Skip to content

Commit 898297b

Browse files
chanel-ychanel-y
authored
Merge pull request #181 from microsoft/powershell-ast-modernization-follow-up
PS: Fix more taint-tracking/dataflow regressions
2 parents e17a169 + 8ae92a5 commit 898297b

File tree

22 files changed

+790
-188
lines changed

22 files changed

+790
-188
lines changed

‎powershell/ql/lib/semmle/code/powershell/ast/internal/CallExpr.qll‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ class CallExpr extends Expr, TCallExpr {
2828
/** Gets the qualifier of this call, if any. */
2929
Expr getQualifier() { none() }
3030

31+
Expr getPipelineArgument() {
32+
exists(Pipeline p, int i | this = p.getComponent(i + 1) and result = p.getComponent(i))
33+
}
34+
3135
final override string toString() { result = "Call to " + this.getName() }
3236

3337
predicate isStatic() { none() }
@@ -52,3 +56,11 @@ class Qualifier extends Expr {
5256

5357
CallExpr getCall() { result = call }
5458
}
59+
60+
class PipelineArgument extends Expr {
61+
CallExpr call;
62+
63+
PipelineArgument() { this = call.getPipelineArgument() }
64+
65+
CallExpr getCall() { result = call }
66+
}

‎powershell/ql/lib/semmle/code/powershell/ast/internal/ChildIndex.qll‎

Lines changed: 76 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,87 @@ newtype ChildIndex =
3636
// PipelineByPropertNameVar(Raw::PipelineByPropertyNameParameter p) or
3737
PipelineIteratorVar() or
3838
PipelineByPropertyNameIteratorVar(Raw::PipelineByPropertyNameParameter p) or
39-
RealVar(string name) { name = variableNameInScope(_, _) }
39+
RealVar(string name) { name = variableNameInScope(_, _) } or
40+
ProcessBlockPipelineVarReadAccess()
4041

4142
int synthPipelineParameterChildIndex(Raw::ScriptBlock sb) {
43+
// If there is a parameter block, but no pipeline parameter
4244
exists(Raw::ParamBlock pb |
4345
pb = sb.getParamBlock() and
4446
not pb.getAParameter() instanceof Raw::PipelineParameter and
4547
result = pb.getNumParameters()
4648
)
49+
or
50+
// There is no parameter block
51+
not exists(sb.getParamBlock()) and
52+
exists(Raw::FunctionDefinitionStmt funDefStmt |
53+
funDefStmt.getBody() = sb and
54+
result = funDefStmt.getNumParameters()
55+
)
56+
}
57+
58+
string stringOfChildIndex(ChildIndex i) {
59+
exists(Raw::ChildIndex rawIndex |
60+
i = RawChildIndex(rawIndex) and
61+
result = Raw::stringOfChildIndex(rawIndex)
62+
)
63+
or
64+
i = ParamPipeline() and
65+
result = "ParamPipeline"
66+
or
67+
i = ParamDefaultVal() and
68+
result = "ParamDefaultVal"
69+
or
70+
i = FunParam(_) and
71+
result = "FunParam"
72+
or
73+
i = CmdArgument(_) and
74+
result = "CmdArgument"
75+
or
76+
i = ExprStmtExpr() and
77+
result = "ExprStmtExpr"
78+
or
79+
i = MethodBody() and
80+
result = "MethodBody"
81+
or
82+
i = ThisVar() and
83+
result = "ThisVar"
84+
or
85+
i = PipelineParamVar() and
86+
result = "PipelineParamVar"
87+
or
88+
i = PipelineIteratorVar() and
89+
result = "PipelineIteratorVar"
90+
or
91+
i = PipelineByPropertyNameIteratorVar(_) and
92+
result = "PipelineByPropertyNameIteratorVar"
93+
or
94+
i = RealVar(_) and
95+
result = "RealVar"
96+
or
97+
i = ExprRedirection(_) and
98+
result = "ExprRedirection"
99+
or
100+
i = FunDefFun() and
101+
result = "FunDefFun"
102+
or
103+
i = TypeDefType() and
104+
result = "TypeDefType"
105+
or
106+
i = TypeMember(_) and
107+
result = "TypeMember"
108+
or
109+
i = ScriptBlockAttr(_) and
110+
result = "ScriptBlockAttr"
111+
or
112+
i = ParamAttr(_) and
113+
result = "ParamAttr"
114+
or
115+
i = FunctionBody() and
116+
result = "FunctionBody"
117+
or
118+
i = ProcessBlockPipelineVarReadAccess() and
119+
result = "ProcessBlockPipelineVarReadAccess"
47120
}
48121

49122
Raw::ChildIndex toRawChildIndex(ChildIndex i) { i = RawChildIndex(result) }
@@ -265,3 +338,5 @@ ChildIndex usingExprExpr() { result = RawChildIndex(Raw::UsingExprExpr()) }
265338
ChildIndex whileStmtCond() { result = RawChildIndex(Raw::WhileStmtCond()) }
266339

267340
ChildIndex whileStmtBody() { result = RawChildIndex(Raw::WhileStmtBody()) }
341+
342+
ChildIndex processBlockPipelineVarReadAccess() { result = ProcessBlockPipelineVarReadAccess() }

‎powershell/ql/lib/semmle/code/powershell/ast/internal/NamedBlock.qll‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,14 @@ class ProcessBlock extends NamedBlock {
5050
result = this.getEnclosingFunction().getPipelineParameter()
5151
}
5252

53+
PipelineIteratorVariable getPipelineIteratorVariable() {
54+
result = TVariableSynth(getRawAst(this), PipelineIteratorVar())
55+
}
56+
57+
VarReadAccess getPipelineParameterAccess() {
58+
synthChild(getRawAst(this), processBlockPipelineVarReadAccess(), result)
59+
}
60+
5361
PipelineByPropertyNameParameter getAPipelineByPropertyNameParameter() {
5462
result = scriptBlock.getEnclosingFunction().getAParameter()
5563
}

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/ChildIndex.qll‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,3 +99,201 @@ newtype ChildIndex =
9999
UsingExprExpr() or
100100
WhileStmtCond() or
101101
WhileStmtBody()
102+
103+
string stringOfChildIndex(ChildIndex i) {
104+
i = ArrayExprStmtBlock() and result = "ArrayExprStmtBlock"
105+
or
106+
i = ArrayLiteralExpr(_) and result = "ArrayLiteralExpr"
107+
or
108+
i = AssignStmtLeftHandSide() and result = "AssignStmtLeftHandSide"
109+
or
110+
i = AssignStmtRightHandSide() and result = "AssignStmtRightHandSide"
111+
or
112+
i = AttributeNamedArg(_) and result = "AttributeNamedArg"
113+
or
114+
i = AttributePosArg(_) and result = "AttributePosArg"
115+
or
116+
i = AttributedExprExpr() and result = "AttributedExprExpr"
117+
or
118+
i = AttributedExprAttr() and result = "AttributedExprAttr"
119+
or
120+
i = BinaryExprLeft() and result = "BinaryExprLeft"
121+
or
122+
i = BinaryExprRight() and result = "BinaryExprRight"
123+
or
124+
i = CatchClauseBody() and result = "CatchClauseBody"
125+
or
126+
i = CatchClauseType(_) and result = "CatchClauseType"
127+
or
128+
i = CmdElement_(_) and result = "CmdElement"
129+
or
130+
i = CmdCallee() and result = "CmdCallee"
131+
or
132+
i = CmdRedirection(_) and result = "CmdRedirection"
133+
or
134+
i = CmdExprExpr() and result = "CmdExprExpr"
135+
or
136+
i = ConfigurationName() and result = "ConfigurationName"
137+
or
138+
i = ConfigurationBody() and result = "ConfigurationBody"
139+
or
140+
i = ConvertExprExpr() and result = "ConvertExprExpr"
141+
or
142+
i = ConvertExprType() and result = "ConvertExprType"
143+
or
144+
i = ConvertExprAttr() and result = "ConvertExprAttr"
145+
or
146+
i = DataStmtBody() and result = "DataStmtBody"
147+
or
148+
i = DataStmtCmdAllowed(_) and result = "DataStmtCmdAllowed"
149+
or
150+
i = DoUntilStmtCond() and result = "DoUntilStmtCond"
151+
or
152+
i = DoUntilStmtBody() and result = "DoUntilStmtBody"
153+
or
154+
i = DoWhileStmtCond() and result = "DoWhileStmtCond"
155+
or
156+
i = DoWhileStmtBody() and result = "DoWhileStmtBody"
157+
or
158+
i = DynamicStmtName() and result = "DynamicStmtName"
159+
or
160+
i = DynamicStmtBody() and result = "DynamicStmtBody"
161+
or
162+
i = ExitStmtPipeline() and result = "ExitStmtPipeline"
163+
or
164+
i = ExpandableStringExprExpr(_) and result = "ExpandableStringExprExpr"
165+
or
166+
i = ForEachStmtVar() and result = "ForEachStmtVar"
167+
or
168+
i = ForEachStmtIter() and result = "ForEachStmtIter"
169+
or
170+
i = ForEachStmtBody() and result = "ForEachStmtBody"
171+
or
172+
i = ForStmtInit() and result = "ForStmtInit"
173+
or
174+
i = ForStmtCond() and result = "ForStmtCond"
175+
or
176+
i = ForStmtIter() and result = "ForStmtIter"
177+
or
178+
i = ForStmtBody() and result = "ForStmtBody"
179+
or
180+
i = FunDefStmtBody() and result = "FunDefStmtBody"
181+
or
182+
i = FunDefStmtParam(_) and result = "FunDefStmtParam"
183+
or
184+
i = GotoStmtLabel() and result = "GotoStmtLabel"
185+
or
186+
i = HashTableExprKey(_) and result = "HashTableExprKey"
187+
or
188+
i = HashTableExprStmt(_) and result = "HashTableExprStmt"
189+
or
190+
i = IfStmtElse() and result = "IfStmtElse"
191+
or
192+
i = IfStmtCond(_) and result = "IfStmtCond"
193+
or
194+
i = IfStmtThen(_) and result = "IfStmtThen"
195+
or
196+
i = IndexExprIndex() and result = "IndexExprIndex"
197+
or
198+
i = IndexExprBase() and result = "IndexExprBase"
199+
or
200+
i = InvokeMemberExprQual() and result = "InvokeMemberExprQual"
201+
or
202+
i = InvokeMemberExprCallee() and result = "InvokeMemberExprCallee"
203+
or
204+
i = InvokeMemberExprArg(_) and result = "InvokeMemberExprArg"
205+
or
206+
i = MemberExprQual() and result = "MemberExprQual"
207+
or
208+
i = MemberExprMember() and result = "MemberExprMember"
209+
or
210+
i = NamedAttributeArgVal() and result = "NamedAttributeArgVal"
211+
or
212+
i = MemberAttr(_) and result = "MemberAttr"
213+
or
214+
i = MemberTypeConstraint() and result = "MemberTypeConstraint"
215+
or
216+
i = NamedBlockStmt(_) and result = "NamedBlockStmt"
217+
or
218+
i = NamedBlockTrap(_) and result = "NamedBlockTrap"
219+
or
220+
i = ParamBlockAttr(_) and result = "ParamBlockAttr"
221+
or
222+
i = ParamBlockParam(_) and result = "ParamBlockParam"
223+
or
224+
i = ParamAttr(_) and result = "ParamAttr"
225+
or
226+
i = ParamDefaultVal() and result = "ParamDefaultVal"
227+
or
228+
i = ParenExprExpr() and result = "ParenExprExpr"
229+
or
230+
i = PipelineComp(_) and result = "PipelineComp"
231+
or
232+
i = PipelineChainLeft() and result = "PipelineChainLeft"
233+
or
234+
i = PipelineChainRight() and result = "PipelineChainRight"
235+
or
236+
i = ReturnStmtPipeline() and result = "ReturnStmtPipeline"
237+
or
238+
i = RedirectionExpr() and result = "RedirectionExpr"
239+
or
240+
i = ScriptBlockUsing(_) and result = "ScriptBlockUsing"
241+
or
242+
i = ScriptBlockParamBlock() and result = "ScriptBlockParamBlock"
243+
or
244+
i = ScriptBlockBeginBlock() and result = "ScriptBlockBeginBlock"
245+
or
246+
i = ScriptBlockCleanBlock() and result = "ScriptBlockCleanBlock"
247+
or
248+
i = ScriptBlockDynParamBlock() and result = "ScriptBlockDynParamBlock"
249+
or
250+
i = ScriptBlockEndBlock() and result = "ScriptBlockEndBlock"
251+
or
252+
i = ScriptBlockProcessBlock() and result = "ScriptBlockProcessBlock"
253+
or
254+
i = ScriptBlockExprBody() and result = "ScriptBlockExprBody"
255+
or
256+
i = StmtBlockStmt(_) and result = "StmtBlockStmt"
257+
or
258+
i = StmtBlockTrapStmt(_) and result = "StmtBlockTrapStmt"
259+
or
260+
i = ExpandableSubExprExpr() and result = "ExpandableSubExprExpr"
261+
or
262+
i = SwitchStmtCond() and result = "SwitchStmtCond"
263+
or
264+
i = SwitchStmtDefault() and result = "SwitchStmtDefault"
265+
or
266+
i = SwitchStmtCase(_) and result = "SwitchStmtCase"
267+
or
268+
i = SwitchStmtPat(_) and result = "SwitchStmtPat"
269+
or
270+
i = CondExprCond() and result = "CondExprCond"
271+
or
272+
i = CondExprTrue() and result = "CondExprTrue"
273+
or
274+
i = CondExprFalse() and result = "CondExprFalse"
275+
or
276+
i = ThrowStmtPipeline() and result = "ThrowStmtPipeline"
277+
or
278+
i = TryStmtBody() and result = "TryStmtBody"
279+
or
280+
i = TryStmtCatchClause(_) and result = "TryStmtCatchClause"
281+
or
282+
i = TryStmtFinally() and result = "TryStmtFinally"
283+
or
284+
i = TypeStmtMember(_) and result = "TypeStmtMember"
285+
or
286+
i = TypeStmtBaseType(_) and result = "TypeStmtBaseType"
287+
or
288+
i = TrapStmtBody() and result = "TrapStmtBody"
289+
or
290+
i = TrapStmtTypeConstraint() and result = "TrapStmtTypeConstraint"
291+
or
292+
i = UnaryExprOp() and result = "UnaryExprOp"
293+
or
294+
i = UsingExprExpr() and result = "UsingExprExpr"
295+
or
296+
i = WhileStmtCond() and result = "WhileStmtCond"
297+
or
298+
i = WhileStmtBody() and result = "WhileStmtBody"
299+
}

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/Function.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ class FunctionDefinitionStmt extends @function_definition, Stmt {
1111

1212
Parameter getAParameter() { result = this.getParameter(_) }
1313

14+
int getNumParameters() { result = count(this.getParameter(_)) }
15+
1416
override Ast getChild(ChildIndex i) {
1517
i = FunDefStmtBody() and result = this.getBody()
1618
or

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/Parameter.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class PipelineParameter extends Parameter {
3535
this.getAnAttribute().(Attribute).getANamedArgument() = namedAttribute and
3636
namedAttribute.getName().toLowerCase() = "valuefrompipeline"
3737
|
38-
namedAttribute.getValue().(ConstExpr).getValue().getValue() = "true"
38+
namedAttribute.getValue().(ConstExpr).getValue().getValue().toLowerCase() = "true"
3939
or
4040
not exists(namedAttribute.getValue().(ConstExpr).getValue().getValue())
4141
)
@@ -50,7 +50,7 @@ class PipelineByPropertyNameParameter extends Parameter {
5050
this.getAnAttribute().(Attribute).getANamedArgument() = namedAttribute and
5151
namedAttribute.getName().toLowerCase() = "valuefrompipelinebypropertyname"
5252
|
53-
namedAttribute.getValue().(ConstExpr).getValue().getValue() = "true"
53+
namedAttribute.getValue().(ConstExpr).getValue().getValue().toLowerCase() = "true"
5454
or
5555
not exists(namedAttribute.getValue().(ConstExpr).getValue().getValue())
5656
)

‎powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/VariableExpression.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ class VarAccess extends @variable_expression, Expr {
2424
boolean isVariable() { variable_expression(this, _, _, _, _, _, _, _, _, _, result, _) }
2525

2626
boolean isDriveQualified() { variable_expression(this, _, _, _, _, _, _, _, _, _, _, result) }
27+
28+
predicate isReadAccess() { not this.isWriteAccess() }
29+
30+
predicate isWriteAccess() { any(AssignStmt assign).getLeftHandSide() = this }
2731
}
2832

2933
class ThisAccess extends VarAccess {

0 commit comments

Comments
 (0)