Skip to content

Commit 919d14a

Browse files
MathiasVPMathiasVP
authored
Merge pull request #22145 from hvitved/flow-summary-source-sink-locations
FlowSummaryImpl: Embed AST nodes in source/sink summary nodes for better flow paths
2 parents a252409 + 5c0b66f commit 919d14a

90 files changed

Lines changed: 4288 additions & 3951 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,11 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
1717

1818
class SummarizedCallableBase = Function;
1919

20-
class SourceBase = Void;
20+
class SourceBase extends Void {
21+
Location getLocation() { none() }
22+
}
2123

22-
class SinkBase = Void;
24+
class SinkBase = SourceBase;
2325

2426
class FlowSummaryCallBase = CallInstruction;
2527

@@ -132,10 +134,22 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
132134

133135
private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
134136

135-
private module StepsInput implements Impl::Private::StepsInputSig {
136-
Impl::Private::SummaryNode getSummaryNode(Node n) {
137-
result = n.(FlowSummaryNode).getSummaryNode()
137+
private module Input2 implements Impl::Private::InputSig2 {
138+
private import codeql.util.Void
139+
140+
class SourceSinkReportingElement extends Void {
141+
Location getLocation() { none() }
142+
143+
DataFlowCallable getEnclosingCallable() { none() }
144+
145+
SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
138146
}
147+
}
148+
149+
private import Impl::Private::Make2<Input2> as Impl2
150+
151+
private module StepsInput implements Impl2::StepsInputSig {
152+
Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
139153

140154
DataFlowCall getACall(Public::SummarizedCallable sc) {
141155
result.getStaticCallTarget().getUnderlyingCallable() = sc
@@ -148,12 +162,6 @@ private module StepsInput implements Impl::Private::StepsInputSig {
148162
pragma[only_bind_out](out.getIndirectionIndex())
149163
)
150164
}
151-
152-
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
153-
154-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
155-
156-
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
157165
}
158166

159167
module SourceSinkInterpretationInput implements
@@ -270,8 +278,9 @@ module SourceSinkInterpretationInput implements
270278

271279
module Private {
272280
import Impl::Private
281+
import Impl2
273282

274-
module Steps = Impl::Private::Steps<StepsInput>;
283+
module Steps = Impl2::Steps<StepsInput>;
275284

276285
module External {
277286
import Impl::Private::External

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1535,10 +1535,10 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
15351535
}
15361536

15371537
override DataFlowCallable getEnclosingCallable() {
1538-
result = FlowSummaryImpl::Private::getEnclosingCallable(this.getSummaryNode())
1538+
result = this.getSummaryNode().getEnclosingCallable()
15391539
}
15401540

1541-
override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
1541+
override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
15421542

15431543
override string toStringImpl() { result = this.getSummaryNode().toString() }
15441544
}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,8 +119,7 @@ private module Cached {
119119
)
120120
or
121121
// models-as-data summarized flow
122-
FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
123-
n2.(FlowSummaryNode).getSummaryNode())
122+
FlowSummaryImpl::Private::Steps::summaryJumpStep(n1, n2)
124123
}
125124

126125
/**

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,7 @@ private module Cached {
158158
model = ""
159159
or
160160
// models-as-data summarized flow
161-
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
162-
nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
161+
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
163162
}
164163

165164
private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,7 @@ private module Cached {
6767
model = ""
6868
or
6969
// models-as-data summarized flow
70-
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
71-
nodeTo.(FlowSummaryNode).getSummaryNode(), false, model)
70+
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false, model)
7271
or
7372
// object->field conflation for content that is a `TaintInheritingContent`.
7473
exists(DataFlow::ContentSet f |

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -714,8 +714,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
714714
) and
715715
model = ""
716716
or
717-
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
718-
nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
717+
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
719718
}
720719

721720
/**
@@ -1778,7 +1777,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
17781777
}
17791778

17801779
override DataFlowCallable getEnclosingCallableImpl() {
1781-
result.asSummarizedCallable() = this.getSummarizedCallable()
1780+
result = this.getSummaryNode().getEnclosingCallable()
17821781
}
17831782

17841783
override DataFlowType getDataFlowType() {
@@ -1789,7 +1788,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
17891788

17901789
override ControlFlowNode getControlFlowNodeImpl() { none() }
17911790

1792-
override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
1791+
override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
17931792

17941793
override string toStringImpl() { result = this.getSummaryNode().toString() }
17951794
}
@@ -2085,8 +2084,7 @@ predicate jumpStep(Node pred, Node succ) {
20852084
)
20862085
)
20872086
or
2088-
FlowSummaryImpl::Private::Steps::summaryJumpStep(pred.(FlowSummaryNode).getSummaryNode(),
2089-
succ.(FlowSummaryNode).getSummaryNode())
2087+
FlowSummaryImpl::Private::Steps::summaryJumpStep(pred, succ)
20902088
or
20912089
succ = pred.(LocalFunctionCreationNode).getAnAccess(false)
20922090
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,17 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow>
3030
)
3131
}
3232

33-
class SourceBase = Void;
33+
class SourceBase extends Void {
34+
Location getLocation() { none() }
35+
}
36+
37+
class SinkBase = SourceBase;
3438

35-
class SinkBase = Void;
39+
class FlowSummaryCallBase = SourceBase;
3640

37-
class FlowSummaryCallBase = Void;
41+
DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
42+
result.asSummarizedCallable() = c
43+
}
3844

3945
predicate neutralElement(SummarizedCallableBase c, string kind, string provenance, boolean isExact) {
4046
interpretNeutral(c, kind, provenance, isExact)
@@ -122,7 +128,21 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow>
122128

123129
private import Make<Location, DataFlowImplSpecific::CsharpDataFlow, Input> as Impl
124130

125-
private module TypesInput implements Impl::Private::TypesInputSig {
131+
private module Input2 implements Impl::Private::InputSig2 {
132+
private import codeql.util.Void
133+
134+
class SourceSinkReportingElement extends Void {
135+
Location getLocation() { none() }
136+
137+
DataFlowCallable getEnclosingCallable() { none() }
138+
139+
SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
140+
}
141+
}
142+
143+
private import Impl::Private::Make2<Input2> as Impl2
144+
145+
private module TypesInput implements Impl2::TypesInputSig {
126146
DataFlowType getSyntheticGlobalType(Impl::Private::SyntheticGlobal sg) {
127147
exists(sg) and
128148
result.asGvnType() = Gvn::getGlobalValueNumber(any(ObjectType t))
@@ -195,27 +215,15 @@ private module TypesInput implements Impl::Private::TypesInputSig {
195215
)
196216
}
197217

198-
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
199-
none()
200-
}
201-
202-
DataFlowType getSinkType(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
218+
DataFlowType getSourceSinkType(Input2::SourceSinkReportingElement e) { none() }
203219
}
204220

205-
private module StepsInput implements Impl::Private::StepsInputSig {
206-
Impl::Private::SummaryNode getSummaryNode(Node n) {
207-
result = n.(FlowSummaryNode).getSummaryNode()
208-
}
221+
private module StepsInput implements Impl2::StepsInputSig {
222+
Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
209223

210224
DataFlowCall getACall(Public::SummarizedCallable sc) {
211225
sc = viableCallable(result).asSummarizedCallable()
212226
}
213-
214-
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
215-
216-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
217-
218-
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
219227
}
220228

221229
module SourceSinkInterpretationInput implements
@@ -339,9 +347,10 @@ module SourceSinkInterpretationInput implements
339347

340348
module Private {
341349
import Impl::Private
342-
import Impl::Private::Types<TypesInput>
350+
import Impl2
351+
import Types<TypesInput>
343352

344-
module Steps = Impl::Private::Steps<StepsInput>;
353+
module Steps = Impl2::Steps<StepsInput>;
345354

346355
module External {
347356
import Impl::Private::External

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,8 +171,7 @@ private module Cached {
171171
) and
172172
model = ""
173173
or
174-
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
175-
nodeTo.(FlowSummaryNode).getSummaryNode(), false, model)
174+
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false, model)
176175
}
177176
}
178177

‎go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ module Private {
8282
result = this.getSummaryNode().getSummarizedCallable()
8383
}
8484

85-
override Location getLocation() { result = this.getSummarizedCallable().getLocation() }
85+
override Location getLocation() { result = this.getSummaryNode().getLocation() }
8686

8787
override string toString() { result = this.getSummaryNode().toString() }
8888

‎go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,7 @@ predicate jumpStep(Node n1, Node n2) {
153153
n2 = recvRead
154154
)
155155
or
156-
FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
157-
n2.(FlowSummaryNode).getSummaryNode())
156+
FlowSummaryImpl::Private::Steps::summaryJumpStep(n1, n2)
158157
}
159158

160159
/**

0 commit comments

Comments
 (0)