mirror of
https://github.com/github/codeql.git
synced 2026-03-05 15:16:47 +01:00
b2f99dbbc7
Data flow nodes for expressions do not take CFG splitting into account. Example:
```
if (b)
x = tainted;
x = x.ToLower();
if (!b)
Use(x);
```
Flow is incorrectly reported from `tainted` to `x` in `Use(x)`, because the step
from `tainted` to `x.ToLower()` throws away the information that `b = true`.
The solution is to remember the splitting in data flow expression nodes, that is,
to represent the exact control flow node instead of just the expression. With that
we get flow from `tainted` to `[b = true] x.ToLower()`, but not from `tainted` to
`[b = false] x.ToLower()`.
The data flow API remains unchanged, but in order for analyses to fully benefit from
CFG splitting, sanitizers in particular should be CFG-based instead of expression-based:
```
if (b)
x = tainted;
if (IsInvalid(x))
return;
Use(x);
```
If the call to `IsInvalid()` is a sanitizer, then defining an expression node to be
a sanitizer using `GuardedExpr` will be too conservative (`x` in `Use(x)` is in fact
not guarded). However, `[b = true] x` in `[b = true] Use(x)` is guarded, and to help
defining guard-based sanitizers, the class `GuardedDataFlowNode` has been introduced.
24 lines
1.5 KiB
Plaintext
24 lines
1.5 KiB
Plaintext
| LocalDataFlow.cs:53:15:53:19 | access to local variable sink0 |
|
|
| LocalDataFlow.cs:300:15:300:20 | access to local variable sink40 |
|
|
| LocalDataFlow.cs:302:15:302:20 | access to local variable sink41 |
|
|
| LocalDataFlow.cs:304:15:304:20 | access to local variable sink42 |
|
|
| LocalDataFlow.cs:306:15:306:20 | access to local variable sink43 |
|
|
| LocalDataFlow.cs:392:15:392:20 | access to local variable sink67 |
|
|
| LocalDataFlow.cs:394:15:394:20 | access to local variable sink68 |
|
|
| LocalDataFlow.cs:412:15:412:20 | access to local variable sink70 |
|
|
| LocalDataFlow.cs:420:19:420:24 | access to local variable sink71 |
|
|
| LocalDataFlow.cs:430:23:430:28 | access to local variable sink72 |
|
|
| LocalDataFlow.cs:466:15:466:21 | access to parameter tainted |
|
|
| SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
|
|
| SSA.cs:25:15:25:22 | access to local variable ssaSink1 |
|
|
| SSA.cs:43:15:43:22 | access to local variable ssaSink2 |
|
|
| SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
|
|
| SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
|
|
| SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
|
|
| SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
|
|
| SSA.cs:180:15:180:22 | access to local variable ssaSink5 |
|
|
| Splitting.cs:8:19:8:19 | [b (line 3): true] access to local variable x |
|
|
| Splitting.cs:12:15:12:15 | [b (line 3): false] access to local variable x |
|
|
| Splitting.cs:25:15:25:15 | [b (line 17): true] access to local variable x |
|
|
| Splitting.cs:27:19:27:19 | access to local variable x |
|