mirror of
https://github.com/github/codeql.git
synced 2026-03-05 07:06:47 +01:00
d1755500e4
Initial implementation of data flow through fields, using the algorithm of the
shared data flow implementation. Fields (and field-like properties) are covered,
and stores can be either
- ordinary assignments, `Foo = x`,
- object initializers, `new C() { Foo = x }`, or
- field initializers, `int Foo = x`.
For field initializers, we need to synthesize calls (`SynthesizedCall`),
callables (`SynthesizedCallable`), parameters (`InstanceParameterNode`), and
arguments (`SynthesizedThisArgumentNode`), as the C# extractor does not (yet)
extract such entities. For example, in
```
class C
{
int Field1 = 1;
int Field2 = 2;
C() { }
}
```
there is a synthesized call from the constructor `C`, with a synthesized `this`
argument, and the targets of that call are two synthesized callables with bodies
`this.Field1 = 1` and `this.Field2 = 2`, respectively.
A consequence of this is that `DataFlowCallable` is no longer an alias for
`DotNet::Callable`, but instead an IPA type.
45 lines
881 B
C#
45 lines
881 B
C#
public class B
|
|
{
|
|
public void M1()
|
|
{
|
|
var e = new Elem();
|
|
var b1 = new Box1(e, null);
|
|
var b2 = new Box2(b1);
|
|
Sink(b2.box1.elem1); // flow
|
|
Sink(b2.box1.elem2); // FP due to flow in M2 below
|
|
}
|
|
|
|
public void M2()
|
|
{
|
|
var e = new Elem();
|
|
var b1 = new Box1(null, e);
|
|
var b2 = new Box2(b1);
|
|
Sink(b2.box1.elem1); // FP due to flow in M1 above
|
|
Sink(b2.box1.elem2); // flow
|
|
}
|
|
|
|
public static void Sink(object o) { }
|
|
|
|
public class Elem { }
|
|
|
|
public class Box1
|
|
{
|
|
public Elem elem1;
|
|
public Elem elem2;
|
|
public Box1(Elem e1, Elem e2)
|
|
{
|
|
this.elem1 = e1;
|
|
this.elem2 = e2;
|
|
}
|
|
}
|
|
|
|
public class Box2
|
|
{
|
|
public Box1 box1;
|
|
public Box2(Box1 b1)
|
|
{
|
|
this.box1 = b1;
|
|
}
|
|
}
|
|
}
|