@@ -109,7 +109,13 @@ private predicate localAdditionalForwardTaintStep(
109109 .getSummaryNode ( ) , succ .( DataFlowPrivate:: FlowSummaryNode ) .getSummaryNode ( ) , false , model )
110110}
111111
112- private predicate localForwardTaintStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
112+ /**
113+ * This is a helper predicate for `localAdditionalBackwardTaintStep`. It mixes
114+ * local data flow with local forward taint steps. It should only ever be used
115+ * via its transitive closure, which gives local forward taint flow, that is
116+ * with backward steps excluded.
117+ */
118+ private predicate partialLocalForwardTaintFlow ( DataFlow:: Node pred , DataFlow:: Node succ ) {
113119 DataFlow:: localFlow ( pred , succ ) or
114120 localAdditionalForwardTaintStep ( pred , succ , _) or
115121 // Simple flow through library code is included in the exposed local
@@ -126,7 +132,7 @@ private predicate localAdditionalBackwardTaintStep(
126132 // backward step through function model
127133 exists ( FunctionModel m , DataFlow:: Node resultNode |
128134 m .backwardTaintStep ( resultNode , succ ) and
129- localForwardTaintStep + ( resultNode , pred .( DataFlow:: PostUpdateNode ) .getPreUpdateNode ( ) )
135+ partialLocalForwardTaintFlow + ( resultNode , pred .( DataFlow:: PostUpdateNode ) .getPreUpdateNode ( ) )
130136 ) and
131137 model = "FunctionModel"
132138}
0 commit comments