Skip to content

Commit 407f634

Browse files
lcarteylcartey
committed
C#: Fix potential bug in CaptureOutNode.
In theory this bug could associated CaptureOutNodes with the wrong transitively called callable. However, in practice I could not create a test case that revealed incorrect behaviour. I've included one such test case in the commit. I believe that the cause of this is that OutNode::getACall() is not actually used in the data flow libraries. Instead, DataFlowDispatch::Cached::getAnOutNode is the predicate which is used to associated OutNode's with DataFlowCall's in practice, and that is always used in a context that correctly binds the runtime target of the call.
1 parent 4ecfe97 commit 407f634

File tree

9 files changed

+106
-4
lines changed

9 files changed

+106
-4
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -953,7 +953,7 @@ private module OutNodes {
953953
additionalCalls = false and
954954
call.(ImplicitDelegateDataFlowCall).isArgumentOf(csharpCall(_, cfn), _)
955955
or
956-
additionalCalls = true and call = TTransitiveCapturedCall(cfn, _)
956+
additionalCalls = true and call = TTransitiveCapturedCall(cfn, n.getEnclosingCallable())
957957
)
958958
}
959959

‎csharp/ql/test/library-tests/dataflow/global/Capture.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,18 +108,18 @@ void M()
108108
};
109109
CaptureOut2NotCalled();
110110
Check(nonSink0);
111-
/*string sink40 = "";
111+
string sink40 = "";
112112
void CaptureOutMultipleLambdas()
113113
{
114114
RunAction(() => {
115115
sink40 = "taint source";
116116
});
117117
RunAction(() => {
118-
sink40 = "not tainted";
118+
nonSink0 = "not tainted";
119119
});
120120
};
121121
CaptureOutMultipleLambdas();
122-
Check(sink40);*/
122+
Check(sink40); Check(nonSink0);
123123
}
124124

125125
void Through(string tainted)

‎csharp/ql/test/library-tests/dataflow/global/DataFlow.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
| Capture.cs:72:15:72:20 | access to local variable sink30 |
66
| Capture.cs:84:15:84:20 | access to local variable sink31 |
77
| Capture.cs:93:15:93:20 | access to local variable sink32 |
8+
| Capture.cs:122:15:122:20 | access to local variable sink40 |
89
| Capture.cs:133:15:133:20 | access to local variable sink33 |
910
| Capture.cs:145:15:145:20 | access to local variable sink34 |
1011
| Capture.cs:154:15:154:20 | access to local variable sink35 |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,45 @@
337337
| Capture.cs:109:9:109:30 | call to local function CaptureOut2NotCalled | Capture.cs:109:9:109:30 | call to local function CaptureOut2NotCalled |
338338
| Capture.cs:110:9:110:23 | call to method Check | Capture.cs:110:9:110:23 | call to method Check |
339339
| Capture.cs:110:15:110:22 | access to local variable nonSink0 | Capture.cs:110:15:110:22 | access to local variable nonSink0 |
340+
| Capture.cs:111:16:111:26 | SSA def(sink40) | Capture.cs:111:16:111:26 | SSA def(sink40) |
341+
| Capture.cs:111:16:111:26 | String sink40 = ... | Capture.cs:111:16:111:26 | String sink40 = ... |
342+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:16:111:26 | SSA def(sink40) |
343+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:16:111:26 | SSA def(sink40) |
344+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:25:111:26 | "" |
345+
| Capture.cs:114:13:116:14 | call to method RunAction | Capture.cs:114:13:116:14 | call to method RunAction |
346+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:114:23:116:13 | (...) => ... |
347+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
348+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
349+
| Capture.cs:115:17:115:39 | ... = ... | Capture.cs:115:17:115:39 | ... = ... |
350+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:115:17:115:39 | SSA def(sink40) |
351+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
352+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
353+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
354+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
355+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:26:115:39 | "taint source" |
356+
| Capture.cs:117:13:119:14 | call to method RunAction | Capture.cs:117:13:119:14 | call to method RunAction |
357+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:117:23:119:13 | (...) => ... |
358+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
359+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
360+
| Capture.cs:118:17:118:40 | ... = ... | Capture.cs:118:17:118:40 | ... = ... |
361+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
362+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
363+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
364+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
365+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
366+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:28:118:40 | "not tainted" |
367+
| Capture.cs:121:9:121:33 | access to local function CaptureOutMultipleLambdas | Capture.cs:121:9:121:33 | access to local function CaptureOutMultipleLambdas |
368+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
369+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
370+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
371+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
372+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
373+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
374+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas |
375+
| Capture.cs:122:9:122:21 | call to method Check | Capture.cs:122:9:122:21 | call to method Check |
376+
| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:122:15:122:20 | access to local variable sink40 |
377+
| Capture.cs:122:24:122:38 | call to method Check | Capture.cs:122:24:122:38 | call to method Check |
378+
| Capture.cs:122:30:122:37 | access to local variable nonSink0 | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
340379
| Capture.cs:125:10:125:16 | this | Capture.cs:125:10:125:16 | this |
341380
| Capture.cs:125:25:125:31 | tainted | Capture.cs:125:25:125:31 | tainted |
342381
| Capture.cs:125:25:125:31 | tainted | Capture.cs:125:25:125:31 | tainted |
@@ -647,6 +686,10 @@
647686
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
648687
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
649688
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
689+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
690+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
691+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
692+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
650693
| Capture.cs:204:9:204:9 | access to parameter a | Capture.cs:204:9:204:9 | access to parameter a |
651694
| Capture.cs:204:9:204:18 | delegate call | Capture.cs:204:9:204:18 | delegate call |
652695
| GlobalDataFlow.cs:14:17:14:17 | this | GlobalDataFlow.cs:14:17:14:17 | this |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ edges
2222
| Capture.cs:89:13:89:35 | SSA def(sink32) | Capture.cs:92:9:92:41 | SSA call def(sink32) |
2323
| Capture.cs:89:22:89:35 | "taint source" | Capture.cs:89:13:89:35 | SSA def(sink32) |
2424
| Capture.cs:92:9:92:41 | SSA call def(sink32) | Capture.cs:93:15:93:20 | access to local variable sink32 |
25+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
26+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
27+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
2528
| Capture.cs:125:25:125:31 | tainted | Capture.cs:132:9:132:25 | [implicit argument] tainted |
2629
| Capture.cs:125:25:125:31 | tainted | Capture.cs:144:9:144:25 | [implicit argument] tainted |
2730
| Capture.cs:125:25:125:31 | tainted | Capture.cs:153:9:153:45 | [implicit argument] tainted |
@@ -225,6 +228,7 @@ edges
225228
| Capture.cs:169:15:169:20 | access to local variable sink37 | Capture.cs:125:25:125:31 | tainted | Capture.cs:169:15:169:20 | access to local variable sink37 | access to local variable sink37 |
226229
| Capture.cs:195:15:195:20 | access to local variable sink38 | Capture.cs:125:25:125:31 | tainted | Capture.cs:195:15:195:20 | access to local variable sink38 | access to local variable sink38 |
227230
| GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 | access to local variable sink4 |
231+
| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:115:26:115:39 | "taint source" | Capture.cs:122:15:122:20 | access to local variable sink40 | access to local variable sink40 |
228232
| GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 | access to local variable sink5 |
229233
| GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 | GlobalDataFlow.cs:318:16:318:29 | "taint source" | GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 | access to local variable sink6 |
230234
| GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 | GlobalDataFlow.cs:323:13:323:26 | "taint source" | GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 | access to local variable sink7 |

‎csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@
1111
| Capture.cs:92:9:92:51 | call to method ToArray | return | Capture.cs:92:9:92:51 | call to method ToArray |
1212
| Capture.cs:92:30:92:40 | [implicit call] access to local variable captureOut3 | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) |
1313
| Capture.cs:92:30:92:40 | [implicit call] access to local variable captureOut3 | return | Capture.cs:92:30:92:40 | [output] access to local variable captureOut3 |
14+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
15+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
16+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
17+
| Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
18+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
19+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
1420
| Capture.cs:132:9:132:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:132:9:132:25 | SSA call def(sink33) |
1521
| Capture.cs:144:9:144:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) |
1622
| Capture.cs:144:9:144:25 | call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) |

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
| Capture.cs:72:15:72:20 | access to local variable sink30 |
66
| Capture.cs:84:15:84:20 | access to local variable sink31 |
77
| Capture.cs:93:15:93:20 | access to local variable sink32 |
8+
| Capture.cs:122:15:122:20 | access to local variable sink40 |
89
| Capture.cs:133:15:133:20 | access to local variable sink33 |
910
| Capture.cs:145:15:145:20 | access to local variable sink34 |
1011
| Capture.cs:154:15:154:20 | access to local variable sink35 |

‎csharp/ql/test/library-tests/dataflow/global/TaintTrackingEdges.expected‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -395,6 +395,45 @@
395395
| Capture.cs:109:9:109:30 | call to local function CaptureOut2NotCalled | Capture.cs:109:9:109:30 | call to local function CaptureOut2NotCalled |
396396
| Capture.cs:110:9:110:23 | call to method Check | Capture.cs:110:9:110:23 | call to method Check |
397397
| Capture.cs:110:15:110:22 | access to local variable nonSink0 | Capture.cs:110:15:110:22 | access to local variable nonSink0 |
398+
| Capture.cs:111:16:111:26 | SSA def(sink40) | Capture.cs:111:16:111:26 | SSA def(sink40) |
399+
| Capture.cs:111:16:111:26 | String sink40 = ... | Capture.cs:111:16:111:26 | String sink40 = ... |
400+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:16:111:26 | SSA def(sink40) |
401+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:16:111:26 | SSA def(sink40) |
402+
| Capture.cs:111:25:111:26 | "" | Capture.cs:111:25:111:26 | "" |
403+
| Capture.cs:114:13:116:14 | call to method RunAction | Capture.cs:114:13:116:14 | call to method RunAction |
404+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:114:23:116:13 | (...) => ... |
405+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
406+
| Capture.cs:114:23:116:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
407+
| Capture.cs:115:17:115:39 | ... = ... | Capture.cs:115:17:115:39 | ... = ... |
408+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:115:17:115:39 | SSA def(sink40) |
409+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
410+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
411+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
412+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
413+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:26:115:39 | "taint source" |
414+
| Capture.cs:117:13:119:14 | call to method RunAction | Capture.cs:117:13:119:14 | call to method RunAction |
415+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:117:23:119:13 | (...) => ... |
416+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
417+
| Capture.cs:117:23:119:13 | (...) => ... | Capture.cs:202:34:202:34 | a |
418+
| Capture.cs:118:17:118:40 | ... = ... | Capture.cs:118:17:118:40 | ... = ... |
419+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
420+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
421+
| Capture.cs:118:17:118:40 | SSA def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
422+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
423+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:17:118:40 | SSA def(nonSink0) |
424+
| Capture.cs:118:28:118:40 | "not tainted" | Capture.cs:118:28:118:40 | "not tainted" |
425+
| Capture.cs:121:9:121:33 | access to local function CaptureOutMultipleLambdas | Capture.cs:121:9:121:33 | access to local function CaptureOutMultipleLambdas |
426+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
427+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
428+
| Capture.cs:121:9:121:35 | SSA call def(nonSink0) | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
429+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
430+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
431+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
432+
| Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas | Capture.cs:121:9:121:35 | call to local function CaptureOutMultipleLambdas |
433+
| Capture.cs:122:9:122:21 | call to method Check | Capture.cs:122:9:122:21 | call to method Check |
434+
| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:122:15:122:20 | access to local variable sink40 |
435+
| Capture.cs:122:24:122:38 | call to method Check | Capture.cs:122:24:122:38 | call to method Check |
436+
| Capture.cs:122:30:122:37 | access to local variable nonSink0 | Capture.cs:122:30:122:37 | access to local variable nonSink0 |
398437
| Capture.cs:125:10:125:16 | this | Capture.cs:125:10:125:16 | this |
399438
| Capture.cs:125:25:125:31 | tainted | Capture.cs:125:25:125:31 | tainted |
400439
| Capture.cs:125:25:125:31 | tainted | Capture.cs:125:25:125:31 | tainted |
@@ -753,6 +792,10 @@
753792
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
754793
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
755794
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
795+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
796+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
797+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
798+
| Capture.cs:202:34:202:34 | a | Capture.cs:204:9:204:9 | access to parameter a |
756799
| Capture.cs:204:9:204:9 | access to parameter a | Capture.cs:204:9:204:9 | access to parameter a |
757800
| Capture.cs:204:9:204:18 | delegate call | Capture.cs:204:9:204:18 | delegate call |
758801
| GlobalDataFlow.cs:14:17:14:17 | this | GlobalDataFlow.cs:14:17:14:17 | this |

‎csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ edges
2222
| Capture.cs:89:13:89:35 | SSA def(sink32) | Capture.cs:92:9:92:41 | SSA call def(sink32) |
2323
| Capture.cs:89:22:89:35 | "taint source" | Capture.cs:89:13:89:35 | SSA def(sink32) |
2424
| Capture.cs:92:9:92:41 | SSA call def(sink32) | Capture.cs:93:15:93:20 | access to local variable sink32 |
25+
| Capture.cs:115:17:115:39 | SSA def(sink40) | Capture.cs:121:9:121:35 | SSA call def(sink40) |
26+
| Capture.cs:115:26:115:39 | "taint source" | Capture.cs:115:17:115:39 | SSA def(sink40) |
27+
| Capture.cs:121:9:121:35 | SSA call def(sink40) | Capture.cs:122:15:122:20 | access to local variable sink40 |
2528
| Capture.cs:125:25:125:31 | tainted | Capture.cs:132:9:132:25 | [implicit argument] tainted |
2629
| Capture.cs:125:25:125:31 | tainted | Capture.cs:144:9:144:25 | [implicit argument] tainted |
2730
| Capture.cs:125:25:125:31 | tainted | Capture.cs:153:9:153:45 | [implicit argument] tainted |
@@ -252,6 +255,7 @@ edges
252255
| Capture.cs:72:15:72:20 | access to local variable sink30 | Capture.cs:69:22:69:35 | "taint source" | Capture.cs:72:15:72:20 | access to local variable sink30 | access to local variable sink30 |
253256
| Capture.cs:84:15:84:20 | access to local variable sink31 | Capture.cs:79:26:79:39 | "taint source" | Capture.cs:84:15:84:20 | access to local variable sink31 | access to local variable sink31 |
254257
| Capture.cs:93:15:93:20 | access to local variable sink32 | Capture.cs:89:22:89:35 | "taint source" | Capture.cs:93:15:93:20 | access to local variable sink32 | access to local variable sink32 |
258+
| Capture.cs:122:15:122:20 | access to local variable sink40 | Capture.cs:115:26:115:39 | "taint source" | Capture.cs:122:15:122:20 | access to local variable sink40 | access to local variable sink40 |
255259
| Capture.cs:133:15:133:20 | access to local variable sink33 | Capture.cs:125:25:125:31 | tainted | Capture.cs:133:15:133:20 | access to local variable sink33 | access to local variable sink33 |
256260
| Capture.cs:145:15:145:20 | access to local variable sink34 | Capture.cs:125:25:125:31 | tainted | Capture.cs:145:15:145:20 | access to local variable sink34 | access to local variable sink34 |
257261
| Capture.cs:154:15:154:20 | access to local variable sink35 | Capture.cs:125:25:125:31 | tainted | Capture.cs:154:15:154:20 | access to local variable sink35 | access to local variable sink35 |

0 commit comments

Comments
 (0)