Skip to content

Commit ba4dd2b

Browse files
author
Alvaro Muñoz
committed
Update to latest dataflow shared library
1 parent 2c96127 commit ba4dd2b

26 files changed

+316
-292
lines changed

‎ql/lib/codeql-pack.lock.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 0.1.8
5+
version: 1.0.0
66
codeql/dataflow:
7-
version: 0.1.8
7+
version: 1.0.0
88
codeql/ssa:
9-
version: 0.2.8
9+
version: 1.0.0
1010
codeql/typetracking:
11-
version: 0.2.8
11+
version: 1.0.0
1212
codeql/util:
13-
version: 0.2.8
13+
version: 1.0.0
1414
codeql/yaml:
15-
version: 0.1.5
15+
version: 1.0.0
1616
compiled: false

‎ql/lib/codeql/actions/DataFlow.qll

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,21 @@
22
* Provides classes for performing local (intra-procedural) and
33
* global (inter-procedural) data flow analyses.
44
*/
5+
6+
import codeql.Locations
7+
58
module DataFlow {
69
private import codeql.dataflow.DataFlow
710
private import codeql.actions.dataflow.internal.DataFlowImplSpecific
8-
import DataFlowMake<ActionsDataFlow>
11+
import DataFlowMake<Location, ActionsDataFlow>
912
import codeql.actions.dataflow.internal.DataFlowPublic
1013
// debug
1114
private import codeql.actions.dataflow.internal.TaintTrackingImplSpecific
1215
import codeql.dataflow.internal.DataFlowImplConsistency as DFIC
1316

14-
module ActionsConsistency implements DFIC::InputSig<ActionsDataFlow> { }
17+
module ActionsConsistency implements DFIC::InputSig<Location, ActionsDataFlow> { }
1518

1619
module Consistency {
17-
import DFIC::MakeConsistency<ActionsDataFlow, ActionsTaintTracking, ActionsConsistency>
20+
import DFIC::MakeConsistency<Location, ActionsDataFlow, ActionsTaintTracking, ActionsConsistency>
1821
}
1922
}

‎ql/lib/codeql/actions/TaintTracking.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,12 @@
22
* Provides classes for performing local (intra-procedural) and
33
* global (inter-procedural) taint-tracking analyses.
44
*/
5+
6+
import codeql.Locations
7+
58
module TaintTracking {
69
private import codeql.actions.dataflow.internal.DataFlowImplSpecific
710
private import codeql.actions.dataflow.internal.TaintTrackingImplSpecific
811
private import codeql.dataflow.TaintTracking
9-
import TaintFlowMake<ActionsDataFlow, ActionsTaintTracking>
12+
import TaintFlowMake<Location, ActionsDataFlow, ActionsTaintTracking>
1013
}

‎ql/lib/codeql/actions/dataflow/internal/DataFlowImplSpecific.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@
44
*/
55

66
private import codeql.dataflow.DataFlow
7+
private import codeql.Locations
78

8-
module ActionsDataFlow implements InputSig {
9+
module ActionsDataFlow implements InputSig<Location> {
910
import DataFlowPrivate as Private
1011
import DataFlowPublic
1112
import Private

‎ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
private import codeql.util.Unit
12
private import codeql.dataflow.DataFlow
23
private import codeql.actions.Ast
34
private import codeql.actions.Cfg as Cfg
@@ -8,6 +9,8 @@ private import codeql.actions.dataflow.ExternalFlow
89
private import codeql.actions.dataflow.FlowSteps
910
private import codeql.actions.dataflow.FlowSources
1011

12+
class DataFlowSecondLevelScope = Unit;
13+
1114
cached
1215
newtype TNode = TExprNode(DataFlowExpr e)
1316

@@ -78,6 +81,9 @@ class DataFlowCall instanceof Cfg::Node {
7881
string getName() { result = super.getAstNode().(Uses).getCallee() }
7982

8083
DataFlowCallable getEnclosingCallable() { result = super.getScope() }
84+
85+
/** Gets a best-effort total ordering. */
86+
int totalorder() { none() }
8187
}
8288

8389
/**
@@ -104,6 +110,9 @@ class DataFlowCallable instanceof Cfg::CfgScope {
104110
.indexOf(["/action.yml", "/action.yaml"]))
105111
else none()
106112
}
113+
114+
/** Gets a best-effort total ordering. */
115+
int totalorder() { none() }
107116
}
108117

109118
newtype TReturnKind = TNormalReturn()
@@ -158,6 +167,19 @@ newtype TContent =
158167

159168
predicate forceHighPrecision(Content c) { c instanceof FieldContent }
160169

170+
class NodeRegion instanceof Unit {
171+
string toString() { result = "NodeRegion" }
172+
173+
predicate contains(Node n) { none() }
174+
175+
int totalOrder() { result = 1 }
176+
}
177+
178+
/**
179+
* Holds if the nodes in `nr` are unreachable when the call context is `call`.
180+
*/
181+
predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call) { none() }
182+
161183
class ContentApprox = ContentSet;
162184

163185
ContentApprox getContentApprox(Content c) { result = c }
@@ -287,9 +309,13 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
287309
}
288310

289311
/**
290-
* a simple local flow step that should always preserve the call context (same callable)
312+
* This is the local flow predicate that is used as a building block in global
313+
* data flow.
291314
*/
292-
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) { localFlowStep(nodeFrom, nodeTo) }
315+
cached
316+
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
317+
localFlowStep(nodeFrom, nodeTo) and model = ""
318+
}
293319

294320
/**
295321
* Holds if data can flow from `node1` to `node2` through a non-local step
@@ -366,11 +392,6 @@ predicate clearsContent(Node n, ContentSet c) { none() }
366392
*/
367393
predicate expectsContent(Node n, ContentSet c) { none() }
368394

369-
/**
370-
* Holds if the node `n` is unreachable when the call context is `call`.
371-
*/
372-
predicate isUnreachableInCall(Node n, DataFlowCall call) { none() }
373-
374395
/**
375396
* Holds if flow is allowed to pass from parameter `p` and back to itself as a
376397
* side-effect, resulting in a summary from `p` to itself.
@@ -400,3 +421,7 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves
400421
* This compression is normally done to not show SSA steps, casts, etc.
401422
*/
402423
predicate neverSkipInPathGraph(Node node) { any() }
424+
425+
predicate knownSourceModel(Node source, string model) { none() }
426+
427+
predicate knownSinkModel(Node sink, string model) { none() }

‎ql/lib/codeql/actions/dataflow/internal/DataFlowPublic.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ class FieldContent extends Content, TFieldContent {
178178

179179
predicate hasLocalFlow(Node n1, Node n2) {
180180
n1 = n2 or
181-
simpleLocalFlowStep(n1, n2) or
181+
simpleLocalFlowStep(n1, n2, _) or
182182
exists(ContentSet c | ctxFieldReadStep(n1, n2, c))
183183
}
184184

‎ql/lib/codeql/actions/dataflow/internal/TaintTrackingImplSpecific.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@
33
* Implementation of https://github.com/github/codeql/blob/main/shared/dataflow/codeql/dataflow/TaintTracking.qll
44
*/
55

6+
private import codeql.Locations
67
private import codeql.dataflow.TaintTracking
78
private import DataFlowImplSpecific
89

9-
module ActionsTaintTracking implements InputSig<ActionsDataFlow> {
10+
module ActionsTaintTracking implements InputSig<Location, ActionsDataFlow> {
1011
import TaintTrackingPrivate
1112
}

‎ql/lib/codeql/actions/dataflow/internal/TaintTrackingPrivate.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,16 @@ private import codeql.actions.Ast
1414
*/
1515
predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
1616

17+
// predicate defaultAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
18+
// any(AdditionalTaintStep s).step(nodeFrom, nodeTo)
19+
// }
1720
/**
1821
* Holds if the additional step from `nodeFrom` to `nodeTo` should be included
1922
* in all global taint flow configurations.
2023
*/
21-
predicate defaultAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
22-
any(AdditionalTaintStep s).step(nodeFrom, nodeTo)
24+
cached
25+
predicate defaultAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo, string model) {
26+
any(AdditionalTaintStep s).step(nodeFrom, nodeTo) and model = ""
2327
}
2428

2529
/**

‎ql/lib/qlpack.gbo

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎ql/lib/qlpack.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ warnOnImplicitThis: true
44
name: githubsecuritylab/actions-all
55
version: 0.0.33
66
dependencies:
7-
codeql/util: ^0.2.0
8-
codeql/yaml: ^0.1.2
9-
codeql/controlflow: ^0.1.0
10-
codeql/dataflow: ^0.1.0
7+
codeql/util: ^1.0.0
8+
codeql/yaml: ^1.0.0
9+
codeql/controlflow: ^1.0.0
10+
codeql/dataflow: ^1.0.0
1111
dbscheme: yaml.dbscheme
1212
extractor: yaml
1313
groups:

0 commit comments

Comments
 (0)