@@ -42,58 +42,6 @@ class SecurityOptions extends string {
4242 )
4343 }
4444
45- /**
46- * The argument of the given function is filled in from user input.
47- */
48- deprecated predicate userInputArgument ( FunctionCall functionCall , int arg ) {
49- exists ( string fname |
50- functionCall .getTarget ( ) .hasGlobalOrStdName ( fname ) and
51- exists ( functionCall .getArgument ( arg ) ) and
52- (
53- fname = [ "fread" , "fgets" , "fgetws" , "gets" ] and arg = 0
54- or
55- fname = "scanf" and arg >= 1
56- or
57- fname = "fscanf" and arg >= 2
58- )
59- or
60- functionCall .getTarget ( ) .hasGlobalName ( fname ) and
61- exists ( functionCall .getArgument ( arg ) ) and
62- fname = "getaddrinfo" and
63- arg = 3
64- )
65- or
66- exists ( RemoteFlowSourceFunction remote , FunctionOutput output |
67- functionCall .getTarget ( ) = remote and
68- output .isParameterDerefOrQualifierObject ( arg ) and
69- remote .hasRemoteFlowSource ( output , _)
70- )
71- }
72-
73- /**
74- * The return value of the given function is filled in from user input.
75- */
76- deprecated predicate userInputReturned ( FunctionCall functionCall ) {
77- exists ( string fname |
78- functionCall .getTarget ( ) .getName ( ) = fname and
79- (
80- fname = [ "fgets" , "gets" ] or
81- this .userInputReturn ( fname )
82- )
83- )
84- or
85- exists ( RemoteFlowSourceFunction remote , FunctionOutput output |
86- functionCall .getTarget ( ) = remote and
87- ( output .isReturnValue ( ) or output .isReturnValueDeref ( ) ) and
88- remote .hasRemoteFlowSource ( output , _)
89- )
90- }
91-
92- /**
93- * DEPRECATED: Users should override `userInputReturned()` instead.
94- */
95- deprecated predicate userInputReturn ( string function ) { none ( ) }
96-
9745 /**
9846 * The argument of the given function is used for running a process or loading
9947 * a library.
@@ -108,29 +56,6 @@ class SecurityOptions extends string {
10856 function = [ "LoadLibrary" , "LoadLibraryA" , "LoadLibraryW" ] and arg = 0
10957 }
11058
111- /**
112- * This predicate should hold if the expression is directly
113- * computed from user input. Such expressions are treated as
114- * sources of taint.
115- */
116- deprecated predicate isUserInput ( Expr expr , string cause ) {
117- exists ( FunctionCall fc , int i |
118- this .userInputArgument ( fc , i ) and
119- expr = fc .getArgument ( i ) and
120- cause = fc .getTarget ( ) .getName ( )
121- )
122- or
123- exists ( FunctionCall fc |
124- this .userInputReturned ( fc ) and
125- expr = fc and
126- cause = fc .getTarget ( ) .getName ( )
127- )
128- or
129- commandLineArg ( expr ) and cause = "argv"
130- or
131- expr .( EnvironmentRead ) .getSourceDescription ( ) = cause
132- }
133-
13459 /**
13560 * This predicate should hold if the expression raises privilege for the
13661 * current session. The default definition only holds true for some
@@ -173,21 +98,6 @@ predicate argv(Parameter argv) {
17398/** Convenience accessor for SecurityOptions.isPureFunction */
17499predicate isPureFunction ( string name ) { exists ( SecurityOptions opts | opts .isPureFunction ( name ) ) }
175100
176- /** Convenience accessor for SecurityOptions.userInputArgument */
177- deprecated predicate userInputArgument ( FunctionCall functionCall , int arg ) {
178- exists ( SecurityOptions opts | opts .userInputArgument ( functionCall , arg ) )
179- }
180-
181- /** Convenience accessor for SecurityOptions.userInputReturn */
182- deprecated predicate userInputReturned ( FunctionCall functionCall ) {
183- exists ( SecurityOptions opts | opts .userInputReturned ( functionCall ) )
184- }
185-
186- /** Convenience accessor for SecurityOptions.isUserInput */
187- deprecated predicate isUserInput ( Expr expr , string cause ) {
188- exists ( SecurityOptions opts | opts .isUserInput ( expr , cause ) )
189- }
190-
191101/** Convenience accessor for SecurityOptions.isProcessOperationArgument */
192102predicate isProcessOperationArgument ( string function , int arg ) {
193103 exists ( SecurityOptions opts | opts .isProcessOperationArgument ( function , arg ) )
0 commit comments