Geoffrey White
227bf91626
C++: Correct test annotation.
2020-10-22 09:45:09 +01:00
Mathias Vorreiter Pedersen
7b456d6162
Merge branch 'main' into mathiasvp/array-field-flow
2020-09-16 10:45:31 +02:00
Jonas Jensen
bdce24735c
C++: Add flow through arrays
...
This works by adding data-flow edges to skip over array expressions when
reading from arrays. On the post-update side, there was already code to
skip over array expressions when storing to arrays. That happens in
`valueToUpdate` in `AddressFlow.qll`, which needed just a small tweak to
support assignments with non-field expressions at the top-level LHS,
like `*a = ...` or `a[0] = ...`.
The new code in `AddressFlow.qll` is copy-pasted from `EscapesTree.qll`,
and there is already a note in these files saying that they share a lot
of code and must be maintained in sync.
2020-09-15 14:46:11 +02:00
Mathias Vorreiter Pedersen
0c14e2b69a
C++: Fix annotations in taint.cpp
2020-09-14 23:08:50 +02:00
Mathias Vorreiter Pedersen
7cd6137b34
Merge branch 'main' into mathiasvp/array-field-flow
2020-09-14 20:45:06 +02:00
Mathias Vorreiter Pedersen
41147d245d
C++: Accept test changes
2020-09-08 14:35:22 +02:00
Mathias Vorreiter Pedersen
3cca74e654
C++: Accept test changes
2020-09-01 10:54:46 +02:00
Mathias Vorreiter Pedersen
e4807c0181
C++: Accept test changes
2020-08-26 15:51:09 +02:00
Robert Marsh
1c9b6f0a48
Merge branch 'master' into ir-this-parameter-2
...
Accept test changes - dataflow changes are all positive
2020-06-16 11:28:49 -07:00
Mathias Vorreiter Pedersen
a38839b446
C++: Include copy of IntWrapper class with two data members
2020-06-10 22:27:40 +02:00
Mathias Vorreiter Pedersen
ca20f17703
C++: Implement move constructor in terms of swap. I'm haven't found anything online on whether this is good or bad, and the only reason for not doing it might be performance.
2020-06-10 22:16:58 +02:00
Mathias Vorreiter Pedersen
1a95095505
C++: Add default move constructor. Also removed debug comment I forgot to remove earlier. Luckily, that meant that no line numbers changed in .expected files.
2020-06-10 17:13:04 +02:00
Mathias Vorreiter Pedersen
5abab25c28
Update cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2020-06-10 16:51:21 +02:00
Mathias Vorreiter Pedersen
88dabffd2b
C++: Add tests that demonstrate flow through custom swap functions
2020-06-10 15:06:57 +02:00
Robert Marsh
a897caec76
C++: outbound dataflow via this indirections
2020-05-28 15:30:41 -07:00
Mathias Vorreiter Pedersen
90d473d886
C++: Demonstrate lack of taint through getdelim
2020-05-15 11:01:27 +02:00
Geoffrey White
7a98919879
C++: Add a non-standard swap to taint tests.
2020-04-01 17:14:38 +01:00
Geoffrey White
edf2b54813
CPP: Model strndup.
2020-01-23 13:46:57 +00:00
Geoffrey White
1867d58034
CPP: Allow flow to return value.
2020-01-22 16:25:40 +00:00
Geoffrey White
704bfe7184
CPP: Support taint flow from qualifiers.
2020-01-22 16:22:29 +00:00
Geoffrey White
e6daf3b7ee
CPP: Support taint flow to qualifiers.
2020-01-22 16:16:31 +00:00
Geoffrey White
1a6f7febe7
CPP: Add tests of taint through qualifiers.
2020-01-22 16:11:13 +00:00
Geoffrey White
ef47563139
CPP: Support flow of pointed-to things through function calls.
2020-01-16 11:08:19 +00:00
Geoffrey White
ce389ca791
CPP: Add tests for strdup.
2020-01-15 18:26:24 +00:00
Jonas Jensen
5d7a0b8dd5
Merge remote-tracking branch 'upstream/master' into dataflow-ref-parameter
...
I've accepted the new test output, which shows that this branch fixes
two false negatives in the test cases from #2088 .
2019-10-08 13:09:20 +02:00
Geoffrey White
050d99fa87
CPP: Add test cases.
2019-10-04 17:44:27 +01:00
Jonas Jensen
7c319efb8b
C++: Data flow through reference parameters
2019-10-01 10:43:49 +02:00
Dave Bartolomeo
8a9528b1a8
C++: Accept test output after fixes for PointerAdd element sizes
2019-08-22 10:43:31 -07:00
Geoffrey White
a70975f95f
CPP: Update test comments.
2019-08-22 15:40:38 +01:00
Geoffrey White
4ea999872b
Merge pull request #1746 from jbj/ast-field-flow-ctor
...
C++: Field flow through ConstructorFieldInit
2019-08-19 09:14:02 +01:00
Jonas Jensen
84adeda167
C++: Support flow through LambdaExpression
...
I've checked with a temporary workaround for the locations problem that
my annotations in the test cpp files are on the correct lines.
2019-08-16 16:20:22 +02:00
Jonas Jensen
45eefdb218
C++: Field flow through ConstructorFieldInit
...
This allows a member initializer list to be seen as a sequence of field
assignments. For example, the constructor
C() : a(taint()) { }
now has data flow similar to
C() { this.a = taint(); }
2019-08-16 09:10:17 +02:00
Geoffrey White
1bd4aeebad
CPP: Effects of #1715 .
2019-08-15 14:05:09 +01:00
Geoffrey White
02e1edd640
CPP: Test taint through lambdas.
2019-08-15 14:00:45 +01:00
Jonas Jensen
38ec693ead
C++: Improved ConstructorCall field flow
...
This commit changes C++ `ConstructorCall` to behave like
`new`-expressions in Java: they are both `ExprNode`s and
`PostUpdateNodes`, and there's a "pre-update node" (here called
`PreConstructorCallNode`) to play the role of the qualifier argument
when calling a constructor.
2019-08-13 11:05:13 +02:00
Jonas Jensen
6a3f5efc1b
C++: Accept AST field flow test output
2019-08-08 14:05:03 +02:00
Geoffrey White
c2fd2e273e
CPP: Model taint flow through std::swap.
2019-07-12 18:00:39 +01:00
Geoffrey White
f132bca06e
CPP: Add a taint flow test of 'std::swap'.
2019-07-12 16:37:01 +01:00
Robert Marsh
919f5c616f
C++: comment and test for taint flow via memcpy
2019-04-23 11:17:18 -07:00
Robert Marsh
9a9ec7bb17
C++: add IR-based taint tracking library
2019-02-21 17:09:09 -08:00
Pavel Avgustinov
b55526aa58
QL code and tests for C#/C++/JavaScript.
2018-08-02 17:53:23 +01:00
