Skip to content

Commit 6dbc59d

Browse files
jketemajketema
committed
C++: Simplify isSink based on reviewer comments
1 parent 3dfe18b commit 6dbc59d

File tree

3 files changed

+7
-21
lines changed

3 files changed

+7
-21
lines changed

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@ Expr asSourceExpr(DataFlow::Node node) {
5454
}
5555

5656
Expr asSinkExpr(DataFlow::Node node) {
57-
result = node.asConvertedExpr()
58-
or
5957
result =
6058
node.asOperand()
6159
.(SideEffectOperand)
@@ -113,14 +111,11 @@ class TaintedPathConfiguration extends TaintTracking::Configuration {
113111

114112
predicate hasFilteredFlowPath(DataFlow::PathNode source, DataFlow::PathNode sink) {
115113
this.hasFlowPath(source, sink) and
116-
not exists(DataFlow::PathNode source2, DataFlow::PathNode sink2 |
117-
this.hasFlowPath(source2, sink2) and
118-
asSourceExpr(source.getNode()) = asSourceExpr(source2.getNode()) and
119-
asSinkExpr(sink.getNode()) = asSinkExpr(sink2.getNode())
114+
not exists(DataFlow::PathNode source2 |
115+
this.hasFlowPath(source2, sink) and
116+
asSourceExpr(source.getNode()) = asSourceExpr(source2.getNode())
120117
|
121118
not exists(source.getNode().asConvertedExpr()) and exists(source2.getNode().asConvertedExpr())
122-
or
123-
not exists(sink.getNode().asConvertedExpr()) and exists(sink2.getNode().asConvertedExpr())
124119
)
125120
}
126121
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
11
edges
2-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data |
32
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection |
43
nodes
54
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | semmle.label | fgets output argument |
6-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | semmle.label | data |
75
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | semmle.label | data indirection |
86
subpaths
97
#select
10-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |
8+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,24 @@
11
edges
2-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
32
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
4-
| test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName |
53
| test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName indirection |
64
| test.c:37:17:37:24 | fileName | test.c:38:11:38:18 | fileName indirection |
75
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection |
8-
| test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName |
96
| test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName indirection |
10-
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName |
117
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection |
128
nodes
139
| test.c:9:23:9:26 | argv | semmle.label | argv |
14-
| test.c:17:11:17:18 | fileName | semmle.label | fileName |
1510
| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
1611
| test.c:31:22:31:25 | argv | semmle.label | argv |
17-
| test.c:32:11:32:18 | fileName | semmle.label | fileName |
1812
| test.c:32:11:32:18 | fileName indirection | semmle.label | fileName indirection |
1913
| test.c:37:17:37:24 | fileName | semmle.label | fileName |
2014
| test.c:37:17:37:24 | scanf output argument | semmle.label | scanf output argument |
2115
| test.c:38:11:38:18 | fileName indirection | semmle.label | fileName indirection |
2216
| test.c:43:17:43:24 | fileName | semmle.label | fileName |
2317
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
24-
| test.c:44:11:44:18 | fileName | semmle.label | fileName |
2518
| test.c:44:11:44:18 | fileName indirection | semmle.label | fileName indirection |
2619
subpaths
2720
#select
28-
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |
29-
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv | user input (argv) |
21+
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |
22+
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv | user input (argv) |
3023
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | fileName | test.c:38:11:38:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | fileName | user input (scanf) |
31-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |
24+
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |

0 commit comments

Comments
 (0)