This repository was archived by the owner on Jan 5, 2023. It is now read-only.
File tree Expand file tree Collapse file tree 2 files changed +12
-12
lines changed Expand file tree Collapse file tree 2 files changed +12
-12
lines changed Original file line number Diff line number Diff line change @@ -600,16 +600,6 @@ class ComponentReadNode extends ReadNode {
600
600
Node getBase ( ) { result = instructionNode ( insn .getBase ( ) ) }
601
601
}
602
602
603
- /**
604
- * Gets the data-flow node representing the bottom of a stack of zero or more `ComponentReadNode`s.
605
- *
606
- * For example, in the expression a.b[c].d[e], this would return the dataflow node for the read from `a`.
607
- */
608
- Node getUnderlyingNode ( ReadNode read ) {
609
- ( result = read or result = read .( ComponentReadNode ) .getBase + ( ) ) and
610
- not result instanceof ComponentReadNode
611
- }
612
-
613
603
/**
614
604
* A data-flow node that reads an element of an array, map, slice or string.
615
605
*/
Original file line number Diff line number Diff line change @@ -145,16 +145,26 @@ module Protobuf {
145
145
exists ( Type base | base .getPointerType ( ) instanceof MessageType | result = base .getField ( _) )
146
146
}
147
147
148
+ /**
149
+ * Gets the data-flow node representing the bottom of a stack of zero or more `ComponentReadNode`s.
150
+ *
151
+ * For example, in the expression a.b[c].d[e], this would return the dataflow node for the read from `a`.
152
+ */
153
+ DataFlow:: Node getUnderlyingNode ( DataFlow:: ReadNode read ) {
154
+ ( result = read or result = read .( DataFlow:: ComponentReadNode ) .getBase + ( ) ) and
155
+ not result instanceof DataFlow:: ComponentReadNode
156
+ }
157
+
148
158
/**
149
159
* Additional taint step tainting a Message when taint is written to any of its fields and/or elements.
150
160
*/
151
161
private class WriteMessageFieldStep extends TaintTracking:: AdditionalTaintStep {
152
162
override predicate step ( DataFlow:: Node pred , DataFlow:: Node succ ) {
153
- exists ( DataFlow:: ReadNode base | succ = DataFlow :: getUnderlyingNode ( base ) |
163
+ exists ( DataFlow:: ReadNode base | succ = getUnderlyingNode ( base ) |
154
164
any ( DataFlow:: Write w ) .writesField ( base , getAMessageField ( ) , pred )
155
165
)
156
166
or
157
- exists ( DataFlow:: ReadNode base | succ = DataFlow :: getUnderlyingNode ( base ) |
167
+ exists ( DataFlow:: ReadNode base | succ = getUnderlyingNode ( base ) |
158
168
any ( DataFlow:: Write w ) .writesElement ( base , _, pred ) and
159
169
[ succ .getType ( ) , succ .getType ( ) .getPointerType ( ) ] instanceof MessageType
160
170
)
You can’t perform that action at this time.
0 commit comments