mirror of
https://github.com/github/codeql.git
synced 2026-05-14 11:19:27 +02:00
C++: fix implicit this
This commit is contained in:
committed by
Mathias Vorreiter Pedersen
parent
b2e4276bc8
commit
fe891746bf
@@ -77,21 +77,21 @@ abstract class BufferWrite extends Expr {
|
||||
* much smaller (8 bytes) than their true maximum length. This can be
|
||||
* helpful in determining the cause of a buffer overflow issue.
|
||||
*/
|
||||
int getMaxDataLimited() { result = getMaxData() }
|
||||
int getMaxDataLimited() { result = this.getMaxData() }
|
||||
|
||||
/**
|
||||
* Gets the size of a single character of the type this
|
||||
* operation works with, in bytes.
|
||||
*/
|
||||
int getCharSize() {
|
||||
result = getBufferType().(PointerType).getBaseType().getSize() or
|
||||
result = getBufferType().(ArrayType).getBaseType().getSize()
|
||||
result = this.getBufferType().(PointerType).getBaseType().getSize() or
|
||||
result = this.getBufferType().(ArrayType).getBaseType().getSize()
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a description of this buffer write.
|
||||
*/
|
||||
string getBWDesc() { result = toString() }
|
||||
string getBWDesc() { result = this.toString() }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -109,7 +109,7 @@ abstract class BufferWriteCall extends BufferWrite, FunctionCall { }
|
||||
class StrCopyBW extends BufferWriteCall {
|
||||
StrcpyFunction f;
|
||||
|
||||
StrCopyBW() { getTarget() = f.(TopLevelFunction) }
|
||||
StrCopyBW() { this.getTarget() = f.(TopLevelFunction) }
|
||||
|
||||
/**
|
||||
* Gets the index of the parameter that is the maximum size of the copy (in characters).
|
||||
@@ -122,21 +122,22 @@ class StrCopyBW extends BufferWriteCall {
|
||||
int getParamSrc() { result = f.getParamSrc() }
|
||||
|
||||
override Type getBufferType() {
|
||||
result = this.getTarget().getParameter(getParamSrc()).getUnspecifiedType()
|
||||
result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()
|
||||
}
|
||||
|
||||
override Expr getASource() { result = getArgument(getParamSrc()) }
|
||||
override Expr getASource() { result = this.getArgument(this.getParamSrc()) }
|
||||
|
||||
override Expr getDest() { result = getArgument(f.getParamDest()) }
|
||||
override Expr getDest() { result = this.getArgument(f.getParamDest()) }
|
||||
|
||||
override predicate hasExplicitLimit() { exists(getParamSize()) }
|
||||
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
|
||||
|
||||
override int getExplicitLimit() {
|
||||
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
|
||||
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
|
||||
}
|
||||
|
||||
override int getMaxData() {
|
||||
result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
|
||||
result =
|
||||
this.getArgument(this.getParamSrc()).(AnalysedString).getMaxLength() * this.getCharSize()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -146,7 +147,7 @@ class StrCopyBW extends BufferWriteCall {
|
||||
class StrCatBW extends BufferWriteCall {
|
||||
StrcatFunction f;
|
||||
|
||||
StrCatBW() { getTarget() = f.(TopLevelFunction) }
|
||||
StrCatBW() { this.getTarget() = f.(TopLevelFunction) }
|
||||
|
||||
/**
|
||||
* Gets the index of the parameter that is the maximum size of the copy (in characters).
|
||||
@@ -159,21 +160,22 @@ class StrCatBW extends BufferWriteCall {
|
||||
int getParamSrc() { result = f.getParamSrc() }
|
||||
|
||||
override Type getBufferType() {
|
||||
result = this.getTarget().getParameter(getParamSrc()).getUnspecifiedType()
|
||||
result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()
|
||||
}
|
||||
|
||||
override Expr getASource() { result = getArgument(getParamSrc()) }
|
||||
override Expr getASource() { result = this.getArgument(this.getParamSrc()) }
|
||||
|
||||
override Expr getDest() { result = getArgument(f.getParamDest()) }
|
||||
override Expr getDest() { result = this.getArgument(f.getParamDest()) }
|
||||
|
||||
override predicate hasExplicitLimit() { exists(getParamSize()) }
|
||||
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
|
||||
|
||||
override int getExplicitLimit() {
|
||||
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
|
||||
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
|
||||
}
|
||||
|
||||
override int getMaxData() {
|
||||
result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
|
||||
result =
|
||||
this.getArgument(this.getParamSrc()).(AnalysedString).getMaxLength() * this.getCharSize()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -184,7 +186,7 @@ class SprintfBW extends BufferWriteCall {
|
||||
FormattingFunction f;
|
||||
|
||||
SprintfBW() {
|
||||
exists(string name | f = getTarget().(TopLevelFunction) and name = f.getName() |
|
||||
exists(string name | f = this.getTarget().(TopLevelFunction) and name = f.getName() |
|
||||
/*
|
||||
* C sprintf variants:
|
||||
*/
|
||||
@@ -229,19 +231,19 @@ class SprintfBW extends BufferWriteCall {
|
||||
result = this.(FormattingFunctionCall).getFormatArgument(_)
|
||||
}
|
||||
|
||||
override Expr getDest() { result = getArgument(f.getOutputParameterIndex(false)) }
|
||||
override Expr getDest() { result = this.getArgument(f.getOutputParameterIndex(false)) }
|
||||
|
||||
override int getMaxData() {
|
||||
exists(FormatLiteral fl |
|
||||
fl = this.(FormattingFunctionCall).getFormat() and
|
||||
result = fl.getMaxConvertedLength() * getCharSize()
|
||||
result = fl.getMaxConvertedLength() * this.getCharSize()
|
||||
)
|
||||
}
|
||||
|
||||
override int getMaxDataLimited() {
|
||||
exists(FormatLiteral fl |
|
||||
fl = this.(FormattingFunctionCall).getFormat() and
|
||||
result = fl.getMaxConvertedLengthLimited() * getCharSize()
|
||||
result = fl.getMaxConvertedLengthLimited() * this.getCharSize()
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -251,7 +253,7 @@ class SprintfBW extends BufferWriteCall {
|
||||
*/
|
||||
class SnprintfBW extends BufferWriteCall {
|
||||
SnprintfBW() {
|
||||
exists(TopLevelFunction fn, string name | fn = getTarget() and name = fn.getName() |
|
||||
exists(TopLevelFunction fn, string name | fn = this.getTarget() and name = fn.getName() |
|
||||
/*
|
||||
* C snprintf variants:
|
||||
*/
|
||||
@@ -326,25 +328,25 @@ class SnprintfBW extends BufferWriteCall {
|
||||
result = this.(FormattingFunctionCall).getFormatArgument(_)
|
||||
}
|
||||
|
||||
override Expr getDest() { result = getArgument(0) }
|
||||
override Expr getDest() { result = this.getArgument(0) }
|
||||
|
||||
override predicate hasExplicitLimit() { exists(getParamSize()) }
|
||||
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
|
||||
|
||||
override int getExplicitLimit() {
|
||||
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
|
||||
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
|
||||
}
|
||||
|
||||
override int getMaxData() {
|
||||
exists(FormatLiteral fl |
|
||||
fl = this.(FormattingFunctionCall).getFormat() and
|
||||
result = fl.getMaxConvertedLength() * getCharSize()
|
||||
result = fl.getMaxConvertedLength() * this.getCharSize()
|
||||
)
|
||||
}
|
||||
|
||||
override int getMaxDataLimited() {
|
||||
exists(FormatLiteral fl |
|
||||
fl = this.(FormattingFunctionCall).getFormat() and
|
||||
result = fl.getMaxConvertedLengthLimited() * getCharSize()
|
||||
result = fl.getMaxConvertedLengthLimited() * this.getCharSize()
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -354,7 +356,7 @@ class SnprintfBW extends BufferWriteCall {
|
||||
*/
|
||||
class GetsBW extends BufferWriteCall {
|
||||
GetsBW() {
|
||||
getTarget().(TopLevelFunction).getName() =
|
||||
this.getTarget().(TopLevelFunction).getName() =
|
||||
[
|
||||
"gets", // gets(dst)
|
||||
"fgets", // fgets(dst, max_amount, src_stream)
|
||||
@@ -365,24 +367,24 @@ class GetsBW extends BufferWriteCall {
|
||||
/**
|
||||
* Gets the index of the parameter that is the maximum number of characters to be read.
|
||||
*/
|
||||
int getParamSize() { exists(getArgument(1)) and result = 1 }
|
||||
int getParamSize() { exists(this.getArgument(1)) and result = 1 }
|
||||
|
||||
override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }
|
||||
|
||||
override Expr getASource() {
|
||||
if exists(getArgument(2))
|
||||
then result = getArgument(2)
|
||||
if exists(this.getArgument(2))
|
||||
then result = this.getArgument(2)
|
||||
else
|
||||
// the source is input inside the 'gets' call itself
|
||||
result = this
|
||||
}
|
||||
|
||||
override Expr getDest() { result = getArgument(0) }
|
||||
override Expr getDest() { result = this.getArgument(0) }
|
||||
|
||||
override predicate hasExplicitLimit() { exists(getParamSize()) }
|
||||
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
|
||||
|
||||
override int getExplicitLimit() {
|
||||
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
|
||||
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -438,7 +440,7 @@ class ScanfBW extends BufferWrite {
|
||||
exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg |
|
||||
this = fc.getArgument(arg) and
|
||||
fl = fc.getFormat() and
|
||||
result = (fl.getMaxConvertedLength(arg - getParamArgs()) + 1) * getCharSize() // +1 is for the terminating null
|
||||
result = (fl.getMaxConvertedLength(arg - this.getParamArgs()) + 1) * this.getCharSize() // +1 is for the terminating null
|
||||
)
|
||||
}
|
||||
|
||||
@@ -463,14 +465,14 @@ private int path_max() {
|
||||
class RealpathBW extends BufferWriteCall {
|
||||
RealpathBW() {
|
||||
exists(path_max()) and // Ignore realpath() calls if PATH_MAX cannot be determined
|
||||
getTarget().hasGlobalName("realpath") // realpath(path, resolved_path);
|
||||
this.getTarget().hasGlobalName("realpath") // realpath(path, resolved_path);
|
||||
}
|
||||
|
||||
override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }
|
||||
|
||||
override Expr getDest() { result = getArgument(1) }
|
||||
override Expr getDest() { result = this.getArgument(1) }
|
||||
|
||||
override Expr getASource() { result = getArgument(0) }
|
||||
override Expr getASource() { result = this.getArgument(0) }
|
||||
|
||||
override int getMaxData() {
|
||||
result = path_max() and
|
||||
|
||||
@@ -52,9 +52,9 @@ class BasicOStreamClass extends Type {
|
||||
*/
|
||||
class BasicOStreamCall extends FunctionCall {
|
||||
BasicOStreamCall() {
|
||||
if getTarget() instanceof MemberFunction
|
||||
then getQualifier().getType() instanceof BasicOStreamClass
|
||||
else getArgument(0).getType() instanceof BasicOStreamClass
|
||||
if this.getTarget() instanceof MemberFunction
|
||||
then this.getQualifier().getType() instanceof BasicOStreamClass
|
||||
else this.getArgument(0).getType() instanceof BasicOStreamClass
|
||||
}
|
||||
}
|
||||
|
||||
@@ -77,10 +77,10 @@ abstract class ChainedOutputCall extends BasicOStreamCall {
|
||||
*/
|
||||
Expr getEndDest() {
|
||||
// recurse into the destination
|
||||
result = getDest().(ChainedOutputCall).getEndDest()
|
||||
result = this.getDest().(ChainedOutputCall).getEndDest()
|
||||
or
|
||||
// or return something other than a ChainedOutputCall
|
||||
result = getDest() and
|
||||
result = this.getDest() and
|
||||
not result instanceof ChainedOutputCall
|
||||
}
|
||||
}
|
||||
@@ -89,18 +89,18 @@ abstract class ChainedOutputCall extends BasicOStreamCall {
|
||||
* A call to `operator<<` on an output stream.
|
||||
*/
|
||||
class OperatorLShiftCall extends ChainedOutputCall {
|
||||
OperatorLShiftCall() { getTarget().(Operator).hasName("operator<<") }
|
||||
OperatorLShiftCall() { this.getTarget().(Operator).hasName("operator<<") }
|
||||
|
||||
override Expr getSource() {
|
||||
if getTarget() instanceof MemberFunction
|
||||
then result = getArgument(0)
|
||||
else result = getArgument(1)
|
||||
if this.getTarget() instanceof MemberFunction
|
||||
then result = this.getArgument(0)
|
||||
else result = this.getArgument(1)
|
||||
}
|
||||
|
||||
override Expr getDest() {
|
||||
if getTarget() instanceof MemberFunction
|
||||
then result = getQualifier()
|
||||
else result = getArgument(0)
|
||||
if this.getTarget() instanceof MemberFunction
|
||||
then result = this.getQualifier()
|
||||
else result = this.getArgument(0)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -108,22 +108,22 @@ class OperatorLShiftCall extends ChainedOutputCall {
|
||||
* A call to 'put'.
|
||||
*/
|
||||
class PutFunctionCall extends ChainedOutputCall {
|
||||
PutFunctionCall() { getTarget().(MemberFunction).hasName("put") }
|
||||
PutFunctionCall() { this.getTarget().(MemberFunction).hasName("put") }
|
||||
|
||||
override Expr getSource() { result = getArgument(0) }
|
||||
override Expr getSource() { result = this.getArgument(0) }
|
||||
|
||||
override Expr getDest() { result = getQualifier() }
|
||||
override Expr getDest() { result = this.getQualifier() }
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to 'write'.
|
||||
*/
|
||||
class WriteFunctionCall extends ChainedOutputCall {
|
||||
WriteFunctionCall() { getTarget().(MemberFunction).hasName("write") }
|
||||
WriteFunctionCall() { this.getTarget().(MemberFunction).hasName("write") }
|
||||
|
||||
override Expr getSource() { result = getArgument(0) }
|
||||
override Expr getSource() { result = this.getArgument(0) }
|
||||
|
||||
override Expr getDest() { result = getQualifier() }
|
||||
override Expr getDest() { result = this.getQualifier() }
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -24,7 +24,7 @@ private class RemoteReturnSource extends RemoteFlowSource {
|
||||
|
||||
RemoteReturnSource() {
|
||||
exists(RemoteFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
|
||||
asInstruction() = instr and
|
||||
this.asInstruction() = instr and
|
||||
instr.getStaticCallTarget() = func and
|
||||
func.hasRemoteFlowSource(output, sourceType) and
|
||||
(
|
||||
@@ -43,7 +43,7 @@ private class RemoteParameterSource extends RemoteFlowSource {
|
||||
|
||||
RemoteParameterSource() {
|
||||
exists(RemoteFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
|
||||
asInstruction() = instr and
|
||||
this.asInstruction() = instr and
|
||||
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
|
||||
func.hasRemoteFlowSource(output, sourceType) and
|
||||
output.isParameterDerefOrQualifierObject(instr.getIndex())
|
||||
@@ -58,7 +58,7 @@ private class LocalReturnSource extends LocalFlowSource {
|
||||
|
||||
LocalReturnSource() {
|
||||
exists(LocalFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
|
||||
asInstruction() = instr and
|
||||
this.asInstruction() = instr and
|
||||
instr.getStaticCallTarget() = func and
|
||||
func.hasLocalFlowSource(output, sourceType) and
|
||||
(
|
||||
@@ -77,7 +77,7 @@ private class LocalParameterSource extends LocalFlowSource {
|
||||
|
||||
LocalParameterSource() {
|
||||
exists(LocalFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
|
||||
asInstruction() = instr and
|
||||
this.asInstruction() = instr and
|
||||
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
|
||||
func.hasLocalFlowSource(output, sourceType) and
|
||||
output.isParameterDerefOrQualifierObject(instr.getIndex())
|
||||
|
||||
@@ -77,7 +77,7 @@ abstract class FunctionWithWrappers extends Function {
|
||||
) {
|
||||
// base case
|
||||
func = this and
|
||||
interestingArg(paramIndex) and
|
||||
this.interestingArg(paramIndex) and
|
||||
callChain = toCause(func, paramIndex) and
|
||||
depth = 0
|
||||
or
|
||||
@@ -101,7 +101,7 @@ abstract class FunctionWithWrappers extends Function {
|
||||
private predicate wrapperFunctionAnyDepth(Function func, int paramIndex, string cause) {
|
||||
// base case
|
||||
func = this and
|
||||
interestingArg(paramIndex) and
|
||||
this.interestingArg(paramIndex) and
|
||||
cause = toCause(func, paramIndex)
|
||||
or
|
||||
// recursive step
|
||||
@@ -147,7 +147,7 @@ abstract class FunctionWithWrappers extends Function {
|
||||
)
|
||||
or
|
||||
not this.wrapperFunctionLimitedDepth(func, paramIndex, _, _) and
|
||||
cause = wrapperFunctionAnyDepthUnique(func, paramIndex)
|
||||
cause = this.wrapperFunctionAnyDepthUnique(func, paramIndex)
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -78,7 +78,7 @@ class SecurityOptions extends string {
|
||||
functionCall.getTarget().getName() = fname and
|
||||
(
|
||||
fname = ["fgets", "gets"] or
|
||||
userInputReturn(fname)
|
||||
this.userInputReturn(fname)
|
||||
)
|
||||
)
|
||||
or
|
||||
|
||||
@@ -29,7 +29,7 @@ private predicate suspicious(string s) {
|
||||
*/
|
||||
class SensitiveVariable extends Variable {
|
||||
SensitiveVariable() {
|
||||
suspicious(getName().toLowerCase()) and
|
||||
suspicious(this.getName().toLowerCase()) and
|
||||
not this.getUnspecifiedType() instanceof IntegralType
|
||||
}
|
||||
}
|
||||
@@ -39,7 +39,7 @@ class SensitiveVariable extends Variable {
|
||||
*/
|
||||
class SensitiveFunction extends Function {
|
||||
SensitiveFunction() {
|
||||
suspicious(getName().toLowerCase()) and
|
||||
suspicious(this.getName().toLowerCase()) and
|
||||
not this.getUnspecifiedType() instanceof IntegralType
|
||||
}
|
||||
}
|
||||
|
||||
@@ -113,7 +113,7 @@ module BoostorgAsio {
|
||||
result.getName() = "tls_server"
|
||||
)
|
||||
or
|
||||
result = getASslv23ProtocolConstant()
|
||||
result = this.getASslv23ProtocolConstant()
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user