@@ -91,15 +91,16 @@ predicate isNonConst(DataFlow::Node node, boolean isIndirect) {
91
91
)
92
92
)
93
93
or
94
- exists ( UncalledFunction f , Parameter p | f .getAParameter ( ) = p |
95
- p = e .( VariableAccess ) .getTarget ( ) )
96
- or
94
+ exists ( UncalledFunction f , Parameter p | f .getAParameter ( ) = p |
95
+ p = e .( VariableAccess ) .getTarget ( )
96
+ )
97
+ or
97
98
node instanceof FlowSource
98
99
or
99
- (
100
- node instanceof DataFlow :: DefinitionByReferenceNode and
101
- not exists ( FormattingFunctionCall fc | node . asDefiningArgument ( ) = fc . getOutputArgument ( _ ) ) and
102
- not exists ( Call c | c .getAnArgument ( ) = node .asDefiningArgument ( ) and c .getTarget ( ) .hasDefinition ( ) )
100
+ node instanceof DataFlow :: DefinitionByReferenceNode and
101
+ not exists ( FormattingFunctionCall fc | node . asDefiningArgument ( ) = fc . getOutputArgument ( _ ) ) and
102
+ not exists ( Call c |
103
+ c .getAnArgument ( ) = node .asDefiningArgument ( ) and c .getTarget ( ) .hasDefinition ( )
103
104
)
104
105
)
105
106
or
@@ -121,15 +122,7 @@ predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
121
122
}
122
123
123
124
module NonConstFlowConfig implements DataFlow:: ConfigSig {
124
- predicate isSource ( DataFlow:: Node source ) {
125
- // isNonConst(source)
126
- isNonConst ( source , _)
127
- // exists(boolean isIndirect, Type t |
128
- // isNonConst(source, isIndirect) and
129
- // t = source.getType() and
130
- // not cannotContainString(t, isIndirect)
131
- // )
132
- }
125
+ predicate isSource ( DataFlow:: Node source ) { isNonConst ( source , _) }
133
126
134
127
predicate isSink ( DataFlow:: Node sink ) { isSinkImpl ( sink , _) }
135
128
@@ -138,17 +131,10 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {
138
131
139
132
module NonConstFlow = TaintTracking:: Global< NonConstFlowConfig > ;
140
133
141
- // import NonConstFlow::PathGraph
142
-
143
- from
144
- FormattingFunctionCall call , Expr formatString , DataFlow:: Node sink
145
- // ,NonConstFlow::PathNode src,
146
- // NonConstFlow::PathNode sink
134
+ from FormattingFunctionCall call , Expr formatString , DataFlow:: Node sink
147
135
where
148
136
call .getArgument ( call .getFormatParameterIndex ( ) ) = formatString and
149
- //NonConstFlow::flowPath(src, sink) and
150
137
NonConstFlow:: flowTo ( sink ) and
151
- //isSinkImpl(sink.getNode(), formatString)
152
138
isSinkImpl ( sink , formatString )
153
139
select formatString , //sink.getNode(), src, sink,
154
140
"The format string argument to " + call .getTarget ( ) .getName ( ) +
0 commit comments