mirror of
https://github.com/github/codeql.git
synced 2026-07-01 17:45:36 +02:00
Compare commits
23 Commits
temp-dca-p
...
copilot/ad
| Author | SHA1 | Date | |
|---|---|---|---|
|
57083e7f40 | ||
|
|
f7f537631c | ||
|
|
bfa81c30f4 | ||
|
|
c807858312 | ||
|
|
1a12cd68ec | ||
|
|
17cbc4990d | ||
|
|
77c962b4d9 | ||
|
|
1e33a81d6b | ||
|
|
d664d17a11 | ||
|
|
e9766086cd | ||
|
|
d551ab3afb | ||
|
|
daf97f7139 | ||
|
|
3410f39b3c | ||
|
|
cf51664d69 | ||
|
|
3cbb8ba87e | ||
|
|
dbbcc1741c | ||
|
|
f37b3e77ff | ||
|
|
0e05ea5153 | ||
|
|
8657c8b26e | ||
|
|
449a3ac870 | ||
|
|
fc954c3e1a | ||
|
|
8fc2f7c92e | ||
|
|
35cd0f829f |
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: breaking
|
||||
---
|
||||
* Removed support for using variables as sources and sinks in models-as-data. Users of this feature should convert such sources and sinks to models defined using the QL language.
|
||||
@@ -931,31 +931,6 @@ private Element interpretElement0(
|
||||
signature = "" and
|
||||
elementSpec(namespace, type, subtypes, name, signature, _)
|
||||
)
|
||||
or
|
||||
// Member variables
|
||||
elementSpec(namespace, type, subtypes, name, signature, _) and
|
||||
signature = "" and
|
||||
exists(Class namedClass, Class classWithMember, MemberVariable member |
|
||||
member.getName() = name and
|
||||
member = classWithMember.getAMember() and
|
||||
namedClass.hasQualifiedName(namespace, type) and
|
||||
result = member
|
||||
|
|
||||
// field declared in the named type or a subtype of it (or an extension of any)
|
||||
subtypes = true and
|
||||
classWithMember = namedClass.getADerivedClass*()
|
||||
or
|
||||
// field declared directly in the named type (or an extension of it)
|
||||
subtypes = false and
|
||||
classWithMember = namedClass
|
||||
)
|
||||
or
|
||||
// Global or namespace variables
|
||||
elementSpec(namespace, type, subtypes, name, signature, _) and
|
||||
signature = "" and
|
||||
type = "" and
|
||||
subtypes = false and
|
||||
result = any(GlobalOrNamespaceVariable v | v.hasQualifiedName(namespace, name))
|
||||
}
|
||||
|
||||
cached
|
||||
|
||||
@@ -230,40 +230,11 @@ module SourceSinkInterpretationInput implements
|
||||
|
||||
/** Provides additional sink specification logic. */
|
||||
bindingset[c]
|
||||
predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) {
|
||||
// Allow variables to be picked as output nodes.
|
||||
exists(Node n, Element ast |
|
||||
n = node.asNode() and
|
||||
ast = mid.asElement()
|
||||
|
|
||||
c = "" and
|
||||
n.asExpr().(VariableAccess).getTarget() = ast
|
||||
)
|
||||
}
|
||||
predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) { none() }
|
||||
|
||||
/** Provides additional source specification logic. */
|
||||
bindingset[c]
|
||||
predicate interpretInput(string c, InterpretNode mid, InterpretNode node) {
|
||||
exists(Node n, Element ast, VariableAccess e |
|
||||
n = node.asNode() and
|
||||
ast = mid.asElement() and
|
||||
e.getTarget() = ast
|
||||
|
|
||||
// Allow variables to be picked as input nodes.
|
||||
// We could simply do this as `e = n.asExpr()`, but that would not allow
|
||||
// us to pick `x` as a sink in an example such as `x = source()` (but
|
||||
// only subsequent uses of `x`) since the variable access on `x` doesn't
|
||||
// actually load the value of `x`. So instead, we pick the instruction
|
||||
// node corresponding to the generated `StoreInstruction` and use the
|
||||
// expression associated with the destination instruction. This means
|
||||
// that the `x` in `x = source()` can be marked as an input.
|
||||
c = "" and
|
||||
exists(StoreInstruction store |
|
||||
store.getDestinationAddress().getUnconvertedResultExpression() = e and
|
||||
n.asInstruction() = store
|
||||
)
|
||||
)
|
||||
}
|
||||
predicate interpretInput(string c, InterpretNode mid, InterpretNode node) { none() }
|
||||
}
|
||||
|
||||
module Private {
|
||||
|
||||
@@ -33,34 +33,34 @@ summaryCalls
|
||||
| file://:0:0:0:0 | [summary] call to [summary param] 0 in madCallArg0ReturnToReturnFirst in madCallArg0ReturnToReturnFirst |
|
||||
| file://:0:0:0:0 | [summary] call to [summary param] 0 in madCallArg0WithValue in madCallArg0WithValue |
|
||||
summarizedCallables
|
||||
| tests.cpp:144:5:144:19 | madArg0ToReturn |
|
||||
| tests.cpp:145:6:145:28 | madArg0ToReturnIndirect |
|
||||
| tests.cpp:147:5:147:28 | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:148:5:148:27 | madArg0IndirectToReturn |
|
||||
| tests.cpp:149:5:149:33 | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:150:5:150:30 | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:151:6:151:26 | madArg0ToArg1Indirect |
|
||||
| tests.cpp:152:6:152:34 | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:153:5:153:18 | madArgsComplex |
|
||||
| tests.cpp:154:5:154:14 | madArgsAny |
|
||||
| tests.cpp:155:5:155:28 | madAndImplementedComplex |
|
||||
| tests.cpp:160:5:160:24 | madArg0FieldToReturn |
|
||||
| tests.cpp:161:5:161:32 | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:162:5:162:32 | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:163:13:163:32 | madArg0ToReturnField |
|
||||
| tests.cpp:164:14:164:41 | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:165:13:165:40 | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:284:7:284:19 | madArg0ToSelf |
|
||||
| tests.cpp:285:6:285:20 | madSelfToReturn |
|
||||
| tests.cpp:287:7:287:20 | madArg0ToField |
|
||||
| tests.cpp:288:6:288:21 | madFieldToReturn |
|
||||
| tests.cpp:313:7:313:30 | namespaceMadSelfToReturn |
|
||||
| tests.cpp:434:5:434:29 | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:435:9:435:38 | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:436:6:436:25 | madCallArg0WithValue |
|
||||
| tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:471:5:471:17 | receive_array |
|
||||
| tests.cpp:127:5:127:19 | madArg0ToReturn |
|
||||
| tests.cpp:128:6:128:28 | madArg0ToReturnIndirect |
|
||||
| tests.cpp:130:5:130:28 | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:131:5:131:27 | madArg0IndirectToReturn |
|
||||
| tests.cpp:132:5:132:33 | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:133:5:133:30 | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:134:6:134:26 | madArg0ToArg1Indirect |
|
||||
| tests.cpp:135:6:135:34 | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:136:5:136:18 | madArgsComplex |
|
||||
| tests.cpp:137:5:137:14 | madArgsAny |
|
||||
| tests.cpp:138:5:138:28 | madAndImplementedComplex |
|
||||
| tests.cpp:143:5:143:24 | madArg0FieldToReturn |
|
||||
| tests.cpp:144:5:144:32 | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:145:5:145:32 | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:146:13:146:32 | madArg0ToReturnField |
|
||||
| tests.cpp:147:14:147:41 | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:148:13:148:40 | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:250:7:250:19 | madArg0ToSelf |
|
||||
| tests.cpp:251:6:251:20 | madSelfToReturn |
|
||||
| tests.cpp:253:7:253:20 | madArg0ToField |
|
||||
| tests.cpp:254:6:254:21 | madFieldToReturn |
|
||||
| tests.cpp:277:7:277:30 | namespaceMadSelfToReturn |
|
||||
| tests.cpp:392:5:392:29 | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:393:9:393:38 | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:394:6:394:25 | madCallArg0WithValue |
|
||||
| tests.cpp:395:5:395:36 | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:429:5:429:17 | receive_array |
|
||||
sourceCallables
|
||||
| tests.cpp:3:5:3:10 | source |
|
||||
| tests.cpp:4:6:4:14 | sourcePtr |
|
||||
@@ -82,297 +82,284 @@ sourceCallables
|
||||
| tests.cpp:19:6:19:32 | remoteMadSourceIndirectArg1 |
|
||||
| tests.cpp:19:39:19:39 | x |
|
||||
| tests.cpp:19:47:19:47 | y |
|
||||
| tests.cpp:20:5:20:22 | remoteMadSourceVar |
|
||||
| tests.cpp:21:6:21:31 | remoteMadSourceVarIndirect |
|
||||
| tests.cpp:24:6:24:28 | namespaceLocalMadSource |
|
||||
| tests.cpp:25:6:25:31 | namespaceLocalMadSourceVar |
|
||||
| tests.cpp:28:7:28:30 | namespace2LocalMadSource |
|
||||
| tests.cpp:31:6:31:19 | localMadSource |
|
||||
| tests.cpp:33:5:33:27 | namespaceLocalMadSource |
|
||||
| tests.cpp:35:6:35:17 | test_sources |
|
||||
| tests.cpp:50:6:50:6 | v |
|
||||
| tests.cpp:51:7:51:16 | v_indirect |
|
||||
| tests.cpp:52:6:52:13 | v_direct |
|
||||
| tests.cpp:63:6:63:6 | a |
|
||||
| tests.cpp:63:9:63:9 | b |
|
||||
| tests.cpp:63:12:63:12 | c |
|
||||
| tests.cpp:63:15:63:15 | d |
|
||||
| tests.cpp:75:6:75:6 | e |
|
||||
| tests.cpp:85:6:85:26 | remoteMadSourceParam0 |
|
||||
| tests.cpp:85:32:85:32 | x |
|
||||
| tests.cpp:92:6:92:16 | madSinkArg0 |
|
||||
| tests.cpp:92:22:92:22 | x |
|
||||
| tests.cpp:93:6:93:13 | notASink |
|
||||
| tests.cpp:93:19:93:19 | x |
|
||||
| tests.cpp:94:6:94:16 | madSinkArg1 |
|
||||
| tests.cpp:94:22:94:22 | x |
|
||||
| tests.cpp:94:29:94:29 | y |
|
||||
| tests.cpp:95:6:95:17 | madSinkArg01 |
|
||||
| tests.cpp:95:23:95:23 | x |
|
||||
| tests.cpp:95:30:95:30 | y |
|
||||
| tests.cpp:95:37:95:37 | z |
|
||||
| tests.cpp:96:6:96:17 | madSinkArg02 |
|
||||
| tests.cpp:96:23:96:23 | x |
|
||||
| tests.cpp:96:30:96:30 | y |
|
||||
| tests.cpp:96:37:96:37 | z |
|
||||
| tests.cpp:97:6:97:24 | madSinkIndirectArg0 |
|
||||
| tests.cpp:97:31:97:31 | x |
|
||||
| tests.cpp:98:6:98:30 | madSinkDoubleIndirectArg0 |
|
||||
| tests.cpp:98:38:98:38 | x |
|
||||
| tests.cpp:99:5:99:14 | madSinkVar |
|
||||
| tests.cpp:100:6:100:23 | madSinkVarIndirect |
|
||||
| tests.cpp:102:6:102:15 | test_sinks |
|
||||
| tests.cpp:116:6:116:6 | a |
|
||||
| tests.cpp:117:7:117:11 | a_ptr |
|
||||
| tests.cpp:132:6:132:18 | madSinkParam0 |
|
||||
| tests.cpp:132:24:132:24 | x |
|
||||
| tests.cpp:138:8:138:8 | operator= |
|
||||
| tests.cpp:138:8:138:8 | operator= |
|
||||
| tests.cpp:138:8:138:18 | MyContainer |
|
||||
| tests.cpp:139:6:139:10 | value |
|
||||
| tests.cpp:140:6:140:11 | value2 |
|
||||
| tests.cpp:141:7:141:9 | ptr |
|
||||
| tests.cpp:144:5:144:19 | madArg0ToReturn |
|
||||
| tests.cpp:144:25:144:25 | x |
|
||||
| tests.cpp:145:6:145:28 | madArg0ToReturnIndirect |
|
||||
| tests.cpp:145:34:145:34 | x |
|
||||
| tests.cpp:146:5:146:15 | notASummary |
|
||||
| tests.cpp:146:21:146:21 | x |
|
||||
| tests.cpp:147:5:147:28 | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:147:34:147:34 | x |
|
||||
| tests.cpp:148:5:148:27 | madArg0IndirectToReturn |
|
||||
| tests.cpp:148:34:148:34 | x |
|
||||
| tests.cpp:149:5:149:33 | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:149:41:149:41 | x |
|
||||
| tests.cpp:150:5:150:30 | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:150:37:150:37 | x |
|
||||
| tests.cpp:151:6:151:26 | madArg0ToArg1Indirect |
|
||||
| tests.cpp:151:32:151:32 | x |
|
||||
| tests.cpp:151:40:151:40 | y |
|
||||
| tests.cpp:152:6:152:34 | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:152:47:152:47 | x |
|
||||
| tests.cpp:152:55:152:55 | y |
|
||||
| tests.cpp:153:5:153:18 | madArgsComplex |
|
||||
| tests.cpp:153:25:153:25 | a |
|
||||
| tests.cpp:153:33:153:33 | b |
|
||||
| tests.cpp:153:40:153:40 | c |
|
||||
| tests.cpp:153:47:153:47 | d |
|
||||
| tests.cpp:154:5:154:14 | madArgsAny |
|
||||
| tests.cpp:154:20:154:20 | a |
|
||||
| tests.cpp:154:28:154:28 | b |
|
||||
| tests.cpp:155:5:155:28 | madAndImplementedComplex |
|
||||
| tests.cpp:155:34:155:34 | a |
|
||||
| tests.cpp:155:41:155:41 | b |
|
||||
| tests.cpp:155:48:155:48 | c |
|
||||
| tests.cpp:160:5:160:24 | madArg0FieldToReturn |
|
||||
| tests.cpp:160:38:160:39 | mc |
|
||||
| tests.cpp:161:5:161:32 | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:161:47:161:48 | mc |
|
||||
| tests.cpp:162:5:162:32 | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:162:46:162:47 | mc |
|
||||
| tests.cpp:163:13:163:32 | madArg0ToReturnField |
|
||||
| tests.cpp:163:38:163:38 | x |
|
||||
| tests.cpp:164:14:164:41 | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:164:47:164:47 | x |
|
||||
| tests.cpp:165:13:165:40 | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:165:46:165:46 | x |
|
||||
| tests.cpp:167:13:167:30 | madFieldToFieldVar |
|
||||
| tests.cpp:168:13:168:38 | madFieldToIndirectFieldVar |
|
||||
| tests.cpp:169:14:169:39 | madIndirectFieldToFieldVar |
|
||||
| tests.cpp:171:6:171:19 | test_summaries |
|
||||
| tests.cpp:174:6:174:6 | a |
|
||||
| tests.cpp:174:9:174:9 | b |
|
||||
| tests.cpp:174:12:174:12 | c |
|
||||
| tests.cpp:174:15:174:15 | d |
|
||||
| tests.cpp:174:18:174:18 | e |
|
||||
| tests.cpp:175:7:175:11 | a_ptr |
|
||||
| tests.cpp:218:14:218:16 | mc1 |
|
||||
| tests.cpp:218:19:218:21 | mc2 |
|
||||
| tests.cpp:237:15:237:18 | rtn1 |
|
||||
| tests.cpp:240:14:240:17 | rtn2 |
|
||||
| tests.cpp:241:7:241:14 | rtn2_ptr |
|
||||
| tests.cpp:267:7:267:7 | operator= |
|
||||
| tests.cpp:267:7:267:7 | operator= |
|
||||
| tests.cpp:267:7:267:13 | MyClass |
|
||||
| tests.cpp:270:6:270:26 | memberRemoteMadSource |
|
||||
| tests.cpp:271:7:271:39 | memberRemoteMadSourceIndirectArg0 |
|
||||
| tests.cpp:271:46:271:46 | x |
|
||||
| tests.cpp:272:6:272:29 | memberRemoteMadSourceVar |
|
||||
| tests.cpp:273:7:273:21 | qualifierSource |
|
||||
| tests.cpp:274:7:274:26 | qualifierFieldSource |
|
||||
| tests.cpp:277:7:277:23 | memberMadSinkArg0 |
|
||||
| tests.cpp:277:29:277:29 | x |
|
||||
| tests.cpp:278:6:278:21 | memberMadSinkVar |
|
||||
| tests.cpp:279:7:279:19 | qualifierSink |
|
||||
| tests.cpp:280:7:280:23 | qualifierArg0Sink |
|
||||
| tests.cpp:280:29:280:29 | x |
|
||||
| tests.cpp:281:7:281:24 | qualifierFieldSink |
|
||||
| tests.cpp:284:7:284:19 | madArg0ToSelf |
|
||||
| tests.cpp:284:25:284:25 | x |
|
||||
| tests.cpp:285:6:285:20 | madSelfToReturn |
|
||||
| tests.cpp:286:6:286:16 | notASummary |
|
||||
| tests.cpp:287:7:287:20 | madArg0ToField |
|
||||
| tests.cpp:287:26:287:26 | x |
|
||||
| tests.cpp:288:6:288:21 | madFieldToReturn |
|
||||
| tests.cpp:290:6:290:8 | val |
|
||||
| tests.cpp:293:7:293:7 | MyDerivedClass |
|
||||
| tests.cpp:293:7:293:7 | operator= |
|
||||
| tests.cpp:293:7:293:7 | operator= |
|
||||
| tests.cpp:293:7:293:20 | MyDerivedClass |
|
||||
| tests.cpp:295:6:295:28 | subtypeRemoteMadSource1 |
|
||||
| tests.cpp:296:6:296:21 | subtypeNonSource |
|
||||
| tests.cpp:297:6:297:28 | subtypeRemoteMadSource2 |
|
||||
| tests.cpp:300:9:300:15 | source2 |
|
||||
| tests.cpp:301:6:301:9 | sink |
|
||||
| tests.cpp:301:19:301:20 | mc |
|
||||
| tests.cpp:304:8:304:8 | operator= |
|
||||
| tests.cpp:304:8:304:8 | operator= |
|
||||
| tests.cpp:304:8:304:14 | MyClass |
|
||||
| tests.cpp:307:8:307:33 | namespaceMemberMadSinkArg0 |
|
||||
| tests.cpp:307:39:307:39 | x |
|
||||
| tests.cpp:308:15:308:46 | namespaceStaticMemberMadSinkArg0 |
|
||||
| tests.cpp:308:52:308:52 | x |
|
||||
| tests.cpp:309:7:309:31 | namespaceMemberMadSinkVar |
|
||||
| tests.cpp:310:14:310:44 | namespaceStaticMemberMadSinkVar |
|
||||
| tests.cpp:313:7:313:30 | namespaceMadSelfToReturn |
|
||||
| tests.cpp:317:22:317:28 | source3 |
|
||||
| tests.cpp:319:6:319:23 | test_class_members |
|
||||
| tests.cpp:320:10:320:11 | mc |
|
||||
| tests.cpp:320:14:320:16 | mc2 |
|
||||
| tests.cpp:320:19:320:21 | mc3 |
|
||||
| tests.cpp:320:24:320:26 | mc4 |
|
||||
| tests.cpp:320:29:320:31 | mc5 |
|
||||
| tests.cpp:320:34:320:36 | mc6 |
|
||||
| tests.cpp:320:39:320:41 | mc7 |
|
||||
| tests.cpp:320:44:320:46 | mc8 |
|
||||
| tests.cpp:320:49:320:51 | mc9 |
|
||||
| tests.cpp:320:54:320:57 | mc10 |
|
||||
| tests.cpp:320:60:320:63 | mc11 |
|
||||
| tests.cpp:321:11:321:13 | ptr |
|
||||
| tests.cpp:321:17:321:23 | mc4_ptr |
|
||||
| tests.cpp:322:17:322:19 | mdc |
|
||||
| tests.cpp:323:23:323:25 | mnc |
|
||||
| tests.cpp:323:28:323:31 | mnc2 |
|
||||
| tests.cpp:324:24:324:31 | mnc2_ptr |
|
||||
| tests.cpp:330:6:330:6 | a |
|
||||
| tests.cpp:429:8:429:8 | operator= |
|
||||
| tests.cpp:429:8:429:8 | operator= |
|
||||
| tests.cpp:429:8:429:14 | intPair |
|
||||
| tests.cpp:430:6:430:10 | first |
|
||||
| tests.cpp:431:6:431:11 | second |
|
||||
| tests.cpp:434:5:434:29 | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:434:37:434:43 | fun_ptr |
|
||||
| tests.cpp:435:9:435:38 | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:46:435:52 | fun_ptr |
|
||||
| tests.cpp:436:6:436:25 | madCallArg0WithValue |
|
||||
| tests.cpp:436:34:436:40 | fun_ptr |
|
||||
| tests.cpp:436:53:436:57 | value |
|
||||
| tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:437:45:437:51 | fun_ptr |
|
||||
| tests.cpp:437:64:437:68 | value |
|
||||
| tests.cpp:439:5:439:14 | getTainted |
|
||||
| tests.cpp:440:6:440:13 | useValue |
|
||||
| tests.cpp:440:19:440:19 | x |
|
||||
| tests.cpp:441:6:441:17 | dontUseValue |
|
||||
| tests.cpp:441:23:441:23 | x |
|
||||
| tests.cpp:443:6:443:27 | test_function_pointers |
|
||||
| tests.cpp:456:19:456:19 | X |
|
||||
| tests.cpp:457:8:457:35 | StructWithTypedefInParameter<X> |
|
||||
| tests.cpp:457:8:457:35 | StructWithTypedefInParameter<int> |
|
||||
| tests.cpp:458:12:458:15 | Type |
|
||||
| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:459:45:459:45 | x |
|
||||
| tests.cpp:459:45:459:45 | x |
|
||||
| tests.cpp:462:6:462:37 | test_parameter_ref_to_return_ref |
|
||||
| tests.cpp:463:6:463:6 | x |
|
||||
| tests.cpp:464:36:464:36 | s |
|
||||
| tests.cpp:465:6:465:6 | y |
|
||||
| tests.cpp:469:7:469:9 | INT |
|
||||
| tests.cpp:471:5:471:17 | receive_array |
|
||||
| tests.cpp:471:23:471:23 | a |
|
||||
| tests.cpp:473:6:473:23 | test_receive_array |
|
||||
| tests.cpp:474:6:474:6 | x |
|
||||
| tests.cpp:475:6:475:10 | array |
|
||||
| tests.cpp:476:6:476:6 | y |
|
||||
| tests.cpp:23:7:23:30 | namespace2LocalMadSource |
|
||||
| tests.cpp:26:6:26:19 | localMadSource |
|
||||
| tests.cpp:28:5:28:27 | namespaceLocalMadSource |
|
||||
| tests.cpp:30:6:30:17 | test_sources |
|
||||
| tests.cpp:45:6:45:6 | v |
|
||||
| tests.cpp:46:7:46:16 | v_indirect |
|
||||
| tests.cpp:47:6:47:13 | v_direct |
|
||||
| tests.cpp:58:6:58:6 | a |
|
||||
| tests.cpp:58:9:58:9 | b |
|
||||
| tests.cpp:58:12:58:12 | c |
|
||||
| tests.cpp:58:15:58:15 | d |
|
||||
| tests.cpp:67:6:67:6 | e |
|
||||
| tests.cpp:75:6:75:26 | remoteMadSourceParam0 |
|
||||
| tests.cpp:75:32:75:32 | x |
|
||||
| tests.cpp:82:6:82:16 | madSinkArg0 |
|
||||
| tests.cpp:82:22:82:22 | x |
|
||||
| tests.cpp:83:6:83:13 | notASink |
|
||||
| tests.cpp:83:19:83:19 | x |
|
||||
| tests.cpp:84:6:84:16 | madSinkArg1 |
|
||||
| tests.cpp:84:22:84:22 | x |
|
||||
| tests.cpp:84:29:84:29 | y |
|
||||
| tests.cpp:85:6:85:17 | madSinkArg01 |
|
||||
| tests.cpp:85:23:85:23 | x |
|
||||
| tests.cpp:85:30:85:30 | y |
|
||||
| tests.cpp:85:37:85:37 | z |
|
||||
| tests.cpp:86:6:86:17 | madSinkArg02 |
|
||||
| tests.cpp:86:23:86:23 | x |
|
||||
| tests.cpp:86:30:86:30 | y |
|
||||
| tests.cpp:86:37:86:37 | z |
|
||||
| tests.cpp:87:6:87:24 | madSinkIndirectArg0 |
|
||||
| tests.cpp:87:31:87:31 | x |
|
||||
| tests.cpp:88:6:88:30 | madSinkDoubleIndirectArg0 |
|
||||
| tests.cpp:88:38:88:38 | x |
|
||||
| tests.cpp:92:6:92:15 | test_sinks |
|
||||
| tests.cpp:106:6:106:6 | a |
|
||||
| tests.cpp:107:7:107:11 | a_ptr |
|
||||
| tests.cpp:115:6:115:18 | madSinkParam0 |
|
||||
| tests.cpp:115:24:115:24 | x |
|
||||
| tests.cpp:121:8:121:8 | operator= |
|
||||
| tests.cpp:121:8:121:8 | operator= |
|
||||
| tests.cpp:121:8:121:18 | MyContainer |
|
||||
| tests.cpp:122:6:122:10 | value |
|
||||
| tests.cpp:123:6:123:11 | value2 |
|
||||
| tests.cpp:124:7:124:9 | ptr |
|
||||
| tests.cpp:127:5:127:19 | madArg0ToReturn |
|
||||
| tests.cpp:127:25:127:25 | x |
|
||||
| tests.cpp:128:6:128:28 | madArg0ToReturnIndirect |
|
||||
| tests.cpp:128:34:128:34 | x |
|
||||
| tests.cpp:129:5:129:15 | notASummary |
|
||||
| tests.cpp:129:21:129:21 | x |
|
||||
| tests.cpp:130:5:130:28 | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:130:34:130:34 | x |
|
||||
| tests.cpp:131:5:131:27 | madArg0IndirectToReturn |
|
||||
| tests.cpp:131:34:131:34 | x |
|
||||
| tests.cpp:132:5:132:33 | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:132:41:132:41 | x |
|
||||
| tests.cpp:133:5:133:30 | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:133:37:133:37 | x |
|
||||
| tests.cpp:134:6:134:26 | madArg0ToArg1Indirect |
|
||||
| tests.cpp:134:32:134:32 | x |
|
||||
| tests.cpp:134:40:134:40 | y |
|
||||
| tests.cpp:135:6:135:34 | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:135:47:135:47 | x |
|
||||
| tests.cpp:135:55:135:55 | y |
|
||||
| tests.cpp:136:5:136:18 | madArgsComplex |
|
||||
| tests.cpp:136:25:136:25 | a |
|
||||
| tests.cpp:136:33:136:33 | b |
|
||||
| tests.cpp:136:40:136:40 | c |
|
||||
| tests.cpp:136:47:136:47 | d |
|
||||
| tests.cpp:137:5:137:14 | madArgsAny |
|
||||
| tests.cpp:137:20:137:20 | a |
|
||||
| tests.cpp:137:28:137:28 | b |
|
||||
| tests.cpp:138:5:138:28 | madAndImplementedComplex |
|
||||
| tests.cpp:138:34:138:34 | a |
|
||||
| tests.cpp:138:41:138:41 | b |
|
||||
| tests.cpp:138:48:138:48 | c |
|
||||
| tests.cpp:143:5:143:24 | madArg0FieldToReturn |
|
||||
| tests.cpp:143:38:143:39 | mc |
|
||||
| tests.cpp:144:5:144:32 | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:144:47:144:48 | mc |
|
||||
| tests.cpp:145:5:145:32 | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:145:46:145:47 | mc |
|
||||
| tests.cpp:146:13:146:32 | madArg0ToReturnField |
|
||||
| tests.cpp:146:38:146:38 | x |
|
||||
| tests.cpp:147:14:147:41 | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:147:47:147:47 | x |
|
||||
| tests.cpp:148:13:148:40 | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:148:46:148:46 | x |
|
||||
| tests.cpp:150:6:150:19 | test_summaries |
|
||||
| tests.cpp:153:6:153:6 | a |
|
||||
| tests.cpp:153:9:153:9 | b |
|
||||
| tests.cpp:153:12:153:12 | c |
|
||||
| tests.cpp:153:15:153:15 | d |
|
||||
| tests.cpp:153:18:153:18 | e |
|
||||
| tests.cpp:154:7:154:11 | a_ptr |
|
||||
| tests.cpp:197:14:197:16 | mc1 |
|
||||
| tests.cpp:197:19:197:21 | mc2 |
|
||||
| tests.cpp:216:15:216:18 | rtn1 |
|
||||
| tests.cpp:219:14:219:17 | rtn2 |
|
||||
| tests.cpp:220:7:220:14 | rtn2_ptr |
|
||||
| tests.cpp:233:7:233:7 | operator= |
|
||||
| tests.cpp:233:7:233:7 | operator= |
|
||||
| tests.cpp:233:7:233:13 | MyClass |
|
||||
| tests.cpp:236:6:236:26 | memberRemoteMadSource |
|
||||
| tests.cpp:237:7:237:39 | memberRemoteMadSourceIndirectArg0 |
|
||||
| tests.cpp:237:46:237:46 | x |
|
||||
| tests.cpp:239:7:239:21 | qualifierSource |
|
||||
| tests.cpp:240:7:240:26 | qualifierFieldSource |
|
||||
| tests.cpp:243:7:243:23 | memberMadSinkArg0 |
|
||||
| tests.cpp:243:29:243:29 | x |
|
||||
| tests.cpp:245:7:245:19 | qualifierSink |
|
||||
| tests.cpp:246:7:246:23 | qualifierArg0Sink |
|
||||
| tests.cpp:246:29:246:29 | x |
|
||||
| tests.cpp:247:7:247:24 | qualifierFieldSink |
|
||||
| tests.cpp:250:7:250:19 | madArg0ToSelf |
|
||||
| tests.cpp:250:25:250:25 | x |
|
||||
| tests.cpp:251:6:251:20 | madSelfToReturn |
|
||||
| tests.cpp:252:6:252:16 | notASummary |
|
||||
| tests.cpp:253:7:253:20 | madArg0ToField |
|
||||
| tests.cpp:253:26:253:26 | x |
|
||||
| tests.cpp:254:6:254:21 | madFieldToReturn |
|
||||
| tests.cpp:256:6:256:8 | val |
|
||||
| tests.cpp:259:7:259:7 | MyDerivedClass |
|
||||
| tests.cpp:259:7:259:7 | operator= |
|
||||
| tests.cpp:259:7:259:7 | operator= |
|
||||
| tests.cpp:259:7:259:20 | MyDerivedClass |
|
||||
| tests.cpp:261:6:261:28 | subtypeRemoteMadSource1 |
|
||||
| tests.cpp:262:6:262:21 | subtypeNonSource |
|
||||
| tests.cpp:263:6:263:28 | subtypeRemoteMadSource2 |
|
||||
| tests.cpp:266:9:266:15 | source2 |
|
||||
| tests.cpp:267:6:267:9 | sink |
|
||||
| tests.cpp:267:19:267:20 | mc |
|
||||
| tests.cpp:270:8:270:8 | operator= |
|
||||
| tests.cpp:270:8:270:8 | operator= |
|
||||
| tests.cpp:270:8:270:14 | MyClass |
|
||||
| tests.cpp:273:8:273:33 | namespaceMemberMadSinkArg0 |
|
||||
| tests.cpp:273:39:273:39 | x |
|
||||
| tests.cpp:274:15:274:46 | namespaceStaticMemberMadSinkArg0 |
|
||||
| tests.cpp:274:52:274:52 | x |
|
||||
| tests.cpp:277:7:277:30 | namespaceMadSelfToReturn |
|
||||
| tests.cpp:281:22:281:28 | source3 |
|
||||
| tests.cpp:283:6:283:23 | test_class_members |
|
||||
| tests.cpp:284:10:284:11 | mc |
|
||||
| tests.cpp:284:14:284:16 | mc2 |
|
||||
| tests.cpp:284:19:284:21 | mc3 |
|
||||
| tests.cpp:284:24:284:26 | mc4 |
|
||||
| tests.cpp:284:29:284:31 | mc5 |
|
||||
| tests.cpp:284:34:284:36 | mc6 |
|
||||
| tests.cpp:284:39:284:41 | mc7 |
|
||||
| tests.cpp:284:44:284:46 | mc8 |
|
||||
| tests.cpp:284:49:284:51 | mc9 |
|
||||
| tests.cpp:284:54:284:57 | mc10 |
|
||||
| tests.cpp:284:60:284:63 | mc11 |
|
||||
| tests.cpp:285:11:285:13 | ptr |
|
||||
| tests.cpp:285:17:285:23 | mc4_ptr |
|
||||
| tests.cpp:286:17:286:19 | mdc |
|
||||
| tests.cpp:287:23:287:25 | mnc |
|
||||
| tests.cpp:287:28:287:31 | mnc2 |
|
||||
| tests.cpp:288:24:288:31 | mnc2_ptr |
|
||||
| tests.cpp:294:6:294:6 | a |
|
||||
| tests.cpp:387:8:387:8 | operator= |
|
||||
| tests.cpp:387:8:387:8 | operator= |
|
||||
| tests.cpp:387:8:387:14 | intPair |
|
||||
| tests.cpp:388:6:388:10 | first |
|
||||
| tests.cpp:389:6:389:11 | second |
|
||||
| tests.cpp:392:5:392:29 | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:392:37:392:43 | fun_ptr |
|
||||
| tests.cpp:393:9:393:38 | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:46:393:52 | fun_ptr |
|
||||
| tests.cpp:394:6:394:25 | madCallArg0WithValue |
|
||||
| tests.cpp:394:34:394:40 | fun_ptr |
|
||||
| tests.cpp:394:53:394:57 | value |
|
||||
| tests.cpp:395:5:395:36 | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:395:45:395:51 | fun_ptr |
|
||||
| tests.cpp:395:64:395:68 | value |
|
||||
| tests.cpp:397:5:397:14 | getTainted |
|
||||
| tests.cpp:398:6:398:13 | useValue |
|
||||
| tests.cpp:398:19:398:19 | x |
|
||||
| tests.cpp:399:6:399:17 | dontUseValue |
|
||||
| tests.cpp:399:23:399:23 | x |
|
||||
| tests.cpp:401:6:401:27 | test_function_pointers |
|
||||
| tests.cpp:414:19:414:19 | X |
|
||||
| tests.cpp:415:8:415:35 | StructWithTypedefInParameter<X> |
|
||||
| tests.cpp:415:8:415:35 | StructWithTypedefInParameter<int> |
|
||||
| tests.cpp:416:12:416:15 | Type |
|
||||
| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
|
||||
| tests.cpp:417:45:417:45 | x |
|
||||
| tests.cpp:417:45:417:45 | x |
|
||||
| tests.cpp:420:6:420:37 | test_parameter_ref_to_return_ref |
|
||||
| tests.cpp:421:6:421:6 | x |
|
||||
| tests.cpp:422:36:422:36 | s |
|
||||
| tests.cpp:423:6:423:6 | y |
|
||||
| tests.cpp:427:7:427:9 | INT |
|
||||
| tests.cpp:429:5:429:17 | receive_array |
|
||||
| tests.cpp:429:23:429:23 | a |
|
||||
| tests.cpp:431:6:431:23 | test_receive_array |
|
||||
| tests.cpp:432:6:432:6 | x |
|
||||
| tests.cpp:433:6:433:10 | array |
|
||||
| tests.cpp:434:6:434:6 | y |
|
||||
flowSummaryNode
|
||||
| tests.cpp:144:5:144:19 | [summary param] 0 in madArg0ToReturn | ParameterNode | madArg0ToReturn | madArg0ToReturn |
|
||||
| tests.cpp:144:5:144:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn |
|
||||
| tests.cpp:145:6:145:28 | [summary param] 0 in madArg0ToReturnIndirect | ParameterNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
|
||||
| tests.cpp:145:6:145:28 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
|
||||
| tests.cpp:147:5:147:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:147:5:147:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:148:5:148:27 | [summary param] *0 in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
|
||||
| tests.cpp:148:5:148:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
|
||||
| tests.cpp:149:5:149:33 | [summary param] **0 in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:149:5:149:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:150:5:150:30 | [summary param] 0 in madArg0NotIndirectToReturn | ParameterNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:150:5:150:30 | [summary] to write: ReturnValue in madArg0NotIndirectToReturn | ReturnNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:151:6:151:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:151:6:151:26 | [summary param] *1 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:151:6:151:26 | [summary] to write: Argument[*1] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:152:6:152:34 | [summary param] *0 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:152:6:152:34 | [summary param] *1 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:152:6:152:34 | [summary] to write: Argument[*1] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:153:5:153:18 | [summary param] 2 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:153:5:153:18 | [summary param] *0 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:153:5:153:18 | [summary param] *1 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:153:5:153:18 | [summary] to write: ReturnValue in madArgsComplex | ReturnNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:155:5:155:28 | [summary param] 2 in madAndImplementedComplex | ParameterNode | madAndImplementedComplex | madAndImplementedComplex |
|
||||
| tests.cpp:155:5:155:28 | [summary] to write: ReturnValue in madAndImplementedComplex | ReturnNode | madAndImplementedComplex | madAndImplementedComplex |
|
||||
| tests.cpp:160:5:160:24 | [summary param] 0 in madArg0FieldToReturn | ParameterNode | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:160:5:160:24 | [summary] read: Argument[0].Field[MyContainer::value]/Field[value] in madArg0FieldToReturn | | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:160:5:160:24 | [summary] to write: ReturnValue in madArg0FieldToReturn | ReturnNode | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:161:5:161:32 | [summary param] *0 in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:161:5:161:32 | [summary] read: Argument[*0].Field[MyContainer::value]/Field[value] in madArg0IndirectFieldToReturn | | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:161:5:161:32 | [summary] to write: ReturnValue in madArg0IndirectFieldToReturn | ReturnNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:162:5:162:32 | [summary param] 0 in madArg0FieldIndirectToReturn | ParameterNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:162:5:162:32 | [summary] read: Argument[0].Field[*MyContainer::ptr]/Field[*ptr] in madArg0FieldIndirectToReturn | | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:162:5:162:32 | [summary] to write: ReturnValue in madArg0FieldIndirectToReturn | ReturnNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:163:13:163:32 | [summary param] 0 in madArg0ToReturnField | ParameterNode | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:163:13:163:32 | [summary] to write: ReturnValue in madArg0ToReturnField | ReturnNode | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:163:13:163:32 | [summary] to write: ReturnValue.Field[MyContainer::value]/Field[value] in madArg0ToReturnField | | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:164:14:164:41 | [summary param] 0 in madArg0ToReturnIndirectField | ParameterNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:164:14:164:41 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirectField | ReturnNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:164:14:164:41 | [summary] to write: ReturnValue[*].Field[MyContainer::value]/Field[value] in madArg0ToReturnIndirectField | | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:165:13:165:40 | [summary param] 0 in madArg0ToReturnFieldIndirect | ParameterNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue.Field[*MyContainer::ptr]/Field[*ptr] in madArg0ToReturnFieldIndirect | | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:284:7:284:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:284:7:284:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:284:7:284:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:285:6:285:20 | [summary param] this in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
|
||||
| tests.cpp:285:6:285:20 | [summary] to write: ReturnValue in madSelfToReturn | ReturnNode | madSelfToReturn | madSelfToReturn |
|
||||
| tests.cpp:287:7:287:20 | [summary param] 0 in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:287:7:287:20 | [summary param] this in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this].Field[MyClass::val]/Field[val] in madArg0ToField | | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:288:6:288:21 | [summary param] this in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:288:6:288:21 | [summary] read: Argument[this].Field[MyClass::val]/Field[val] in madFieldToReturn | | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:288:6:288:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:313:7:313:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
|
||||
| tests.cpp:313:7:313:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
|
||||
| tests.cpp:434:5:434:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:434:5:434:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:434:5:434:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:434:5:434:29 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:434:5:434:29 | [summary] to write: ReturnValue in madCallArg0ReturnToReturn | ReturnNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:435:9:435:38 | [summary param] 0 in madCallArg0ReturnToReturnFirst | ParameterNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:9:435:38 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:9:435:38 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturnFirst | OutNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:9:435:38 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue in madCallArg0ReturnToReturnFirst | ReturnNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue.Field[first]/Field[intPair::first] in madCallArg0ReturnToReturnFirst | | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:436:6:436:25 | [summary param] 0 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary param] 1 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[0] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[0] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:436:6:436:25 | [summary] to write: Argument[1] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:437:5:437:36 | [summary param] 1 in madCallReturnValueIgnoreFunction | ParameterNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:437:5:437:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:459:5:459:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
|
||||
| tests.cpp:459:5:459:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
|
||||
| tests.cpp:471:5:471:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array |
|
||||
| tests.cpp:471:5:471:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array |
|
||||
| tests.cpp:127:5:127:19 | [summary param] 0 in madArg0ToReturn | ParameterNode | madArg0ToReturn | madArg0ToReturn |
|
||||
| tests.cpp:127:5:127:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn |
|
||||
| tests.cpp:128:6:128:28 | [summary param] 0 in madArg0ToReturnIndirect | ParameterNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
|
||||
| tests.cpp:128:6:128:28 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
|
||||
| tests.cpp:130:5:130:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:130:5:130:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
|
||||
| tests.cpp:131:5:131:27 | [summary param] *0 in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
|
||||
| tests.cpp:131:5:131:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
|
||||
| tests.cpp:132:5:132:33 | [summary param] **0 in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:132:5:132:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
|
||||
| tests.cpp:133:5:133:30 | [summary param] 0 in madArg0NotIndirectToReturn | ParameterNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:133:5:133:30 | [summary] to write: ReturnValue in madArg0NotIndirectToReturn | ReturnNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
|
||||
| tests.cpp:134:6:134:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:134:6:134:26 | [summary param] *1 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:134:6:134:26 | [summary] to write: Argument[*1] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
|
||||
| tests.cpp:135:6:135:34 | [summary param] *0 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:135:6:135:34 | [summary param] *1 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:135:6:135:34 | [summary] to write: Argument[*1] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
|
||||
| tests.cpp:136:5:136:18 | [summary param] 2 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:136:5:136:18 | [summary param] *0 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:136:5:136:18 | [summary param] *1 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:136:5:136:18 | [summary] to write: ReturnValue in madArgsComplex | ReturnNode | madArgsComplex | madArgsComplex |
|
||||
| tests.cpp:138:5:138:28 | [summary param] 2 in madAndImplementedComplex | ParameterNode | madAndImplementedComplex | madAndImplementedComplex |
|
||||
| tests.cpp:138:5:138:28 | [summary] to write: ReturnValue in madAndImplementedComplex | ReturnNode | madAndImplementedComplex | madAndImplementedComplex |
|
||||
| tests.cpp:143:5:143:24 | [summary param] 0 in madArg0FieldToReturn | ParameterNode | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:143:5:143:24 | [summary] read: Argument[0].Field[MyContainer::value]/Field[value] in madArg0FieldToReturn | | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:143:5:143:24 | [summary] to write: ReturnValue in madArg0FieldToReturn | ReturnNode | madArg0FieldToReturn | madArg0FieldToReturn |
|
||||
| tests.cpp:144:5:144:32 | [summary param] *0 in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:144:5:144:32 | [summary] read: Argument[*0].Field[MyContainer::value]/Field[value] in madArg0IndirectFieldToReturn | | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:144:5:144:32 | [summary] to write: ReturnValue in madArg0IndirectFieldToReturn | ReturnNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
|
||||
| tests.cpp:145:5:145:32 | [summary param] 0 in madArg0FieldIndirectToReturn | ParameterNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:145:5:145:32 | [summary] read: Argument[0].Field[*MyContainer::ptr]/Field[*ptr] in madArg0FieldIndirectToReturn | | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:145:5:145:32 | [summary] to write: ReturnValue in madArg0FieldIndirectToReturn | ReturnNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
|
||||
| tests.cpp:146:13:146:32 | [summary param] 0 in madArg0ToReturnField | ParameterNode | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:146:13:146:32 | [summary] to write: ReturnValue in madArg0ToReturnField | ReturnNode | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:146:13:146:32 | [summary] to write: ReturnValue.Field[MyContainer::value]/Field[value] in madArg0ToReturnField | | madArg0ToReturnField | madArg0ToReturnField |
|
||||
| tests.cpp:147:14:147:41 | [summary param] 0 in madArg0ToReturnIndirectField | ParameterNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:147:14:147:41 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirectField | ReturnNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:147:14:147:41 | [summary] to write: ReturnValue[*].Field[MyContainer::value]/Field[value] in madArg0ToReturnIndirectField | | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
|
||||
| tests.cpp:148:13:148:40 | [summary param] 0 in madArg0ToReturnFieldIndirect | ParameterNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:148:13:148:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:148:13:148:40 | [summary] to write: ReturnValue.Field[*MyContainer::ptr]/Field[*ptr] in madArg0ToReturnFieldIndirect | | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
|
||||
| tests.cpp:250:7:250:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:250:7:250:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:250:7:250:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
|
||||
| tests.cpp:251:6:251:20 | [summary param] this in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
|
||||
| tests.cpp:251:6:251:20 | [summary] to write: ReturnValue in madSelfToReturn | ReturnNode | madSelfToReturn | madSelfToReturn |
|
||||
| tests.cpp:253:7:253:20 | [summary param] 0 in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:253:7:253:20 | [summary param] this in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:253:7:253:20 | [summary] to write: Argument[this] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:253:7:253:20 | [summary] to write: Argument[this].Field[MyClass::val]/Field[val] in madArg0ToField | | madArg0ToField | madArg0ToField |
|
||||
| tests.cpp:254:6:254:21 | [summary param] this in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:254:6:254:21 | [summary] read: Argument[this].Field[MyClass::val]/Field[val] in madFieldToReturn | | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:254:6:254:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn |
|
||||
| tests.cpp:277:7:277:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
|
||||
| tests.cpp:277:7:277:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
|
||||
| tests.cpp:392:5:392:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:392:5:392:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:392:5:392:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:392:5:392:29 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:392:5:392:29 | [summary] to write: ReturnValue in madCallArg0ReturnToReturn | ReturnNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
|
||||
| tests.cpp:393:9:393:38 | [summary param] 0 in madCallArg0ReturnToReturnFirst | ParameterNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:9:393:38 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:9:393:38 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturnFirst | OutNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:9:393:38 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:9:393:38 | [summary] to write: ReturnValue in madCallArg0ReturnToReturnFirst | ReturnNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:393:9:393:38 | [summary] to write: ReturnValue.Field[first]/Field[intPair::first] in madCallArg0ReturnToReturnFirst | | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
|
||||
| tests.cpp:394:6:394:25 | [summary param] 0 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary param] 1 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary] read: Argument[0].Parameter[0] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary] to write: Argument[0].Parameter[0] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:394:6:394:25 | [summary] to write: Argument[1] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
|
||||
| tests.cpp:395:5:395:36 | [summary param] 1 in madCallReturnValueIgnoreFunction | ParameterNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:395:5:395:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
|
||||
| tests.cpp:417:5:417:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
|
||||
| tests.cpp:417:5:417:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
|
||||
| tests.cpp:429:5:429:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array |
|
||||
| tests.cpp:429:5:429:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array |
|
||||
|
||||
@@ -11,15 +11,12 @@ extensions:
|
||||
- ["", "", False, "remoteMadSourceDoubleIndirect", "", "", "ReturnValue[**]", "remote", "manual"]
|
||||
- ["", "", False, "remoteMadSourceIndirectArg0", "", "", "Argument[*0]", "remote", "manual"]
|
||||
- ["", "", False, "remoteMadSourceIndirectArg1", "", "", "Argument[*1]", "remote", "manual"]
|
||||
- ["", "", False, "remoteMadSourceVar", "", "", "", "remote", "manual"]
|
||||
- ["", "", False, "remoteMadSourceVarIndirect", "", "", "*", "remote", "manual"] # we can't express this source/sink correctly at present, "*" is not a valid access path
|
||||
- ["", "", False, "remoteMadSourceParam0", "", "", "Parameter[0]", "remote", "manual"]
|
||||
- ["MyNamespace", "", False, "namespaceLocalMadSource", "", "", "ReturnValue", "local", "manual"]
|
||||
- ["MyNamespace", "", False, "namespaceLocalMadSourceVar", "", "", "", "local", "manual"]
|
||||
- ["MyNamespace::MyNamespace2", "", False, "namespace2LocalMadSource", "", "", "ReturnValue", "local", "manual"]
|
||||
- ["", "MyClass", True, "memberRemoteMadSource", "", "", "ReturnValue", "remote", "manual"]
|
||||
- ["", "MyClass", True, "memberRemoteMadSourceIndirectArg0", "", "", "Argument[*0]", "remote", "manual"]
|
||||
- ["", "MyClass", True, "memberRemoteMadSourceVar", "", "", "", "remote", "manual"]
|
||||
- ["", "MyClass", True, "subtypeRemoteMadSource1", "", "", "ReturnValue", "remote", "manual"]
|
||||
- ["", "MyClass", False, "subtypeNonSource", "", "", "ReturnValue", "remote", "manual"] # the tests define this in MyDerivedClass, so it should *not* be recongized as a source
|
||||
- ["", "MyClass", True, "qualifierSource", "", "", "Argument[-1]", "remote", "manual"]
|
||||
@@ -35,18 +32,13 @@ extensions:
|
||||
- ["", "", False, "madSinkArg02", "", "", "Argument[0,2]", "test-sink", "manual"]
|
||||
- ["", "", False, "madSinkIndirectArg0", "", "", "Argument[*0]", "test-sink", "manual"]
|
||||
- ["", "", False, "madSinkDoubleIndirectArg0", "", "", "Argument[**0]", "test-sink", "manual"]
|
||||
- ["", "", False, "madSinkVar", "", "", "", "test-sink", "manual"]
|
||||
- ["", "", False, "madSinkVarIndirect", "", "", "*", "test-sink", "manual"] # we can't express this source/sink correctly at present, "*" is not a valid access path
|
||||
- ["", "", False, "madSinkParam0", "", "", "Parameter[0]", "test-sink", "manual"]
|
||||
- ["", "MyClass", True, "memberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
|
||||
- ["", "MyClass", True, "memberMadSinkVar", "", "", "", "test-sink", "manual"]
|
||||
- ["", "MyClass", True, "qualifierSink", "", "", "Argument[-1]", "test-sink", "manual"]
|
||||
- ["", "MyClass", True, "qualifierArg0Sink", "", "", "Argument[-1..0]", "test-sink", "manual"]
|
||||
- ["", "MyClass", True, "qualifierFieldSink", "", "", "Argument[-1].val", "test-sink", "manual"]
|
||||
- ["MyNamespace", "MyClass", True, "namespaceMemberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
|
||||
- ["MyNamespace", "MyClass", True, "namespaceStaticMemberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
|
||||
- ["MyNamespace", "MyClass", True, "namespaceMemberMadSinkVar", "", "", "", "test-sink", "manual"]
|
||||
- ["MyNamespace", "MyClass", True, "namespaceStaticMemberMadSinkVar", "", "", "", "test-sink", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/cpp-all
|
||||
extensible: summaryModel
|
||||
@@ -68,9 +60,6 @@ extensions:
|
||||
- ["", "", False, "madArg0ToReturnField", "", "", "Argument[0]", "ReturnValue.Field[value]", "taint", "manual"]
|
||||
- ["", "", False, "madArg0ToReturnIndirectField", "", "", "Argument[0]", "ReturnValue[*].Field[value]", "taint", "manual"]
|
||||
- ["", "", False, "madArg0ToReturnFieldIndirect", "", "", "Argument[0]", "ReturnValue.Field[*ptr]", "taint", "manual"]
|
||||
- ["", "", False, "madFieldToFieldVar", "", "", "Field[value]", "Field[value2]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[value2]" is not a valid output
|
||||
- ["", "", False, "madFieldToIndirectFieldVar", "", "", "Field[value]", "Field[*ptr]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[*ptr]" is not a valid output
|
||||
- ["", "", False, "madIndirectFieldToFieldVar", "", "", "Field[value]", "Field[value2]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[value2]" is not a valid output
|
||||
- ["", "MyClass", True, "madArg0ToSelf", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
|
||||
- ["", "MyClass", True, "madSelfToReturn", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
|
||||
- ["", "MyClass", True, "madArg0ToField", "", "", "Argument[0]", "Argument[-1].Field[val]", "taint", "manual"]
|
||||
|
||||
@@ -17,13 +17,8 @@ int *remoteMadSourceIndirect(); // $ interpretElement
|
||||
int **remoteMadSourceDoubleIndirect(); // $ interpretElement
|
||||
void remoteMadSourceIndirectArg0(int *x, int *y); // $ interpretElement
|
||||
void remoteMadSourceIndirectArg1(int &x, int &y); // $ interpretElement
|
||||
int remoteMadSourceVar; // $ interpretElement
|
||||
int *remoteMadSourceVarIndirect; // $ interpretElement
|
||||
|
||||
namespace MyNamespace {
|
||||
int namespaceLocalMadSource(); // $ interpretElement
|
||||
int namespaceLocalMadSourceVar; // $ interpretElement
|
||||
|
||||
namespace MyNamespace2 {
|
||||
int namespace2LocalMadSource(); // $ interpretElement
|
||||
}
|
||||
@@ -69,14 +64,9 @@ void test_sources() {
|
||||
sink(c);
|
||||
sink(d); // $ ir
|
||||
|
||||
sink(remoteMadSourceVar); // $ ir
|
||||
sink(*remoteMadSourceVarIndirect); // $ MISSING: ir
|
||||
|
||||
int e = localMadSource();
|
||||
sink(e); // $ ir
|
||||
|
||||
sink(MyNamespace::namespaceLocalMadSource()); // $ ir
|
||||
sink(MyNamespace::namespaceLocalMadSourceVar); // $ ir
|
||||
|
||||
sink(MyNamespace::MyNamespace2::namespace2LocalMadSource()); // $ ir
|
||||
sink(MyNamespace::localMadSource()); // $ (the MyNamespace version of this function is not a source)
|
||||
sink(namespaceLocalMadSource()); // (the global namespace version of this function is not a source)
|
||||
@@ -96,8 +86,8 @@ void madSinkArg01(int x, int y, int z); // $ interpretElement
|
||||
void madSinkArg02(int x, int y, int z); // $ interpretElement
|
||||
void madSinkIndirectArg0(int *x); // $ interpretElement
|
||||
void madSinkDoubleIndirectArg0(int **x); // $ interpretElement
|
||||
int madSinkVar; // $ interpretElement
|
||||
int *madSinkVarIndirect; // $ interpretElement
|
||||
|
||||
|
||||
|
||||
void test_sinks() {
|
||||
// test sinks
|
||||
@@ -118,15 +108,8 @@ void test_sinks() {
|
||||
madSinkIndirectArg0(&a); // $ ir
|
||||
madSinkIndirectArg0(a_ptr); // $ ir
|
||||
madSinkDoubleIndirectArg0(&a_ptr); // $ ir
|
||||
|
||||
madSinkVar = source(); // $ ir
|
||||
|
||||
// test sources + sinks together
|
||||
|
||||
madSinkArg0(localMadSource()); // $ ir
|
||||
madSinkIndirectArg0(remoteMadSourceIndirect()); // $ ir
|
||||
madSinkVar = remoteMadSourceVar; // $ ir
|
||||
*madSinkVarIndirect = remoteMadSourceVar; // $ MISSING: ir
|
||||
}
|
||||
|
||||
void madSinkParam0(int x) { // $ interpretElement
|
||||
@@ -164,10 +147,6 @@ MyContainer madArg0ToReturnField(int x); // $ interpretElement
|
||||
MyContainer *madArg0ToReturnIndirectField(int x); // $ interpretElement
|
||||
MyContainer madArg0ToReturnFieldIndirect(int x); // $ interpretElement
|
||||
|
||||
MyContainer madFieldToFieldVar; // $ interpretElement
|
||||
MyContainer madFieldToIndirectFieldVar; // $ interpretElement
|
||||
MyContainer *madIndirectFieldToFieldVar; // $ interpretElement
|
||||
|
||||
void test_summaries() {
|
||||
// test summaries
|
||||
|
||||
@@ -241,19 +220,6 @@ void test_summaries() {
|
||||
int *rtn2_ptr = rtn2.ptr;
|
||||
sink(*rtn2_ptr); // $ ir
|
||||
|
||||
// test global variable summaries
|
||||
|
||||
madFieldToFieldVar.value = source();
|
||||
sink(madFieldToFieldVar.value2); // $ MISSING: ir
|
||||
|
||||
madFieldToIndirectFieldVar.value = source();
|
||||
sink(madFieldToIndirectFieldVar.ptr);
|
||||
sink(*(madFieldToIndirectFieldVar.ptr)); // $ MISSING: ir
|
||||
|
||||
madIndirectFieldToFieldVar->value = source();
|
||||
sink((*madIndirectFieldToFieldVar).value2); // $ MISSING: ir
|
||||
sink(madIndirectFieldToFieldVar->value2); // $ MISSING: ir
|
||||
|
||||
// test source + sinks + summaries together
|
||||
|
||||
madSinkArg0(madArg0ToReturn(remoteMadSource())); // $ ir
|
||||
@@ -269,13 +235,13 @@ public:
|
||||
// sources
|
||||
int memberRemoteMadSource(); // $ interpretElement
|
||||
void memberRemoteMadSourceIndirectArg0(int *x); // $ interpretElement
|
||||
int memberRemoteMadSourceVar; // $ interpretElement
|
||||
|
||||
void qualifierSource(); // $ interpretElement
|
||||
void qualifierFieldSource(); // $ interpretElement
|
||||
|
||||
// sinks
|
||||
void memberMadSinkArg0(int x); // $ interpretElement
|
||||
int memberMadSinkVar; // $ interpretElement
|
||||
|
||||
void qualifierSink(); // $ interpretElement
|
||||
void qualifierArg0Sink(int x); // $ interpretElement
|
||||
void qualifierFieldSink(); // $ interpretElement
|
||||
@@ -306,8 +272,6 @@ namespace MyNamespace {
|
||||
// sinks
|
||||
void namespaceMemberMadSinkArg0(int x); // $ interpretElement
|
||||
static void namespaceStaticMemberMadSinkArg0(int x); // $ interpretElement
|
||||
int namespaceMemberMadSinkVar; // $ interpretElement
|
||||
static int namespaceStaticMemberMadSinkVar; // $ interpretElement
|
||||
|
||||
// summaries
|
||||
int namespaceMadSelfToReturn(); // $ interpretElement
|
||||
@@ -331,8 +295,6 @@ void test_class_members() {
|
||||
mc.memberRemoteMadSourceIndirectArg0(&a);
|
||||
sink(a); // $ ir
|
||||
|
||||
sink(mc.memberRemoteMadSourceVar); // $ ir
|
||||
|
||||
// test subtype sources
|
||||
|
||||
sink(mdc.memberRemoteMadSource()); // $ ir
|
||||
@@ -344,12 +306,8 @@ void test_class_members() {
|
||||
|
||||
mc.memberMadSinkArg0(source()); // $ ir
|
||||
|
||||
mc.memberMadSinkVar = source(); // $ ir
|
||||
|
||||
mnc.namespaceMemberMadSinkArg0(source()); // $ ir
|
||||
MyNamespace::MyClass::namespaceStaticMemberMadSinkArg0(source()); // $ ir
|
||||
mnc.namespaceMemberMadSinkVar = source(); // $ ir
|
||||
MyNamespace::MyClass::namespaceStaticMemberMadSinkVar = source(); // $ ir
|
||||
|
||||
// test class member summaries
|
||||
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
class Program
|
||||
{
|
||||
static void Main() {}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
|
||||
<PropertyGroup>
|
||||
<OutputType>Exe</OutputType>
|
||||
<TargetFramework>net9.0</TargetFramework>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
|
||||
</Project>
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"sdk": {
|
||||
"version": "9.0.201"
|
||||
}
|
||||
}
|
||||
8
csharp/ql/integration-tests/windows/subst/file.expected
Normal file
8
csharp/ql/integration-tests/windows/subst/file.expected
Normal file
@@ -0,0 +1,8 @@
|
||||
| code/Program.cs:0:0:0:0 | code/Program.cs | |
|
||||
| code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs | |
|
||||
| code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs | |
|
||||
| code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs | |
|
||||
| code/obj/Debug/net9.0/dotnet_build.dll:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.dll | |
|
||||
| file://:0:0:0:0 | | |
|
||||
| file://Z:/dotnet_build.csproj:0:0:0:0 | Z:/dotnet_build.csproj | relative |
|
||||
| file://Z:/obj/dotnet_build.csproj.nuget.g.props:0:0:0:0 | Z:/obj/dotnet_build.csproj.nuget.g.props | relative |
|
||||
7
csharp/ql/integration-tests/windows/subst/file.ql
Normal file
7
csharp/ql/integration-tests/windows/subst/file.ql
Normal file
@@ -0,0 +1,7 @@
|
||||
import csharp
|
||||
|
||||
from File f, string relative
|
||||
where
|
||||
not f.getURL().matches("file://C:/Program Files/%") and
|
||||
if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
csharp/ql/integration-tests/windows/subst/test.py
Normal file
7
csharp/ql/integration-tests/windows/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, csharp, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(source_root=drive)
|
||||
@@ -56,9 +56,19 @@ codeql_pkg_files(
|
||||
prefix = "tools/{CODEQL_PLATFORM}",
|
||||
)
|
||||
|
||||
codeql_pkg_files(
|
||||
name = "canonicalize-dll",
|
||||
srcs = select({
|
||||
"@platforms//os:windows": ["//shared/canonicalize:pkg"],
|
||||
"//conditions:default": [],
|
||||
}),
|
||||
prefix = "tools/{CODEQL_PLATFORM}",
|
||||
)
|
||||
|
||||
codeql_pack(
|
||||
name = "go",
|
||||
srcs = [
|
||||
":canonicalize-dll",
|
||||
":extractor-pack-arch",
|
||||
":resources",
|
||||
"//go/codeql-tools",
|
||||
|
||||
@@ -123,7 +123,7 @@ k8s.io/api/core,,,10,,,,,,,,,,,,,,,,,,,,,,,10,
|
||||
k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,,,,,,,,47,
|
||||
k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,,,,,,,,
|
||||
launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,,,,,,
|
||||
log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,
|
||||
log,43,,16,,,,43,,,,,,,,,,,,,,,,,,,16,
|
||||
math/big,,,1,,,,,,,,,,,,,,,,,,,,,,,1,
|
||||
mime,,,14,,,,,,,,,,,,,,,,,,,,,,,14,
|
||||
net,2,16,100,,,,,,1,,,,,,,,1,,,,,,,16,,100,
|
||||
|
||||
|
@@ -32,7 +32,7 @@ Go framework & library support
|
||||
`Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
|
||||
`SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
|
||||
`Squirrel <https://github.com/Masterminds/squirrel>`_,"``github.com/Masterminds/squirrel*``, ``github.com/lann/squirrel*``, ``gopkg.in/Masterminds/squirrel``",81,,96
|
||||
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
|
||||
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,625,127
|
||||
`XORM <https://xorm.io>`_,"``github.com/go-xorm/xorm*``, ``xorm.io/xorm*``",,,68
|
||||
`XPath <https://github.com/antchfx/xpath>`_,``github.com/antchfx/xpath*``,,,4
|
||||
`appleboy/gin-jwt <https://github.com/appleboy/gin-jwt>`_,``github.com/appleboy/gin-jwt*``,,,1
|
||||
@@ -74,5 +74,5 @@ Go framework & library support
|
||||
`xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_,``github.com/santhosh-tekuri/xpathparser*``,,,2
|
||||
`yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
|
||||
`zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
|
||||
Totals,,688,1072,1577
|
||||
Totals,,688,1085,1580
|
||||
|
||||
|
||||
@@ -16,6 +16,7 @@ go_library(
|
||||
importpath = "github.com/github/codeql-go/extractor",
|
||||
visibility = ["//visibility:public"],
|
||||
deps = [
|
||||
"//go/extractor/canonicalize",
|
||||
"//go/extractor/dbscheme",
|
||||
"//go/extractor/diagnostics",
|
||||
"//go/extractor/srcarchive",
|
||||
|
||||
11
go/extractor/canonicalize/BUILD.bazel
generated
Normal file
11
go/extractor/canonicalize/BUILD.bazel
generated
Normal file
@@ -0,0 +1,11 @@
|
||||
load("@rules_go//go:def.bzl", "go_library")
|
||||
|
||||
go_library(
|
||||
name = "canonicalize",
|
||||
srcs = [
|
||||
"canonicalize_other.go",
|
||||
"canonicalize_windows.go",
|
||||
],
|
||||
importpath = "github.com/github/codeql-go/extractor/canonicalize",
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
5
go/extractor/canonicalize/canonicalize_other.go
Normal file
5
go/extractor/canonicalize/canonicalize_other.go
Normal file
@@ -0,0 +1,5 @@
|
||||
//go:build !windows
|
||||
|
||||
package canonicalize
|
||||
|
||||
func CanonicalizePath(path string) string { return path }
|
||||
65
go/extractor/canonicalize/canonicalize_windows.go
Normal file
65
go/extractor/canonicalize/canonicalize_windows.go
Normal file
@@ -0,0 +1,65 @@
|
||||
//go:build windows
|
||||
|
||||
package canonicalize
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"unsafe"
|
||||
)
|
||||
|
||||
var (
|
||||
dll *syscall.DLL
|
||||
procCanonicalize *syscall.Proc
|
||||
procFree *syscall.Proc
|
||||
available bool
|
||||
)
|
||||
|
||||
func init() {
|
||||
root := os.Getenv("CODEQL_EXTRACTOR_GO_ROOT")
|
||||
if root == "" {
|
||||
return
|
||||
}
|
||||
dllPath := filepath.Join(root, "tools", "win64", "codeql_canonical_path.dll")
|
||||
d, err := syscall.LoadDLL(dllPath)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
p, err := d.FindProc("canonicalize_path_u8")
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
f, _ := d.FindProc("canonicalize_free_u8")
|
||||
dll = d
|
||||
procCanonicalize = p
|
||||
procFree = f
|
||||
available = true
|
||||
}
|
||||
|
||||
func CanonicalizePath(path string) string {
|
||||
if !available {
|
||||
return path
|
||||
}
|
||||
pathBytes := append([]byte(path), 0)
|
||||
ret, _, _ := procCanonicalize.Call(uintptr(unsafe.Pointer(&pathBytes[0])))
|
||||
if ret == 0 {
|
||||
return path
|
||||
}
|
||||
result := bytePtrToString((*byte)(unsafe.Pointer(ret)))
|
||||
if procFree != nil {
|
||||
procFree.Call(ret)
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func bytePtrToString(p *byte) string {
|
||||
if p == nil {
|
||||
return ""
|
||||
}
|
||||
var n int
|
||||
for ptr := unsafe.Pointer(p); *(*byte)(ptr) != 0; n++ {
|
||||
ptr = unsafe.Add(ptr, 1)
|
||||
}
|
||||
return string(unsafe.Slice(p, n))
|
||||
}
|
||||
@@ -22,6 +22,7 @@ import (
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/github/codeql-go/extractor/canonicalize"
|
||||
"github.com/github/codeql-go/extractor/dbscheme"
|
||||
"github.com/github/codeql-go/extractor/diagnostics"
|
||||
"github.com/github/codeql-go/extractor/srcarchive"
|
||||
@@ -766,7 +767,7 @@ func normalizedPath(ast *ast.File, fset *token.FileSet) string {
|
||||
if err != nil {
|
||||
return file
|
||||
}
|
||||
return path
|
||||
return canonicalize.CanonicalizePath(path)
|
||||
}
|
||||
|
||||
// extractFile extracts AST information for the given file
|
||||
|
||||
3
go/ql/integration-tests/subst/code/main.go
Normal file
3
go/ql/integration-tests/subst/code/main.go
Normal file
@@ -0,0 +1,3 @@
|
||||
package main
|
||||
|
||||
func main() {}
|
||||
1
go/ql/integration-tests/subst/file.expected
Normal file
1
go/ql/integration-tests/subst/file.expected
Normal file
@@ -0,0 +1 @@
|
||||
| file://Z:/main.go:0:0:0:0 | Z:/main.go | relative |
|
||||
5
go/ql/integration-tests/subst/file.ql
Normal file
5
go/ql/integration-tests/subst/file.ql
Normal file
@@ -0,0 +1,5 @@
|
||||
import go
|
||||
|
||||
from File f, string relative
|
||||
where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
go/ql/integration-tests/subst/test.py
Normal file
7
go/ql/integration-tests/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, go, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(command="go build main.go", source_root=drive)
|
||||
@@ -1242,11 +1242,11 @@ public class FileUtil
|
||||
public static File tryMakeCanonical (File f)
|
||||
{
|
||||
try {
|
||||
return f.getCanonicalFile();
|
||||
return NativeCanonicalizer.resolve(f.getCanonicalFile());
|
||||
}
|
||||
catch (IOException ignored) {
|
||||
Exceptions.ignore(ignored, "Can't log error: Could be too verbose.");
|
||||
return new File(simplifyPath(f));
|
||||
return NativeCanonicalizer.resolve(new File(simplifyPath(f)));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
package com.semmle.util.files;
|
||||
|
||||
import java.io.File;
|
||||
import java.nio.file.Path;
|
||||
import java.nio.file.Paths;
|
||||
|
||||
public class NativeCanonicalizer {
|
||||
private static final boolean available;
|
||||
|
||||
static {
|
||||
boolean loaded = false;
|
||||
if (File.separatorChar == '\\') {
|
||||
String dist = System.getenv("CODEQL_DIST");
|
||||
if (dist != null && !dist.isEmpty()) {
|
||||
try {
|
||||
Path library = Paths.get(dist).resolve("tools").resolve("win64")
|
||||
.resolve("codeql_canonical_path.dll").toAbsolutePath();
|
||||
System.load(library.toString());
|
||||
loaded = true;
|
||||
} catch (RuntimeException | UnsatisfiedLinkError ignored) {
|
||||
}
|
||||
}
|
||||
}
|
||||
available = loaded;
|
||||
}
|
||||
|
||||
private NativeCanonicalizer() {}
|
||||
|
||||
// UTF-16 JNI interface - no encoding conversion
|
||||
private static native String nativeCanonicalizePath(String path);
|
||||
|
||||
public static File resolve(File path) {
|
||||
if (!available) return path;
|
||||
String result = nativeCanonicalizePath(path.getAbsolutePath());
|
||||
return result != null ? new File(result) : path;
|
||||
}
|
||||
|
||||
public static boolean isAvailable() {
|
||||
return available;
|
||||
}
|
||||
}
|
||||
4
java/ql/integration-tests/java/subst/code/test1.java
Normal file
4
java/ql/integration-tests/java/subst/code/test1.java
Normal file
@@ -0,0 +1,4 @@
|
||||
class Test {
|
||||
public static void main(String[] args) {
|
||||
}
|
||||
}
|
||||
1
java/ql/integration-tests/java/subst/code/test2.kt
Normal file
1
java/ql/integration-tests/java/subst/code/test2.kt
Normal file
@@ -0,0 +1 @@
|
||||
fun main() {}
|
||||
5
java/ql/integration-tests/java/subst/file.expected
Normal file
5
java/ql/integration-tests/java/subst/file.expected
Normal file
@@ -0,0 +1,5 @@
|
||||
| file://:0:0:0:0 | | |
|
||||
| file://:0:0:0:0 | | |
|
||||
| file://Z:/Test.class:0:0:0:0 | Test | relative |
|
||||
| file://Z:/test1.java:0:0:0:0 | test1 | relative |
|
||||
| file://Z:/test2.kt:0:0:0:0 | test2 | relative |
|
||||
9
java/ql/integration-tests/java/subst/file.ql
Normal file
9
java/ql/integration-tests/java/subst/file.ql
Normal file
@@ -0,0 +1,9 @@
|
||||
import java
|
||||
|
||||
from File f, string relative
|
||||
where
|
||||
not f.getURL().matches("file:///modules/%") and
|
||||
not f.getURL().matches("file:///!unknown-binary-location/kotlin/%") and
|
||||
not f.getURL().matches("%/ql/java/kotlin-extractor/%") and
|
||||
if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
java/ql/integration-tests/java/subst/test.py
Normal file
7
java/ql/integration-tests/java/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, java, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(command=["javac test1.java", "kotlinc test2.kt"], source_root=drive)
|
||||
@@ -234,8 +234,3 @@ subpaths
|
||||
| use.kt:9:14:9:25 | taint(...) : Closeable | use.kt:9:31:9:36 | it : Closeable | use.kt:9:33:9:34 | it : Closeable | use.kt:9:14:9:36 | use(...) |
|
||||
| with.kt:7:19:7:30 | taint(...) : String | with.kt:7:33:7:40 | $this$with : String | with.kt:7:35:7:38 | this : String | with.kt:7:14:7:40 | with(...) |
|
||||
testFailures
|
||||
| test.kt:28:14:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
|
||||
| test.kt:35:14:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
|
||||
| test.kt:41:14:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |
|
||||
| test.kt:53:14:53:24 | getDuration(...) | Unexpected result: hasTaintFlow=f |
|
||||
| test.kt:58:14:58:29 | component2(...) | Unexpected result: hasTaintFlow=g |
|
||||
|
||||
@@ -25,20 +25,20 @@ class Test {
|
||||
val p = Pair(taint("a"), "")
|
||||
sink(p) // $ hasTaintFlow=a
|
||||
sink(p.component1()) // $ hasTaintFlow=a
|
||||
sink(p.second)
|
||||
sink(p.second) // $ SPURIOUS: hasTaintFlow=a
|
||||
|
||||
sink(taint("b").capitalize()) // $ hasTaintFlow=b
|
||||
sink(taint("c").replaceFirstChar { _ -> 'x' }) // $ hasTaintFlow=c
|
||||
|
||||
val t = Triple("", taint("d"), "")
|
||||
sink(t) // $ hasTaintFlow=d
|
||||
sink(t.component1())
|
||||
sink(t.component1()) // $ SPURIOUS: hasTaintFlow=d
|
||||
sink(t.second) // $ hasTaintFlow=d
|
||||
|
||||
val p1 = taint("e") to ""
|
||||
sink(p1) // $ hasTaintFlow=e
|
||||
sink(p1.component1()) // $ hasTaintFlow=e
|
||||
sink(p1.second)
|
||||
sink(p1.second) // $ SPURIOUS: hasTaintFlow=e
|
||||
|
||||
val l = p.toList()
|
||||
sink(l) // $ hasTaintFlow=a
|
||||
@@ -50,12 +50,12 @@ class Test {
|
||||
val tv = TimedValue(taint("f"), Duration.parse(""))
|
||||
sink(tv) // $ hasTaintFlow=f
|
||||
sink(tv.component1()) // $ hasTaintFlow=f
|
||||
sink(tv.duration)
|
||||
sink(tv.duration) // $ SPURIOUS: hasTaintFlow=f
|
||||
|
||||
val mg0 = MatchGroup(taint("g"), IntRange(0, 10))
|
||||
sink(mg0) // $ hasTaintFlow=g
|
||||
sink(mg0.value) // $ hasTaintFlow=g
|
||||
sink(mg0.component2())
|
||||
sink(mg0.component2()) // $ SPURIOUS: hasTaintFlow=g
|
||||
|
||||
val iv = IndexedValue<String>(5, taint("h"))
|
||||
sink(iv) // $ hasTaintFlow=h
|
||||
@@ -72,4 +72,4 @@ class Test {
|
||||
sink(x.index)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -234,8 +234,3 @@ subpaths
|
||||
| use.kt:9:14:9:25 | taint(...) : Closeable | use.kt:9:31:9:36 | it : Closeable | use.kt:9:33:9:34 | it : Closeable | use.kt:9:14:9:36 | use(...) |
|
||||
| with.kt:7:19:7:30 | taint(...) : String | with.kt:7:33:7:40 | $this$with : String | with.kt:7:35:7:38 | this : String | with.kt:7:14:7:40 | with(...) |
|
||||
testFailures
|
||||
| test.kt:28:14:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
|
||||
| test.kt:35:14:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
|
||||
| test.kt:41:14:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |
|
||||
| test.kt:53:14:53:24 | getDuration(...) | Unexpected result: hasTaintFlow=f |
|
||||
| test.kt:58:14:58:29 | component2(...) | Unexpected result: hasTaintFlow=g |
|
||||
|
||||
@@ -25,20 +25,20 @@ class Test {
|
||||
val p = Pair(taint("a"), "")
|
||||
sink(p) // $ hasTaintFlow=a
|
||||
sink(p.component1()) // $ hasTaintFlow=a
|
||||
sink(p.second)
|
||||
sink(p.second) // $ SPURIOUS: hasTaintFlow=a
|
||||
|
||||
sink(taint("b").capitalize()) // $ hasTaintFlow=b
|
||||
sink(taint("c").replaceFirstChar { _ -> 'x' }) // $ hasTaintFlow=c
|
||||
|
||||
val t = Triple("", taint("d"), "")
|
||||
sink(t) // $ hasTaintFlow=d
|
||||
sink(t.component1())
|
||||
sink(t.component1()) // $ SPURIOUS: hasTaintFlow=d
|
||||
sink(t.second) // $ hasTaintFlow=d
|
||||
|
||||
val p1 = taint("e") to ""
|
||||
sink(p1) // $ hasTaintFlow=e
|
||||
sink(p1.component1()) // $ hasTaintFlow=e
|
||||
sink(p1.second)
|
||||
sink(p1.second) // $ SPURIOUS: hasTaintFlow=e
|
||||
|
||||
val l = p.toList()
|
||||
sink(l) // $ hasTaintFlow=a
|
||||
@@ -50,12 +50,12 @@ class Test {
|
||||
val tv = TimedValue(taint("f"), Duration.parse(""))
|
||||
sink(tv) // $ hasTaintFlow=f
|
||||
sink(tv.component1()) // $ hasTaintFlow=f
|
||||
sink(tv.duration)
|
||||
sink(tv.duration) // $ SPURIOUS: hasTaintFlow=f
|
||||
|
||||
val mg0 = MatchGroup(taint("g"), IntRange(0, 10))
|
||||
sink(mg0) // $ hasTaintFlow=g
|
||||
sink(mg0.value) // $ hasTaintFlow=g
|
||||
sink(mg0.component2())
|
||||
sink(mg0.component2()) // $ SPURIOUS: hasTaintFlow=g
|
||||
|
||||
val iv = IndexedValue<String>(5, taint("h"))
|
||||
sink(iv) // $ hasTaintFlow=h
|
||||
@@ -72,4 +72,4 @@ class Test {
|
||||
sink(x.index)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
1
javascript/ql/integration-tests/subst/code/main.js
Normal file
1
javascript/ql/integration-tests/subst/code/main.js
Normal file
@@ -0,0 +1 @@
|
||||
function interesting() { }
|
||||
1
javascript/ql/integration-tests/subst/code/test.ts
Normal file
1
javascript/ql/integration-tests/subst/code/test.ts
Normal file
@@ -0,0 +1 @@
|
||||
0
|
||||
2
javascript/ql/integration-tests/subst/file.expected
Normal file
2
javascript/ql/integration-tests/subst/file.expected
Normal file
@@ -0,0 +1,2 @@
|
||||
| file://Z:/main.js:0:0:0:0 | Z:/main.js | relative |
|
||||
| file://Z:/test.ts:0:0:0:0 | Z:/test.ts | relative |
|
||||
7
javascript/ql/integration-tests/subst/file.ql
Normal file
7
javascript/ql/integration-tests/subst/file.ql
Normal file
@@ -0,0 +1,7 @@
|
||||
import javascript
|
||||
|
||||
from File f, string relative
|
||||
where
|
||||
not f.getURL().matches("%/target/intree/%") and
|
||||
if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
javascript/ql/integration-tests/subst/test.py
Normal file
7
javascript/ql/integration-tests/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, javascript, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(source_root=drive)
|
||||
@@ -36,6 +36,8 @@ private module Input implements InputSig<Location, PythonDataFlow> {
|
||||
// parameter, but dataflow-consistency queries should _not_ complain about there not
|
||||
// being a post-update node for the synthetic `**kwargs` parameter.
|
||||
n instanceof SynthDictSplatParameterNode
|
||||
or
|
||||
Private::Conversions::readStep(n, _, _)
|
||||
}
|
||||
|
||||
predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
|
||||
|
||||
1
python/ql/integration-tests/subst/code/main.py
Normal file
1
python/ql/integration-tests/subst/code/main.py
Normal file
@@ -0,0 +1 @@
|
||||
print(0)
|
||||
1
python/ql/integration-tests/subst/file.expected
Normal file
1
python/ql/integration-tests/subst/file.expected
Normal file
@@ -0,0 +1 @@
|
||||
| code/main.py:0:0:0:0 | code/main.py | |
|
||||
5
python/ql/integration-tests/subst/file.ql
Normal file
5
python/ql/integration-tests/subst/file.ql
Normal file
@@ -0,0 +1,5 @@
|
||||
import python
|
||||
|
||||
from File f, string relative
|
||||
where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
python/ql/integration-tests/subst/test.py
Normal file
7
python/ql/integration-tests/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, python, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(source_root=drive)
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
|
||||
- Temporarily disabled the `instanceFieldStep` disjunct of the internal `TypeTrackingInput::levelStepCall` predicate, which was introduced in 7.2.0 and caused catastrophic query slowdowns on some OOP-heavy Python codebases (e.g. `mypy` and `dask`).
|
||||
@@ -753,7 +753,7 @@ predicate jumpStepNotSharedWithTypeTracker(Node nodeFrom, Node nodeTo) {
|
||||
* As of 2024-04-02 the type-tracking library only supports precise content, so there is
|
||||
* no reason to include steps for list content right now.
|
||||
*/
|
||||
predicate storeStepCommon(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
predicate storeStepCommon(Node nodeFrom, Content c, Node nodeTo) {
|
||||
tupleStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
dictStoreStep(nodeFrom, c, nodeTo)
|
||||
@@ -767,29 +767,31 @@ predicate storeStepCommon(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
* Holds if data can flow from `nodeFrom` to `nodeTo` via an assignment to
|
||||
* content `c`.
|
||||
*/
|
||||
predicate storeStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
storeStepCommon(nodeFrom, c, nodeTo)
|
||||
predicate storeStep(Node nodeFrom, ContentSet cs, Node nodeTo) {
|
||||
exists(Content c | cs = singleton(c) |
|
||||
storeStepCommon(nodeFrom, c, nodeTo)
|
||||
or
|
||||
listStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
setStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
attributeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
matchStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
any(Orm::AdditionalOrmSteps es).storeStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
synthStarArgsElementParameterNodeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
synthDictSplatArgumentNodeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
yieldStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
VariableCapture::storeStep(nodeFrom, c, nodeTo)
|
||||
)
|
||||
or
|
||||
listStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
setStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
attributeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
matchStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
any(Orm::AdditionalOrmSteps es).storeStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
FlowSummaryImpl::Private::Steps::summaryStoreStep(nodeFrom.(FlowSummaryNode).getSummaryNode(), c,
|
||||
FlowSummaryImpl::Private::Steps::summaryStoreStep(nodeFrom.(FlowSummaryNode).getSummaryNode(), cs,
|
||||
nodeTo.(FlowSummaryNode).getSummaryNode())
|
||||
or
|
||||
synthStarArgsElementParameterNodeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
synthDictSplatArgumentNodeStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
yieldStoreStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
VariableCapture::storeStep(nodeFrom, c, nodeTo)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -985,7 +987,7 @@ predicate attributeStoreStep(Node nodeFrom, AttributeContent c, Node nodeTo) {
|
||||
/**
|
||||
* Subset of `readStep` that should be shared with type-tracking.
|
||||
*/
|
||||
predicate readStepCommon(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
predicate readStepCommon(Node nodeFrom, Content c, Node nodeTo) {
|
||||
subscriptReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
iterableUnpackingReadStep(nodeFrom, c, nodeTo)
|
||||
@@ -994,21 +996,25 @@ predicate readStepCommon(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
/**
|
||||
* Holds if data can flow from `nodeFrom` to `nodeTo` via a read of content `c`.
|
||||
*/
|
||||
predicate readStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
readStepCommon(nodeFrom, c, nodeTo)
|
||||
predicate readStep(Node nodeFrom, ContentSet cs, Node nodeTo) {
|
||||
exists(Content c | cs = singleton(c) |
|
||||
readStepCommon(nodeFrom, c, nodeTo)
|
||||
or
|
||||
matchReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
forReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
attributeReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
synthDictSplatParameterNodeReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
VariableCapture::readStep(nodeFrom, c, nodeTo)
|
||||
)
|
||||
or
|
||||
matchReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
forReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
attributeReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
FlowSummaryImpl::Private::Steps::summaryReadStep(nodeFrom.(FlowSummaryNode).getSummaryNode(), c,
|
||||
FlowSummaryImpl::Private::Steps::summaryReadStep(nodeFrom.(FlowSummaryNode).getSummaryNode(), cs,
|
||||
nodeTo.(FlowSummaryNode).getSummaryNode())
|
||||
or
|
||||
synthDictSplatParameterNodeReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
VariableCapture::readStep(nodeFrom, c, nodeTo)
|
||||
Conversions::readStep(nodeFrom, cs, nodeTo)
|
||||
}
|
||||
|
||||
/** Data flows from a sequence to a subscript of the sequence. */
|
||||
@@ -1064,23 +1070,68 @@ predicate attributeReadStep(Node nodeFrom, AttributeContent c, AttrRead nodeTo)
|
||||
nodeTo.accesses(nodeFrom, c.getAttribute())
|
||||
}
|
||||
|
||||
module Conversions {
|
||||
private import semmle.python.Concepts
|
||||
|
||||
predicate decoderReadStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
exists(Decoding decoding |
|
||||
nodeFrom = decoding.getAnInput() and
|
||||
nodeTo = decoding.getOutput()
|
||||
) and
|
||||
c.isAnyTupleOrDictionaryElement()
|
||||
}
|
||||
|
||||
predicate encoderReadStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
exists(Encoding encoding |
|
||||
nodeFrom = encoding.getAnInput() and
|
||||
nodeTo = encoding.getOutput()
|
||||
) and
|
||||
c.isAnyTupleOrDictionaryElement()
|
||||
}
|
||||
|
||||
predicate formatReadStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
// % formatting
|
||||
exists(BinaryExprNode fmt | fmt = nodeTo.asCfgNode() |
|
||||
fmt.getOp() instanceof Mod and
|
||||
fmt.getRight() = nodeFrom.asCfgNode()
|
||||
) and
|
||||
c.isAnyTupleElement()
|
||||
or
|
||||
// format_map
|
||||
// see https://docs.python.org/3/library/stdtypes.html#str.format_map
|
||||
nodeTo.(MethodCallNode).calls(_, "format_map") and
|
||||
nodeTo.(MethodCallNode).getArg(0) = nodeFrom and
|
||||
c.isAnyDictionaryElement()
|
||||
}
|
||||
|
||||
predicate readStep(Node nodeFrom, ContentSet c, Node nodeTo) {
|
||||
decoderReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
encoderReadStep(nodeFrom, c, nodeTo)
|
||||
or
|
||||
formatReadStep(nodeFrom, c, nodeTo)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if values stored inside content `c` are cleared at node `n`. For example,
|
||||
* any value stored inside `f` is cleared at the pre-update node associated with `x`
|
||||
* in `x.f = newValue`.
|
||||
*/
|
||||
predicate clearsContent(Node n, ContentSet c) {
|
||||
matchClearStep(n, c)
|
||||
predicate clearsContent(Node n, ContentSet cs) {
|
||||
exists(Content c | cs = singleton(c) |
|
||||
matchClearStep(n, c)
|
||||
or
|
||||
attributeClearStep(n, c)
|
||||
or
|
||||
dictClearStep(n, c)
|
||||
or
|
||||
dictSplatParameterNodeClearStep(n, c)
|
||||
or
|
||||
VariableCapture::clearsContent(n, c)
|
||||
)
|
||||
or
|
||||
attributeClearStep(n, c)
|
||||
or
|
||||
dictClearStep(n, c)
|
||||
or
|
||||
FlowSummaryImpl::Private::Steps::summaryClearsContent(n.(FlowSummaryNode).getSummaryNode(), c)
|
||||
or
|
||||
dictSplatParameterNodeClearStep(n, c)
|
||||
or
|
||||
VariableCapture::clearsContent(n, c)
|
||||
FlowSummaryImpl::Private::Steps::summaryClearsContent(n.(FlowSummaryNode).getSummaryNode(), cs)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -1198,12 +1249,65 @@ predicate allowParameterReturnInSelf(ParameterNode p) {
|
||||
)
|
||||
}
|
||||
|
||||
bindingset[s]
|
||||
private string getFirstChar(string s) {
|
||||
result =
|
||||
min(int i, string c |
|
||||
c = s.charAt(i) and c != "_"
|
||||
or
|
||||
c = "" and i = s.length()
|
||||
|
|
||||
c order by i
|
||||
)
|
||||
}
|
||||
|
||||
private string getAttributeContentFirstChar(AttributeContent ac) {
|
||||
result = getFirstChar(ac.getAttribute())
|
||||
}
|
||||
|
||||
private string getDictionaryElementContentKeyFirstChar(DictionaryElementContent dec) {
|
||||
result = getFirstChar(dec.getKey())
|
||||
}
|
||||
|
||||
private newtype TContentApprox =
|
||||
TListElementContentApprox() or
|
||||
TSetElementContentApprox() or
|
||||
TTupleElementContentApprox() or
|
||||
TDictionaryElementContentApprox(string first) {
|
||||
first = "" // for `TDictionaryElementAnyContent`
|
||||
or
|
||||
first = getDictionaryElementContentKeyFirstChar(_)
|
||||
} or
|
||||
TAttributeContentApprox(string first) { first = getAttributeContentFirstChar(_) } or
|
||||
TCapturedVariableContentApprox()
|
||||
|
||||
/** An approximated `Content`. */
|
||||
class ContentApprox = Unit;
|
||||
class ContentApprox extends TContentApprox {
|
||||
/** Gets a textual representation of this element. */
|
||||
string toString() { result = "" }
|
||||
}
|
||||
|
||||
/** Gets an approximated value for content `c`. */
|
||||
pragma[inline]
|
||||
ContentApprox getContentApprox(Content c) { any() }
|
||||
ContentApprox getContentApprox(Content c) {
|
||||
c = TListElementContent() and
|
||||
result = TListElementContentApprox()
|
||||
or
|
||||
c = TSetElementContent() and
|
||||
result = TSetElementContentApprox()
|
||||
or
|
||||
c = TTupleElementContent(_) and
|
||||
result = TTupleElementContentApprox()
|
||||
or
|
||||
result = TDictionaryElementContentApprox(getDictionaryElementContentKeyFirstChar(c))
|
||||
or
|
||||
c = TDictionaryElementAnyContent() and
|
||||
result = TDictionaryElementContentApprox("")
|
||||
or
|
||||
result = TAttributeContentApprox(getAttributeContentFirstChar(c))
|
||||
or
|
||||
c = TCapturedVariableContent(_) and
|
||||
result = TCapturedVariableContentApprox()
|
||||
}
|
||||
|
||||
/** Helper for `.getEnclosingCallable`. */
|
||||
DataFlowCallable getCallableScope(Scope s) {
|
||||
|
||||
@@ -898,19 +898,78 @@ class CapturedVariableContent extends Content, TCapturedVariableContent {
|
||||
override string getMaDRepresentation() { none() }
|
||||
}
|
||||
|
||||
/**
|
||||
* An entity that represents a set of `Content`s.
|
||||
*
|
||||
* Most `ContentSet`s are singletons (i.e. they consist of a single `Content`),
|
||||
* but `AnyDictionaryElement` and `AnyTupleElement` act as wildcards on the
|
||||
* read side: a read at such a `ContentSet` matches any specific dictionary
|
||||
* key / tuple index store, as well as (for dictionaries) the
|
||||
* "unknown-bucket" Content `DictionaryElementAnyContent`.
|
||||
*
|
||||
* Keeping these as wildcard `ContentSet`s (rather than enumerating one
|
||||
* `ContentSet` per key/index) keeps the dataflow `readSetEx` relation small
|
||||
* when implicit reads are used (e.g. at sinks via `defaultImplicitTaintRead`).
|
||||
*/
|
||||
private newtype TContentSet =
|
||||
TSingletonContent(Content c) or
|
||||
TAnyTupleElement() or
|
||||
TAnyDictionaryElement() or
|
||||
TAnyTupleOrDictionaryElement()
|
||||
|
||||
/**
|
||||
* An entity that represents a set of `Content`s.
|
||||
*
|
||||
* The set may be interpreted differently depending on whether it is
|
||||
* stored into (`getAStoreContent`) or read from (`getAReadContent`).
|
||||
*/
|
||||
class ContentSet instanceof Content {
|
||||
class ContentSet extends TContentSet {
|
||||
/** Holds if this content set is the singleton `{c}`. */
|
||||
predicate isSingleton(Content c) { this = TSingletonContent(c) }
|
||||
|
||||
/** Holds if this content set is the wildcard for all tuple elements. */
|
||||
predicate isAnyTupleElement() { this = TAnyTupleElement() }
|
||||
|
||||
/** Holds if this content set is the wildcard for all dictionary elements. */
|
||||
predicate isAnyDictionaryElement() { this = TAnyDictionaryElement() }
|
||||
|
||||
/** Holds if this content set is the wildcard for all tuple elements or dictionary elements. */
|
||||
predicate isAnyTupleOrDictionaryElement() { this = TAnyTupleOrDictionaryElement() }
|
||||
|
||||
/** Gets a content that may be stored into when storing into this set. */
|
||||
Content getAStoreContent() { result = this }
|
||||
Content getAStoreContent() { this = TSingletonContent(result) }
|
||||
|
||||
/** Gets a content that may be read from when reading from this set. */
|
||||
Content getAReadContent() { result = this }
|
||||
Content getAReadContent() {
|
||||
this = TSingletonContent(result)
|
||||
or
|
||||
// Wildcard expansion: a read at "any tuple element" matches a store at any
|
||||
// specific tuple index. (Stores always target a specific index, so we don't
|
||||
// need a `TupleElementAnyContent` Content kind here.)
|
||||
this = TAnyTupleElement() and result instanceof TupleElementContent
|
||||
or
|
||||
this = TAnyDictionaryElement() and
|
||||
(result instanceof DictionaryElementContent or result instanceof DictionaryElementAnyContent)
|
||||
or
|
||||
this = TAnyTupleOrDictionaryElement() and
|
||||
(
|
||||
result instanceof TupleElementContent or
|
||||
result instanceof DictionaryElementContent or
|
||||
result instanceof DictionaryElementAnyContent
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets a textual representation of this content set. */
|
||||
string toString() { result = super.toString() }
|
||||
string toString() {
|
||||
exists(Content c | this = TSingletonContent(c) | result = c.toString())
|
||||
or
|
||||
this = TAnyTupleElement() and result = "Any tuple element"
|
||||
or
|
||||
this = TAnyDictionaryElement() and result = "Any dictionary element"
|
||||
or
|
||||
this = TAnyTupleOrDictionaryElement() and result = "Any tuple or dictionary element"
|
||||
}
|
||||
}
|
||||
|
||||
/** Gets the singleton `ContentSet` wrapping the `Content` `c`. */
|
||||
ContentSet singleton(Content c) { result = TSingletonContent(c) }
|
||||
|
||||
@@ -66,21 +66,29 @@ module Input implements InputSig<Location, DataFlowImplSpecific::PythonDataFlow>
|
||||
}
|
||||
|
||||
string encodeContent(ContentSet cs, string arg) {
|
||||
cs = TListElementContent() and result = "ListElement" and arg = ""
|
||||
or
|
||||
cs = TSetElementContent() and result = "SetElement" and arg = ""
|
||||
or
|
||||
exists(int index |
|
||||
cs = TTupleElementContent(index) and result = "TupleElement" and arg = index.toString()
|
||||
exists(Content c | cs.isSingleton(c) |
|
||||
c = TListElementContent() and result = "ListElement" and arg = ""
|
||||
or
|
||||
c = TSetElementContent() and result = "SetElement" and arg = ""
|
||||
or
|
||||
exists(int index |
|
||||
c = TTupleElementContent(index) and result = "TupleElement" and arg = index.toString()
|
||||
)
|
||||
or
|
||||
exists(string key |
|
||||
c = TDictionaryElementContent(key) and result = "DictionaryElement" and arg = key
|
||||
)
|
||||
or
|
||||
c = TDictionaryElementAnyContent() and result = "DictionaryElementAny" and arg = ""
|
||||
or
|
||||
exists(string attr | c = TAttributeContent(attr) and result = "Attribute" and arg = attr)
|
||||
)
|
||||
or
|
||||
exists(string key |
|
||||
cs = TDictionaryElementContent(key) and result = "DictionaryElement" and arg = key
|
||||
)
|
||||
cs.isAnyTupleElement() and result = "AnyTupleElement" and arg = ""
|
||||
or
|
||||
cs = TDictionaryElementAnyContent() and result = "DictionaryElementAny" and arg = ""
|
||||
cs.isAnyDictionaryElement() and result = "AnyDictionaryElement" and arg = ""
|
||||
or
|
||||
exists(string attr | cs = TAttributeContent(attr) and result = "Attribute" and arg = attr)
|
||||
cs.isAnyTupleOrDictionaryElement() and result = "AnyTupleOrDictionaryElement" and arg = ""
|
||||
}
|
||||
|
||||
bindingset[token]
|
||||
@@ -139,27 +147,29 @@ module Private {
|
||||
predicate withContent = SC::withContent/1;
|
||||
|
||||
/** Gets a summary component that represents a list element. */
|
||||
SummaryComponent listElement() { result = content(any(ListElementContent c)) }
|
||||
SummaryComponent listElement() { result = content(singleton(any(ListElementContent c))) }
|
||||
|
||||
/** Gets a summary component that represents a set element. */
|
||||
SummaryComponent setElement() { result = content(any(SetElementContent c)) }
|
||||
SummaryComponent setElement() { result = content(singleton(any(SetElementContent c))) }
|
||||
|
||||
/** Gets a summary component that represents a tuple element. */
|
||||
SummaryComponent tupleElement(int index) {
|
||||
exists(TupleElementContent c | c.getIndex() = index and result = content(c))
|
||||
exists(TupleElementContent c | c.getIndex() = index and result = content(singleton(c)))
|
||||
}
|
||||
|
||||
/** Gets a summary component that represents a dictionary element. */
|
||||
SummaryComponent dictionaryElement(string key) {
|
||||
exists(DictionaryElementContent c | c.getKey() = key and result = content(c))
|
||||
exists(DictionaryElementContent c | c.getKey() = key and result = content(singleton(c)))
|
||||
}
|
||||
|
||||
/** Gets a summary component that represents a dictionary element at any key. */
|
||||
SummaryComponent dictionaryElementAny() { result = content(any(DictionaryElementAnyContent c)) }
|
||||
SummaryComponent dictionaryElementAny() {
|
||||
result = content(singleton(any(DictionaryElementAnyContent c)))
|
||||
}
|
||||
|
||||
/** Gets a summary component that represents an attribute element. */
|
||||
SummaryComponent attribute(string attr) {
|
||||
exists(AttributeContent c | c.getAttribute() = attr and result = content(c))
|
||||
exists(AttributeContent c | c.getAttribute() = attr and result = content(singleton(c)))
|
||||
}
|
||||
|
||||
/** Gets a summary component that represents the return value of a call. */
|
||||
|
||||
@@ -11,12 +11,34 @@ private import semmle.python.ApiGraphs
|
||||
*/
|
||||
predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
|
||||
|
||||
/**
|
||||
* Holds if default taint tracking should read content `contentSet` implicitly and
|
||||
* propagate taint from a container to reads of that content.
|
||||
*/
|
||||
private predicate defaultTaintReadContent(DataFlow::ContentSet contentSet) {
|
||||
// Tuple and dictionary content is precise, so use wildcard content sets to avoid
|
||||
// blowing up the size of `Stage1::readSetEx` (otherwise this predicate would
|
||||
// expand to one row per (node, distinct key or index) and the framework's
|
||||
// read-set relation grows quadratically). `ContentSet.getAReadContent` expands
|
||||
// these wildcards back to the specific contents when matching against stores.
|
||||
contentSet.isAnyTupleOrDictionaryElement()
|
||||
or
|
||||
// List and set element content is already imprecise, so no wildcard expansion is
|
||||
// needed.
|
||||
contentSet.getAStoreContent() instanceof DataFlow::ListElementContent
|
||||
or
|
||||
contentSet.getAStoreContent() instanceof DataFlow::SetElementContent
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if default `TaintTracking::Configuration`s should allow implicit reads
|
||||
* of `c` at sinks and inputs to additional taint steps.
|
||||
*/
|
||||
bindingset[node]
|
||||
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) { none() }
|
||||
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {
|
||||
exists(node) and
|
||||
defaultTaintReadContent(c)
|
||||
}
|
||||
|
||||
private module Cached {
|
||||
/**
|
||||
@@ -128,11 +150,6 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
|
||||
nodeFrom.getNode() = object and
|
||||
method_name in ["partition", "rpartition", "rsplit", "split", "splitlines"]
|
||||
or
|
||||
// Iterable[str] -> str
|
||||
// TODO: check if these should be handled differently in regards to content
|
||||
method_name = "join" and
|
||||
nodeFrom.getNode() = call.getArg(0)
|
||||
or
|
||||
// Mapping[str, Any] -> str
|
||||
method_name = "format_map" and
|
||||
nodeFrom.getNode() = call.getArg(0)
|
||||
@@ -161,32 +178,21 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if taint can flow from `nodeFrom` to `nodeTo` with a step related to containers
|
||||
* (lists/sets/dictionaries): literals, constructor invocation, methods. Note that this
|
||||
* is currently very imprecise, as an example, since we model `dict.get`, we treat any
|
||||
* `<tainted object>.get(<arg>)` will be tainted, whether it's true or not.
|
||||
* Holds if taint can flow from `nodeFrom` to `nodeTo` with a step related to reading
|
||||
* content from containers (lists/sets/dictionaries/tuples): subscripts, iteration,
|
||||
* constructor invocation, methods.
|
||||
*/
|
||||
predicate containerStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
// construction by literal
|
||||
//
|
||||
// TODO: once we have proper flow-summary modeling, we might not need this step any
|
||||
// longer -- but there needs to be a matching read-step for the store-step, and we
|
||||
// don't provide that right now.
|
||||
DataFlowPrivate::listStoreStep(nodeFrom, _, nodeTo)
|
||||
or
|
||||
DataFlowPrivate::setStoreStep(nodeFrom, _, nodeTo)
|
||||
or
|
||||
DataFlowPrivate::tupleStoreStep(nodeFrom, _, nodeTo)
|
||||
or
|
||||
DataFlowPrivate::dictStoreStep(nodeFrom, _, nodeTo)
|
||||
or
|
||||
// comprehension, so there is taint-flow from `x` in `[x for x in xs]` to the
|
||||
// resulting list of the list-comprehension.
|
||||
//
|
||||
// TODO: once we have proper flow-summary modeling, we might not need this step any
|
||||
// longer -- but there needs to be a matching read-step for the store-step, and we
|
||||
// don't provide that right now.
|
||||
DataFlowPrivate::yieldStoreStep(nodeFrom, _, nodeTo)
|
||||
exists(DataFlow::ContentSet contentSet |
|
||||
DataFlowPrivate::readStep(nodeFrom, contentSet, nodeTo) and
|
||||
exists(DataFlow::Content c | c = contentSet.getAReadContent() |
|
||||
c instanceof DataFlow::TupleElementContent or
|
||||
c instanceof DataFlow::DictionaryElementContent or
|
||||
c instanceof DataFlow::DictionaryElementAnyContent or
|
||||
c instanceof DataFlow::ListElementContent or
|
||||
c instanceof DataFlow::SetElementContent
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -170,13 +170,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
|
||||
/** Holds if there is a level step from `nodeFrom` to `nodeTo`, which may depend on the call graph. */
|
||||
predicate levelStepCall(Node nodeFrom, LocalSourceNode nodeTo) {
|
||||
// HOTFIX: `instanceFieldStep` is temporarily disabled (via `and none()`).
|
||||
// It uses `classInstanceTracker(cls)` -- itself a type-tracker run --
|
||||
// from inside `levelStepCall`, creating a structural mutual recursion
|
||||
// that causes catastrophic query slowdowns on some OOP-heavy Python
|
||||
// codebases (e.g. mypy and dask). The `and none()` should be removed
|
||||
// once that recursion is redesigned.
|
||||
instanceFieldStep(nodeFrom, nodeTo) and none()
|
||||
instanceFieldStep(nodeFrom, nodeTo)
|
||||
or
|
||||
inheritedFieldStep(nodeFrom, nodeTo)
|
||||
}
|
||||
@@ -255,7 +249,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
// is only fed set/list content)
|
||||
not nodeFrom instanceof DataFlowPublic::IterableElementNode
|
||||
or
|
||||
TypeTrackerSummaryFlow::basicStoreStep(nodeFrom, nodeTo, content)
|
||||
TypeTrackerSummaryFlow::basicStoreStep(nodeFrom, nodeTo, DataFlowPublic::singleton(content))
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -286,14 +280,15 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
nodeFrom.asCfgNode() instanceof SequenceNode
|
||||
)
|
||||
or
|
||||
TypeTrackerSummaryFlow::basicLoadStep(nodeFrom, nodeTo, content)
|
||||
TypeTrackerSummaryFlow::basicLoadStep(nodeFrom, nodeTo, DataFlowPublic::singleton(content))
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the `loadContent` of `nodeFrom` is stored in the `storeContent` of `nodeTo`.
|
||||
*/
|
||||
predicate loadStoreStep(Node nodeFrom, Node nodeTo, Content loadContent, Content storeContent) {
|
||||
TypeTrackerSummaryFlow::basicLoadStoreStep(nodeFrom, nodeTo, loadContent, storeContent)
|
||||
TypeTrackerSummaryFlow::basicLoadStoreStep(nodeFrom, nodeTo,
|
||||
DataFlowPublic::singleton(loadContent), DataFlowPublic::singleton(storeContent))
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -4245,6 +4245,7 @@ module StdlibPrivate {
|
||||
)
|
||||
// TODO: Once we have DictKeyContent, we need to transform that into ListElementContent
|
||||
) and
|
||||
// Element content is mutated into list element content
|
||||
output = "ReturnValue.ListElement" and
|
||||
preservesValue = true
|
||||
or
|
||||
@@ -4271,11 +4272,9 @@ module StdlibPrivate {
|
||||
preservesValue = true
|
||||
)
|
||||
or
|
||||
// TODO: We need to also translate iterable content such as list element
|
||||
// but we currently lack TupleElementAny
|
||||
input = "Argument[0]" and
|
||||
input = "Argument[0].ListElement" and
|
||||
output = "ReturnValue" and
|
||||
preservesValue = false
|
||||
preservesValue = true
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4970,6 +4969,26 @@ module StdlibPrivate {
|
||||
}
|
||||
}
|
||||
|
||||
/** A flow summary for `str.join`. */
|
||||
class StrJoinSummary extends SummarizedCallable::Range {
|
||||
StrJoinSummary() { this = "str.join" }
|
||||
|
||||
override DataFlow::CallCfgNode getACall() { result.(DataFlow::MethodCallNode).calls(_, "join") }
|
||||
|
||||
override DataFlow::ArgumentNode getACallback() {
|
||||
result.(DataFlow::AttrRead).getAttributeName() = "join"
|
||||
}
|
||||
|
||||
override predicate propagatesFlow(string input, string output, boolean preservesValue) {
|
||||
(
|
||||
// For code like `" ".join([name])`
|
||||
input = "Argument[0,iterable:].ListElement" and
|
||||
preservesValue = true
|
||||
) and
|
||||
output = "ReturnValue"
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// asyncio
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
6
python/ql/lib/semmle/python/frameworks/lxml.model.yml
Normal file
6
python/ql/lib/semmle/python/frameworks/lxml.model.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/python-all
|
||||
extensible: summaryModel
|
||||
data:
|
||||
- ['lxml', 'Member[etree].Member[fromstringlist]', 'Argument[0,strings:].ListElement', 'ReturnValue', 'taint']
|
||||
6
python/ql/lib/semmle/python/frameworks/xml.model.yml
Normal file
6
python/ql/lib/semmle/python/frameworks/xml.model.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/python-all
|
||||
extensible: summaryModel
|
||||
data:
|
||||
- ['xml', 'Member[etree].Member[fromstringlist]', 'Argument[0,strings:].ListElement', 'ReturnValue', 'taint']
|
||||
@@ -61,10 +61,11 @@ module EscapingCaptureFlowConfig implements DataFlow::ConfigSig {
|
||||
predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet cs) {
|
||||
isSink(node) and
|
||||
(
|
||||
cs.(DataFlow::TupleElementContent).getIndex() in [0 .. 10] or
|
||||
cs instanceof DataFlow::ListElementContent or
|
||||
cs instanceof DataFlow::SetElementContent or
|
||||
cs instanceof DataFlow::DictionaryElementAnyContent
|
||||
cs.isAnyTupleOrDictionaryElement()
|
||||
or
|
||||
cs.getAStoreContent() instanceof DataFlow::ListElementContent
|
||||
or
|
||||
cs.getAStoreContent() instanceof DataFlow::SetElementContent
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,11 +3,15 @@ edges
|
||||
| TarSlipImprov.py:15:7:15:39 | ControlFlowNode for Attribute() | TarSlipImprov.py:15:1:15:3 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:17:5:17:10 | ControlFlowNode for member | TarSlipImprov.py:20:19:20:24 | ControlFlowNode for member | provenance | |
|
||||
| TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result | TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | provenance | |
|
||||
| TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result [List element] | TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | provenance | |
|
||||
| TarSlipImprov.py:20:19:20:24 | ControlFlowNode for member | TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result | provenance | list.append |
|
||||
| TarSlipImprov.py:20:19:20:24 | ControlFlowNode for member | TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result [List element] | provenance | list.append |
|
||||
| TarSlipImprov.py:26:21:26:27 | ControlFlowNode for tarfile | TarSlipImprov.py:28:9:28:14 | ControlFlowNode for member | provenance | |
|
||||
| TarSlipImprov.py:28:9:28:14 | ControlFlowNode for member | TarSlipImprov.py:35:23:35:28 | ControlFlowNode for member | provenance | |
|
||||
| TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result | TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result | provenance | |
|
||||
| TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result [List element] | TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result [List element] | provenance | |
|
||||
| TarSlipImprov.py:35:23:35:28 | ControlFlowNode for member | TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result | provenance | list.append |
|
||||
| TarSlipImprov.py:35:23:35:28 | ControlFlowNode for member | TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result [List element] | provenance | list.append |
|
||||
| TarSlipImprov.py:38:1:38:3 | ControlFlowNode for tar | TarSlipImprov.py:39:65:39:67 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:38:7:38:39 | ControlFlowNode for Attribute() | TarSlipImprov.py:38:1:38:3 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:39:65:39:67 | ControlFlowNode for tar | TarSlipImprov.py:26:21:26:27 | ControlFlowNode for tarfile | provenance | |
|
||||
@@ -34,16 +38,19 @@ edges
|
||||
| TarSlipImprov.py:142:9:142:13 | ControlFlowNode for entry | TarSlipImprov.py:143:36:143:40 | ControlFlowNode for entry | provenance | |
|
||||
| TarSlipImprov.py:151:14:151:50 | ControlFlowNode for closing() | TarSlipImprov.py:151:55:151:56 | ControlFlowNode for tf | provenance | |
|
||||
| TarSlipImprov.py:151:22:151:49 | ControlFlowNode for Attribute() | TarSlipImprov.py:151:14:151:50 | ControlFlowNode for closing() | provenance | Config |
|
||||
| TarSlipImprov.py:151:55:151:56 | ControlFlowNode for tf | TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield | provenance | |
|
||||
| TarSlipImprov.py:151:55:151:56 | ControlFlowNode for tf | TarSlipImprov.py:152:19:152:20 | ControlFlowNode for tf | provenance | |
|
||||
| TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield | TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() | provenance | |
|
||||
| TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield [List element] | TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() [List element] | provenance | |
|
||||
| TarSlipImprov.py:152:19:152:20 | ControlFlowNode for tf | TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield [List element] | provenance | |
|
||||
| TarSlipImprov.py:152:19:152:20 | ControlFlowNode for tf | TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() | provenance | |
|
||||
| TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm | TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc | provenance | |
|
||||
| TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm [List element] | TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc [List element] | provenance | |
|
||||
| TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() | TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm | provenance | |
|
||||
| TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() [List element] | TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm [List element] | provenance | |
|
||||
| TarSlipImprov.py:159:9:159:14 | ControlFlowNode for tar_cm | TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc | provenance | |
|
||||
| TarSlipImprov.py:159:18:159:52 | ControlFlowNode for closing() | TarSlipImprov.py:159:9:159:14 | ControlFlowNode for tar_cm | provenance | |
|
||||
| TarSlipImprov.py:159:26:159:51 | ControlFlowNode for Attribute() | TarSlipImprov.py:159:18:159:52 | ControlFlowNode for closing() | provenance | Config |
|
||||
| TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc | TarSlipImprov.py:169:9:169:12 | ControlFlowNode for tarc | provenance | |
|
||||
| TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc [List element] | TarSlipImprov.py:169:9:169:12 | ControlFlowNode for tarc | provenance | |
|
||||
| TarSlipImprov.py:176:6:176:31 | ControlFlowNode for Attribute() | TarSlipImprov.py:176:36:176:38 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:176:36:176:38 | ControlFlowNode for tar | TarSlipImprov.py:177:9:177:13 | ControlFlowNode for entry | provenance | |
|
||||
| TarSlipImprov.py:177:9:177:13 | ControlFlowNode for entry | TarSlipImprov.py:178:36:178:40 | ControlFlowNode for entry | provenance | |
|
||||
@@ -60,7 +67,9 @@ edges
|
||||
| TarSlipImprov.py:231:43:231:52 | ControlFlowNode for corpus_tar | TarSlipImprov.py:233:9:233:9 | ControlFlowNode for f | provenance | |
|
||||
| TarSlipImprov.py:233:9:233:9 | ControlFlowNode for f | TarSlipImprov.py:235:28:235:28 | ControlFlowNode for f | provenance | |
|
||||
| TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members | TarSlipImprov.py:236:44:236:50 | ControlFlowNode for members | provenance | |
|
||||
| TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members [List element] | TarSlipImprov.py:236:44:236:50 | ControlFlowNode for members | provenance | |
|
||||
| TarSlipImprov.py:235:28:235:28 | ControlFlowNode for f | TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members | provenance | list.append |
|
||||
| TarSlipImprov.py:235:28:235:28 | ControlFlowNode for f | TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members [List element] | provenance | list.append |
|
||||
| TarSlipImprov.py:258:6:258:26 | ControlFlowNode for Attribute() | TarSlipImprov.py:258:31:258:33 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:258:31:258:33 | ControlFlowNode for tar | TarSlipImprov.py:259:9:259:13 | ControlFlowNode for entry | provenance | |
|
||||
| TarSlipImprov.py:259:9:259:13 | ControlFlowNode for entry | TarSlipImprov.py:261:25:261:29 | ControlFlowNode for entry | provenance | |
|
||||
@@ -85,19 +94,24 @@ edges
|
||||
| TarSlipImprov.py:304:7:304:39 | ControlFlowNode for Attribute() | TarSlipImprov.py:304:1:304:3 | ControlFlowNode for tar | provenance | |
|
||||
| TarSlipImprov.py:306:5:306:10 | ControlFlowNode for member | TarSlipImprov.py:309:19:309:24 | ControlFlowNode for member | provenance | |
|
||||
| TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result | TarSlipImprov.py:310:49:310:54 | ControlFlowNode for result | provenance | |
|
||||
| TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result [List element] | TarSlipImprov.py:310:49:310:54 | ControlFlowNode for result | provenance | |
|
||||
| TarSlipImprov.py:309:19:309:24 | ControlFlowNode for member | TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result | provenance | list.append |
|
||||
| TarSlipImprov.py:309:19:309:24 | ControlFlowNode for member | TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result [List element] | provenance | list.append |
|
||||
nodes
|
||||
| TarSlipImprov.py:15:1:15:3 | ControlFlowNode for tar | semmle.label | ControlFlowNode for tar |
|
||||
| TarSlipImprov.py:15:7:15:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:17:5:17:10 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result | semmle.label | [post] ControlFlowNode for result |
|
||||
| TarSlipImprov.py:20:5:20:10 | [post] ControlFlowNode for result [List element] | semmle.label | [post] ControlFlowNode for result [List element] |
|
||||
| TarSlipImprov.py:20:19:20:24 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | semmle.label | ControlFlowNode for result |
|
||||
| TarSlipImprov.py:26:21:26:27 | ControlFlowNode for tarfile | semmle.label | ControlFlowNode for tarfile |
|
||||
| TarSlipImprov.py:28:9:28:14 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result | semmle.label | [post] ControlFlowNode for result |
|
||||
| TarSlipImprov.py:35:9:35:14 | [post] ControlFlowNode for result [List element] | semmle.label | [post] ControlFlowNode for result [List element] |
|
||||
| TarSlipImprov.py:35:23:35:28 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result | semmle.label | ControlFlowNode for result |
|
||||
| TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result [List element] | semmle.label | ControlFlowNode for result [List element] |
|
||||
| TarSlipImprov.py:38:1:38:3 | ControlFlowNode for tar | semmle.label | ControlFlowNode for tar |
|
||||
| TarSlipImprov.py:38:7:38:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() | semmle.label | ControlFlowNode for members_filter1() |
|
||||
@@ -133,14 +147,17 @@ nodes
|
||||
| TarSlipImprov.py:151:14:151:50 | ControlFlowNode for closing() | semmle.label | ControlFlowNode for closing() |
|
||||
| TarSlipImprov.py:151:22:151:49 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:151:55:151:56 | ControlFlowNode for tf | semmle.label | ControlFlowNode for tf |
|
||||
| TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield | semmle.label | ControlFlowNode for Yield |
|
||||
| TarSlipImprov.py:152:13:152:20 | ControlFlowNode for Yield [List element] | semmle.label | ControlFlowNode for Yield [List element] |
|
||||
| TarSlipImprov.py:152:19:152:20 | ControlFlowNode for tf | semmle.label | ControlFlowNode for tf |
|
||||
| TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm | semmle.label | ControlFlowNode for tar_cm |
|
||||
| TarSlipImprov.py:157:9:157:14 | ControlFlowNode for tar_cm [List element] | semmle.label | ControlFlowNode for tar_cm [List element] |
|
||||
| TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() | semmle.label | ControlFlowNode for py2_tarxz() |
|
||||
| TarSlipImprov.py:157:18:157:40 | ControlFlowNode for py2_tarxz() [List element] | semmle.label | ControlFlowNode for py2_tarxz() [List element] |
|
||||
| TarSlipImprov.py:159:9:159:14 | ControlFlowNode for tar_cm | semmle.label | ControlFlowNode for tar_cm |
|
||||
| TarSlipImprov.py:159:18:159:52 | ControlFlowNode for closing() | semmle.label | ControlFlowNode for closing() |
|
||||
| TarSlipImprov.py:159:26:159:51 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc | semmle.label | ControlFlowNode for tarc |
|
||||
| TarSlipImprov.py:162:20:162:23 | ControlFlowNode for tarc [List element] | semmle.label | ControlFlowNode for tarc [List element] |
|
||||
| TarSlipImprov.py:169:9:169:12 | ControlFlowNode for tarc | semmle.label | ControlFlowNode for tarc |
|
||||
| TarSlipImprov.py:176:6:176:31 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:176:36:176:38 | ControlFlowNode for tar | semmle.label | ControlFlowNode for tar |
|
||||
@@ -163,6 +180,7 @@ nodes
|
||||
| TarSlipImprov.py:231:43:231:52 | ControlFlowNode for corpus_tar | semmle.label | ControlFlowNode for corpus_tar |
|
||||
| TarSlipImprov.py:233:9:233:9 | ControlFlowNode for f | semmle.label | ControlFlowNode for f |
|
||||
| TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members | semmle.label | [post] ControlFlowNode for members |
|
||||
| TarSlipImprov.py:235:13:235:19 | [post] ControlFlowNode for members [List element] | semmle.label | [post] ControlFlowNode for members [List element] |
|
||||
| TarSlipImprov.py:235:28:235:28 | ControlFlowNode for f | semmle.label | ControlFlowNode for f |
|
||||
| TarSlipImprov.py:236:44:236:50 | ControlFlowNode for members | semmle.label | ControlFlowNode for members |
|
||||
| TarSlipImprov.py:254:1:254:31 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
@@ -198,11 +216,13 @@ nodes
|
||||
| TarSlipImprov.py:304:7:304:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| TarSlipImprov.py:306:5:306:10 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result | semmle.label | [post] ControlFlowNode for result |
|
||||
| TarSlipImprov.py:309:5:309:10 | [post] ControlFlowNode for result [List element] | semmle.label | [post] ControlFlowNode for result [List element] |
|
||||
| TarSlipImprov.py:309:19:309:24 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| TarSlipImprov.py:310:49:310:54 | ControlFlowNode for result | semmle.label | ControlFlowNode for result |
|
||||
| TarSlipImprov.py:316:1:316:46 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
subpaths
|
||||
| TarSlipImprov.py:39:65:39:67 | ControlFlowNode for tar | TarSlipImprov.py:26:21:26:27 | ControlFlowNode for tarfile | TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result | TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() |
|
||||
| TarSlipImprov.py:39:65:39:67 | ControlFlowNode for tar | TarSlipImprov.py:26:21:26:27 | ControlFlowNode for tarfile | TarSlipImprov.py:36:12:36:17 | ControlFlowNode for result [List element] | TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() |
|
||||
#select
|
||||
| TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | TarSlipImprov.py:15:7:15:39 | ControlFlowNode for Attribute() | TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | Extraction of tarfile from $@ to a potentially untrusted source $@. | TarSlipImprov.py:15:7:15:39 | ControlFlowNode for Attribute() | ControlFlowNode for Attribute() | TarSlipImprov.py:22:35:22:40 | ControlFlowNode for result | ControlFlowNode for result |
|
||||
| TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() | TarSlipImprov.py:38:7:38:39 | ControlFlowNode for Attribute() | TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() | Extraction of tarfile from $@ to a potentially untrusted source $@. | TarSlipImprov.py:38:7:38:39 | ControlFlowNode for Attribute() | ControlFlowNode for Attribute() | TarSlipImprov.py:39:49:39:68 | ControlFlowNode for members_filter1() | ControlFlowNode for members_filter1() |
|
||||
|
||||
@@ -93,7 +93,9 @@ edges
|
||||
| UnsafeUnpack.py:163:23:163:28 | ControlFlowNode for member | UnsafeUnpack.py:166:37:166:42 | ControlFlowNode for member | provenance | |
|
||||
| UnsafeUnpack.py:163:33:163:35 | ControlFlowNode for tar | UnsafeUnpack.py:163:23:163:28 | ControlFlowNode for member | provenance | |
|
||||
| UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result | UnsafeUnpack.py:167:67:167:72 | ControlFlowNode for result | provenance | |
|
||||
| UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result [List element] | UnsafeUnpack.py:167:67:167:72 | ControlFlowNode for result | provenance | |
|
||||
| UnsafeUnpack.py:166:37:166:42 | ControlFlowNode for member | UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result | provenance | list.append |
|
||||
| UnsafeUnpack.py:166:37:166:42 | ControlFlowNode for member | UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result [List element] | provenance | list.append |
|
||||
| UnsafeUnpack.py:171:1:171:8 | ControlFlowNode for response | UnsafeUnpack.py:174:15:174:22 | ControlFlowNode for response | provenance | |
|
||||
| UnsafeUnpack.py:171:12:171:50 | ControlFlowNode for Attribute() | UnsafeUnpack.py:171:1:171:8 | ControlFlowNode for response | provenance | |
|
||||
| UnsafeUnpack.py:173:11:173:17 | ControlFlowNode for tarpath | UnsafeUnpack.py:176:17:176:23 | ControlFlowNode for tarpath | provenance | |
|
||||
@@ -189,6 +191,7 @@ nodes
|
||||
| UnsafeUnpack.py:163:23:163:28 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| UnsafeUnpack.py:163:33:163:35 | ControlFlowNode for tar | semmle.label | ControlFlowNode for tar |
|
||||
| UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result | semmle.label | [post] ControlFlowNode for result |
|
||||
| UnsafeUnpack.py:166:23:166:28 | [post] ControlFlowNode for result [List element] | semmle.label | [post] ControlFlowNode for result [List element] |
|
||||
| UnsafeUnpack.py:166:37:166:42 | ControlFlowNode for member | semmle.label | ControlFlowNode for member |
|
||||
| UnsafeUnpack.py:167:67:167:72 | ControlFlowNode for result | semmle.label | ControlFlowNode for result |
|
||||
| UnsafeUnpack.py:171:1:171:8 | ControlFlowNode for response | semmle.label | ControlFlowNode for response |
|
||||
|
||||
@@ -3,8 +3,10 @@ edges
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:20:45:20:47 | ControlFlowNode for cmd | provenance | |
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:21:52:21:54 | ControlFlowNode for cmd | provenance | |
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:22:52:22:54 | ControlFlowNode for cmd | provenance | |
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:23:41:23:57 | ControlFlowNode for List | provenance | |
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:23:43:23:45 | ControlFlowNode for cmd | provenance | |
|
||||
| Netmiko.py:18:16:18:18 | ControlFlowNode for cmd | Netmiko.py:24:48:24:50 | ControlFlowNode for cmd | provenance | |
|
||||
| Netmiko.py:23:42:23:56 | ControlFlowNode for List [List element] | Netmiko.py:23:41:23:57 | ControlFlowNode for List | provenance | |
|
||||
| Netmiko.py:23:43:23:45 | ControlFlowNode for cmd | Netmiko.py:23:42:23:56 | ControlFlowNode for List [List element] | provenance | |
|
||||
| Pexpect.py:15:16:15:18 | ControlFlowNode for cmd | Pexpect.py:16:14:16:16 | ControlFlowNode for cmd | provenance | |
|
||||
| Pexpect.py:15:16:15:18 | ControlFlowNode for cmd | Pexpect.py:18:18:18:20 | ControlFlowNode for cmd | provenance | |
|
||||
| Scrapli.py:13:16:13:18 | ControlFlowNode for cmd | Scrapli.py:24:42:24:44 | ControlFlowNode for cmd | provenance | |
|
||||
@@ -32,6 +34,8 @@ nodes
|
||||
| Netmiko.py:21:52:21:54 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
| Netmiko.py:22:52:22:54 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
| Netmiko.py:23:41:23:57 | ControlFlowNode for List | semmle.label | ControlFlowNode for List |
|
||||
| Netmiko.py:23:42:23:56 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
|
||||
| Netmiko.py:23:43:23:45 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
| Netmiko.py:24:48:24:50 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
| Pexpect.py:15:16:15:18 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
| Pexpect.py:16:14:16:16 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
|
||||
|
||||
@@ -14,6 +14,7 @@ edges
|
||||
| xslt.py:10:17:10:43 | ControlFlowNode for Attribute() | xslt.py:10:5:10:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xslt.py:11:5:11:13 | ControlFlowNode for xslt_root | xslt.py:14:29:14:37 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xslt.py:11:17:11:36 | ControlFlowNode for Attribute() | xslt.py:11:5:11:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xslt.py:11:27:11:35 | ControlFlowNode for xsltQuery | xslt.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xslt.py:11:27:11:35 | ControlFlowNode for xsltQuery | xslt.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xslt.py:11:27:11:35 | ControlFlowNode for xsltQuery | xslt.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:3:26:3:32 | ControlFlowNode for ImportMember | xsltInjection.py:3:26:3:32 | ControlFlowNode for request | provenance | |
|
||||
@@ -28,6 +29,7 @@ edges
|
||||
| xsltInjection.py:10:17:10:43 | ControlFlowNode for Attribute() | xsltInjection.py:10:5:10:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:11:5:11:13 | ControlFlowNode for xslt_root | xsltInjection.py:12:28:12:36 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:11:17:11:36 | ControlFlowNode for Attribute() | xsltInjection.py:11:5:11:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:11:27:11:35 | ControlFlowNode for xsltQuery | xsltInjection.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xsltInjection.py:11:27:11:35 | ControlFlowNode for xsltQuery | xsltInjection.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:11:27:11:35 | ControlFlowNode for xsltQuery | xsltInjection.py:11:17:11:36 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:17:5:17:13 | ControlFlowNode for xsltQuery | xsltInjection.py:18:27:18:35 | ControlFlowNode for xsltQuery | provenance | |
|
||||
@@ -36,6 +38,7 @@ edges
|
||||
| xsltInjection.py:17:17:17:43 | ControlFlowNode for Attribute() | xsltInjection.py:17:5:17:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:18:5:18:13 | ControlFlowNode for xslt_root | xsltInjection.py:21:29:21:37 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:18:17:18:36 | ControlFlowNode for Attribute() | xsltInjection.py:18:5:18:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:18:27:18:35 | ControlFlowNode for xsltQuery | xsltInjection.py:18:17:18:36 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xsltInjection.py:18:27:18:35 | ControlFlowNode for xsltQuery | xsltInjection.py:18:17:18:36 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:18:27:18:35 | ControlFlowNode for xsltQuery | xsltInjection.py:18:17:18:36 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:26:5:26:13 | ControlFlowNode for xsltQuery | xsltInjection.py:27:27:27:35 | ControlFlowNode for xsltQuery | provenance | |
|
||||
@@ -44,6 +47,7 @@ edges
|
||||
| xsltInjection.py:26:17:26:43 | ControlFlowNode for Attribute() | xsltInjection.py:26:5:26:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:27:5:27:13 | ControlFlowNode for xslt_root | xsltInjection.py:31:24:31:32 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:27:17:27:36 | ControlFlowNode for Attribute() | xsltInjection.py:27:5:27:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:27:27:27:35 | ControlFlowNode for xsltQuery | xsltInjection.py:27:17:27:36 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xsltInjection.py:27:27:27:35 | ControlFlowNode for xsltQuery | xsltInjection.py:27:17:27:36 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:27:27:27:35 | ControlFlowNode for xsltQuery | xsltInjection.py:27:17:27:36 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:35:5:35:13 | ControlFlowNode for xsltQuery | xsltInjection.py:36:34:36:42 | ControlFlowNode for xsltQuery | provenance | |
|
||||
@@ -52,17 +56,22 @@ edges
|
||||
| xsltInjection.py:35:17:35:43 | ControlFlowNode for Attribute() | xsltInjection.py:35:5:35:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:36:5:36:13 | ControlFlowNode for xslt_root | xsltInjection.py:40:24:40:32 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:36:17:36:43 | ControlFlowNode for Attribute() | xsltInjection.py:36:5:36:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:36:34:36:42 | ControlFlowNode for xsltQuery | xsltInjection.py:36:17:36:43 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xsltInjection.py:36:34:36:42 | ControlFlowNode for xsltQuery | xsltInjection.py:36:17:36:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:36:34:36:42 | ControlFlowNode for xsltQuery | xsltInjection.py:36:17:36:43 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:44:5:44:13 | ControlFlowNode for xsltQuery | xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings | provenance | |
|
||||
| xsltInjection.py:44:5:44:13 | ControlFlowNode for xsltQuery | xsltInjection.py:45:20:45:28 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:44:17:44:23 | ControlFlowNode for request | xsltInjection.py:44:17:44:28 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| xsltInjection.py:44:17:44:28 | ControlFlowNode for Attribute | xsltInjection.py:44:17:44:43 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| xsltInjection.py:44:17:44:43 | ControlFlowNode for Attribute() | xsltInjection.py:44:5:44:13 | ControlFlowNode for xsltQuery | provenance | |
|
||||
| xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings | xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings | provenance | |
|
||||
| xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings [List element] | xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | provenance | |
|
||||
| xsltInjection.py:45:19:45:44 | ControlFlowNode for List [List element] | xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings [List element] | provenance | |
|
||||
| xsltInjection.py:45:20:45:28 | ControlFlowNode for xsltQuery | xsltInjection.py:45:19:45:44 | ControlFlowNode for List [List element] | provenance | |
|
||||
| xsltInjection.py:46:5:46:13 | ControlFlowNode for xslt_root | xsltInjection.py:50:24:50:32 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | xsltInjection.py:46:5:46:13 | ControlFlowNode for xslt_root | provenance | |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | Decoding-XML |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | provenance | MaD:58660 |
|
||||
nodes
|
||||
| xslt.py:3:26:3:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
|
||||
| xslt.py:3:26:3:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
@@ -112,9 +121,11 @@ nodes
|
||||
| xsltInjection.py:44:17:44:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| xsltInjection.py:44:17:44:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
|
||||
| xsltInjection.py:44:17:44:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings | semmle.label | ControlFlowNode for xsltStrings |
|
||||
| xsltInjection.py:45:5:45:15 | ControlFlowNode for xsltStrings [List element] | semmle.label | ControlFlowNode for xsltStrings [List element] |
|
||||
| xsltInjection.py:45:19:45:44 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
|
||||
| xsltInjection.py:45:20:45:28 | ControlFlowNode for xsltQuery | semmle.label | ControlFlowNode for xsltQuery |
|
||||
| xsltInjection.py:46:5:46:13 | ControlFlowNode for xslt_root | semmle.label | ControlFlowNode for xslt_root |
|
||||
| xsltInjection.py:46:17:46:49 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings | semmle.label | ControlFlowNode for xsltStrings |
|
||||
| xsltInjection.py:46:38:46:48 | ControlFlowNode for xsltStrings [List element] | semmle.label | ControlFlowNode for xsltStrings [List element] |
|
||||
| xsltInjection.py:50:24:50:32 | ControlFlowNode for xslt_root | semmle.label | ControlFlowNode for xslt_root |
|
||||
subpaths
|
||||
|
||||
@@ -32,11 +32,13 @@ edges
|
||||
| agent_instructions.py:7:5:7:9 | ControlFlowNode for input | agent_instructions.py:9:50:9:89 | ControlFlowNode for BinaryExpr | provenance | Sink:MaD:11 |
|
||||
| agent_instructions.py:7:13:7:19 | ControlFlowNode for request | agent_instructions.py:7:13:7:24 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| agent_instructions.py:7:13:7:24 | ControlFlowNode for Attribute | agent_instructions.py:7:13:7:37 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| agent_instructions.py:7:13:7:24 | ControlFlowNode for Attribute | agent_instructions.py:7:13:7:37 | ControlFlowNode for Attribute() | provenance | dict.get(input) |
|
||||
| agent_instructions.py:7:13:7:37 | ControlFlowNode for Attribute() | agent_instructions.py:7:5:7:9 | ControlFlowNode for input | provenance | |
|
||||
| agent_instructions.py:17:5:17:9 | ControlFlowNode for input | agent_instructions.py:25:28:25:32 | ControlFlowNode for input | provenance | |
|
||||
| agent_instructions.py:17:5:17:9 | ControlFlowNode for input | agent_instructions.py:35:28:35:32 | ControlFlowNode for input | provenance | |
|
||||
| agent_instructions.py:17:13:17:19 | ControlFlowNode for request | agent_instructions.py:17:13:17:24 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| agent_instructions.py:17:13:17:24 | ControlFlowNode for Attribute | agent_instructions.py:17:13:17:37 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| agent_instructions.py:17:13:17:24 | ControlFlowNode for Attribute | agent_instructions.py:17:13:17:37 | ControlFlowNode for Attribute() | provenance | dict.get(input) |
|
||||
| agent_instructions.py:17:13:17:37 | ControlFlowNode for Attribute() | agent_instructions.py:17:5:17:9 | ControlFlowNode for input | provenance | |
|
||||
| anthropic_test.py:2:26:2:32 | ControlFlowNode for ImportMember | anthropic_test.py:2:26:2:32 | ControlFlowNode for request | provenance | |
|
||||
| anthropic_test.py:2:26:2:32 | ControlFlowNode for request | anthropic_test.py:11:15:11:21 | ControlFlowNode for request | provenance | |
|
||||
@@ -61,7 +63,7 @@ edges
|
||||
| openai_test.py:2:26:2:32 | ControlFlowNode for request | openai_test.py:13:13:13:19 | ControlFlowNode for request | provenance | |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:17:22:17:46 | ControlFlowNode for BinaryExpr | provenance | Sink:MaD:10 |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:22:22:22:46 | ControlFlowNode for BinaryExpr | provenance | Sink:MaD:10 |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:26:28:26:51 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:26:28:26:51 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:41:22:41:46 | ControlFlowNode for BinaryExpr | provenance | Sink:MaD:10 |
|
||||
| openai_test.py:12:5:12:11 | ControlFlowNode for persona | openai_test.py:63:28:63:51 | ControlFlowNode for BinaryExpr | provenance | Sink:MaD:8 |
|
||||
@@ -72,7 +74,7 @@ edges
|
||||
| openai_test.py:12:15:12:26 | ControlFlowNode for Attribute | openai_test.py:12:15:12:41 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| openai_test.py:12:15:12:41 | ControlFlowNode for Attribute() | openai_test.py:12:5:12:11 | ControlFlowNode for persona | provenance | |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:18:15:18:19 | ControlFlowNode for query | provenance | Sink:MaD:9 |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:33:33:33:37 | ControlFlowNode for query | provenance | |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:33:33:33:37 | ControlFlowNode for query | provenance | |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:42:15:42:19 | ControlFlowNode for query | provenance | Sink:MaD:9 |
|
||||
| openai_test.py:13:5:13:9 | ControlFlowNode for query | openai_test.py:53:33:53:37 | ControlFlowNode for query | provenance | |
|
||||
@@ -82,6 +84,14 @@ edges
|
||||
| openai_test.py:13:13:13:19 | ControlFlowNode for request | openai_test.py:13:13:13:24 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| openai_test.py:13:13:13:24 | ControlFlowNode for Attribute | openai_test.py:13:13:13:37 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| openai_test.py:13:13:13:37 | ControlFlowNode for Attribute() | openai_test.py:13:5:13:9 | ControlFlowNode for query | provenance | |
|
||||
| openai_test.py:24:13:27:13 | ControlFlowNode for Dict [Dictionary element at key content] | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 Sink:MaD:9 |
|
||||
| openai_test.py:26:28:26:51 | ControlFlowNode for BinaryExpr | openai_test.py:24:13:27:13 | ControlFlowNode for Dict [Dictionary element at key content] | provenance | |
|
||||
| openai_test.py:28:13:36:13 | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 Sink:MaD:9 |
|
||||
| openai_test.py:28:13:36:13 | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 Sink:MaD:9 Sink:MaD:9 |
|
||||
| openai_test.py:28:13:36:13 | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] | openai_test.py:23:15:37:9 | ControlFlowNode for List | provenance | Sink:MaD:9 Sink:MaD:9 Sink:MaD:9 Sink:MaD:9 |
|
||||
| openai_test.py:30:28:35:17 | ControlFlowNode for List [List element, Dictionary element at key text] | openai_test.py:28:13:36:13 | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] | provenance | |
|
||||
| openai_test.py:31:21:34:21 | ControlFlowNode for Dict [Dictionary element at key text] | openai_test.py:30:28:35:17 | ControlFlowNode for List [List element, Dictionary element at key text] | provenance | |
|
||||
| openai_test.py:33:33:33:37 | ControlFlowNode for query | openai_test.py:31:21:34:21 | ControlFlowNode for Dict [Dictionary element at key text] | provenance | |
|
||||
models
|
||||
| 1 | Sink: Anthropic; Member[beta].Member[messages].Member[create].Argument[messages:].ListElement.DictionaryElement[content]; prompt-injection |
|
||||
| 2 | Sink: Anthropic; Member[beta].Member[messages].Member[create].Argument[system:]; prompt-injection |
|
||||
@@ -140,7 +150,13 @@ nodes
|
||||
| openai_test.py:18:15:18:19 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| openai_test.py:22:22:22:46 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| openai_test.py:23:15:37:9 | ControlFlowNode for List | semmle.label | ControlFlowNode for List |
|
||||
| openai_test.py:24:13:27:13 | ControlFlowNode for Dict [Dictionary element at key content] | semmle.label | ControlFlowNode for Dict [Dictionary element at key content] |
|
||||
| openai_test.py:26:28:26:51 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| openai_test.py:26:28:26:51 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| openai_test.py:28:13:36:13 | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] | semmle.label | ControlFlowNode for Dict [Dictionary element at key content, List element, Dictionary element at key text] |
|
||||
| openai_test.py:30:28:35:17 | ControlFlowNode for List [List element, Dictionary element at key text] | semmle.label | ControlFlowNode for List [List element, Dictionary element at key text] |
|
||||
| openai_test.py:31:21:34:21 | ControlFlowNode for Dict [Dictionary element at key text] | semmle.label | ControlFlowNode for Dict [Dictionary element at key text] |
|
||||
| openai_test.py:33:33:33:37 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| openai_test.py:33:33:33:37 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| openai_test.py:41:22:41:46 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| openai_test.py:42:15:42:19 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
|
||||
@@ -131,6 +131,5 @@ from unknown_settings import password # $ SensitiveDataSource=password
|
||||
print(password) # $ SensitiveUse=password
|
||||
_config = {"sleep_timer": 5, "mysql_password": password}
|
||||
|
||||
# since we have taint-step from store of `password`, we will consider any item in the
|
||||
# dictionary to be a password :(
|
||||
print(_config["sleep_timer"]) # $ SPURIOUS: SensitiveUse=password
|
||||
# since we have precise dictionary content, other items of the config are not tainted
|
||||
print(_config["sleep_timer"])
|
||||
|
||||
@@ -7,13 +7,9 @@ edges
|
||||
| summaries.py:36:38:36:38 | ControlFlowNode for x | summaries.py:36:41:36:45 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | summaries.py:36:18:36:54 | ControlFlowNode for apply_lambda() | provenance | apply_lambda |
|
||||
| summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | summaries.py:36:38:36:38 | ControlFlowNode for x | provenance | apply_lambda |
|
||||
| summaries.py:44:1:44:12 | ControlFlowNode for tainted_list | summaries.py:45:6:45:20 | ControlFlowNode for Subscript | provenance | |
|
||||
| summaries.py:44:1:44:12 | ControlFlowNode for tainted_list [List element] | summaries.py:45:6:45:17 | ControlFlowNode for tainted_list [List element] | provenance | |
|
||||
| summaries.py:44:16:44:33 | ControlFlowNode for reversed() | summaries.py:44:1:44:12 | ControlFlowNode for tainted_list | provenance | |
|
||||
| summaries.py:44:16:44:33 | ControlFlowNode for reversed() [List element] | summaries.py:44:1:44:12 | ControlFlowNode for tainted_list [List element] | provenance | |
|
||||
| summaries.py:44:25:44:32 | ControlFlowNode for List | summaries.py:44:16:44:33 | ControlFlowNode for reversed() | provenance | builtins.reversed |
|
||||
| summaries.py:44:25:44:32 | ControlFlowNode for List [List element] | summaries.py:44:16:44:33 | ControlFlowNode for reversed() [List element] | provenance | builtins.reversed |
|
||||
| summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | summaries.py:44:25:44:32 | ControlFlowNode for List | provenance | |
|
||||
| summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | summaries.py:44:25:44:32 | ControlFlowNode for List [List element] | provenance | |
|
||||
| summaries.py:45:6:45:17 | ControlFlowNode for tainted_list [List element] | summaries.py:45:6:45:20 | ControlFlowNode for Subscript | provenance | |
|
||||
| summaries.py:48:15:48:15 | ControlFlowNode for x | summaries.py:49:12:49:18 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
@@ -42,6 +38,7 @@ edges
|
||||
| summaries.py:67:1:67:18 | ControlFlowNode for tainted_resultlist | summaries.py:68:6:68:26 | ControlFlowNode for Subscript | provenance | |
|
||||
| summaries.py:67:1:67:18 | ControlFlowNode for tainted_resultlist [List element] | summaries.py:68:6:68:23 | ControlFlowNode for tainted_resultlist [List element] | provenance | |
|
||||
| summaries.py:67:22:67:39 | ControlFlowNode for json_loads() [List element] | summaries.py:67:1:67:18 | ControlFlowNode for tainted_resultlist [List element] | provenance | |
|
||||
| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:67:1:67:18 | ControlFlowNode for tainted_resultlist | provenance | |
|
||||
| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:67:1:67:18 | ControlFlowNode for tainted_resultlist | provenance | Decoding-JSON |
|
||||
| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:67:22:67:39 | ControlFlowNode for json_loads() [List element] | provenance | json.loads |
|
||||
| summaries.py:68:6:68:23 | ControlFlowNode for tainted_resultlist [List element] | summaries.py:68:6:68:26 | ControlFlowNode for Subscript | provenance | |
|
||||
@@ -56,11 +53,8 @@ nodes
|
||||
| summaries.py:36:41:36:45 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
|
||||
| summaries.py:37:6:37:19 | ControlFlowNode for tainted_lambda | semmle.label | ControlFlowNode for tainted_lambda |
|
||||
| summaries.py:44:1:44:12 | ControlFlowNode for tainted_list | semmle.label | ControlFlowNode for tainted_list |
|
||||
| summaries.py:44:1:44:12 | ControlFlowNode for tainted_list [List element] | semmle.label | ControlFlowNode for tainted_list [List element] |
|
||||
| summaries.py:44:16:44:33 | ControlFlowNode for reversed() | semmle.label | ControlFlowNode for reversed() |
|
||||
| summaries.py:44:16:44:33 | ControlFlowNode for reversed() [List element] | semmle.label | ControlFlowNode for reversed() [List element] |
|
||||
| summaries.py:44:25:44:32 | ControlFlowNode for List | semmle.label | ControlFlowNode for List |
|
||||
| summaries.py:44:25:44:32 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
|
||||
| summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
|
||||
| summaries.py:45:6:45:17 | ControlFlowNode for tainted_list [List element] | semmle.label | ControlFlowNode for tainted_list [List element] |
|
||||
|
||||
@@ -32,7 +32,6 @@ def test_construction():
|
||||
list(tainted_tuple), # $ tainted
|
||||
list(tainted_set), # $ tainted
|
||||
list(tainted_dict.values()), # $ tainted
|
||||
list(tainted_dict.items()), # $ tainted
|
||||
|
||||
tuple(tainted_list), # $ tainted
|
||||
set(tainted_list), # $ tainted
|
||||
@@ -41,10 +40,11 @@ def test_construction():
|
||||
dict(k = tainted_string)["k"], # $ tainted
|
||||
dict(dict(k = tainted_string))["k"], # $ tainted
|
||||
dict(["k", tainted_string]), # $ tainted
|
||||
list(tainted_dict.items()), # $ tainted
|
||||
)
|
||||
|
||||
ensure_not_tainted(
|
||||
dict(k = tainted_string)["k1"]
|
||||
dict(k = tainted_string)["k1"],
|
||||
)
|
||||
|
||||
|
||||
@@ -59,7 +59,7 @@ def test_access(x, y, z):
|
||||
sorted(tainted_list), # $ tainted
|
||||
reversed(tainted_list), # $ tainted
|
||||
iter(tainted_list), # $ tainted
|
||||
next(iter(tainted_list)), # $ MISSING: tainted
|
||||
next(iter(tainted_list)), # $ tainted
|
||||
[i for i in tainted_list], # $ tainted
|
||||
[tainted_list for _i in [1,2,3]], # $ tainted
|
||||
)
|
||||
|
||||
@@ -53,7 +53,7 @@ def contrived_1():
|
||||
|
||||
(a, b, c), (d, e, f) = tainted_list, no_taint_list
|
||||
ensure_tainted(a, b, c) # $ tainted
|
||||
ensure_not_tainted(d, e, f) # $ SPURIOUS: tainted
|
||||
ensure_not_tainted(d, e, f)
|
||||
|
||||
|
||||
def contrived_2():
|
||||
|
||||
@@ -157,7 +157,7 @@ class MyClass2(object):
|
||||
print(self.foo) # $ tracked MISSING: tracked=foo
|
||||
|
||||
instance = MyClass2()
|
||||
print(instance.foo) # $ MISSING: tracked=foo tracked
|
||||
print(instance.foo) # $ tracked MISSING: tracked=foo
|
||||
instance.print_foo() # $ MISSING: tracked=foo
|
||||
|
||||
|
||||
@@ -195,7 +195,7 @@ class Sub1(Base1):
|
||||
|
||||
sub1 = Sub1()
|
||||
sub1.read_foo()
|
||||
print(sub1.foo) # $ MISSING: tracked=foo tracked
|
||||
print(sub1.foo) # $ tracked MISSING: tracked=foo
|
||||
|
||||
|
||||
# attribute written in a subclass method, read in an inherited base class method
|
||||
@@ -210,7 +210,7 @@ class Sub2(Base2):
|
||||
|
||||
sub2 = Sub2()
|
||||
sub2.read_bar()
|
||||
print(sub2.bar) # $ MISSING: tracked=bar tracked
|
||||
print(sub2.bar) # $ tracked MISSING: tracked=bar
|
||||
|
||||
|
||||
# attribute written in a base class method, read on an instance of the subclass
|
||||
@@ -223,4 +223,4 @@ class Sub3(Base3):
|
||||
pass
|
||||
|
||||
sub3 = Sub3()
|
||||
print(sub3.baz) # $ MISSING: tracked=baz tracked
|
||||
print(sub3.baz) # $ tracked MISSING: tracked=baz
|
||||
|
||||
@@ -3,10 +3,12 @@ edges
|
||||
| taint_step_test.py:5:12:5:35 | ControlFlowNode for Attribute() | taint_step_test.py:5:5:5:8 | ControlFlowNode for path | provenance | |
|
||||
| taint_step_test.py:6:5:6:8 | ControlFlowNode for file | taint_step_test.py:19:48:19:51 | ControlFlowNode for file | provenance | |
|
||||
| taint_step_test.py:6:12:6:35 | ControlFlowNode for Attribute() | taint_step_test.py:6:5:6:8 | ControlFlowNode for file | provenance | |
|
||||
| taint_step_test.py:11:18:11:21 | ControlFlowNode for path | taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | provenance | |
|
||||
| taint_step_test.py:11:18:11:21 | ControlFlowNode for path | taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | provenance | AdditionalTaintStep |
|
||||
| taint_step_test.py:11:18:11:21 | ControlFlowNode for path | taint_step_test.py:12:33:12:36 | ControlFlowNode for path | provenance | |
|
||||
| taint_step_test.py:11:24:11:27 | ControlFlowNode for file | taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | provenance | AdditionalTaintStep |
|
||||
| taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | taint_step_test.py:13:19:13:26 | ControlFlowNode for filepath | provenance | |
|
||||
| taint_step_test.py:12:20:12:43 | ControlFlowNode for Attribute() | taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | provenance | |
|
||||
| taint_step_test.py:12:33:12:36 | ControlFlowNode for path | taint_step_test.py:12:20:12:43 | ControlFlowNode for Attribute() | provenance | str.join |
|
||||
| taint_step_test.py:19:43:19:46 | ControlFlowNode for path | taint_step_test.py:11:18:11:21 | ControlFlowNode for path | provenance | AdditionalTaintStep |
|
||||
| taint_step_test.py:19:48:19:51 | ControlFlowNode for file | taint_step_test.py:11:24:11:27 | ControlFlowNode for file | provenance | AdditionalTaintStep |
|
||||
nodes
|
||||
@@ -17,6 +19,8 @@ nodes
|
||||
| taint_step_test.py:11:18:11:21 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
|
||||
| taint_step_test.py:11:24:11:27 | ControlFlowNode for file | semmle.label | ControlFlowNode for file |
|
||||
| taint_step_test.py:12:9:12:16 | ControlFlowNode for filepath | semmle.label | ControlFlowNode for filepath |
|
||||
| taint_step_test.py:12:20:12:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| taint_step_test.py:12:33:12:36 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
|
||||
| taint_step_test.py:13:19:13:26 | ControlFlowNode for filepath | semmle.label | ControlFlowNode for filepath |
|
||||
| taint_step_test.py:19:43:19:46 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
|
||||
| taint_step_test.py:19:48:19:51 | ControlFlowNode for file | semmle.label | ControlFlowNode for file |
|
||||
|
||||
@@ -6,16 +6,16 @@ pat = ... # some pattern
|
||||
compiled_pat = re.compile(pat)
|
||||
|
||||
# see https://docs.python.org/3/library/re.html#functions
|
||||
ensure_not_tainted(
|
||||
# returns Match object, which is tested properly below. (note: with the flow summary
|
||||
# modeling, objects containing tainted values are not themselves tainted).
|
||||
re.search(pat, ts),
|
||||
re.match(pat, ts),
|
||||
re.fullmatch(pat, ts),
|
||||
ensure_tainted(
|
||||
# returns Match object, which is tested properly below. (note: the match objects contain
|
||||
# tainted values but are not themselves tainted - this test relies on implicit reads at sinks).
|
||||
re.search(pat, ts), # $ tainted
|
||||
re.match(pat, ts), # $ tainted
|
||||
re.fullmatch(pat, ts), # $ tainted
|
||||
|
||||
compiled_pat.search(ts),
|
||||
compiled_pat.match(ts),
|
||||
compiled_pat.fullmatch(ts),
|
||||
compiled_pat.search(ts), # $ tainted
|
||||
compiled_pat.match(ts), # $ tainted
|
||||
compiled_pat.fullmatch(ts), # $ tainted
|
||||
)
|
||||
|
||||
# Match object
|
||||
@@ -80,9 +80,9 @@ ensure_tainted(
|
||||
)
|
||||
|
||||
ensure_not_tainted(
|
||||
re.subn(pat, repl="safe", string=ts),
|
||||
re.subn(pat, repl="safe", string=ts)[1], # // the number of substitutions made
|
||||
)
|
||||
ensure_tainted(
|
||||
re.subn(pat, repl="safe", string=ts), # $ tainted // implicit read at sink
|
||||
re.subn(pat, repl="safe", string=ts)[0], # $ tainted // the string
|
||||
)
|
||||
|
||||
@@ -63,7 +63,8 @@ class TaintTest(tornado.web.RequestHandler):
|
||||
request.headers["header-name"], # $ tainted
|
||||
request.headers.get_list("header-name"), # $ tainted
|
||||
request.headers.get_all(), # $ tainted
|
||||
[(k, v) for (k, v) in request.headers.get_all()], # $ tainted
|
||||
[(k, v) for (k, v) in request.headers.get_all()][0], # $ tainted
|
||||
list([(k, v) for (k, v) in request.headers.get_all()])[0], # $ tainted
|
||||
|
||||
# Dict[str, http.cookies.Morsel]
|
||||
request.cookies, # $ tainted
|
||||
@@ -71,6 +72,11 @@ class TaintTest(tornado.web.RequestHandler):
|
||||
request.cookies["cookie-name"].key, # $ tainted
|
||||
request.cookies["cookie-name"].value, # $ tainted
|
||||
request.cookies["cookie-name"].coded_value, # $ tainted
|
||||
|
||||
# The comprehension is not tainted, only the elements, but this passes due to implicit reads at sinks
|
||||
[(k, v) for (k, v) in request.headers.get_all()], # $ tainted
|
||||
# The list is not tainted, only the elements, but this passes due to implicit reads at sinks
|
||||
list([(k, v) for (k, v) in request.headers.get_all()]), # $ tainted
|
||||
)
|
||||
|
||||
|
||||
|
||||
@@ -11,10 +11,13 @@
|
||||
edges
|
||||
| BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | provenance | |
|
||||
| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:18 | ControlFlowNode for ALL_LOCALS | provenance | |
|
||||
| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:20:8:20:17 | ControlFlowNode for ALL_LOCALS | provenance | |
|
||||
| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | provenance | |
|
||||
| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:17:9:17:18 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup [Tuple element at index 0] | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:20:8:20:17 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:20:8:20:23 | ControlFlowNode for Tuple [Tuple element at index 0] | provenance | |
|
||||
| BindToAllInterfaces_test.py:20:8:20:23 | ControlFlowNode for Tuple [Tuple element at index 0] | BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup [Tuple element at index 0] | provenance | |
|
||||
| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | provenance | |
|
||||
| BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | provenance | |
|
||||
@@ -25,9 +28,10 @@ edges
|
||||
| BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
|
||||
| BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
|
||||
| BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | provenance | |
|
||||
| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | BindToAllInterfaces_test.py:48:9:48:12 | ControlFlowNode for host | provenance | |
|
||||
| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | provenance | |
|
||||
| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| BindToAllInterfaces_test.py:48:9:48:12 | ControlFlowNode for host | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
| BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
|
||||
nodes
|
||||
@@ -37,8 +41,11 @@ nodes
|
||||
| BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
|
||||
| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | semmle.label | ControlFlowNode for ALL_LOCALS |
|
||||
| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
|
||||
| BindToAllInterfaces_test.py:17:9:17:18 | ControlFlowNode for ALL_LOCALS | semmle.label | ControlFlowNode for ALL_LOCALS |
|
||||
| BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
|
||||
| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
|
||||
| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup [Tuple element at index 0] | semmle.label | ControlFlowNode for tup [Tuple element at index 0] |
|
||||
| BindToAllInterfaces_test.py:20:8:20:17 | ControlFlowNode for ALL_LOCALS | semmle.label | ControlFlowNode for ALL_LOCALS |
|
||||
| BindToAllInterfaces_test.py:20:8:20:23 | ControlFlowNode for Tuple [Tuple element at index 0] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 0] |
|
||||
| BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
|
||||
| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
|
||||
| BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
|
||||
@@ -55,6 +62,7 @@ nodes
|
||||
| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
|
||||
| BindToAllInterfaces_test.py:48:9:48:12 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
|
||||
| BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
|
||||
| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
|
||||
| BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
|
||||
|
||||
@@ -5,11 +5,13 @@ edges
|
||||
| test.py:5:26:5:32 | ControlFlowNode for request | test.py:34:12:34:18 | ControlFlowNode for request | provenance | |
|
||||
| test.py:5:26:5:32 | ControlFlowNode for request | test.py:42:12:42:18 | ControlFlowNode for request | provenance | |
|
||||
| test.py:5:26:5:32 | ControlFlowNode for request | test.py:54:12:54:18 | ControlFlowNode for request | provenance | |
|
||||
| test.py:13:5:13:12 | ControlFlowNode for data_raw | test.py:14:5:14:8 | ControlFlowNode for data | provenance | |
|
||||
| test.py:13:5:13:12 | ControlFlowNode for data_raw | test.py:14:5:14:8 | ControlFlowNode for data | provenance | Decoding-Base64 |
|
||||
| test.py:13:16:13:22 | ControlFlowNode for request | test.py:13:16:13:27 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| test.py:13:16:13:27 | ControlFlowNode for Attribute | test.py:13:16:13:39 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| test.py:13:16:13:39 | ControlFlowNode for Attribute() | test.py:13:5:13:12 | ControlFlowNode for data_raw | provenance | |
|
||||
| test.py:14:5:14:8 | ControlFlowNode for data | test.py:15:36:15:39 | ControlFlowNode for data | provenance | |
|
||||
| test.py:23:5:23:12 | ControlFlowNode for data_raw | test.py:24:5:24:8 | ControlFlowNode for data | provenance | |
|
||||
| test.py:23:5:23:12 | ControlFlowNode for data_raw | test.py:24:5:24:8 | ControlFlowNode for data | provenance | Decoding-Base64 |
|
||||
| test.py:23:16:23:22 | ControlFlowNode for request | test.py:23:16:23:27 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| test.py:23:16:23:27 | ControlFlowNode for Attribute | test.py:23:16:23:39 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
|
||||
@@ -1,10 +1,13 @@
|
||||
edges
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:5:25:5:28 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:8:23:8:26 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:11:25:11:38 | ControlFlowNode for Attribute() | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:14:25:14:40 | ControlFlowNode for Attribute() | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:11:34:11:37 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:14:35:14:38 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:17:32:17:35 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:4:22:4:25 | ControlFlowNode for name | src/unsafe_shell_test.py:20:27:20:30 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:11:34:11:37 | ControlFlowNode for name | src/unsafe_shell_test.py:11:25:11:38 | ControlFlowNode for Attribute() | provenance | str.join |
|
||||
| src/unsafe_shell_test.py:14:34:14:39 | ControlFlowNode for List [List element] | src/unsafe_shell_test.py:14:25:14:40 | ControlFlowNode for Attribute() | provenance | str.join |
|
||||
| src/unsafe_shell_test.py:14:35:14:38 | ControlFlowNode for name | src/unsafe_shell_test.py:14:34:14:39 | ControlFlowNode for List [List element] | provenance | |
|
||||
| src/unsafe_shell_test.py:26:20:26:23 | ControlFlowNode for name | src/unsafe_shell_test.py:29:30:29:33 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:36:22:36:25 | ControlFlowNode for name | src/unsafe_shell_test.py:39:30:39:33 | ControlFlowNode for name | provenance | |
|
||||
| src/unsafe_shell_test.py:36:22:36:25 | ControlFlowNode for name | src/unsafe_shell_test.py:44:20:44:23 | ControlFlowNode for name | provenance | |
|
||||
@@ -15,7 +18,10 @@ nodes
|
||||
| src/unsafe_shell_test.py:5:25:5:28 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:8:23:8:26 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:11:25:11:38 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| src/unsafe_shell_test.py:11:34:11:37 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:14:25:14:40 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| src/unsafe_shell_test.py:14:34:14:39 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
|
||||
| src/unsafe_shell_test.py:14:35:14:38 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:17:32:17:35 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:20:27:20:30 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| src/unsafe_shell_test.py:26:20:26:23 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
|
||||
@@ -11,8 +11,10 @@ edges
|
||||
| reflected_xss.py:9:18:9:24 | ControlFlowNode for request | reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | provenance | AdditionalTaintStep |
|
||||
| reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | reflected_xss.py:9:18:9:45 | ControlFlowNode for Attribute() | provenance | dict.get |
|
||||
| reflected_xss.py:9:18:9:45 | ControlFlowNode for Attribute() | reflected_xss.py:9:5:9:14 | ControlFlowNode for first_name | provenance | |
|
||||
| reflected_xss.py:21:5:21:8 | ControlFlowNode for data | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | provenance | |
|
||||
| reflected_xss.py:21:5:21:8 | ControlFlowNode for data | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | provenance | AdditionalTaintStep |
|
||||
| reflected_xss.py:21:23:21:29 | ControlFlowNode for request | reflected_xss.py:21:5:21:8 | ControlFlowNode for data | provenance | AdditionalTaintStep |
|
||||
| reflected_xss.py:27:5:27:8 | ControlFlowNode for data | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | provenance | |
|
||||
| reflected_xss.py:27:5:27:8 | ControlFlowNode for data | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | provenance | AdditionalTaintStep |
|
||||
| reflected_xss.py:27:23:27:29 | ControlFlowNode for request | reflected_xss.py:27:5:27:8 | ControlFlowNode for data | provenance | AdditionalTaintStep |
|
||||
nodes
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
#select
|
||||
| app.py:23:20:23:24 | ControlFlowNode for query | app.py:20:18:20:21 | ControlFlowNode for name | app.py:23:20:23:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:20:18:20:21 | ControlFlowNode for name | user-provided value |
|
||||
| app.py:30:20:30:24 | ControlFlowNode for query | app.py:27:19:27:22 | ControlFlowNode for name | app.py:30:20:30:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:27:19:27:22 | ControlFlowNode for name | user-provided value |
|
||||
| app.py:37:20:37:24 | ControlFlowNode for query | app.py:34:19:34:22 | ControlFlowNode for name | app.py:37:20:37:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:34:19:34:22 | ControlFlowNode for name | user-provided value |
|
||||
| app.py:44:20:44:24 | ControlFlowNode for query | app.py:41:19:41:22 | ControlFlowNode for name | app.py:44:20:44:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:41:19:41:22 | ControlFlowNode for name | user-provided value |
|
||||
| app.py:51:20:51:24 | ControlFlowNode for query | app.py:48:19:48:22 | ControlFlowNode for name | app.py:51:20:51:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:48:19:48:22 | ControlFlowNode for name | user-provided value |
|
||||
| sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | ControlFlowNode for username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | ControlFlowNode for username | user-provided value |
|
||||
@@ -24,6 +25,8 @@ edges
|
||||
| app.py:21:5:21:9 | ControlFlowNode for query | app.py:23:20:23:24 | ControlFlowNode for query | provenance | |
|
||||
| app.py:27:19:27:22 | ControlFlowNode for name | app.py:28:5:28:9 | ControlFlowNode for query | provenance | |
|
||||
| app.py:28:5:28:9 | ControlFlowNode for query | app.py:30:20:30:24 | ControlFlowNode for query | provenance | |
|
||||
| app.py:34:19:34:22 | ControlFlowNode for name | app.py:35:5:35:9 | ControlFlowNode for query | provenance | |
|
||||
| app.py:35:5:35:9 | ControlFlowNode for query | app.py:37:20:37:24 | ControlFlowNode for query | provenance | |
|
||||
| app.py:41:19:41:22 | ControlFlowNode for name | app.py:42:5:42:9 | ControlFlowNode for query | provenance | |
|
||||
| app.py:42:5:42:9 | ControlFlowNode for query | app.py:44:20:44:24 | ControlFlowNode for query | provenance | |
|
||||
| app.py:48:19:48:22 | ControlFlowNode for name | app.py:49:5:49:9 | ControlFlowNode for query | provenance | |
|
||||
@@ -51,6 +54,9 @@ nodes
|
||||
| app.py:27:19:27:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| app.py:28:5:28:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| app.py:30:20:30:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| app.py:34:19:34:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| app.py:35:5:35:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| app.py:37:20:37:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| app.py:41:19:41:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
|
||||
| app.py:42:5:42:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
| app.py:44:20:44:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
|
||||
|
||||
@@ -31,10 +31,10 @@ async def unsafe2(name: str): # $ Source
|
||||
cursor.close()
|
||||
|
||||
@app.get("/unsafe3/")
|
||||
async def unsafe3(name: str): # $ MISSING: Source
|
||||
async def unsafe3(name: str): # $ Source
|
||||
query = "select * from users where name=" + name
|
||||
cursor = hdb_con3.cursor()
|
||||
cursor.execute(query) # $ MISSING: Alert
|
||||
cursor.execute(query) # $ Alert
|
||||
cursor.close()
|
||||
|
||||
@app.get("/unsafe4/")
|
||||
|
||||
@@ -7,7 +7,8 @@ edges
|
||||
| test.py:50:29:50:31 | ControlFlowNode for err | test.py:50:16:50:32 | ControlFlowNode for format_error() | provenance | |
|
||||
| test.py:50:29:50:31 | ControlFlowNode for err | test.py:52:18:52:20 | ControlFlowNode for msg | provenance | |
|
||||
| test.py:52:18:52:20 | ControlFlowNode for msg | test.py:53:12:53:27 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| test.py:65:25:65:25 | ControlFlowNode for e | test.py:66:24:66:40 | ControlFlowNode for Dict | provenance | |
|
||||
| test.py:65:25:65:25 | ControlFlowNode for e | test.py:66:34:66:39 | ControlFlowNode for str() | provenance | |
|
||||
| test.py:66:34:66:39 | ControlFlowNode for str() | test.py:66:24:66:40 | ControlFlowNode for Dict | provenance | |
|
||||
nodes
|
||||
| test.py:16:16:16:37 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| test.py:23:25:23:25 | ControlFlowNode for e | semmle.label | ControlFlowNode for e |
|
||||
@@ -23,6 +24,7 @@ nodes
|
||||
| test.py:53:12:53:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| test.py:65:25:65:25 | ControlFlowNode for e | semmle.label | ControlFlowNode for e |
|
||||
| test.py:66:24:66:40 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| test.py:66:34:66:39 | ControlFlowNode for str() | semmle.label | ControlFlowNode for str() |
|
||||
subpaths
|
||||
| test.py:50:29:50:31 | ControlFlowNode for err | test.py:52:18:52:20 | ControlFlowNode for msg | test.py:53:12:53:27 | ControlFlowNode for BinaryExpr | test.py:50:16:50:32 | ControlFlowNode for format_error() |
|
||||
#select
|
||||
|
||||
@@ -23,7 +23,6 @@
|
||||
| test.py:70:15:70:25 | ControlFlowNode for bank_number | test.py:67:38:67:48 | ControlFlowNode for bank_number | test.py:70:15:70:25 | ControlFlowNode for bank_number | This expression logs $@ as clear text. | test.py:67:38:67:48 | ControlFlowNode for bank_number | sensitive data (private) |
|
||||
| test.py:73:15:73:17 | ControlFlowNode for ccn | test.py:67:76:67:78 | ControlFlowNode for ccn | test.py:73:15:73:17 | ControlFlowNode for ccn | This expression logs $@ as clear text. | test.py:67:76:67:78 | ControlFlowNode for ccn | sensitive data (private) |
|
||||
| test.py:74:15:74:22 | ControlFlowNode for user_ccn | test.py:67:81:67:88 | ControlFlowNode for user_ccn | test.py:74:15:74:22 | ControlFlowNode for user_ccn | This expression logs $@ as clear text. | test.py:67:81:67:88 | ControlFlowNode for user_ccn | sensitive data (private) |
|
||||
| test.py:105:11:105:31 | ControlFlowNode for Subscript | test.py:103:21:103:37 | ControlFlowNode for Attribute | test.py:105:11:105:31 | ControlFlowNode for Subscript | This expression logs $@ as clear text. | test.py:103:21:103:37 | ControlFlowNode for Attribute | sensitive data (password) |
|
||||
edges
|
||||
| test.py:19:5:19:12 | ControlFlowNode for password | test.py:20:48:20:55 | ControlFlowNode for password | provenance | |
|
||||
| test.py:19:5:19:12 | ControlFlowNode for password | test.py:22:58:22:65 | ControlFlowNode for password | provenance | |
|
||||
@@ -48,8 +47,6 @@ edges
|
||||
| test.py:67:38:67:48 | ControlFlowNode for bank_number | test.py:70:15:70:25 | ControlFlowNode for bank_number | provenance | |
|
||||
| test.py:67:76:67:78 | ControlFlowNode for ccn | test.py:73:15:73:17 | ControlFlowNode for ccn | provenance | |
|
||||
| test.py:67:81:67:88 | ControlFlowNode for user_ccn | test.py:74:15:74:22 | ControlFlowNode for user_ccn | provenance | |
|
||||
| test.py:101:5:101:10 | ControlFlowNode for config | test.py:105:11:105:31 | ControlFlowNode for Subscript | provenance | |
|
||||
| test.py:103:21:103:37 | ControlFlowNode for Attribute | test.py:101:5:101:10 | ControlFlowNode for config | provenance | |
|
||||
nodes
|
||||
| test.py:19:5:19:12 | ControlFlowNode for password | semmle.label | ControlFlowNode for password |
|
||||
| test.py:19:16:19:29 | ControlFlowNode for get_password() | semmle.label | ControlFlowNode for get_password() |
|
||||
@@ -94,7 +91,4 @@ nodes
|
||||
| test.py:70:15:70:25 | ControlFlowNode for bank_number | semmle.label | ControlFlowNode for bank_number |
|
||||
| test.py:73:15:73:17 | ControlFlowNode for ccn | semmle.label | ControlFlowNode for ccn |
|
||||
| test.py:74:15:74:22 | ControlFlowNode for user_ccn | semmle.label | ControlFlowNode for user_ccn |
|
||||
| test.py:101:5:101:10 | ControlFlowNode for config | semmle.label | ControlFlowNode for config |
|
||||
| test.py:103:21:103:37 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
|
||||
| test.py:105:11:105:31 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
|
||||
subpaths
|
||||
|
||||
@@ -100,9 +100,9 @@ def FPs(account, account_id):
|
||||
import settings
|
||||
config = {
|
||||
"sleep_timer": 5,
|
||||
"password": settings.password # $ SPURIOUS: Source
|
||||
"password": settings.password
|
||||
}
|
||||
print(config["sleep_timer"]) # $ SPURIOUS: Alert # OK
|
||||
print(config["sleep_timer"]) # OK
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
@@ -9,9 +9,11 @@ edges
|
||||
| password_in_cookie.py:14:5:14:12 | ControlFlowNode for password | password_in_cookie.py:16:33:16:40 | ControlFlowNode for password | provenance | |
|
||||
| password_in_cookie.py:14:16:14:43 | ControlFlowNode for Attribute() | password_in_cookie.py:14:5:14:12 | ControlFlowNode for password | provenance | |
|
||||
| test.py:15:5:15:12 | ControlFlowNode for password | test.py:17:20:17:27 | ControlFlowNode for password | provenance | |
|
||||
| test.py:15:5:15:12 | ControlFlowNode for password | test.py:18:9:18:13 | ControlFlowNode for lines | provenance | |
|
||||
| test.py:15:5:15:12 | ControlFlowNode for password | test.py:18:18:18:32 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| test.py:15:16:15:29 | ControlFlowNode for get_password() | test.py:15:5:15:12 | ControlFlowNode for password | provenance | |
|
||||
| test.py:18:9:18:13 | ControlFlowNode for lines | test.py:19:25:19:29 | ControlFlowNode for lines | provenance | |
|
||||
| test.py:18:9:18:13 | ControlFlowNode for lines [List element] | test.py:19:25:19:29 | ControlFlowNode for lines | provenance | |
|
||||
| test.py:18:17:18:33 | ControlFlowNode for List [List element] | test.py:18:9:18:13 | ControlFlowNode for lines [List element] | provenance | |
|
||||
| test.py:18:18:18:32 | ControlFlowNode for BinaryExpr | test.py:18:17:18:33 | ControlFlowNode for List [List element] | provenance | |
|
||||
nodes
|
||||
| password_in_cookie.py:7:5:7:12 | ControlFlowNode for password | semmle.label | ControlFlowNode for password |
|
||||
| password_in_cookie.py:7:16:7:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
@@ -22,6 +24,8 @@ nodes
|
||||
| test.py:15:5:15:12 | ControlFlowNode for password | semmle.label | ControlFlowNode for password |
|
||||
| test.py:15:16:15:29 | ControlFlowNode for get_password() | semmle.label | ControlFlowNode for get_password() |
|
||||
| test.py:17:20:17:27 | ControlFlowNode for password | semmle.label | ControlFlowNode for password |
|
||||
| test.py:18:9:18:13 | ControlFlowNode for lines | semmle.label | ControlFlowNode for lines |
|
||||
| test.py:18:9:18:13 | ControlFlowNode for lines [List element] | semmle.label | ControlFlowNode for lines [List element] |
|
||||
| test.py:18:17:18:33 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
|
||||
| test.py:18:18:18:32 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| test.py:19:25:19:29 | ControlFlowNode for lines | semmle.label | ControlFlowNode for lines |
|
||||
subpaths
|
||||
|
||||
@@ -82,14 +82,19 @@ edges
|
||||
| full_partial_test.py:61:5:61:7 | ControlFlowNode for url | full_partial_test.py:63:18:63:20 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:66:5:66:14 | ControlFlowNode for user_input | full_partial_test.py:70:5:70:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:66:5:66:14 | ControlFlowNode for user_input | full_partial_test.py:74:5:74:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:66:5:66:14 | ControlFlowNode for user_input | full_partial_test.py:78:5:78:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:66:5:66:14 | ControlFlowNode for user_input | full_partial_test.py:78:38:78:47 | ControlFlowNode for user_input | provenance | |
|
||||
| full_partial_test.py:66:18:66:24 | ControlFlowNode for request | full_partial_test.py:66:5:66:14 | ControlFlowNode for user_input | provenance | AdditionalTaintStep |
|
||||
| full_partial_test.py:66:18:66:24 | ControlFlowNode for request | full_partial_test.py:67:5:67:13 | ControlFlowNode for query_val | provenance | AdditionalTaintStep |
|
||||
| full_partial_test.py:67:5:67:13 | ControlFlowNode for query_val | full_partial_test.py:78:5:78:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:67:5:67:13 | ControlFlowNode for query_val | full_partial_test.py:78:50:78:58 | ControlFlowNode for query_val | provenance | |
|
||||
| full_partial_test.py:67:17:67:23 | ControlFlowNode for request | full_partial_test.py:67:5:67:13 | ControlFlowNode for query_val | provenance | AdditionalTaintStep |
|
||||
| full_partial_test.py:70:5:70:7 | ControlFlowNode for url | full_partial_test.py:72:18:72:20 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:74:5:74:7 | ControlFlowNode for url | full_partial_test.py:76:18:76:20 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:78:5:78:7 | ControlFlowNode for url | full_partial_test.py:80:18:80:20 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:78:11:78:59 | ControlFlowNode for BinaryExpr | full_partial_test.py:78:5:78:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:78:38:78:47 | ControlFlowNode for user_input | full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 0] | provenance | |
|
||||
| full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 0] | full_partial_test.py:78:11:78:59 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 1] | full_partial_test.py:78:11:78:59 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| full_partial_test.py:78:50:78:58 | ControlFlowNode for query_val | full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 1] | provenance | |
|
||||
| full_partial_test.py:83:5:83:14 | ControlFlowNode for user_input | full_partial_test.py:87:5:87:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:83:5:83:14 | ControlFlowNode for user_input | full_partial_test.py:91:5:91:7 | ControlFlowNode for url | provenance | |
|
||||
| full_partial_test.py:83:5:83:14 | ControlFlowNode for user_input | full_partial_test.py:95:5:95:7 | ControlFlowNode for url | provenance | |
|
||||
@@ -274,6 +279,11 @@ nodes
|
||||
| full_partial_test.py:74:5:74:7 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
|
||||
| full_partial_test.py:76:18:76:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
|
||||
| full_partial_test.py:78:5:78:7 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
|
||||
| full_partial_test.py:78:11:78:59 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| full_partial_test.py:78:38:78:47 | ControlFlowNode for user_input | semmle.label | ControlFlowNode for user_input |
|
||||
| full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 0] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 0] |
|
||||
| full_partial_test.py:78:38:78:58 | ControlFlowNode for Tuple [Tuple element at index 1] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 1] |
|
||||
| full_partial_test.py:78:50:78:58 | ControlFlowNode for query_val | semmle.label | ControlFlowNode for query_val |
|
||||
| full_partial_test.py:80:18:80:20 | ControlFlowNode for url | semmle.label | ControlFlowNode for url |
|
||||
| full_partial_test.py:83:5:83:14 | ControlFlowNode for user_input | semmle.label | ControlFlowNode for user_input |
|
||||
| full_partial_test.py:83:18:83:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
|
||||
@@ -7,25 +7,34 @@ edges
|
||||
| PoC/server.py:1:26:1:32 | ControlFlowNode for request | PoC/server.py:98:14:98:20 | ControlFlowNode for request | provenance | |
|
||||
| PoC/server.py:26:5:26:17 | ControlFlowNode for author_string | PoC/server.py:27:25:27:37 | ControlFlowNode for author_string | provenance | |
|
||||
| PoC/server.py:26:21:26:27 | ControlFlowNode for request | PoC/server.py:26:5:26:17 | ControlFlowNode for author_string | provenance | AdditionalTaintStep |
|
||||
| PoC/server.py:27:5:27:10 | ControlFlowNode for author | PoC/server.py:30:27:30:44 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:27:5:27:10 | ControlFlowNode for author | PoC/server.py:31:34:31:51 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:27:5:27:10 | ControlFlowNode for author | PoC/server.py:30:38:30:43 | ControlFlowNode for author | provenance | |
|
||||
| PoC/server.py:27:5:27:10 | ControlFlowNode for author | PoC/server.py:31:45:31:50 | ControlFlowNode for author | provenance | |
|
||||
| PoC/server.py:27:14:27:38 | ControlFlowNode for Attribute() | PoC/server.py:27:5:27:10 | ControlFlowNode for author | provenance | |
|
||||
| PoC/server.py:27:25:27:37 | ControlFlowNode for author_string | PoC/server.py:27:14:27:38 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| PoC/server.py:30:38:30:43 | ControlFlowNode for author | PoC/server.py:30:27:30:44 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:31:45:31:50 | ControlFlowNode for author | PoC/server.py:31:34:31:51 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:43:5:43:10 | ControlFlowNode for author | PoC/server.py:47:38:47:67 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| PoC/server.py:43:14:43:20 | ControlFlowNode for request | PoC/server.py:43:5:43:10 | ControlFlowNode for author | provenance | AdditionalTaintStep |
|
||||
| PoC/server.py:47:38:47:67 | ControlFlowNode for BinaryExpr | PoC/server.py:47:27:47:68 | ControlFlowNode for Dict | provenance | Config |
|
||||
| PoC/server.py:52:5:52:10 | ControlFlowNode for author | PoC/server.py:54:17:54:70 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| PoC/server.py:52:14:52:20 | ControlFlowNode for request | PoC/server.py:52:5:52:10 | ControlFlowNode for author | provenance | AdditionalTaintStep |
|
||||
| PoC/server.py:53:5:53:10 | ControlFlowNode for search | PoC/server.py:61:27:61:58 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:53:5:53:10 | ControlFlowNode for search | PoC/server.py:61:51:61:56 | ControlFlowNode for search | provenance | |
|
||||
| PoC/server.py:53:14:57:5 | ControlFlowNode for Dict | PoC/server.py:53:5:53:10 | ControlFlowNode for search | provenance | |
|
||||
| PoC/server.py:54:17:54:70 | ControlFlowNode for BinaryExpr | PoC/server.py:53:14:57:5 | ControlFlowNode for Dict | provenance | Config |
|
||||
| PoC/server.py:61:37:61:57 | ControlFlowNode for Dict [Dictionary element at key $function] | PoC/server.py:61:27:61:58 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:61:51:61:56 | ControlFlowNode for search | PoC/server.py:61:37:61:57 | ControlFlowNode for Dict [Dictionary element at key $function] | provenance | |
|
||||
| PoC/server.py:77:5:77:10 | ControlFlowNode for author | PoC/server.py:80:23:80:101 | ControlFlowNode for BinaryExpr | provenance | |
|
||||
| PoC/server.py:77:14:77:20 | ControlFlowNode for request | PoC/server.py:77:5:77:10 | ControlFlowNode for author | provenance | AdditionalTaintStep |
|
||||
| PoC/server.py:78:5:78:15 | ControlFlowNode for accumulator | PoC/server.py:84:5:84:9 | ControlFlowNode for group | provenance | |
|
||||
| PoC/server.py:78:5:78:15 | ControlFlowNode for accumulator | PoC/server.py:86:37:86:47 | ControlFlowNode for accumulator | provenance | |
|
||||
| PoC/server.py:78:19:83:5 | ControlFlowNode for Dict | PoC/server.py:78:5:78:15 | ControlFlowNode for accumulator | provenance | |
|
||||
| PoC/server.py:80:23:80:101 | ControlFlowNode for BinaryExpr | PoC/server.py:78:19:83:5 | ControlFlowNode for Dict | provenance | Config |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group | PoC/server.py:91:29:91:47 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group | PoC/server.py:92:38:92:56 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | PoC/server.py:91:41:91:45 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | provenance | |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | PoC/server.py:92:50:92:54 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | provenance | |
|
||||
| PoC/server.py:84:13:87:5 | ControlFlowNode for Dict [Dictionary element at key author, Dictionary element at key $accumulator] | PoC/server.py:84:5:84:9 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | provenance | |
|
||||
| PoC/server.py:86:19:86:49 | ControlFlowNode for Dict [Dictionary element at key $accumulator] | PoC/server.py:84:13:87:5 | ControlFlowNode for Dict [Dictionary element at key author, Dictionary element at key $accumulator] | provenance | |
|
||||
| PoC/server.py:86:37:86:47 | ControlFlowNode for accumulator | PoC/server.py:86:19:86:49 | ControlFlowNode for Dict [Dictionary element at key $accumulator] | provenance | |
|
||||
| PoC/server.py:91:41:91:45 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | PoC/server.py:91:29:91:47 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:92:50:92:54 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | PoC/server.py:92:38:92:56 | ControlFlowNode for Dict | provenance | |
|
||||
| PoC/server.py:98:5:98:10 | ControlFlowNode for author | PoC/server.py:99:5:99:10 | ControlFlowNode for mapper | provenance | |
|
||||
| PoC/server.py:98:14:98:20 | ControlFlowNode for request | PoC/server.py:98:5:98:10 | ControlFlowNode for author | provenance | AdditionalTaintStep |
|
||||
| PoC/server.py:99:5:99:10 | ControlFlowNode for mapper | PoC/server.py:102:9:102:14 | ControlFlowNode for mapper | provenance | |
|
||||
@@ -39,16 +48,18 @@ edges
|
||||
| flask_mongoengine_bad.py:20:30:20:42 | ControlFlowNode for unsafe_search | flask_mongoengine_bad.py:20:19:20:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| flask_mongoengine_bad.py:26:5:26:17 | ControlFlowNode for unsafe_search | flask_mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| flask_mongoengine_bad.py:26:21:26:27 | ControlFlowNode for request | flask_mongoengine_bad.py:26:5:26:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| flask_mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | flask_mongoengine_bad.py:30:39:30:59 | ControlFlowNode for Dict | provenance | |
|
||||
| flask_mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | flask_mongoengine_bad.py:30:48:30:58 | ControlFlowNode for json_search | provenance | |
|
||||
| flask_mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | flask_mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | provenance | |
|
||||
| flask_mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | flask_mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| flask_mongoengine_bad.py:30:48:30:58 | ControlFlowNode for json_search | flask_mongoengine_bad.py:30:39:30:59 | ControlFlowNode for Dict | provenance | |
|
||||
| flask_pymongo_bad.py:1:26:1:32 | ControlFlowNode for ImportMember | flask_pymongo_bad.py:1:26:1:32 | ControlFlowNode for request | provenance | |
|
||||
| flask_pymongo_bad.py:1:26:1:32 | ControlFlowNode for request | flask_pymongo_bad.py:11:21:11:27 | ControlFlowNode for request | provenance | |
|
||||
| flask_pymongo_bad.py:11:5:11:17 | ControlFlowNode for unsafe_search | flask_pymongo_bad.py:12:30:12:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| flask_pymongo_bad.py:11:21:11:27 | ControlFlowNode for request | flask_pymongo_bad.py:11:5:11:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| flask_pymongo_bad.py:12:5:12:15 | ControlFlowNode for json_search | flask_pymongo_bad.py:14:31:14:51 | ControlFlowNode for Dict | provenance | |
|
||||
| flask_pymongo_bad.py:12:5:12:15 | ControlFlowNode for json_search | flask_pymongo_bad.py:14:40:14:50 | ControlFlowNode for json_search | provenance | |
|
||||
| flask_pymongo_bad.py:12:19:12:43 | ControlFlowNode for Attribute() | flask_pymongo_bad.py:12:5:12:15 | ControlFlowNode for json_search | provenance | |
|
||||
| flask_pymongo_bad.py:12:30:12:42 | ControlFlowNode for unsafe_search | flask_pymongo_bad.py:12:19:12:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| flask_pymongo_bad.py:14:40:14:50 | ControlFlowNode for json_search | flask_pymongo_bad.py:14:31:14:51 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for ImportMember | mongoengine_bad.py:1:26:1:32 | ControlFlowNode for request | provenance | |
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for request | mongoengine_bad.py:18:21:18:27 | ControlFlowNode for request | provenance | |
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for request | mongoengine_bad.py:26:21:26:27 | ControlFlowNode for request | provenance | |
|
||||
@@ -58,24 +69,28 @@ edges
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for request | mongoengine_bad.py:57:21:57:27 | ControlFlowNode for request | provenance | |
|
||||
| mongoengine_bad.py:18:5:18:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:19:30:19:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:18:21:18:27 | ControlFlowNode for request | mongoengine_bad.py:18:5:18:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:19:5:19:15 | ControlFlowNode for json_search | mongoengine_bad.py:22:26:22:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:19:5:19:15 | ControlFlowNode for json_search | mongoengine_bad.py:22:35:22:45 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:19:19:19:43 | ControlFlowNode for Attribute() | mongoengine_bad.py:19:5:19:15 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:19:30:19:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:19:19:19:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:22:35:22:45 | ControlFlowNode for json_search | mongoengine_bad.py:22:26:22:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:26:5:26:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:26:21:26:27 | ControlFlowNode for request | mongoengine_bad.py:26:5:26:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | mongoengine_bad.py:30:26:30:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | mongoengine_bad.py:30:35:30:45 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:30:35:30:45 | ControlFlowNode for json_search | mongoengine_bad.py:30:26:30:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:34:5:34:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:35:30:35:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:34:21:34:27 | ControlFlowNode for request | mongoengine_bad.py:34:5:34:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:35:5:35:15 | ControlFlowNode for json_search | mongoengine_bad.py:38:26:38:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:35:5:35:15 | ControlFlowNode for json_search | mongoengine_bad.py:38:35:38:45 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:35:19:35:43 | ControlFlowNode for Attribute() | mongoengine_bad.py:35:5:35:15 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:35:30:35:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:35:19:35:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:38:35:38:45 | ControlFlowNode for json_search | mongoengine_bad.py:38:26:38:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:42:5:42:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:43:30:43:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:42:21:42:27 | ControlFlowNode for request | mongoengine_bad.py:42:5:42:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:43:5:43:15 | ControlFlowNode for json_search | mongoengine_bad.py:46:26:46:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:43:5:43:15 | ControlFlowNode for json_search | mongoengine_bad.py:46:35:46:45 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:43:19:43:43 | ControlFlowNode for Attribute() | mongoengine_bad.py:43:5:43:15 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:43:30:43:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:43:19:43:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:46:35:46:45 | ControlFlowNode for json_search | mongoengine_bad.py:46:26:46:46 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:50:5:50:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:51:30:51:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:50:21:50:27 | ControlFlowNode for request | mongoengine_bad.py:50:5:50:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:51:5:51:15 | ControlFlowNode for json_search | mongoengine_bad.py:53:34:53:44 | ControlFlowNode for json_search | provenance | |
|
||||
@@ -83,9 +98,10 @@ edges
|
||||
| mongoengine_bad.py:51:30:51:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:51:19:51:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:57:5:57:17 | ControlFlowNode for unsafe_search | mongoengine_bad.py:58:30:58:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| mongoengine_bad.py:57:21:57:27 | ControlFlowNode for request | mongoengine_bad.py:57:5:57:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| mongoengine_bad.py:58:5:58:15 | ControlFlowNode for json_search | mongoengine_bad.py:61:29:61:49 | ControlFlowNode for Dict | provenance | |
|
||||
| mongoengine_bad.py:58:5:58:15 | ControlFlowNode for json_search | mongoengine_bad.py:61:38:61:48 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:58:19:58:43 | ControlFlowNode for Attribute() | mongoengine_bad.py:58:5:58:15 | ControlFlowNode for json_search | provenance | |
|
||||
| mongoengine_bad.py:58:30:58:42 | ControlFlowNode for unsafe_search | mongoengine_bad.py:58:19:58:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| mongoengine_bad.py:61:38:61:48 | ControlFlowNode for json_search | mongoengine_bad.py:61:29:61:49 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for ImportMember | pymongo_test.py:1:26:1:32 | ControlFlowNode for request | provenance | |
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for request | pymongo_test.py:12:21:12:27 | ControlFlowNode for request | provenance | |
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for request | pymongo_test.py:29:27:29:33 | ControlFlowNode for request | provenance | |
|
||||
@@ -93,9 +109,10 @@ edges
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for request | pymongo_test.py:52:26:52:32 | ControlFlowNode for request | provenance | |
|
||||
| pymongo_test.py:12:5:12:17 | ControlFlowNode for unsafe_search | pymongo_test.py:13:30:13:42 | ControlFlowNode for unsafe_search | provenance | |
|
||||
| pymongo_test.py:12:21:12:27 | ControlFlowNode for request | pymongo_test.py:12:5:12:17 | ControlFlowNode for unsafe_search | provenance | AdditionalTaintStep |
|
||||
| pymongo_test.py:13:5:13:15 | ControlFlowNode for json_search | pymongo_test.py:15:42:15:62 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:13:5:13:15 | ControlFlowNode for json_search | pymongo_test.py:15:51:15:61 | ControlFlowNode for json_search | provenance | |
|
||||
| pymongo_test.py:13:19:13:43 | ControlFlowNode for Attribute() | pymongo_test.py:13:5:13:15 | ControlFlowNode for json_search | provenance | |
|
||||
| pymongo_test.py:13:30:13:42 | ControlFlowNode for unsafe_search | pymongo_test.py:13:19:13:43 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| pymongo_test.py:15:51:15:61 | ControlFlowNode for json_search | pymongo_test.py:15:42:15:62 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:29:5:29:12 | ControlFlowNode for event_id | pymongo_test.py:33:45:33:72 | ControlFlowNode for Fstring | provenance | |
|
||||
| pymongo_test.py:29:16:29:51 | ControlFlowNode for Attribute() | pymongo_test.py:29:5:29:12 | ControlFlowNode for event_id | provenance | |
|
||||
| pymongo_test.py:29:27:29:33 | ControlFlowNode for request | pymongo_test.py:29:27:29:50 | ControlFlowNode for Subscript | provenance | AdditionalTaintStep |
|
||||
@@ -112,13 +129,23 @@ edges
|
||||
| pymongo_test.py:52:15:52:50 | ControlFlowNode for Attribute() | pymongo_test.py:52:5:52:11 | ControlFlowNode for decoded | provenance | |
|
||||
| pymongo_test.py:52:26:52:32 | ControlFlowNode for request | pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript | provenance | AdditionalTaintStep |
|
||||
| pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript | pymongo_test.py:52:15:52:50 | ControlFlowNode for Attribute() | provenance | Config |
|
||||
| pymongo_test.py:54:5:54:10 | ControlFlowNode for search | pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:54:5:54:10 | ControlFlowNode for search | pymongo_test.py:59:49:59:54 | ControlFlowNode for search | provenance | |
|
||||
| pymongo_test.py:54:5:54:10 | ControlFlowNode for search [Dictionary element at key body] | pymongo_test.py:59:49:59:54 | ControlFlowNode for search [Dictionary element at key body] | provenance | |
|
||||
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | pymongo_test.py:54:5:54:10 | ControlFlowNode for search | provenance | |
|
||||
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict [Dictionary element at key body] | pymongo_test.py:54:5:54:10 | ControlFlowNode for search [Dictionary element at key body] | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | provenance | Decoding-NoSQL |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:61:25:61:57 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:62:25:62:42 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict [Dictionary element at key body] | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:61:49:61:55 | ControlFlowNode for decoded | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:62:35:62:41 | ControlFlowNode for decoded | provenance | |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:63:25:63:31 | ControlFlowNode for decoded | provenance | |
|
||||
| pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function, Dictionary element at key body] | pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function] | pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search | pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function] | provenance | |
|
||||
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search [Dictionary element at key body] | pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function, Dictionary element at key body] | provenance | |
|
||||
| pymongo_test.py:61:35:61:56 | ControlFlowNode for Dict [Dictionary element at key $function] | pymongo_test.py:61:25:61:57 | ControlFlowNode for Dict | provenance | |
|
||||
| pymongo_test.py:61:49:61:55 | ControlFlowNode for decoded | pymongo_test.py:61:35:61:56 | ControlFlowNode for Dict [Dictionary element at key $function] | provenance | |
|
||||
| pymongo_test.py:62:35:62:41 | ControlFlowNode for decoded | pymongo_test.py:62:25:62:42 | ControlFlowNode for Dict | provenance | |
|
||||
nodes
|
||||
| PoC/server.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
|
||||
| PoC/server.py:1:26:1:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
@@ -128,7 +155,9 @@ nodes
|
||||
| PoC/server.py:27:14:27:38 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| PoC/server.py:27:25:27:37 | ControlFlowNode for author_string | semmle.label | ControlFlowNode for author_string |
|
||||
| PoC/server.py:30:27:30:44 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:30:38:30:43 | ControlFlowNode for author | semmle.label | ControlFlowNode for author |
|
||||
| PoC/server.py:31:34:31:51 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:31:45:31:50 | ControlFlowNode for author | semmle.label | ControlFlowNode for author |
|
||||
| PoC/server.py:43:5:43:10 | ControlFlowNode for author | semmle.label | ControlFlowNode for author |
|
||||
| PoC/server.py:43:14:43:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| PoC/server.py:47:27:47:68 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
@@ -139,14 +168,21 @@ nodes
|
||||
| PoC/server.py:53:14:57:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:54:17:54:70 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| PoC/server.py:61:27:61:58 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:61:37:61:57 | ControlFlowNode for Dict [Dictionary element at key $function] | semmle.label | ControlFlowNode for Dict [Dictionary element at key $function] |
|
||||
| PoC/server.py:61:51:61:56 | ControlFlowNode for search | semmle.label | ControlFlowNode for search |
|
||||
| PoC/server.py:77:5:77:10 | ControlFlowNode for author | semmle.label | ControlFlowNode for author |
|
||||
| PoC/server.py:77:14:77:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| PoC/server.py:78:5:78:15 | ControlFlowNode for accumulator | semmle.label | ControlFlowNode for accumulator |
|
||||
| PoC/server.py:78:19:83:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:80:23:80:101 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group | semmle.label | ControlFlowNode for group |
|
||||
| PoC/server.py:84:5:84:9 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | semmle.label | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] |
|
||||
| PoC/server.py:84:13:87:5 | ControlFlowNode for Dict [Dictionary element at key author, Dictionary element at key $accumulator] | semmle.label | ControlFlowNode for Dict [Dictionary element at key author, Dictionary element at key $accumulator] |
|
||||
| PoC/server.py:86:19:86:49 | ControlFlowNode for Dict [Dictionary element at key $accumulator] | semmle.label | ControlFlowNode for Dict [Dictionary element at key $accumulator] |
|
||||
| PoC/server.py:86:37:86:47 | ControlFlowNode for accumulator | semmle.label | ControlFlowNode for accumulator |
|
||||
| PoC/server.py:91:29:91:47 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:91:41:91:45 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | semmle.label | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] |
|
||||
| PoC/server.py:92:38:92:56 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| PoC/server.py:92:50:92:54 | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] | semmle.label | ControlFlowNode for group [Dictionary element at key author, Dictionary element at key $accumulator] |
|
||||
| PoC/server.py:98:5:98:10 | ControlFlowNode for author | semmle.label | ControlFlowNode for author |
|
||||
| PoC/server.py:98:14:98:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| PoC/server.py:99:5:99:10 | ControlFlowNode for mapper | semmle.label | ControlFlowNode for mapper |
|
||||
@@ -165,6 +201,7 @@ nodes
|
||||
| flask_mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| flask_mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| flask_mongoengine_bad.py:30:39:30:59 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| flask_mongoengine_bad.py:30:48:30:58 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| flask_pymongo_bad.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
|
||||
| flask_pymongo_bad.py:1:26:1:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| flask_pymongo_bad.py:11:5:11:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
@@ -173,6 +210,7 @@ nodes
|
||||
| flask_pymongo_bad.py:12:19:12:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| flask_pymongo_bad.py:12:30:12:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| flask_pymongo_bad.py:14:31:14:51 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| flask_pymongo_bad.py:14:40:14:50 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
|
||||
| mongoengine_bad.py:1:26:1:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| mongoengine_bad.py:18:5:18:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
@@ -181,24 +219,28 @@ nodes
|
||||
| mongoengine_bad.py:19:19:19:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| mongoengine_bad.py:19:30:19:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:22:26:22:46 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| mongoengine_bad.py:22:35:22:45 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:26:5:26:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:26:21:26:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| mongoengine_bad.py:27:5:27:15 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:27:19:27:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| mongoengine_bad.py:27:30:27:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:30:26:30:46 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| mongoengine_bad.py:30:35:30:45 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:34:5:34:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:34:21:34:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| mongoengine_bad.py:35:5:35:15 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:35:19:35:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| mongoengine_bad.py:35:30:35:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:38:26:38:46 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| mongoengine_bad.py:38:35:38:45 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:42:5:42:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:42:21:42:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| mongoengine_bad.py:43:5:43:15 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:43:19:43:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| mongoengine_bad.py:43:30:43:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:46:26:46:46 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| mongoengine_bad.py:46:35:46:45 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| mongoengine_bad.py:50:5:50:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:50:21:50:27 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| mongoengine_bad.py:51:5:51:15 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
@@ -211,6 +253,7 @@ nodes
|
||||
| mongoengine_bad.py:58:19:58:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| mongoengine_bad.py:58:30:58:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| mongoengine_bad.py:61:29:61:49 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| mongoengine_bad.py:61:38:61:48 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
|
||||
| pymongo_test.py:1:26:1:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| pymongo_test.py:12:5:12:17 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
@@ -219,6 +262,7 @@ nodes
|
||||
| pymongo_test.py:13:19:13:43 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| pymongo_test.py:13:30:13:42 | ControlFlowNode for unsafe_search | semmle.label | ControlFlowNode for unsafe_search |
|
||||
| pymongo_test.py:15:42:15:62 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| pymongo_test.py:15:51:15:61 | ControlFlowNode for json_search | semmle.label | ControlFlowNode for json_search |
|
||||
| pymongo_test.py:29:5:29:12 | ControlFlowNode for event_id | semmle.label | ControlFlowNode for event_id |
|
||||
| pymongo_test.py:29:16:29:51 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
|
||||
| pymongo_test.py:29:27:29:33 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
@@ -236,11 +280,20 @@ nodes
|
||||
| pymongo_test.py:52:26:52:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
|
||||
| pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
|
||||
| pymongo_test.py:54:5:54:10 | ControlFlowNode for search | semmle.label | ControlFlowNode for search |
|
||||
| pymongo_test.py:54:5:54:10 | ControlFlowNode for search [Dictionary element at key body] | semmle.label | ControlFlowNode for search [Dictionary element at key body] |
|
||||
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict [Dictionary element at key body] | semmle.label | ControlFlowNode for Dict [Dictionary element at key body] |
|
||||
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |
|
||||
| pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function, Dictionary element at key body] | semmle.label | ControlFlowNode for Dict [Dictionary element at key $function, Dictionary element at key body] |
|
||||
| pymongo_test.py:59:35:59:55 | ControlFlowNode for Dict [Dictionary element at key $function] | semmle.label | ControlFlowNode for Dict [Dictionary element at key $function] |
|
||||
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search | semmle.label | ControlFlowNode for search |
|
||||
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search [Dictionary element at key body] | semmle.label | ControlFlowNode for search [Dictionary element at key body] |
|
||||
| pymongo_test.py:61:25:61:57 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| pymongo_test.py:61:35:61:56 | ControlFlowNode for Dict [Dictionary element at key $function] | semmle.label | ControlFlowNode for Dict [Dictionary element at key $function] |
|
||||
| pymongo_test.py:61:49:61:55 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |
|
||||
| pymongo_test.py:62:25:62:42 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
|
||||
| pymongo_test.py:62:35:62:41 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |
|
||||
| pymongo_test.py:63:25:63:31 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |
|
||||
subpaths
|
||||
#select
|
||||
|
||||
1
ruby/ql/integration-tests/subst/code/test.rb
Normal file
1
ruby/ql/integration-tests/subst/code/test.rb
Normal file
@@ -0,0 +1 @@
|
||||
0
|
||||
2
ruby/ql/integration-tests/subst/file.expected
Normal file
2
ruby/ql/integration-tests/subst/file.expected
Normal file
@@ -0,0 +1,2 @@
|
||||
| code/test.rb:0:0:0:0 | code/test.rb | |
|
||||
| file://:0:0:0:0 | | |
|
||||
5
ruby/ql/integration-tests/subst/file.ql
Normal file
5
ruby/ql/integration-tests/subst/file.ql
Normal file
@@ -0,0 +1,5 @@
|
||||
import ruby
|
||||
|
||||
from File f, string relative
|
||||
where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
ruby/ql/integration-tests/subst/test.py
Normal file
7
ruby/ql/integration-tests/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, ruby, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(source_root=drive)
|
||||
1
rust/ql/integration-tests/subst/code/test.rs
Normal file
1
rust/ql/integration-tests/subst/code/test.rs
Normal file
@@ -0,0 +1 @@
|
||||
fn main() {}
|
||||
2
rust/ql/integration-tests/subst/file.expected
Normal file
2
rust/ql/integration-tests/subst/file.expected
Normal file
@@ -0,0 +1,2 @@
|
||||
| code/test.rs:0:0:0:0 | code/test.rs | |
|
||||
| file://:0:0:0:0 | | |
|
||||
7
rust/ql/integration-tests/subst/file.ql
Normal file
7
rust/ql/integration-tests/subst/file.ql
Normal file
@@ -0,0 +1,7 @@
|
||||
import rust
|
||||
|
||||
from File f, string relative
|
||||
where
|
||||
not f.getURL().matches("%/target/intree/%") and
|
||||
if exists(f.getRelativePath()) then relative = "relative" else relative = ""
|
||||
select f, relative
|
||||
7
rust/ql/integration-tests/subst/test.py
Normal file
7
rust/ql/integration-tests/subst/test.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import runs_on
|
||||
|
||||
|
||||
@runs_on.windows
|
||||
def test(codeql, rust, cwd, subst_drive):
|
||||
drive = subst_drive(cwd / "code")
|
||||
codeql.database.create(source_root=drive)
|
||||
35
shared/canonicalize/BUILD.bazel
Normal file
35
shared/canonicalize/BUILD.bazel
Normal file
@@ -0,0 +1,35 @@
|
||||
load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
|
||||
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files")
|
||||
|
||||
cc_binary(
|
||||
name = "codeql_canonical_path.dll",
|
||||
srcs = [
|
||||
"canonicalize.cpp",
|
||||
"canonicalize.h",
|
||||
"canonicalize_jni.cpp",
|
||||
],
|
||||
defines = ["CODEQL_CANONICALIZE_EXPORTS"],
|
||||
linkopts = ["-lkernel32"],
|
||||
linkshared = True,
|
||||
target_compatible_with = ["@platforms//os:windows"],
|
||||
visibility = ["//visibility:public"],
|
||||
deps = ["@rules_java//toolchains:jni"],
|
||||
)
|
||||
|
||||
cc_library(
|
||||
name = "canonicalize",
|
||||
srcs = ["canonicalize.cpp"],
|
||||
hdrs = ["canonicalize.h"],
|
||||
defines = ["CODEQL_CANONICALIZE_EXPORTS"],
|
||||
linkopts = ["-lkernel32"],
|
||||
target_compatible_with = ["@platforms//os:windows"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
pkg_files(
|
||||
name = "pkg",
|
||||
srcs = [":codeql_canonical_path.dll"],
|
||||
attributes = pkg_attributes(mode = "0755"),
|
||||
target_compatible_with = ["@platforms//os:windows"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
165
shared/canonicalize/canonicalize.cpp
Normal file
165
shared/canonicalize/canonicalize.cpp
Normal file
@@ -0,0 +1,165 @@
|
||||
#ifdef _WIN32
|
||||
#include "canonicalize.h"
|
||||
#include <windows.h>
|
||||
#include <string>
|
||||
#include <unordered_map>
|
||||
#include <shared_mutex>
|
||||
#include <random>
|
||||
|
||||
namespace {
|
||||
|
||||
class PathCache {
|
||||
public:
|
||||
static PathCache& instance() {
|
||||
static PathCache cache;
|
||||
return cache;
|
||||
}
|
||||
|
||||
const wchar_t* canonicalize(const wchar_t* path) {
|
||||
std::wstring key(path);
|
||||
|
||||
// Fast path: shared (read) lock for cache hit
|
||||
{
|
||||
std::shared_lock lock(mutex_);
|
||||
auto it = cache_.find(key);
|
||||
if (it != cache_.end()) {
|
||||
return _wcsdup(it->second.c_str());
|
||||
}
|
||||
}
|
||||
|
||||
// Slow path: resolve and insert under exclusive lock
|
||||
std::wstring resolved = resolve(path);
|
||||
if (resolved.empty()) return nullptr;
|
||||
|
||||
std::unique_lock lock(mutex_);
|
||||
// Check again under exclusive lock (another thread may have inserted)
|
||||
auto it = cache_.find(key);
|
||||
if (it != cache_.end()) {
|
||||
return _wcsdup(it->second.c_str());
|
||||
}
|
||||
|
||||
// Evict a random entry if at capacity (matches C# strategy)
|
||||
if (cache_.size() >= max_capacity_) {
|
||||
std::uniform_int_distribution<size_t> dist(0, cache_.size() - 1);
|
||||
auto evict = cache_.begin();
|
||||
std::advance(evict, dist(rng_));
|
||||
cache_.erase(evict);
|
||||
}
|
||||
|
||||
auto inserted = cache_.emplace(std::move(key), std::move(resolved)).first;
|
||||
return _wcsdup(inserted->second.c_str());
|
||||
}
|
||||
|
||||
private:
|
||||
PathCache() = default;
|
||||
|
||||
static constexpr size_t max_capacity_ = 4096;
|
||||
std::unordered_map<std::wstring, std::wstring> cache_;
|
||||
std::shared_mutex mutex_;
|
||||
std::mt19937 rng_{std::random_device{}()};
|
||||
|
||||
static std::wstring resolve(const wchar_t* path) {
|
||||
HANDLE h = CreateFileW(
|
||||
path,
|
||||
0,
|
||||
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
|
||||
nullptr,
|
||||
OPEN_EXISTING,
|
||||
FILE_FLAG_BACKUP_SEMANTICS,
|
||||
nullptr);
|
||||
|
||||
if (h == INVALID_HANDLE_VALUE) {
|
||||
return resolve_nonexistent(path);
|
||||
}
|
||||
|
||||
std::wstring result = get_final_path(h);
|
||||
CloseHandle(h);
|
||||
|
||||
if (result.empty()) return {};
|
||||
return strip_prefix(result);
|
||||
}
|
||||
|
||||
static std::wstring get_final_path(HANDLE h) {
|
||||
wchar_t buf[MAX_PATH];
|
||||
DWORD len = GetFinalPathNameByHandleW(h, buf, MAX_PATH, FILE_NAME_NORMALIZED);
|
||||
|
||||
if (len > 0 && len < MAX_PATH) {
|
||||
return std::wstring(buf, len);
|
||||
}
|
||||
if (len >= MAX_PATH) {
|
||||
std::wstring big(len + 1, L'\0');
|
||||
len = GetFinalPathNameByHandleW(h, big.data(), len + 1, FILE_NAME_NORMALIZED);
|
||||
if (len > 0) return std::wstring(big.data(), len);
|
||||
}
|
||||
return {};
|
||||
}
|
||||
|
||||
static std::wstring strip_prefix(const std::wstring& path) {
|
||||
constexpr std::wstring_view unc_prefix = L"\\\\?\\UNC\\";
|
||||
constexpr std::wstring_view lp_prefix = L"\\\\?\\";
|
||||
|
||||
if (path.starts_with(unc_prefix)) {
|
||||
return L"\\" + path.substr(unc_prefix.size() - 1);
|
||||
}
|
||||
if (path.starts_with(lp_prefix)) {
|
||||
return std::wstring(path.substr(lp_prefix.size()));
|
||||
}
|
||||
return path;
|
||||
}
|
||||
|
||||
// For non-existent files: canonicalize parent, append filename
|
||||
// (matches C#'s ConstructCanonicalPath)
|
||||
static std::wstring resolve_nonexistent(const wchar_t* path) {
|
||||
std::wstring spath(path);
|
||||
auto sep = spath.find_last_of(L"\\/");
|
||||
if (sep == std::wstring::npos) return {};
|
||||
|
||||
std::wstring parent = spath.substr(0, sep);
|
||||
std::wstring name = spath.substr(sep + 1);
|
||||
|
||||
std::wstring canonical_parent = resolve(parent.c_str());
|
||||
if (canonical_parent.empty()) return {};
|
||||
|
||||
return canonical_parent + L"\\" + name;
|
||||
}
|
||||
};
|
||||
|
||||
} // namespace
|
||||
|
||||
extern "C" {
|
||||
|
||||
CODEQL_API const wchar_t* canonicalize_path_w(const wchar_t* path) {
|
||||
if (!path || !*path) return nullptr;
|
||||
return PathCache::instance().canonicalize(path);
|
||||
}
|
||||
|
||||
CODEQL_API void canonicalize_free_w(const wchar_t* path) {
|
||||
free(const_cast<wchar_t*>(path));
|
||||
}
|
||||
|
||||
CODEQL_API const char* canonicalize_path_u8(const char* path) {
|
||||
if (!path || !*path) return nullptr;
|
||||
|
||||
int wlen = MultiByteToWideChar(CP_UTF8, 0, path, -1, nullptr, 0);
|
||||
if (wlen <= 0) return nullptr;
|
||||
std::wstring wpath(wlen - 1, L'\0');
|
||||
MultiByteToWideChar(CP_UTF8, 0, path, -1, wpath.data(), wlen);
|
||||
|
||||
const wchar_t* wresult = PathCache::instance().canonicalize(wpath.c_str());
|
||||
if (!wresult) return nullptr;
|
||||
|
||||
int ulen = WideCharToMultiByte(CP_UTF8, 0, wresult, -1, nullptr, 0, nullptr, nullptr);
|
||||
if (ulen <= 0) { free(const_cast<wchar_t*>(wresult)); return nullptr; }
|
||||
char* result = static_cast<char*>(malloc(ulen));
|
||||
WideCharToMultiByte(CP_UTF8, 0, wresult, -1, result, ulen, nullptr, nullptr);
|
||||
free(const_cast<wchar_t*>(wresult));
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
CODEQL_API void canonicalize_free_u8(const char* path) {
|
||||
free(const_cast<char*>(path));
|
||||
}
|
||||
|
||||
} // extern "C"
|
||||
#endif
|
||||
31
shared/canonicalize/canonicalize.h
Normal file
31
shared/canonicalize/canonicalize.h
Normal file
@@ -0,0 +1,31 @@
|
||||
#ifndef CODEQL_CANONICALIZE_H
|
||||
#define CODEQL_CANONICALIZE_H
|
||||
|
||||
#ifdef _WIN32
|
||||
|
||||
#ifdef CODEQL_CANONICALIZE_EXPORTS
|
||||
#define CODEQL_API __declspec(dllexport)
|
||||
#else
|
||||
#define CODEQL_API __declspec(dllimport)
|
||||
#endif
|
||||
|
||||
#include <wchar.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
// UTF-16 interface (for JNI / Java / Kotlin)
|
||||
CODEQL_API const wchar_t* canonicalize_path_w(const wchar_t* path);
|
||||
CODEQL_API void canonicalize_free_w(const wchar_t* path);
|
||||
|
||||
// UTF-8 interface (for Go)
|
||||
CODEQL_API const char* canonicalize_path_u8(const char* path);
|
||||
CODEQL_API void canonicalize_free_u8(const char* path);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // _WIN32
|
||||
#endif // CODEQL_CANONICALIZE_H
|
||||
25
shared/canonicalize/canonicalize_jni.cpp
Normal file
25
shared/canonicalize/canonicalize_jni.cpp
Normal file
@@ -0,0 +1,25 @@
|
||||
#ifdef _WIN32
|
||||
#include <jni.h>
|
||||
#include "canonicalize.h"
|
||||
|
||||
extern "C" {
|
||||
|
||||
JNIEXPORT jstring JNICALL
|
||||
Java_com_semmle_util_files_NativeCanonicalizer_nativeCanonicalizePath(
|
||||
JNIEnv *env, jclass cls, jstring jpath) {
|
||||
|
||||
const jchar* path = env->GetStringChars(jpath, nullptr);
|
||||
const wchar_t* result = canonicalize_path_w(reinterpret_cast<const wchar_t*>(path));
|
||||
env->ReleaseStringChars(jpath, path);
|
||||
|
||||
if (result == nullptr) return nullptr;
|
||||
|
||||
jstring jresult = env->NewString(
|
||||
reinterpret_cast<const jchar*>(result),
|
||||
static_cast<jsize>(wcslen(result)));
|
||||
canonicalize_free_w(result);
|
||||
return jresult;
|
||||
}
|
||||
|
||||
} // extern "C"
|
||||
#endif
|
||||
Reference in New Issue
Block a user