C++: Add ComPtr MaD models
#20301
Merged
C++: Add ComPtr MaD models
#20301
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR adds MaD (Modeling as Data) models for Microsoft's ComPtr template class, which is a smart pointer used extensively in Windows development. The models enable proper data flow tracking through ComPtr operations, resulting in an ~11% increase in summary local flow steps on Microsoft codebases.
- Adds comprehensive MaD models for
ComPtrconstructors, methods, and operations - Includes test coverage with taint flow scenarios for various
ComPtroperations - Updates expected test results to reflect the new data flow capabilities
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| cpp/ql/lib/ext/ComPtr.model.yml | Defines MaD models for ComPtr constructors, methods like Get/Detach/CopyTo, and data flow patterns |
| cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp | Adds comprehensive test cases for ComPtr taint tracking scenarios |
| cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected | Updates expected results for local taint flow tests |
| cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected | Updates expected MaD signature matching results |
| cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected | Updates model validation results |
jketema
reviewed
Aug 27, 2025
| int x = source<int>(); | ||
| Microsoft::WRL::ComPtr<int> p1(new int(x)); | ||
| int *raw = nullptr; | ||
| p1.CopyTo(&raw); |
There was a problem hiding this comment.
This is using the template version right? I seem to be missing a test for the non-template, 1 argument version?
jketema
approved these changes
Aug 27, 2025
|
DCA was uneventful (as expected since we dont have a lot of these things covered in DCA) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is (unsurprisingly) quite an important model to Microsoft.
I've tested it on a random Microsoft database I had locally, and the number of summary local flow steps goes up by ~11% 🎉