@@ -16,21 +16,14 @@ private class StdBasicString extends ClassTemplateInstantiation {
1616}
1717
1818/**
19- * Additional model for `std::string` constructors that reference the character
20- * type of the container, or an iterator. For example construction from
21- * iterators:
22- * ```
23- * std::string b(a.begin(), a.end());
24- * ```
19+ * A `std::string` function for which taint should be propagated.
2520 */
26- private class StdStringConstructor extends Constructor , TaintFunction {
27- StdStringConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicString }
28-
21+ abstract private class StdStringTaintFunction extends TaintFunction {
2922 /**
3023 * Gets the index of a parameter to this function that is a string (or
3124 * character).
3225 */
33- int getAStringParameterIndex ( ) {
26+ final int getAStringParameterIndex ( ) {
3427 exists ( Type paramType | paramType = this .getParameter ( result ) .getUnspecifiedType ( ) |
3528 // e.g. `std::basic_string::CharT *`
3629 paramType instanceof PointerType
@@ -41,15 +34,28 @@ private class StdStringConstructor extends Constructor, TaintFunction {
4134 this .getDeclaringType ( ) .getTemplateArgument ( 2 ) .( Type ) .getUnspecifiedType ( )
4235 or
4336 // i.e. `std::basic_string::CharT`
44- this .getParameter ( result ) .getUnspecifiedType ( ) =
45- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( )
37+ paramType = this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( )
4638 )
4739 }
4840
4941 /**
5042 * Gets the index of a parameter to this function that is an iterator.
5143 */
52- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
44+ final int getAnIteratorParameterIndex ( ) {
45+ this .getParameter ( result ) .getType ( ) instanceof Iterator
46+ }
47+ }
48+
49+ /**
50+ * Additional model for `std::string` constructors that reference the character
51+ * type of the container, or an iterator. For example construction from
52+ * iterators:
53+ * ```
54+ * std::string b(a.begin(), a.end());
55+ * ```
56+ */
57+ private class StdStringConstructor extends Constructor , StdStringTaintFunction {
58+ StdStringConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicString }
5359
5460 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
5561 // taint flow from any parameter of the value type to the returned object
@@ -68,7 +74,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
6874/**
6975 * The `std::string` function `c_str`.
7076 */
71- private class StdStringCStr extends TaintFunction {
77+ private class StdStringCStr extends StdStringTaintFunction {
7278 StdStringCStr ( ) { this .getClassAndName ( "c_str" ) instanceof StdBasicString }
7379
7480 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -81,7 +87,7 @@ private class StdStringCStr extends TaintFunction {
8187/**
8288 * The `std::string` function `data`.
8389 */
84- private class StdStringData extends TaintFunction {
90+ private class StdStringData extends StdStringTaintFunction {
8591 StdStringData ( ) { this .getClassAndName ( "data" ) instanceof StdBasicString }
8692
8793 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -99,7 +105,7 @@ private class StdStringData extends TaintFunction {
99105/**
100106 * The `std::string` function `push_back`.
101107 */
102- private class StdStringPush extends TaintFunction {
108+ private class StdStringPush extends StdStringTaintFunction {
103109 StdStringPush ( ) { this .getClassAndName ( "push_back" ) instanceof StdBasicString }
104110
105111 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -112,7 +118,7 @@ private class StdStringPush extends TaintFunction {
112118/**
113119 * The `std::string` functions `front` and `back`.
114120 */
115- private class StdStringFrontBack extends TaintFunction {
121+ private class StdStringFrontBack extends StdStringTaintFunction {
116122 StdStringFrontBack ( ) { this .getClassAndName ( [ "front" , "back" ] ) instanceof StdBasicString }
117123
118124 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -125,7 +131,7 @@ private class StdStringFrontBack extends TaintFunction {
125131/**
126132 * The (non-member) `std::string` function `operator+`.
127133 */
128- private class StdStringPlus extends TaintFunction {
134+ private class StdStringPlus extends StdStringTaintFunction {
129135 StdStringPlus ( ) {
130136 this .hasQualifiedName ( [ "std" , "bsl" ] , "operator+" ) and
131137 this .getUnspecifiedType ( ) instanceof StdBasicString
@@ -142,31 +148,15 @@ private class StdStringPlus extends TaintFunction {
142148}
143149
144150/**
145- * The `std::string` functions `operator+=`, `append`, `insert` and
146- * `replace`. All of these functions combine the existing string
147- * with a new string (or character) from one of the arguments.
151+ * The `std::string` functions `operator+=`, `append` and `replace`.
152+ * All of these functions combine the existing string with a new
153+ * string (or character) from one of the arguments.
148154 */
149- private class StdStringAppend extends TaintFunction {
155+ private class StdStringAppend extends StdStringTaintFunction {
150156 StdStringAppend ( ) {
151- this .getClassAndName ( [ "operator+=" , "append" , "insert" , " replace"] ) instanceof StdBasicString
157+ this .getClassAndName ( [ "operator+=" , "append" , "replace" ] ) instanceof StdBasicString
152158 }
153159
154- /**
155- * Gets the index of a parameter to this function that is a string (or
156- * character).
157- */
158- int getAStringParameterIndex ( ) {
159- this .getParameter ( result ) .getType ( ) instanceof PointerType or // e.g. `std::basic_string::CharT *`
160- this .getParameter ( result ) .getType ( ) instanceof ReferenceType or // e.g. `std::basic_string &`
161- this .getParameter ( result ) .getUnspecifiedType ( ) =
162- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( ) // i.e. `std::basic_string::CharT`
163- }
164-
165- /**
166- * Gets the index of a parameter to this function that is an iterator.
167- */
168- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
169-
170160 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
171161 // flow from string and parameter to string (qualifier) and return value
172162 (
@@ -187,26 +177,42 @@ private class StdStringAppend extends TaintFunction {
187177}
188178
189179/**
190- * The standard function `std::string.assign `.
180+ * The `std::string` function `insert `.
191181 */
192- private class StdStringAssign extends TaintFunction {
193- StdStringAssign ( ) { this .getClassAndName ( "assign " ) instanceof StdBasicString }
182+ private class StdStringInsert extends StdStringTaintFunction {
183+ StdStringInsert ( ) { this .getClassAndName ( "insert " ) instanceof StdBasicString }
194184
195185 /**
196- * Gets the index of a parameter to this function that is a string (or
197- * character).
186+ * Holds if the return type is an iterator.
198187 */
199- int getAStringParameterIndex ( ) {
200- this .getParameter ( result ) .getType ( ) instanceof PointerType or // e.g. `std::basic_string::CharT *`
201- this .getParameter ( result ) .getType ( ) instanceof ReferenceType or // e.g. `std::basic_string &`
202- this .getParameter ( result ) .getUnspecifiedType ( ) =
203- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( ) // i.e. `std::basic_string::CharT`
188+ predicate hasIteratorReturnValue ( ) { this .getType ( ) instanceof Iterator }
189+
190+ override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
191+ // flow from string and parameter to string (qualifier) and return value
192+ (
193+ input .isQualifierObject ( ) or
194+ input .isParameterDeref ( this .getAStringParameterIndex ( ) ) or
195+ input .isParameter ( this .getAnIteratorParameterIndex ( ) )
196+ ) and
197+ (
198+ output .isQualifierObject ( )
199+ or
200+ if this .hasIteratorReturnValue ( ) then output .isReturnValue ( ) else output .isReturnValueDeref ( )
201+ )
202+ or
203+ // reverse flow from returned reference to the qualifier (for writes to
204+ // the result)
205+ not this .hasIteratorReturnValue ( ) and
206+ input .isReturnValueDeref ( ) and
207+ output .isQualifierObject ( )
204208 }
209+ }
205210
206- /**
207- * Gets the index of a parameter to this function that is an iterator.
208- */
209- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
211+ /**
212+ * The standard function `std::string.assign`.
213+ */
214+ private class StdStringAssign extends StdStringTaintFunction {
215+ StdStringAssign ( ) { this .getClassAndName ( "assign" ) instanceof StdBasicString }
210216
211217 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
212218 // flow from parameter to string itself (qualifier) and return value
@@ -229,7 +235,7 @@ private class StdStringAssign extends TaintFunction {
229235/**
230236 * The standard function `std::string.copy`.
231237 */
232- private class StdStringCopy extends TaintFunction {
238+ private class StdStringCopy extends StdStringTaintFunction {
233239 StdStringCopy ( ) { this .getClassAndName ( "copy" ) instanceof StdBasicString }
234240
235241 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -242,7 +248,7 @@ private class StdStringCopy extends TaintFunction {
242248/**
243249 * The standard function `std::string.substr`.
244250 */
245- private class StdStringSubstr extends TaintFunction {
251+ private class StdStringSubstr extends StdStringTaintFunction {
246252 StdStringSubstr ( ) { this .getClassAndName ( "substr" ) instanceof StdBasicString }
247253
248254 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -255,7 +261,7 @@ private class StdStringSubstr extends TaintFunction {
255261/**
256262 * The `std::string` functions `at` and `operator[]`.
257263 */
258- private class StdStringAt extends TaintFunction {
264+ private class StdStringAt extends StdStringTaintFunction {
259265 StdStringAt ( ) { this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof StdBasicString }
260266
261267 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
0 commit comments