@@ -145,7 +145,7 @@ private class TaintStore extends TaintState, TTaintStore {
145145 *
146146 * This can be used to generate Flow summaries for APIs from parameter to return.
147147 */
148- module ThroughFlowConfig implements DataFlow:: StateConfigSig {
148+ module PropagateFlowConfig implements DataFlow:: StateConfigSig {
149149 class FlowState = TaintState ;
150150
151151 predicate isSource ( DataFlow:: Node source , FlowState state ) {
@@ -190,14 +190,14 @@ module ThroughFlowConfig implements DataFlow::StateConfigSig {
190190 }
191191}
192192
193- private module ThroughFlow = TaintTracking:: GlobalWithState< ThroughFlowConfig > ;
193+ private module PropagateFlow = TaintTracking:: GlobalWithState< PropagateFlowConfig > ;
194194
195195/**
196196 * Gets the summary model(s) of `api`, if there is flow from parameters to return value or parameter.
197197 */
198198string captureThroughFlow ( DataFlowTargetApi api ) {
199199 exists ( DataFlow:: ParameterNode p , ReturnNodeExt returnNodeExt , string input , string output |
200- ThroughFlow :: flow ( p , returnNodeExt ) and
200+ PropagateFlow :: flow ( p , returnNodeExt ) and
201201 returnNodeExt .( DataFlow:: Node ) .getEnclosingCallable ( ) = api and
202202 input = parameterNodeAsInput ( p ) and
203203 output = returnNodeExt .getOutput ( ) and
@@ -213,8 +213,13 @@ string captureThroughFlow(DataFlowTargetApi api) {
213213 * This can be used to generate Source summaries for an API, if the API expose an already known source
214214 * via its return (then the API itself becomes a source).
215215 */
216- module FromSourceConfig implements DataFlow:: ConfigSig {
217- predicate isSource ( DataFlow:: Node source ) { ExternalFlow:: sourceNode ( source , _) }
216+ module PropagateFromSourceConfig implements DataFlow:: ConfigSig {
217+ predicate isSource ( DataFlow:: Node source ) {
218+ exists ( string kind |
219+ isRelevantSourceKind ( kind ) and
220+ ExternalFlow:: sourceNode ( source , kind )
221+ )
222+ }
218223
219224 predicate isSink ( DataFlow:: Node sink ) {
220225 exists ( DataFlowTargetApi c |
@@ -234,17 +239,16 @@ module FromSourceConfig implements DataFlow::ConfigSig {
234239 }
235240}
236241
237- private module FromSource = TaintTracking:: Global< FromSourceConfig > ;
242+ private module PropagateFromSource = TaintTracking:: Global< PropagateFromSourceConfig > ;
238243
239244/**
240245 * Gets the source model(s) of `api`, if there is flow from an existing known source to the return of `api`.
241246 */
242247string captureSource ( DataFlowTargetApi api ) {
243248 exists ( DataFlow:: Node source , ReturnNodeExt sink , string kind |
244- FromSource :: flow ( source , sink ) and
249+ PropagateFromSource :: flow ( source , sink ) and
245250 ExternalFlow:: sourceNode ( source , kind ) and
246251 api = sink .getEnclosingCallable ( ) and
247- isRelevantSourceKind ( kind ) and
248252 result = ModelPrinting:: asSourceModel ( api , sink .getOutput ( ) , kind )
249253 )
250254}
@@ -259,7 +263,9 @@ string captureSource(DataFlowTargetApi api) {
259263module PropagateToSinkConfig implements DataFlow:: ConfigSig {
260264 predicate isSource ( DataFlow:: Node source ) { apiSource ( source ) }
261265
262- predicate isSink ( DataFlow:: Node sink ) { ExternalFlow:: sinkNode ( sink , _) }
266+ predicate isSink ( DataFlow:: Node sink ) {
267+ exists ( string kind | isRelevantSinkKind ( kind ) and ExternalFlow:: sinkNode ( sink , kind ) )
268+ }
263269
264270 predicate isBarrier ( DataFlow:: Node node ) {
265271 exists ( Type t | t = node .getType ( ) and not isRelevantType ( t ) )
@@ -284,7 +290,6 @@ string captureSink(DataFlowTargetApi api) {
284290 PropagateToSink:: flow ( src , sink ) and
285291 ExternalFlow:: sinkNode ( sink , kind ) and
286292 api = src .getEnclosingCallable ( ) and
287- isRelevantSinkKind ( kind ) and
288293 result = ModelPrinting:: asSinkModel ( api , asInputArgument ( src ) , kind )
289294 )
290295}
0 commit comments