Skip to content

Commit 2d03fea

Browse files
committed
Data flow: Rework reverse flow through parameters
1 parent a8f8ab5 commit 2d03fea

File tree

7 files changed

+796
-321
lines changed

7 files changed

+796
-321
lines changed

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -546,7 +546,7 @@ module ProductFlow {
546546
Flow1::PathGraph::edges(pred1, succ1, _, _) and
547547
exists(ReturnKindExt returnKind |
548548
succ1.getNode() = getAnOutNodeExt(call, returnKind) and
549-
returnKind = getParamReturnPosition(_, pred1.asParameterReturnNode()).getKind()
549+
returnKind = getParamReturnPosition(pred1.asParameterReturnNode()).getKind()
550550
)
551551
}
552552

@@ -574,7 +574,7 @@ module ProductFlow {
574574
Flow2::PathGraph::edges(pred2, succ2, _, _) and
575575
exists(ReturnKindExt returnKind |
576576
succ2.getNode() = getAnOutNodeExt(call, returnKind) and
577-
returnKind = getParamReturnPosition(_, pred2.asParameterReturnNode()).getKind()
577+
returnKind = getParamReturnPosition(pred2.asParameterReturnNode()).getKind()
578578
)
579579
}
580580

shared/dataflow/codeql/dataflow/DataFlow.qll

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,13 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
363363
*/
364364
predicate isSink(Node sink);
365365

366+
/**
367+
* INTERNAL: Do not use.
368+
*
369+
* Holds if `sink` is a relevant reverse data flow sink.
370+
*/
371+
default predicate isSinkReverse(Node sink) { none() }
372+
366373
/**
367374
* Holds if data flow through `node` is prohibited. This completely removes
368375
* `node` from the data flow graph.
@@ -465,6 +472,20 @@ module Configs<LocationSig Location, InputSig<Location> Lang> {
465472
*/
466473
default predicate isSink(Node sink) { none() }
467474

475+
/**
476+
* INTERNAL: Do not use.
477+
*
478+
* Holds if `sink` is a relevant reverse data flow sink for any state.
479+
*/
480+
default predicate isSinkReverse(Node sink) { none() }
481+
482+
/**
483+
* INTERNAL: Do not use.
484+
*
485+
* Holds if `sink` is a relevant reverse data flow sink accepting `state`.
486+
*/
487+
default predicate isSinkReverse(Node sink, FlowState state) { none() }
488+
468489
/**
469490
* Holds if data flow through `node` is prohibited. This completely removes
470491
* `node` from the data flow graph.

shared/dataflow/codeql/dataflow/TaintTracking.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,10 @@ module TaintFlowMake<
179179
Config::isSink(sink, state.getState())
180180
}
181181

182+
predicate isSinkReverse(DataFlowLang::Node sink, FlowState state) {
183+
Config::isSinkReverse(sink, state.getState())
184+
}
185+
182186
predicate isBarrier(DataFlowLang::Node node, FlowState state) {
183187
Config::isBarrier(node, state.getState())
184188
}

shared/dataflow/codeql/dataflow/internal/ContentDataFlowImpl.qll

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,13 @@ module MakeImplContentDataFlow<LocationSig Location, InputSig<Location> Lang> {
4646
*/
4747
predicate isSink(Node sink);
4848

49+
/**
50+
* INTERNAL: Do not use.
51+
*
52+
* Holds if `sink` is a relevant reverse data flow sink.
53+
*/
54+
default predicate isSinkReverse(Node sink) { none() }
55+
4956
/**
5057
* Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
5158
*/
@@ -98,6 +105,15 @@ module MakeImplContentDataFlow<LocationSig Location, InputSig<Location> Lang> {
98105
)
99106
}
100107

108+
predicate isSinkReverse(Node sink, FlowState state) {
109+
ContentConfig::isSinkReverse(sink) and
110+
(
111+
state instanceof InitState or
112+
state instanceof StoreState or
113+
state instanceof ReadState
114+
)
115+
}
116+
101117
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
102118
storeStep(node1, state1, _, node2, state2) or
103119
readStep(node1, state1, _, node2, state2) or
@@ -202,7 +218,7 @@ module MakeImplContentDataFlow<LocationSig Location, InputSig<Location> Lang> {
202218
Node node1, State state1, ContentSet c, Node node2, StoreState state2
203219
) {
204220
exists(boolean preservesValue, int size |
205-
storeSet(node1, c, node2, _, _) and
221+
storeSet(node1, c, node2) and
206222
ContentConfig::isRelevantContent(c) and
207223
state2.decode(size + 1, preservesValue)
208224
|
@@ -359,6 +375,8 @@ module MakeImplContentDataFlow<LocationSig Location, InputSig<Location> Lang> {
359375
or
360376
FlowConfig::isSink(node.getNode(), node.getState())
361377
or
378+
FlowConfig::isSinkReverse(node.getNode(), node.getState())
379+
or
362380
excludeStep(node, _)
363381
or
364382
Flow::PathGraph::subpaths(_, _, node, _)

0 commit comments

Comments
 (0)