Skip to content

Commit 7c74fd0

Browse files
aschackmullaschackmull
authored
Merge pull request github#12684 from aschackmull/dataflow/remove-footgun
Dataflow: Remove accidentally exposed predicates.
2 parents 042e53a + 47e7aa9 commit 7c74fd0

40 files changed

+126
-68
lines changed

‎cpp/ql/lib/change-notes/2023-03-28-dataflow-rm-footgun.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ private module Config implements FullStateConfigSig {
328328
}
329329

330330
private import Impl<Config> as I
331-
import I
332331

333332
/**
334333
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +378,8 @@ class PathNode instanceof I::PathNode {
379378
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380379
}
381380

381+
module PathGraph = I::PathGraph;
382+
382383
private predicate hasFlow(Node source, Node sink, Configuration config) {
383384
exists(PathNode source0, PathNode sink0 |
384385
hasFlowPath(source0, sink0, config) and
@@ -388,7 +389,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388389
}
389390

390391
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
392+
I::flowPath(source, sink) and source.getConfiguration() = config
392393
}
393394

394395
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

0 commit comments

Comments
 (0)