@@ -30,46 +30,46 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
3030 override predicate isSink ( DataFlow:: Node node , string flowstate ) {
3131 // arguments to method calls...
3232 exists (
33- string className , string methodName , string argName , ClassDecl c , AbstractFunctionDecl f ,
33+ string className , string methodName , string paramName , ClassDecl c , AbstractFunctionDecl f ,
3434 CallExpr call , int arg
3535 |
3636 (
3737 // `NSRange.init`
3838 className = "NSRange" and
3939 methodName = "init" and
40- argName = [ "location" , "length" ]
40+ paramName = [ "location" , "length" ]
4141 or
4242 // `NSString.character`
4343 className = [ "NSString" , "NSMutableString" ] and
4444 methodName = "character" and
45- argName = "at"
45+ paramName = "at"
4646 or
4747 // `NSString.character`
4848 className = [ "NSString" , "NSMutableString" ] and
4949 methodName = "substring" and
50- argName = [ "from" , "to" ]
50+ paramName = [ "from" , "to" ]
5151 or
5252 // `NSMutableString.insert`
5353 className = "NSMutableString" and
5454 methodName = "insert" and
55- argName = "at"
55+ paramName = "at"
5656 ) and
5757 c .toString ( ) = className and // TODO: use of toString
5858 c .getAMember ( ) = f and // TODO: will this even work if its defined in a parent class?
5959 call .getFunction ( ) .( ApplyExpr ) .getFunction ( ) .( DeclRefExpr ) .getDecl ( ) = f and
6060 call .getFunction ( ) .( ApplyExpr ) .getFunction ( ) .toString ( ) = methodName and // TODO: use of toString
61- f .getParam ( arg ) .getName ( ) = argName and
61+ f .getParam ( arg ) .getName ( ) = paramName and
6262 call .getArgument ( arg ) .getExpr ( ) = node .asExpr ( ) and
6363 flowstate = "String" // `String` length flowing into `NSString`
6464 )
6565 or
6666 // arguments to function calls...
67- exists ( string funcName , string argName , CallExpr call , int arg |
67+ exists ( string funcName , string paramName , CallExpr call , int arg |
6868 // `NSMakeRange`
6969 funcName = "NSMakeRange(_:_:)" and
70- argName = [ "loc" , "len" ] and
70+ paramName = [ "loc" , "len" ] and
7171 call .getStaticTarget ( ) .getName ( ) = funcName and
72- call .getStaticTarget ( ) .getParam ( arg ) .getName ( ) = argName and
72+ call .getStaticTarget ( ) .getParam ( arg ) .getName ( ) = paramName and
7373 call .getArgument ( arg ) .getExpr ( ) = node .asExpr ( ) and
7474 flowstate = "String" // `String` length flowing into `NSString`
7575 )
0 commit comments