Skip to content

Commit b7d4a69

Browse files
aschackmullaschackmull
committed
Dataflow: Add empty provenance column to PathGraph.
1 parent 4c0d535 commit b7d4a69

File tree

7 files changed

+42
-24
lines changed

7 files changed

+42
-24
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -507,13 +507,13 @@ module ProductFlow {
507507
private predicate pathSuccPlus(TNodePair n1, TNodePair n2) = fastTC(pathSucc/2)(n1, n2)
508508

509509
private predicate localPathStep1(Flow1::PathNode pred, Flow1::PathNode succ) {
510-
Flow1::PathGraph::edges(pred, succ) and
510+
Flow1::PathGraph::edges(pred, succ, _, _) and
511511
pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
512512
pragma[only_bind_out](succ.getNode().getEnclosingCallable())
513513
}
514514

515515
private predicate localPathStep2(Flow2::PathNode pred, Flow2::PathNode succ) {
516-
Flow2::PathGraph::edges(pred, succ) and
516+
Flow2::PathGraph::edges(pred, succ, _, _) and
517517
pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
518518
pragma[only_bind_out](succ.getNode().getEnclosingCallable())
519519
}
@@ -530,7 +530,7 @@ module ProductFlow {
530530
TJump()
531531

532532
private predicate intoImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
533-
Flow1::PathGraph::edges(pred1, succ1) and
533+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
534534
pred1.getNode().(ArgumentNode).getCall() = call and
535535
succ1.getNode() instanceof ParameterNode
536536
}
@@ -543,7 +543,7 @@ module ProductFlow {
543543
}
544544

545545
private predicate outImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
546-
Flow1::PathGraph::edges(pred1, succ1) and
546+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
547547
exists(ReturnKindExt returnKind |
548548
succ1.getNode() = returnKind.getAnOutNode(call) and
549549
pred1.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -558,7 +558,7 @@ module ProductFlow {
558558
}
559559

560560
private predicate intoImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
561-
Flow2::PathGraph::edges(pred2, succ2) and
561+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
562562
pred2.getNode().(ArgumentNode).getCall() = call and
563563
succ2.getNode() instanceof ParameterNode
564564
}
@@ -571,7 +571,7 @@ module ProductFlow {
571571
}
572572

573573
private predicate outImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
574-
Flow2::PathGraph::edges(pred2, succ2) and
574+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
575575
exists(ReturnKindExt returnKind |
576576
succ2.getNode() = returnKind.getAnOutNode(call) and
577577
pred2.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -590,7 +590,7 @@ module ProductFlow {
590590
Declaration predDecl, Declaration succDecl, Flow1::PathNode pred1, Flow1::PathNode succ1,
591591
TKind kind
592592
) {
593-
Flow1::PathGraph::edges(pred1, succ1) and
593+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
594594
predDecl != succDecl and
595595
pred1.getNode().getEnclosingCallable() = predDecl and
596596
succ1.getNode().getEnclosingCallable() = succDecl and
@@ -610,7 +610,7 @@ module ProductFlow {
610610
Declaration predDecl, Declaration succDecl, Flow2::PathNode pred2, Flow2::PathNode succ2,
611611
TKind kind
612612
) {
613-
Flow2::PathGraph::edges(pred2, succ2) and
613+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
614614
predDecl != succDecl and
615615
pred2.getNode().getEnclosingCallable() = predDecl and
616616
succ2.getNode().getEnclosingCallable() = succDecl and

‎csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSQuery.qll

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,18 @@ predicate xssFlow(XssNode source, XssNode sink, string message) {
4242
*/
4343
module PathGraph {
4444
/** Holds if `(pred,succ)` is an edge in the graph of data flow path explanations. */
45-
query predicate edges(XssNode pred, XssNode succ) {
46-
exists(XssTracking::PathNode a, XssTracking::PathNode b | XssTracking::PathGraph::edges(a, b) |
45+
query predicate edges(XssNode pred, XssNode succ, string key, string val) {
46+
exists(XssTracking::PathNode a, XssTracking::PathNode b |
47+
XssTracking::PathGraph::edges(a, b, key, val)
48+
|
4749
pred.asDataFlowNode() = a and
4850
succ.asDataFlowNode() = b
4951
)
5052
or
5153
xssFlow(pred, succ, _) and
52-
pred instanceof XssAspNode
54+
pred instanceof XssAspNode and
55+
key = "provenance" and
56+
val = ""
5357
}
5458

5559
/** Holds if `n` is a node in the graph of data flow path explanations. */

‎csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,18 @@
1313
import csharp
1414
import Flow::PathGraph
1515

16-
query predicate edges(Flow::PathNode a, Flow::PathNode b) {
17-
Flow::PathGraph::edges(a, b)
16+
query predicate edges(Flow::PathNode a, Flow::PathNode b, string key, string val) {
17+
Flow::PathGraph::edges(a, b, key, val)
1818
or
1919
FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallableConfig::isSink(a.getNode()) and
20-
FlowsFromTimeSpanArithmeticToTimeComparisonCallableConfig::isSource(b.getNode())
20+
FlowsFromTimeSpanArithmeticToTimeComparisonCallableConfig::isSource(b.getNode()) and
21+
key = "provenance" and
22+
val = ""
2123
or
2224
FlowsFromTimeSpanArithmeticToTimeComparisonCallableConfig::isSink(a.getNode()) and
23-
FlowsFromTimeComparisonCallableToSelectionStatementConditionConfig::isSource(b.getNode())
25+
FlowsFromTimeComparisonCallableToSelectionStatementConditionConfig::isSource(b.getNode()) and
26+
key = "provenance" and
27+
val = ""
2428
}
2529

2630
/**

‎csharp/ql/test/library-tests/cil/dataflow/DataFlow.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ private predicate relevantPathNode(Flow::PathNode n) {
1313
)
1414
}
1515

16-
query predicate edges(Flow::PathNode a, Flow::PathNode b) {
17-
Flow::PathGraph::edges(a, b) and
16+
query predicate edges(Flow::PathNode a, Flow::PathNode b, string key, string val) {
17+
Flow::PathGraph::edges(a, b, key, val) and
1818
relevantPathNode(a) and
1919
relevantPathNode(b)
2020
}

‎java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,11 @@ import semmle.code.java.security.TempDirLocalInformationDisclosureQuery
2525
* resulting in a zero-length paths.
2626
*/
2727
module InsecureMethodPathGraph implements DataFlow::PathGraphSig<MethodCallInsecureFileCreation> {
28-
predicate edges(MethodCallInsecureFileCreation n1, MethodCallInsecureFileCreation n2) { none() }
28+
predicate edges(
29+
MethodCallInsecureFileCreation n1, MethodCallInsecureFileCreation n2, string key, string value
30+
) {
31+
none()
32+
}
2933

3034
predicate nodes(MethodCallInsecureFileCreation n, string key, string val) {
3135
key = "semmle.label" and val = n.toString()

‎shared/dataflow/codeql/dataflow/DataFlow.qll

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,7 @@ module DataFlowMake<InputSig Lang> {
584584

585585
signature module PathGraphSig<PathNodeSig PathNode> {
586586
/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
587-
predicate edges(PathNode a, PathNode b);
587+
predicate edges(PathNode a, PathNode b, string key, string val);
588588

589589
/** Holds if `n` is a node in the graph of data flow path explanations. */
590590
predicate nodes(PathNode n, string key, string val);
@@ -648,9 +648,9 @@ module DataFlowMake<InputSig Lang> {
648648
*/
649649
module PathGraph implements PathGraphSig<PathNode> {
650650
/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
651-
query predicate edges(PathNode a, PathNode b) {
652-
Graph1::edges(a.asPathNode1(), b.asPathNode1()) or
653-
Graph2::edges(a.asPathNode2(), b.asPathNode2())
651+
query predicate edges(PathNode a, PathNode b, string key, string val) {
652+
Graph1::edges(a.asPathNode1(), b.asPathNode1(), key, val) or
653+
Graph2::edges(a.asPathNode2(), b.asPathNode2(), key, val)
654654
}
655655

656656
/** Holds if `n` is a node in the graph of data flow path explanations. */
@@ -719,7 +719,9 @@ module DataFlowMake<InputSig Lang> {
719719
*/
720720
module PathGraph implements PathGraphSig<PathNode> {
721721
/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
722-
query predicate edges(PathNode a, PathNode b) { Merged::PathGraph::edges(a, b) }
722+
query predicate edges(PathNode a, PathNode b, string key, string val) {
723+
Merged::PathGraph::edges(a, b, key, val)
724+
}
723725

724726
/** Holds if `n` is a node in the graph of data flow path explanations. */
725727
query predicate nodes(PathNode n, string key, string val) {

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3724,7 +3724,11 @@ module MakeImpl<InputSig Lang> {
37243724
*/
37253725
module PathGraph implements PathGraphSig<PathNode> {
37263726
/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
3727-
query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
3727+
query predicate edges(PathNode a, PathNode b, string key, string val) {
3728+
a.getASuccessor() = b and
3729+
key = "provenance" and
3730+
val = ""
3731+
}
37283732

37293733
/** Holds if `n` is a node in the graph of data flow path explanations. */
37303734
query predicate nodes(PathNode n, string key, string val) {

0 commit comments

Comments
 (0)