{ // Place your python workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is // used to trigger the snippet and the body will be expanded and inserted. Possible variables are: // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders. // Placeholders with the same ids are connected. // Example: // "Print to console": { // "scope": "javascript,typescript", // "prefix": "log", // "body": [ // "console.log('$1');", // "$2" // ], // "description": "Log output to console" // } "Has relative path": { "scope": "ql", "prefix": "has relative path", "body": [ "exists($1.getLocation().getFile().getRelativePath())" ], "description": "has relative path", }, "debug based on location": { "scope": "ql", "prefix": "debug based on location", "body": [ "$1.getLocation().getFile().getShortName() = \"$2\" and", "$1.getLocation().getStartLine() = $3 and", ], "description": "debug based on location", }, "Exists": { "scope": "ql", "prefix": "exists", "body": [ "exists(${1:DataFlow::Node node} |", " $2", ")" ], "description": "Exists clause", }, "Predicate": { "scope": "ql", "prefix": "predicate", "body": [ "predicate ${1:isFoo}(${2:DataFlow::Node node}) {", " ${3:any()}", "}" ], "description": "Predicate", }, "Class": { "scope": "ql", "prefix": "class", "body": [ "class ${1:MyClass} extends ${2:DataFlow::MethodCallNode} {", " $1() { ${3:getMethodName() = \"foo\"} }", "", " DataFlow::Node ${4:getThing}() { result = ${5:getArgument(0)} }", "}" ], "description": "Class", }, "Abstract class": { "scope": "ql", "prefix": "abstract class", "body": [ "abstract class ${1:AdditionalThing} extends ${2:DataFlow::Node} {", " abstract ${3:DataFlow::Node} ${4:getThing}($5);", "}" ], "description": "Class", }, "Class::Range": { "scope": "ql", "prefix": "range class", "body": [ "class ${1:MyClass} extends ${2:DataFlow::Node} {", " $1::Range range;", "", " $1() { this = range }", "", " ${3:DataFlow::Node} ${4:getThing}() { result = range.$4() }", "}", "", "module $1 {", " abstract class Range extends $2 {", " abstract $3 $4();", " }", "}", ], "description": "Class with ::Range pattern", }, "Class::Range delegate": { "scope": "ql", "prefix": "range delegate", "body": [ "${1:DataFlow::Node} ${2:getThing}() { result = range.$2() }" ], "description": "Predicate that delegates to range class", }, "Type tracking predicate": { "scope": "ql", "prefix": "type tracking", "body": [ "/** Gets a reference to ${3:a thing}. */", "private DataFlow::TypeTrackingNode ${1:myType}(DataFlow::TypeTracker t) {", " t.start() and", " result = ${2:value}", " or", " exists(DataFlow::TypeTracker t2 |", " result = $1(t2).track(t2, t)", " )", "}", "", "/** Gets a reference to $3. */", "DataFlow::Node $1() {", " $1(DataFlow::TypeTracker::end()).flowsTo(result)", "}" ], "description": "Type tracking predicate", }, "Taint tracking configuration": { "scope": "ql", "prefix": "taint tracking", "body": [ "/** @kind path-problem */", "import python", "import experimental.dataflow.DataFlow", "import experimental.dataflow.TaintTracking", "import experimental.semmle.python.Concepts", "import experimental.dataflow.RemoteFlowSources", "import DataFlow::PathGraph", "class ${1:Config} extends TaintTracking::Configuration {", " $1() { this = \"$1\" } ", "", " override predicate isSource(DataFlow::Node node) {", " ${2:none()}", " }", "", " override predicate isSink(DataFlow::Node node) {", " ${3:none()}", " }", "}", "", "from $1 cfg, DataFlow::PathNode source, DataFlow::PathNode sink", "where cfg.hasFlowPath(source, sink)", "select sink, source, sink, \"taint from $@\", source.getNode(), \"here\"" ] }, "Type tracking class": { "scope": "ql", "prefix": "type tracking class", "body": [ "/**", " * Provides models for the `${TM_SELECTED_TEXT}` class", " *", " * See ${1:https://apiref (TODO)}.", " */", "module ${TM_SELECTED_TEXT/^(.*)\\.([^.]+)$/$2/} {", " /** Gets a reference to the `${TM_SELECTED_TEXT}` class. */", " private API::Node classRef() {", " result = API::moduleImport(\"${TM_SELECTED_TEXT/\\.([^.]+)/\").getMember(\"$1/g}\")", " }", "", " /**", " * A source of instances of `${TM_SELECTED_TEXT}`, extend this class to model new instances.", " *", " * This can include instantiations of the class, return values from function", " * calls, or a special parameter that will be set when functions are called by an external", " * library.", " *", " * Use the predicate `${TM_SELECTED_TEXT/^(.*)\\.([^.]+)$/$2/}::instance()` to get references to instances of `${TM_SELECTED_TEXT}`.", " */", " abstract class InstanceSource extends DataFlow::LocalSourceNode { }", "", " /** A direct instantiation of `${TM_SELECTED_TEXT}`. */", " private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {", " ClassInstantiation() { this = classRef().getACall() }", " }", "", " /** Gets a reference to an instance of `${TM_SELECTED_TEXT}`. */", " private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {", " t.start() and", " result instanceof InstanceSource", " or", " exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))", " }", "", " /** Gets a reference to an instance of `${TM_SELECTED_TEXT}`. */", " DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }", "", " /**", " * Taint propagation for `${TM_SELECTED_TEXT}`.", " */", " private class InstanceTaintSteps extends InstanceTaintStepsHelper {", " InstanceTaintSteps() { this = \"${TM_SELECTED_TEXT}\" }", " ", " override DataFlow::Node getInstance() { result = instance() }", " ", " override string getAttributeName() { none() }", " ", " override string getMethodName() { none() }", " ", " override string getAsyncMethodName() { none() }", " }", "", " /**", " * Extra taint propagation for `${TM_SELECTED_TEXT}`, not covered by `InstanceTaintSteps`.", " */", " private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {", " override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {", " // TODO", " none()", " }", " }", "}", ], "description": "Type tracking class (select full class path before inserting)", }, "API graph .getMember chain": { "scope": "ql", "prefix": "api graph .getMember chain", "body": [ "API::moduleImport(\"${TM_SELECTED_TEXT/\\.([^.]+)/\").getMember(\"$1/g}\")" ], "description": "API graph .getMember chain (select full path before inserting)", }, "debug partial flow": { "scope": "ql", "prefix": "debug partial flow", "body": [ "// put the line below inside the configuration", "// override int explorationLimit() { result = 5 }", "// and then run quick evaluation on the predicate below", "// (and potentially limit the set of sources)", "predicate debugPartialFlow(Location loc, DataFlow::PartialPathNode node, int dist) {", " loc = node.getNode().getLocation() and", " exists(loc.getFile().getRelativePath()) and", " exists(Configuration config, DataFlow::PartialPathNode source |", " config.hasPartialFlow(source, node, dist)", " )", "}", ], "description": "debug partial flow", }, }