:10:65:11 | b1 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:66:10:66:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:74:10:74:11 | b1 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:75:10:75:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:107:12:107:13 | c1 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:120:12:120:13 | c1 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:132:10:132:10 | b | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:152:10:152:10 | d | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:153:10:153:10 | d | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:153:13:153:13 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:154:10:154:10 | b | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:163:10:163:11 | l3 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:164:10:164:11 | l3 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:164:14:164:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:165:10:165:11 | l3 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:165:14:165:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:165:20:165:23 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:166:10:166:11 | l3 | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:166:14:166:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:166:20:166:23 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:166:26:166:29 | Unary | Origin of readStep is missing a PostUpdateNode. |
| A.cpp:169:12:169:12 | l | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:9:10:9:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:9:14:9:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:10:10:10:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:10:14:10:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:18:10:18:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:18:14:18:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:19:10:19:11 | b2 | Origin of readStep is missing a PostUpdateNode. |
| B.cpp:19:14:19:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| C.cpp:29:10:29:11 | this | Origin of readStep is missing a PostUpdateNode. |
| C.cpp:31:10:31:11 | this | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:30:5:30:5 | b | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:37:5:37:5 | b | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:58:5:58:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:58:5:58:12 | this | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:64:10:64:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:64:10:64:17 | this | Origin of readStep is missing a PostUpdateNode. |
| D.cpp:64:20:64:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:21:10:21:10 | p | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:21:13:21:16 | Unary | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:29:21:29:21 | b | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:30:21:30:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:30:23:30:26 | Unary | Origin of readStep is missing a PostUpdateNode. |
| E.cpp:32:10:32:10 | b | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:70:11:70:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:73:8:73:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:77:11:77:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:80:8:80:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:84:11:84:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:87:8:87:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:91:11:91:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:92:3:92:3 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:93:8:93:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:111:16:111:16 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:141:15:141:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:147:16:147:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:158:15:158:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:164:15:164:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:175:16:175:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:175:19:175:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:176:8:176:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:181:16:181:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:181:19:181:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:182:8:182:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:187:16:187:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:187:19:187:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:189:8:189:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:194:16:194:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:194:19:194:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:196:8:196:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:200:16:200:18 | ps2 | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:200:21:200:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:201:8:201:10 | ps2 | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:205:16:205:18 | ps2 | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:205:21:205:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| aliasing.cpp:206:8:206:10 | ps2 | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:36:3:36:3 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:36:5:36:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:37:8:37:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:37:8:37:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:37:10:37:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:38:8:38:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:38:8:38:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:38:10:38:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:42:3:42:3 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:42:5:42:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:43:8:43:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:43:8:43:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:43:10:43:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:44:8:44:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:44:8:44:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:44:10:44:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:48:3:48:3 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:48:5:48:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:49:8:49:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:49:8:49:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:49:10:49:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:50:8:50:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:50:8:50:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| arrays.cpp:50:10:50:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:102:22:102:26 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:103:21:103:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:104:16:104:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:106:22:106:27 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:107:21:107:26 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:108:16:108:21 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:110:8:110:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:110:14:110:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:111:8:111:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:111:14:111:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:112:8:112:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:114:8:114:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:114:16:114:27 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:115:8:115:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:115:16:115:24 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:116:8:116:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:122:21:122:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:123:22:123:26 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:124:15:124:19 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:126:21:126:26 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:127:22:127:27 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:128:15:128:20 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:130:8:130:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:130:14:130:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:131:8:131:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:131:14:131:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:132:8:132:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:134:8:134:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:134:16:134:27 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:135:8:135:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:135:16:135:24 | Unary | Origin of readStep is missing a PostUpdateNode. |
| by_reference.cpp:136:8:136:13 | pouter | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:22:3:22:5 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:25:7:25:7 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:42:8:42:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:42:10:42:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:43:8:43:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:43:10:43:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:53:3:53:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:53:6:53:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:54:3:54:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:54:6:54:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:55:3:55:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:55:6:55:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:56:3:56:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
| complex.cpp:56:6:56:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| conflated.cpp:54:3:54:4 | ll | Origin of readStep is missing a PostUpdateNode. |
| conflated.cpp:55:8:55:9 | ll | Origin of readStep is missing a PostUpdateNode. |
| conflated.cpp:60:3:60:4 | ll | Origin of readStep is missing a PostUpdateNode. |
| conflated.cpp:61:8:61:9 | ll | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:23:10:23:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:23:16:23:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:28:10:28:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:28:16:28:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:33:10:33:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:33:16:33:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:38:10:38:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:38:16:38:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:43:10:43:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:43:16:43:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:48:10:48:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| qualifiers.cpp:48:16:48:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:49:9:49:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:53:9:53:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:53:9:53:18 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:53:20:53:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:54:16:54:18 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:54:16:54:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:54:27:54:29 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:54:32:54:40 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:55:12:55:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:55:12:55:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:55:23:55:25 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:57:88:57:90 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:57:88:57:97 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:57:99:57:101 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:21:60:23 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:21:60:30 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:32:60:34 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:55:60:57 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:55:60:64 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:60:66:60:68 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:61:21:61:23 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:61:21:61:30 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:61:32:61:34 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:65:21:65:23 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:65:21:65:30 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:65:32:65:34 | Unary | Origin of readStep is missing a PostUpdateNode. |
| realistic.cpp:65:37:65:45 | Unary | Origin of readStep is missing a PostUpdateNode. |
| simple.cpp:79:16:79:17 | this | Origin of readStep is missing a PostUpdateNode. |
| simple.cpp:83:9:83:10 | this | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:15:8:15:9 | ab | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:16:8:16:9 | ab | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:22:8:22:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:23:8:23:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:26:16:26:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:31:8:31:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:31:14:31:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:32:8:32:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:32:14:32:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:33:8:33:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:33:14:33:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:34:8:34:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:34:14:34:22 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:36:11:36:15 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:41:16:41:20 | Unary | Origin of readStep is missing a PostUpdateNode. |
| struct_init.c:46:10:46:14 | Unary | Origin of readStep is missing a PostUpdateNode. |
argHasPostUpdate
postWithInFlow
| realistic.cpp:54:16:54:47 | memcpy output argument | PostUpdateNode should not be the target of local flow. |

4
cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
View File

@@ -153,10 +153,6 @@
| by_reference.cpp:16:11:16:11 | a | AST only |
| by_reference.cpp:32:15:32:15 | s | IR only |
| by_reference.cpp:36:18:36:18 | this | IR only |
| by_reference.cpp:40:12:40:15 | this | AST only |
| by_reference.cpp:51:8:51:8 | s | AST only |
| by_reference.cpp:57:8:57:8 | s | AST only |
| by_reference.cpp:63:8:63:8 | s | AST only |
| by_reference.cpp:84:10:84:10 | a | AST only |
| by_reference.cpp:88:9:88:9 | a | AST only |
| by_reference.cpp:92:3:92:5 | * ... | AST only |

4
cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
View File

@@ -332,14 +332,18 @@
| by_reference.cpp:24:25:24:29 | value |
| by_reference.cpp:32:12:32:12 | s |
| by_reference.cpp:36:12:36:15 | this |
| by_reference.cpp:40:12:40:15 | this |
| by_reference.cpp:50:3:50:3 | s |
| by_reference.cpp:50:17:50:26 | call to user_input |
| by_reference.cpp:51:8:51:8 | s |
| by_reference.cpp:51:10:51:20 | call to getDirectly |
| by_reference.cpp:56:3:56:3 | s |
| by_reference.cpp:56:19:56:28 | call to user_input |
| by_reference.cpp:57:8:57:8 | s |
| by_reference.cpp:57:10:57:22 | call to getIndirectly |
| by_reference.cpp:62:3:62:3 | s |
| by_reference.cpp:62:25:62:34 | call to user_input |
| by_reference.cpp:63:8:63:8 | s |
| by_reference.cpp:63:10:63:28 | call to getThroughNonMember |
| by_reference.cpp:68:17:68:18 | & ... |
| by_reference.cpp:68:21:68:30 | call to user_input |

10
cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
View File

@@ -35,16 +35,16 @@ void test_reverse_taint_shared() {
std::shared_ptr<int> p = std::make_shared<int>();
*p = source();
sink(p); // $ ast MISSING: ir
sink(*p); // $ ast MISSING: ir
sink(p); // $ ast,ir
sink(*p); // $ ast,ir
}
void test_reverse_taint_unique() {
std::unique_ptr<int> p = std::unique_ptr<int>();
*p = source();
sink(p); // $ ast MISSING: ir
sink(*p); // $ ast MISSING: ir
sink(p); // $ ast,ir
sink(*p); // $ ast,ir
}
void test_shared_get() {
@@ -134,5 +134,5 @@ int nested_shared_ptr_taint_cref(std::shared_ptr<C> p1, std::unique_ptr<std::sha
sink(p1->q->x); // $ ast MISSING: ir
getNumberCRef(*p2);
sink(**p2); // $ ast MISSING: ir
sink(**p2); // $ ast,ir
}

2
cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
View File

@@ -677,7 +677,7 @@ public:
void test_with_const_member(char* source) {
C_const_member_function c;
memcpy(c.data(), source, 16);
sink(c.data()); // $ ast MISSING: ir
sink(c.data()); // $ ast,ir
}
void argument_source(void*);

26
cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
View File

@@ -341,32 +341,6 @@ uniquePostUpdate
| static_init_templates.cpp:240:7:240:7 | this indirection | Node has multiple PostUpdateNodes. |
postIsInSameCallable
reverseRead
| cpp11.cpp:82:17:82:17 | Unary | Origin of readStep is missing a PostUpdateNode. |
| cpp11.cpp:82:17:82:55 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:514:10:514:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:515:10:515:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:515:10:515:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:516:10:516:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:516:10:516:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:658:5:658:5 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:658:5:658:5 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:745:8:745:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:745:8:745:8 | this | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:748:3:748:6 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:750:3:750:7 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:754:8:754:8 | this | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:757:3:757:8 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:759:3:759:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:763:8:763:8 | this | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:766:3:766:9 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:768:3:768:10 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:775:3:775:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:777:3:777:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:784:3:784:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:786:3:786:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:793:3:793:11 | Unary | Origin of readStep is missing a PostUpdateNode. |
| ir.cpp:795:3:795:12 | Unary | Origin of readStep is missing a PostUpdateNode. |
| static_init_templates.cpp:240:7:240:7 | Unary | Origin of readStep is missing a PostUpdateNode. |
argHasPostUpdate
postWithInFlow
| cpp11.cpp:77:19:77:21 | call to Val | PostUpdateNode should not be the target of local flow. |

1
cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ast_gvn.expected
View File

@@ -1,3 +1,4 @@
WARNING: Type GVN has been deprecated and may be removed in future (ast_gvn.ql:4,6-9)
| test.cpp:5:3:5:3 | x | 5:c3-c3 6:c3-c3 |
| test.cpp:5:7:5:8 | p0 | 5:c7-c8 6:c7-c8 |
| test.cpp:5:7:5:13 | ... + ... | 5:c7-c13 6:c7-c13 7:c7-c7 |

3
cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ast_uniqueness.expected
View File

@@ -0,0 +1,3 @@
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (ast_uniqueness.ql:7,13-30)
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (ast_uniqueness.ql:8,30-47)
WARNING: Type GVN has been deprecated and may be removed in future (ast_uniqueness.ql:8,18-21)

1
cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected
View File

@@ -1,3 +1,4 @@
WARNING: Predicate globalValueNumber has been deprecated and may be removed in future (diff_ir_expr.ql:8,29-51)
| test.cpp:5:3:5:13 | ... = ... | test.cpp:5:3:5:13 | ... = ... | AST only |
| test.cpp:6:3:6:13 | ... = ... | test.cpp:6:3:6:13 | ... = ... | AST only |
| test.cpp:7:3:7:7 | ... = ... | test.cpp:7:3:7:7 | ... = ... | AST only |

119
cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/CastArrayPointerArithmetic.expected
View File

@@ -2,11 +2,6 @@ edges
| test.cpp:26:29:26:29 | b | test.cpp:27:2:27:2 | b |
| test.cpp:30:34:30:34 | b | test.cpp:31:2:31:2 | b |
| test.cpp:34:31:34:31 | b | test.cpp:35:2:35:2 | b |
| test.cpp:38:35:38:35 | d | test.cpp:39:2:39:2 | d |
| test.cpp:42:40:42:40 | d | test.cpp:43:2:43:2 | d |
| test.cpp:46:37:46:37 | d | test.cpp:47:2:47:2 | d |
| test.cpp:50:31:50:31 | b | test.cpp:51:3:51:11 | b |
| test.cpp:50:31:50:31 | b | test.cpp:51:11:51:11 | b |
| test.cpp:57:19:57:19 | d | test.cpp:26:29:26:29 | b |
| test.cpp:57:19:57:19 | d | test.cpp:57:19:57:19 | d |
| test.cpp:57:19:57:19 | d | test.cpp:57:19:57:19 | d |
@@ -16,54 +11,15 @@ edges
| test.cpp:57:19:57:19 | d | test.cpp:59:21:59:21 | d |
| test.cpp:57:19:57:19 | d | test.cpp:59:21:59:21 | d |
| test.cpp:57:19:57:19 | d | test.cpp:59:21:59:21 | d |
| test.cpp:57:19:57:19 | d | test.cpp:61:22:61:22 | d |
| test.cpp:57:19:57:19 | d | test.cpp:61:22:61:22 | d |
| test.cpp:57:19:57:19 | d | test.cpp:61:22:61:22 | d |
| test.cpp:57:19:57:19 | d | test.cpp:62:28:62:28 | d |
| test.cpp:57:19:57:19 | d | test.cpp:62:28:62:28 | d |
| test.cpp:57:19:57:19 | d | test.cpp:62:28:62:28 | d |
| test.cpp:57:19:57:19 | d | test.cpp:63:24:63:24 | d |
| test.cpp:57:19:57:19 | d | test.cpp:63:24:63:24 | d |
| test.cpp:57:19:57:19 | d | test.cpp:63:24:63:24 | d |
| test.cpp:57:19:57:19 | d | test.cpp:95:21:95:21 | d |
| test.cpp:57:19:57:19 | d | test.cpp:95:21:95:21 | d |
| test.cpp:57:19:57:19 | d | test.cpp:95:21:95:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:30:34:30:34 | b |
| test.cpp:58:25:58:25 | d | test.cpp:58:25:58:25 | d |
| test.cpp:58:25:58:25 | d | test.cpp:58:25:58:25 | d |
| test.cpp:58:25:58:25 | d | test.cpp:59:21:59:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:59:21:59:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:59:21:59:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:61:22:61:22 | d |
| test.cpp:58:25:58:25 | d | test.cpp:61:22:61:22 | d |
| test.cpp:58:25:58:25 | d | test.cpp:61:22:61:22 | d |
| test.cpp:58:25:58:25 | d | test.cpp:62:28:62:28 | d |
| test.cpp:58:25:58:25 | d | test.cpp:62:28:62:28 | d |
| test.cpp:58:25:58:25 | d | test.cpp:62:28:62:28 | d |
| test.cpp:58:25:58:25 | d | test.cpp:63:24:63:24 | d |
| test.cpp:58:25:58:25 | d | test.cpp:63:24:63:24 | d |
| test.cpp:58:25:58:25 | d | test.cpp:63:24:63:24 | d |
| test.cpp:58:25:58:25 | d | test.cpp:95:21:95:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:95:21:95:21 | d |
| test.cpp:58:25:58:25 | d | test.cpp:95:21:95:21 | d |
| test.cpp:59:21:59:21 | d | test.cpp:34:31:34:31 | b |
| test.cpp:59:21:59:21 | d | test.cpp:59:21:59:21 | d |
| test.cpp:59:21:59:21 | d | test.cpp:59:21:59:21 | d |
| test.cpp:59:21:59:21 | d | test.cpp:61:22:61:22 | d |
| test.cpp:59:21:59:21 | d | test.cpp:61:22:61:22 | d |
| test.cpp:59:21:59:21 | d | test.cpp:61:22:61:22 | d |
| test.cpp:59:21:59:21 | d | test.cpp:62:28:62:28 | d |
| test.cpp:59:21:59:21 | d | test.cpp:62:28:62:28 | d |
| test.cpp:59:21:59:21 | d | test.cpp:62:28:62:28 | d |
| test.cpp:59:21:59:21 | d | test.cpp:63:24:63:24 | d |
| test.cpp:59:21:59:21 | d | test.cpp:63:24:63:24 | d |
| test.cpp:59:21:59:21 | d | test.cpp:63:24:63:24 | d |
| test.cpp:59:21:59:21 | d | test.cpp:95:21:95:21 | d |
| test.cpp:59:21:59:21 | d | test.cpp:95:21:95:21 | d |
| test.cpp:59:21:59:21 | d | test.cpp:95:21:95:21 | d |
| test.cpp:61:22:61:22 | d | test.cpp:38:35:38:35 | d |
| test.cpp:62:28:62:28 | d | test.cpp:42:40:42:40 | d |
| test.cpp:63:24:63:24 | d | test.cpp:46:37:46:37 | d |
| test.cpp:74:19:74:21 | dss | test.cpp:26:29:26:29 | b |
| test.cpp:74:19:74:21 | dss | test.cpp:74:19:74:21 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:74:19:74:21 | dss |
@@ -73,24 +29,15 @@ edges
| test.cpp:74:19:74:21 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:74:19:74:21 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:30:34:30:34 | b |
| test.cpp:75:25:75:27 | dss | test.cpp:75:25:75:27 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:75:25:75:27 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:75:25:75:27 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:76:21:76:23 | dss | test.cpp:34:31:34:31 | b |
| test.cpp:76:21:76:23 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:76:21:76:23 | dss | test.cpp:76:21:76:23 | dss |
| test.cpp:76:21:76:23 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:76:21:76:23 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:76:21:76:23 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:86:19:86:20 | d2 | test.cpp:26:29:26:29 | b |
| test.cpp:86:19:86:20 | d2 | test.cpp:86:19:86:20 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:86:19:86:20 | d2 |
@@ -103,18 +50,6 @@ edges
| test.cpp:86:19:86:20 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:86:19:86:20 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:30:34:30:34 | b |
| test.cpp:87:25:87:26 | d2 | test.cpp:87:25:87:26 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:87:25:87:26 | d2 |
@@ -123,43 +58,10 @@ edges
| test.cpp:87:25:87:26 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:87:25:87:26 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:34:31:34:31 | b |
| test.cpp:88:21:88:22 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:88:21:88:22 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:90:22:90:23 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:91:28:91:29 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:88:21:88:22 | d2 | test.cpp:92:24:92:25 | d2 |
| test.cpp:90:22:90:23 | d2 | test.cpp:38:35:38:35 | d |
| test.cpp:91:28:91:29 | d2 | test.cpp:42:40:42:40 | d |
| test.cpp:92:24:92:25 | d2 | test.cpp:46:37:46:37 | d |
| test.cpp:95:21:95:21 | d | test.cpp:50:31:50:31 | b |
| test.cpp:95:21:95:21 | d | test.cpp:95:21:95:21 | d |
| test.cpp:95:21:95:21 | d | test.cpp:95:21:95:21 | d |
| test.cpp:96:21:96:23 | dss | test.cpp:50:31:50:31 | b |
| test.cpp:96:21:96:23 | dss | test.cpp:96:21:96:23 | dss |
| test.cpp:96:21:96:23 | dss | test.cpp:96:21:96:23 | dss |
nodes
| test.cpp:26:29:26:29 | b | semmle.label | b |
| test.cpp:27:2:27:2 | b | semmle.label | b |
@@ -167,15 +69,6 @@ nodes
| test.cpp:31:2:31:2 | b | semmle.label | b |
| test.cpp:34:31:34:31 | b | semmle.label | b |
| test.cpp:35:2:35:2 | b | semmle.label | b |
| test.cpp:38:35:38:35 | d | semmle.label | d |
| test.cpp:39:2:39:2 | d | semmle.label | d |
| test.cpp:42:40:42:40 | d | semmle.label | d |
| test.cpp:43:2:43:2 | d | semmle.label | d |
| test.cpp:46:37:46:37 | d | semmle.label | d |
| test.cpp:47:2:47:2 | d | semmle.label | d |
| test.cpp:50:31:50:31 | b | semmle.label | b |
| test.cpp:51:3:51:11 | b | semmle.label | b |
| test.cpp:51:11:51:11 | b | semmle.label | b |
| test.cpp:57:19:57:19 | d | semmle.label | d |
| test.cpp:57:19:57:19 | d | semmle.label | d |
| test.cpp:57:19:57:19 | d | semmle.label | d |
@@ -185,9 +78,6 @@ nodes
| test.cpp:59:21:59:21 | d | semmle.label | d |
| test.cpp:59:21:59:21 | d | semmle.label | d |
| test.cpp:59:21:59:21 | d | semmle.label | d |
| test.cpp:61:22:61:22 | d | semmle.label | d |
| test.cpp:62:28:62:28 | d | semmle.label | d |
| test.cpp:63:24:63:24 | d | semmle.label | d |
| test.cpp:74:19:74:21 | dss | semmle.label | dss |
| test.cpp:74:19:74:21 | dss | semmle.label | dss |
| test.cpp:74:19:74:21 | dss | semmle.label | dss |
@@ -209,15 +99,6 @@ nodes
| test.cpp:88:21:88:22 | d2 | semmle.label | d2 |
| test.cpp:88:21:88:22 | d2 | semmle.label | d2 |
| test.cpp:88:21:88:22 | d2 | semmle.label | d2 |
| test.cpp:90:22:90:23 | d2 | semmle.label | d2 |
| test.cpp:91:28:91:29 | d2 | semmle.label | d2 |
| test.cpp:92:24:92:25 | d2 | semmle.label | d2 |
| test.cpp:95:21:95:21 | d | semmle.label | d |
| test.cpp:95:21:95:21 | d | semmle.label | d |
| test.cpp:95:21:95:21 | d | semmle.label | d |
| test.cpp:96:21:96:23 | dss | semmle.label | dss |
| test.cpp:96:21:96:23 | dss | semmle.label | dss |
| test.cpp:96:21:96:23 | dss | semmle.label | dss |
subpaths
#select
| test.cpp:27:2:27:2 | b | test.cpp:57:19:57:19 | d | test.cpp:27:2:27:2 | b | This pointer arithmetic may be done with the wrong type because of $@. | test.cpp:57:19:57:19 | d | this cast |