Skip to content

Commit f7cf327

Browse files
aschackmullaschackmull
committed
Dataflow: Sync
1 parent a34c981 commit f7cf327

File tree

42 files changed

+552
-708
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+552
-708
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ abstract class Configuration extends string {
5454
/**
5555
* Holds if `source` is a relevant data flow source.
5656
*/
57-
abstract predicate isSource(Node source);
57+
predicate isSource(Node source) { none() }
5858

5959
/**
6060
* Holds if `source` is a relevant data flow source with the given initial
@@ -65,7 +65,7 @@ abstract class Configuration extends string {
6565
/**
6666
* Holds if `sink` is a relevant data flow sink.
6767
*/
68-
abstract predicate isSink(Node sink);
68+
predicate isSink(Node sink) { none() }
6969

7070
/**
7171
* Holds if `sink` is a relevant data flow sink accepting `state`.
@@ -308,16 +308,18 @@ private class RetNodeEx extends NodeEx {
308308
private predicate inBarrier(NodeEx node, Configuration config) {
309309
exists(Node n |
310310
node.asNode() = n and
311-
config.isBarrierIn(n) and
312-
(config.isSource(n) or config.isSource(n, _))
311+
config.isBarrierIn(n)
312+
|
313+
config.isSource(n) or config.isSource(n, _)
313314
)
314315
}
315316

316317
private predicate outBarrier(NodeEx node, Configuration config) {
317318
exists(Node n |
318319
node.asNode() = n and
319-
config.isBarrierOut(n) and
320-
(config.isSink(n) or config.isSink(n, _))
320+
config.isBarrierOut(n)
321+
|
322+
config.isSink(n) or config.isSink(n, _)
321323
)
322324
}
323325

@@ -1586,9 +1588,11 @@ private module Stage2 {
15861588
pragma[nomagic]
15871589
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15881590

1591+
// use an alias as a workaround for bad functionality-induced joins
15891592
pragma[nomagic]
15901593
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15911594

1595+
// use an alias as a workaround for bad functionality-induced joins
15921596
pragma[nomagic]
15931597
predicate revFlowAlias(
15941598
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -2349,9 +2353,11 @@ private module Stage3 {
23492353
pragma[nomagic]
23502354
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23512355

2356+
// use an alias as a workaround for bad functionality-induced joins
23522357
pragma[nomagic]
23532358
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23542359

2360+
// use an alias as a workaround for bad functionality-induced joins
23552361
pragma[nomagic]
23562362
predicate revFlowAlias(
23572363
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3175,9 +3181,11 @@ private module Stage4 {
31753181
pragma[nomagic]
31763182
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31773183

3184+
// use an alias as a workaround for bad functionality-induced joins
31783185
pragma[nomagic]
31793186
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31803187

3188+
// use an alias as a workaround for bad functionality-induced joins
31813189
pragma[nomagic]
31823190
predicate revFlowAlias(
31833191
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3990,14 +3998,10 @@ private predicate pathIntoArg(
39903998
PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
39913999
AccessPath ap, AccessPathApprox apa, Configuration config
39924000
) {
3993-
exists(ArgNode arg, ArgumentPosition apos |
3994-
arg = mid.getNodeEx().asNode() and
3995-
state = mid.getState() and
3996-
cc = mid.getCallContext() and
3997-
arg.argumentOf(call, apos) and
3998-
ap = mid.getAp() and
4001+
exists(ArgNodeEx arg, ArgumentPosition apos |
4002+
pathNode(mid, arg, state, cc, _, ap, config, _) and
4003+
arg.asNode().(ArgNode).argumentOf(call, apos) and
39994004
apa = ap.getApprox() and
4000-
config = mid.getConfiguration() and
40014005
parameterMatch(ppos, apos)
40024006
)
40034007
}
@@ -4063,13 +4067,8 @@ private predicate paramFlowsThrough(
40634067
AccessPathApprox apa, Configuration config
40644068
) {
40654069
exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
4066-
mid.getNodeEx() = ret and
4070+
pathNode(mid, ret, state, cc, sc, ap, config, _) and
40674071
kind = ret.getKind() and
4068-
state = mid.getState() and
4069-
cc = mid.getCallContext() and
4070-
sc = mid.getSummaryCtx() and
4071-
config = mid.getConfiguration() and
4072-
ap = mid.getAp() and
40734072
apa = ap.getApprox() and
40744073
pos = sc.getParameterPos() and
40754074
// we don't expect a parameter to return stored in itself, unless explicitly allowed
@@ -4150,13 +4149,8 @@ private module Subpaths {
41504149
) {
41514150
exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
41524151
subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
4153-
ret.getNodeEx() = retnode and
4154-
kind = retnode.getKind() and
4155-
innercc = ret.getCallContext() and
4156-
sc = ret.getSummaryCtx() and
4157-
ret.getConfiguration() = unbindConf(getPathNodeConf(arg)) and
4158-
sout = ret.getState() and
4159-
apout = ret.getAp()
4152+
pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
4153+
kind = retnode.getKind()
41604154
)
41614155
}
41624156

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ abstract class Configuration extends string {
5454
/**
5555
* Holds if `source` is a relevant data flow source.
5656
*/
57-
abstract predicate isSource(Node source);
57+
predicate isSource(Node source) { none() }
5858

5959
/**
6060
* Holds if `source` is a relevant data flow source with the given initial
@@ -65,7 +65,7 @@ abstract class Configuration extends string {
6565
/**
6666
* Holds if `sink` is a relevant data flow sink.
6767
*/
68-
abstract predicate isSink(Node sink);
68+
predicate isSink(Node sink) { none() }
6969

7070
/**
7171
* Holds if `sink` is a relevant data flow sink accepting `state`.
@@ -308,16 +308,18 @@ private class RetNodeEx extends NodeEx {
308308
private predicate inBarrier(NodeEx node, Configuration config) {
309309
exists(Node n |
310310
node.asNode() = n and
311-
config.isBarrierIn(n) and
312-
(config.isSource(n) or config.isSource(n, _))
311+
config.isBarrierIn(n)
312+
|
313+
config.isSource(n) or config.isSource(n, _)
313314
)
314315
}
315316

316317
private predicate outBarrier(NodeEx node, Configuration config) {
317318
exists(Node n |
318319
node.asNode() = n and
319-
config.isBarrierOut(n) and
320-
(config.isSink(n) or config.isSink(n, _))
320+
config.isBarrierOut(n)
321+
|
322+
config.isSink(n) or config.isSink(n, _)
321323
)
322324
}
323325

@@ -1586,9 +1588,11 @@ private module Stage2 {
15861588
pragma[nomagic]
15871589
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15881590

1591+
// use an alias as a workaround for bad functionality-induced joins
15891592
pragma[nomagic]
15901593
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15911594

1595+
// use an alias as a workaround for bad functionality-induced joins
15921596
pragma[nomagic]
15931597
predicate revFlowAlias(
15941598
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -2349,9 +2353,11 @@ private module Stage3 {
23492353
pragma[nomagic]
23502354
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23512355

2356+
// use an alias as a workaround for bad functionality-induced joins
23522357
pragma[nomagic]
23532358
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23542359

2360+
// use an alias as a workaround for bad functionality-induced joins
23552361
pragma[nomagic]
23562362
predicate revFlowAlias(
23572363
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3175,9 +3181,11 @@ private module Stage4 {
31753181
pragma[nomagic]
31763182
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31773183

3184+
// use an alias as a workaround for bad functionality-induced joins
31783185
pragma[nomagic]
31793186
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31803187

3188+
// use an alias as a workaround for bad functionality-induced joins
31813189
pragma[nomagic]
31823190
predicate revFlowAlias(
31833191
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3990,14 +3998,10 @@ private predicate pathIntoArg(
39903998
PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
39913999
AccessPath ap, AccessPathApprox apa, Configuration config
39924000
) {
3993-
exists(ArgNode arg, ArgumentPosition apos |
3994-
arg = mid.getNodeEx().asNode() and
3995-
state = mid.getState() and
3996-
cc = mid.getCallContext() and
3997-
arg.argumentOf(call, apos) and
3998-
ap = mid.getAp() and
4001+
exists(ArgNodeEx arg, ArgumentPosition apos |
4002+
pathNode(mid, arg, state, cc, _, ap, config, _) and
4003+
arg.asNode().(ArgNode).argumentOf(call, apos) and
39994004
apa = ap.getApprox() and
4000-
config = mid.getConfiguration() and
40014005
parameterMatch(ppos, apos)
40024006
)
40034007
}
@@ -4063,13 +4067,8 @@ private predicate paramFlowsThrough(
40634067
AccessPathApprox apa, Configuration config
40644068
) {
40654069
exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
4066-
mid.getNodeEx() = ret and
4070+
pathNode(mid, ret, state, cc, sc, ap, config, _) and
40674071
kind = ret.getKind() and
4068-
state = mid.getState() and
4069-
cc = mid.getCallContext() and
4070-
sc = mid.getSummaryCtx() and
4071-
config = mid.getConfiguration() and
4072-
ap = mid.getAp() and
40734072
apa = ap.getApprox() and
40744073
pos = sc.getParameterPos() and
40754074
// we don't expect a parameter to return stored in itself, unless explicitly allowed
@@ -4150,13 +4149,8 @@ private module Subpaths {
41504149
) {
41514150
exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
41524151
subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
4153-
ret.getNodeEx() = retnode and
4154-
kind = retnode.getKind() and
4155-
innercc = ret.getCallContext() and
4156-
sc = ret.getSummaryCtx() and
4157-
ret.getConfiguration() = unbindConf(getPathNodeConf(arg)) and
4158-
sout = ret.getState() and
4159-
apout = ret.getAp()
4152+
pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
4153+
kind = retnode.getKind()
41604154
)
41614155
}
41624156

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ abstract class Configuration extends string {
5454
/**
5555
* Holds if `source` is a relevant data flow source.
5656
*/
57-
abstract predicate isSource(Node source);
57+
predicate isSource(Node source) { none() }
5858

5959
/**
6060
* Holds if `source` is a relevant data flow source with the given initial
@@ -65,7 +65,7 @@ abstract class Configuration extends string {
6565
/**
6666
* Holds if `sink` is a relevant data flow sink.
6767
*/
68-
abstract predicate isSink(Node sink);
68+
predicate isSink(Node sink) { none() }
6969

7070
/**
7171
* Holds if `sink` is a relevant data flow sink accepting `state`.
@@ -308,16 +308,18 @@ private class RetNodeEx extends NodeEx {
308308
private predicate inBarrier(NodeEx node, Configuration config) {
309309
exists(Node n |
310310
node.asNode() = n and
311-
config.isBarrierIn(n) and
312-
(config.isSource(n) or config.isSource(n, _))
311+
config.isBarrierIn(n)
312+
|
313+
config.isSource(n) or config.isSource(n, _)
313314
)
314315
}
315316

316317
private predicate outBarrier(NodeEx node, Configuration config) {
317318
exists(Node n |
318319
node.asNode() = n and
319-
config.isBarrierOut(n) and
320-
(config.isSink(n) or config.isSink(n, _))
320+
config.isBarrierOut(n)
321+
|
322+
config.isSink(n) or config.isSink(n, _)
321323
)
322324
}
323325

@@ -1586,9 +1588,11 @@ private module Stage2 {
15861588
pragma[nomagic]
15871589
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15881590

1591+
// use an alias as a workaround for bad functionality-induced joins
15891592
pragma[nomagic]
15901593
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
15911594

1595+
// use an alias as a workaround for bad functionality-induced joins
15921596
pragma[nomagic]
15931597
predicate revFlowAlias(
15941598
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -2349,9 +2353,11 @@ private module Stage3 {
23492353
pragma[nomagic]
23502354
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23512355

2356+
// use an alias as a workaround for bad functionality-induced joins
23522357
pragma[nomagic]
23532358
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
23542359

2360+
// use an alias as a workaround for bad functionality-induced joins
23552361
pragma[nomagic]
23562362
predicate revFlowAlias(
23572363
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3175,9 +3181,11 @@ private module Stage4 {
31753181
pragma[nomagic]
31763182
predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31773183

3184+
// use an alias as a workaround for bad functionality-induced joins
31783185
pragma[nomagic]
31793186
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
31803187

3188+
// use an alias as a workaround for bad functionality-induced joins
31813189
pragma[nomagic]
31823190
predicate revFlowAlias(
31833191
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
@@ -3990,14 +3998,10 @@ private predicate pathIntoArg(
39903998
PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
39913999
AccessPath ap, AccessPathApprox apa, Configuration config
39924000
) {
3993-
exists(ArgNode arg, ArgumentPosition apos |
3994-
arg = mid.getNodeEx().asNode() and
3995-
state = mid.getState() and
3996-
cc = mid.getCallContext() and
3997-
arg.argumentOf(call, apos) and
3998-
ap = mid.getAp() and
4001+
exists(ArgNodeEx arg, ArgumentPosition apos |
4002+
pathNode(mid, arg, state, cc, _, ap, config, _) and
4003+
arg.asNode().(ArgNode).argumentOf(call, apos) and
39994004
apa = ap.getApprox() and
4000-
config = mid.getConfiguration() and
40014005
parameterMatch(ppos, apos)
40024006
)
40034007
}
@@ -4063,13 +4067,8 @@ private predicate paramFlowsThrough(
40634067
AccessPathApprox apa, Configuration config
40644068
) {
40654069
exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
4066-
mid.getNodeEx() = ret and
4070+
pathNode(mid, ret, state, cc, sc, ap, config, _) and
40674071
kind = ret.getKind() and
4068-
state = mid.getState() and
4069-
cc = mid.getCallContext() and
4070-
sc = mid.getSummaryCtx() and
4071-
config = mid.getConfiguration() and
4072-
ap = mid.getAp() and
40734072
apa = ap.getApprox() and
40744073
pos = sc.getParameterPos() and
40754074
// we don't expect a parameter to return stored in itself, unless explicitly allowed
@@ -4150,13 +4149,8 @@ private module Subpaths {
41504149
) {
41514150
exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
41524151
subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
4153-
ret.getNodeEx() = retnode and
4154-
kind = retnode.getKind() and
4155-
innercc = ret.getCallContext() and
4156-
sc = ret.getSummaryCtx() and
4157-
ret.getConfiguration() = unbindConf(getPathNodeConf(arg)) and
4158-
sout = ret.getState() and
4159-
apout = ret.getAp()
4152+
pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
4153+
kind = retnode.getKind()
41604154
)
41614155
}
41624156

0 commit comments

Comments
 (0)