Skip to content

Commit 6ba9b7a

Browse files
hvitvedhvitved
committed
Data flow: Rework reverse flow through parameters
1 parent 3d5aec4 commit 6ba9b7a

File tree

17 files changed

+696
-175
lines changed

17 files changed

+696
-175
lines changed

‎csharp/ql/consistency-queries/DataFlowConsistency.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import csharp
22
private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as ControlFlowGraphImpl
33
private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
4+
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
45
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific
56
private import codeql.dataflow.internal.DataFlowImplConsistency
67

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
private import csharp
22
private import DataFlowPublic
33
private import DataFlowDispatch
4-
private import DataFlowImplCommon
4+
private import DataFlowImplCommon as DataFlowImplCommon
55
private import ControlFlowReachability
66
private import FlowSummaryImpl as FlowSummaryImpl
77
private import semmle.code.csharp.dataflow.FlowSummary as FlowSummary
@@ -61,7 +61,7 @@ abstract class NodeImpl extends Node {
6161

6262
/** Gets the type of this node used for type pruning. */
6363
DataFlowType getDataFlowType() {
64-
forceCachingInSameStage() and
64+
DataFlowImplCommon::forceCachingInSameStage() and
6565
exists(Type t0 | result.asGvnType() = Gvn::getGlobalValueNumber(t0) |
6666
t0 = this.getType()
6767
or
@@ -102,20 +102,20 @@ private class ExprNodeImpl extends ExprNode, NodeImpl {
102102
}
103103

104104
override Type getTypeImpl() {
105-
forceCachingInSameStage() and
105+
DataFlowImplCommon::forceCachingInSameStage() and
106106
result = this.getExpr().getType()
107107
}
108108

109109
override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() {
110-
forceCachingInSameStage() and this = TExprNode(result)
110+
DataFlowImplCommon::forceCachingInSameStage() and this = TExprNode(result)
111111
}
112112

113113
override Location getLocationImpl() {
114-
forceCachingInSameStage() and result = this.getExpr().getLocation()
114+
DataFlowImplCommon::forceCachingInSameStage() and result = this.getExpr().getLocation()
115115
}
116116

117117
override string toStringImpl() {
118-
forceCachingInSameStage() and
118+
DataFlowImplCommon::forceCachingInSameStage() and
119119
result = this.getControlFlowNodeImpl().toString()
120120
}
121121
}
@@ -2897,7 +2897,7 @@ private predicate viableConstantBooleanParamArg(
28972897
ParameterNode paramNode, boolean b, DataFlowCall call
28982898
) {
28992899
exists(ConstantBooleanArgumentNode arg |
2900-
viableParamArg(call, paramNode, arg) and
2900+
DataFlowImplCommon::viableParamArg(call, paramNode, arg) and
29012901
b = arg.getBooleanValue()
29022902
)
29032903
}
@@ -3046,7 +3046,7 @@ class DataFlowSecondLevelScope = Unit;
30463046
*/
30473047
predicate allowParameterReturnInSelf(ParameterNode p) {
30483048
exists(DataFlowCallable c, ParameterPosition pos |
3049-
parameterNode(p, c, pos) and
3049+
DataFlowImplCommon::parameterNode(p, c, pos) and
30503050
FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(c.asSummarizedCallable(), pos)
30513051
)
30523052
or

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ private import DataFlowImplSpecific::Private
1212
private import DataFlowImplSpecific::Public
1313
private import semmle.code.csharp.Unification
1414
private import semmle.code.csharp.dataflow.internal.ExternalFlow
15+
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
1516

1617
module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow> {
1718
class SummarizedCallableBase = UnboundCallable;

‎csharp/ql/lib/semmle/code/csharp/exprs/Call.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
import Expr
88
private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
9-
private import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
9+
private import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
1010
private import semmle.code.csharp.dispatch.Dispatch
1111

1212
/**
@@ -528,7 +528,7 @@ class DelegateLikeCall extends Call, DelegateLikeCall_ {
528528
final override Callable getARuntimeTarget() {
529529
exists(ExplicitDelegateLikeDataFlowCall call |
530530
this = call.getCall() and
531-
result = viableCallableLambda(call, _).asCallable(_)
531+
result = DataFlowImplCommon::viableCallableLambda(call, _).asCallable(_)
532532
)
533533
}
534534

‎csharp/ql/test/TestUtilities/InlineFlowTest.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,9 @@ private import internal.InlineExpectationsTestImpl
1212

1313
private module FlowTestImpl implements InputSig<Location, CsharpDataFlow> {
1414
predicate defaultSource(DataFlow::Node source) {
15-
source.asExpr().(MethodCall).getTarget().getUndecoratedName() = ["Source", "Taint"]
15+
source.asExpr().(MethodCall).getTarget().getUndecoratedName() = ["Source", "Taint"] //and
16+
// source.getLocation().getStartLine() = 23 and
17+
// source.getLocation().getFile().getBaseName() = "G.cs"
1618
}
1719

1820
predicate defaultSink(DataFlow::Node sink) {

‎csharp/ql/test/library-tests/dataflow/constructors/ConstructorFlow.expected‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
models
22
edges
3-
| Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | provenance | |
3+
| Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | Constructors.cs:5:24:5:25 | this access [Reverse] : C_no_ctor [field s1] : Object | provenance | |
4+
| Constructors.cs:5:24:5:25 | this access [Reverse] : C_no_ctor [field s1] : Object | Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | provenance | |
45
| Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | provenance | |
56
| Constructors.cs:9:23:9:23 | access to local variable c : C_no_ctor [field s1] : Object | Constructors.cs:10:13:10:13 | access to local variable c : C_no_ctor [field s1] : Object | provenance | |
67
| Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | Constructors.cs:9:23:9:23 | access to local variable c : C_no_ctor [field s1] : Object | provenance | |
78
| Constructors.cs:10:13:10:13 | access to local variable c : C_no_ctor [field s1] : Object | Constructors.cs:13:21:13:22 | this : C_no_ctor [field s1] : Object | provenance | |
89
| Constructors.cs:13:21:13:22 | this : C_no_ctor [field s1] : Object | Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | provenance | |
910
| Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | Constructors.cs:15:18:15:19 | access to field s1 | provenance | |
10-
| Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | Constructors.cs:29:16:29:26 | this [Return] : C_with_ctor [field s1] : Object | provenance | |
11+
| Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | Constructors.cs:21:24:21:25 | this access [Reverse] : C_with_ctor [field s1] : Object | provenance | |
12+
| Constructors.cs:21:24:21:25 | this access [Reverse] : C_with_ctor [field s1] : Object | Constructors.cs:29:16:29:26 | this [Return] : C_with_ctor [field s1] : Object | provenance | |
1113
| Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | provenance | |
1214
| Constructors.cs:25:25:25:25 | access to local variable c : C_with_ctor [field s1] : Object | Constructors.cs:26:13:26:13 | access to local variable c : C_with_ctor [field s1] : Object | provenance | |
1315
| Constructors.cs:25:29:25:45 | object creation of type C_with_ctor : C_with_ctor [field s1] : Object | Constructors.cs:25:25:25:25 | access to local variable c : C_with_ctor [field s1] : Object | provenance | |
@@ -16,13 +18,15 @@ edges
1618
| Constructors.cs:31:21:31:22 | this : C_with_ctor [field s1] : Object | Constructors.cs:33:18:33:19 | this access : C_with_ctor [field s1] : Object | provenance | |
1719
| Constructors.cs:33:18:33:19 | this access : C_with_ctor [field s1] : Object | Constructors.cs:33:18:33:19 | access to field s1 | provenance | |
1820
| Constructors.cs:41:26:41:26 | o : Object | Constructors.cs:41:38:41:38 | access to parameter o : Object | provenance | |
19-
| Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | Constructors.cs:41:16:41:17 | this [Return] : C1 [field Obj] : Object | provenance | |
21+
| Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | Constructors.cs:41:32:41:34 | this access [Reverse] : C1 [field Obj] : Object | provenance | |
22+
| Constructors.cs:41:32:41:34 | this access [Reverse] : C1 [field Obj] : Object | Constructors.cs:41:16:41:17 | this [Return] : C1 [field Obj] : Object | provenance | |
2023
| Constructors.cs:41:38:41:38 | access to parameter o : Object | Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | provenance | |
2124
| Constructors.cs:44:28:44:35 | o21param : Object | Constructors.cs:46:23:46:27 | this access : C2 [parameter o21param] : Object | provenance | |
2225
| Constructors.cs:44:28:44:35 | o21param : Object | Constructors.cs:46:31:46:38 | access to parameter o21param : Object | provenance | |
2326
| Constructors.cs:44:45:44:52 | o22param : Object | Constructors.cs:44:18:44:19 | this [Return] : C2 [parameter o22param] : Object | provenance | |
24-
| Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | Constructors.cs:44:18:44:19 | this [Return] : C2 [field Obj21] : Object | provenance | |
27+
| Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | Constructors.cs:46:23:46:27 | this access [Reverse] : C2 [field Obj21] : Object | provenance | |
2528
| Constructors.cs:46:23:46:27 | this access : C2 [parameter o21param] : Object | Constructors.cs:46:31:46:38 | access to parameter o21param : Object | provenance | |
29+
| Constructors.cs:46:23:46:27 | this access [Reverse] : C2 [field Obj21] : Object | Constructors.cs:44:18:44:19 | this [Return] : C2 [field Obj21] : Object | provenance | |
2630
| Constructors.cs:46:31:46:38 | access to parameter o21param : Object | Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | provenance | |
2731
| Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | access to parameter o22param : Object | provenance | |
2832
| Constructors.cs:50:32:50:36 | this : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | this access : C2 [field Obj21] : Object | provenance | |
@@ -85,9 +89,12 @@ edges
8589
| Constructors.cs:113:14:113:15 | access to local variable c3 : C3 [parameter o31param] : Object | Constructors.cs:113:14:113:21 | access to property Obj31 | provenance | |
8690
| Constructors.cs:121:26:121:28 | oc1 : Object | Constructors.cs:123:20:123:22 | access to parameter oc1 : Object | provenance | |
8791
| Constructors.cs:121:38:121:40 | oc2 : Object | Constructors.cs:124:20:124:22 | access to parameter oc2 : Object | provenance | |
88-
| Constructors.cs:123:13:123:16 | [post] this access : C4 [property Obj1] : Object | Constructors.cs:121:16:121:17 | this [Return] : C4 [property Obj1] : Object | provenance | |
92+
| Constructors.cs:123:13:123:16 | [post] this access : C4 [property Obj1] : Object | Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj1] : Object | provenance | |
93+
| Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj1] : Object | Constructors.cs:121:16:121:17 | this [Return] : C4 [property Obj1] : Object | provenance | |
94+
| Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj2] : Object | Constructors.cs:121:16:121:17 | this [Return] : C4 [property Obj2] : Object | provenance | |
8995
| Constructors.cs:123:20:123:22 | access to parameter oc1 : Object | Constructors.cs:123:13:123:16 | [post] this access : C4 [property Obj1] : Object | provenance | |
90-
| Constructors.cs:124:13:124:16 | [post] this access : C4 [property Obj2] : Object | Constructors.cs:121:16:121:17 | this [Return] : C4 [property Obj2] : Object | provenance | |
96+
| Constructors.cs:124:13:124:16 | [post] this access : C4 [property Obj2] : Object | Constructors.cs:124:13:124:16 | this access [Reverse] : C4 [property Obj2] : Object | provenance | |
97+
| Constructors.cs:124:13:124:16 | this access [Reverse] : C4 [property Obj2] : Object | Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj2] : Object | provenance | |
9198
| Constructors.cs:124:20:124:22 | access to parameter oc2 : Object | Constructors.cs:124:13:124:16 | [post] this access : C4 [property Obj2] : Object | provenance | |
9299
| Constructors.cs:130:13:130:14 | access to local variable o1 : Object | Constructors.cs:132:25:132:26 | access to local variable o1 : Object | provenance | |
93100
| Constructors.cs:130:18:130:34 | call to method Source<Object> : Object | Constructors.cs:130:13:130:14 | access to local variable o1 : Object | provenance | |
@@ -121,6 +128,7 @@ edges
121128
| Constructors.cs:145:14:145:15 | access to local variable r1 : R1 [property Obj2] : Object | Constructors.cs:145:14:145:20 | access to property Obj2 | provenance | |
122129
nodes
123130
| Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | semmle.label | [post] this access : C_no_ctor [field s1] : Object |
131+
| Constructors.cs:5:24:5:25 | this access [Reverse] : C_no_ctor [field s1] : Object | semmle.label | this access [Reverse] : C_no_ctor [field s1] : Object |
124132
| Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
125133
| Constructors.cs:9:23:9:23 | access to local variable c : C_no_ctor [field s1] : Object | semmle.label | access to local variable c : C_no_ctor [field s1] : Object |
126134
| Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | semmle.label | object creation of type C_no_ctor : C_no_ctor [field s1] : Object |
@@ -129,6 +137,7 @@ nodes
129137
| Constructors.cs:15:18:15:19 | access to field s1 | semmle.label | access to field s1 |
130138
| Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | semmle.label | this access : C_no_ctor [field s1] : Object |
131139
| Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | semmle.label | [post] this access : C_with_ctor [field s1] : Object |
140+
| Constructors.cs:21:24:21:25 | this access [Reverse] : C_with_ctor [field s1] : Object | semmle.label | this access [Reverse] : C_with_ctor [field s1] : Object |
132141
| Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
133142
| Constructors.cs:25:25:25:25 | access to local variable c : C_with_ctor [field s1] : Object | semmle.label | access to local variable c : C_with_ctor [field s1] : Object |
134143
| Constructors.cs:25:29:25:45 | object creation of type C_with_ctor : C_with_ctor [field s1] : Object | semmle.label | object creation of type C_with_ctor : C_with_ctor [field s1] : Object |
@@ -140,13 +149,15 @@ nodes
140149
| Constructors.cs:41:16:41:17 | this [Return] : C1 [field Obj] : Object | semmle.label | this [Return] : C1 [field Obj] : Object |
141150
| Constructors.cs:41:26:41:26 | o : Object | semmle.label | o : Object |
142151
| Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | semmle.label | [post] this access : C1 [field Obj] : Object |
152+
| Constructors.cs:41:32:41:34 | this access [Reverse] : C1 [field Obj] : Object | semmle.label | this access [Reverse] : C1 [field Obj] : Object |
143153
| Constructors.cs:41:38:41:38 | access to parameter o : Object | semmle.label | access to parameter o : Object |
144154
| Constructors.cs:44:18:44:19 | this [Return] : C2 [field Obj21] : Object | semmle.label | this [Return] : C2 [field Obj21] : Object |
145155
| Constructors.cs:44:18:44:19 | this [Return] : C2 [parameter o22param] : Object | semmle.label | this [Return] : C2 [parameter o22param] : Object |
146156
| Constructors.cs:44:28:44:35 | o21param : Object | semmle.label | o21param : Object |
147157
| Constructors.cs:44:45:44:52 | o22param : Object | semmle.label | o22param : Object |
148158
| Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | semmle.label | [post] this access : C2 [field Obj21] : Object |
149159
| Constructors.cs:46:23:46:27 | this access : C2 [parameter o21param] : Object | semmle.label | this access : C2 [parameter o21param] : Object |
160+
| Constructors.cs:46:23:46:27 | this access [Reverse] : C2 [field Obj21] : Object | semmle.label | this access [Reverse] : C2 [field Obj21] : Object |
150161
| Constructors.cs:46:31:46:38 | access to parameter o21param : Object | semmle.label | access to parameter o21param : Object |
151162
| Constructors.cs:48:32:48:39 | access to parameter o22param : Object | semmle.label | access to parameter o22param : Object |
152163
| Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | semmle.label | this : C2 [parameter o22param] : Object |
@@ -213,8 +224,11 @@ nodes
213224
| Constructors.cs:121:26:121:28 | oc1 : Object | semmle.label | oc1 : Object |
214225
| Constructors.cs:121:38:121:40 | oc2 : Object | semmle.label | oc2 : Object |
215226
| Constructors.cs:123:13:123:16 | [post] this access : C4 [property Obj1] : Object | semmle.label | [post] this access : C4 [property Obj1] : Object |
227+
| Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj1] : Object | semmle.label | this access [Reverse] : C4 [property Obj1] : Object |
228+
| Constructors.cs:123:13:123:16 | this access [Reverse] : C4 [property Obj2] : Object | semmle.label | this access [Reverse] : C4 [property Obj2] : Object |
216229
| Constructors.cs:123:20:123:22 | access to parameter oc1 : Object | semmle.label | access to parameter oc1 : Object |
217230
| Constructors.cs:124:13:124:16 | [post] this access : C4 [property Obj2] : Object | semmle.label | [post] this access : C4 [property Obj2] : Object |
231+
| Constructors.cs:124:13:124:16 | this access [Reverse] : C4 [property Obj2] : Object | semmle.label | this access [Reverse] : C4 [property Obj2] : Object |
218232
| Constructors.cs:124:20:124:22 | access to parameter oc2 : Object | semmle.label | access to parameter oc2 : Object |
219233
| Constructors.cs:130:13:130:14 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
220234
| Constructors.cs:130:18:130:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |

‎csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
import csharp
2-
import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
2+
import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
33
import semmle.code.csharp.dataflow.internal.DataFlowDispatch
44

55
query predicate delegateCall(DelegateLikeCall dc, Callable c) { c = dc.getARuntimeTarget() }
66

7-
private class LocatableDataFlowCallOption extends DataFlowCallOption {
7+
private class LocatableDataFlowCallOption extends DataFlowImplCommon::DataFlowCallOption {
88
Location getLocation() {
9-
this = TDataFlowCallNone() and
9+
this = DataFlowImplCommon::TDataFlowCallNone() and
1010
result instanceof EmptyLocation
1111
or
1212
exists(DataFlowCall call |
13-
this = TDataFlowCallSome(call) and
13+
this = DataFlowImplCommon::TDataFlowCallSome(call) and
1414
result = call.getLocation()
1515
)
1616
}
@@ -30,5 +30,5 @@ private class LocatableDataFlowCall extends TDataFlowCall {
3030
query predicate viableLambda(
3131
LocatableDataFlowCall call, LocatableDataFlowCallOption lastCall, DataFlowCallable target
3232
) {
33-
target = viableCallableLambda(call, lastCall)
33+
target = DataFlowImplCommon::viableCallableLambda(call, lastCall)
3434
}

0 commit comments

Comments
 (0)