@@ -47,6 +47,20 @@ private predicate defaultSource(DataFlow::Node src) {
47
47
src .asExpr ( ) .( MethodAccess ) .getMethod ( ) .getName ( ) = [ "source" , "taint" ]
48
48
}
49
49
50
+ private module DefaultFlowConf implements DataFlow:: ConfigSig {
51
+ predicate isSource ( DataFlow:: Node n ) { defaultSource ( n ) }
52
+
53
+ predicate isSink ( DataFlow:: Node n ) {
54
+ exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
55
+ }
56
+
57
+ int fieldFlowBranchLimit ( ) { result = 1000 }
58
+ }
59
+
60
+ private module DefaultValueFlow = DataFlow:: Make< DefaultFlowConf > ;
61
+
62
+ private module DefaultTaintFlow = TaintTracking:: Make< DefaultFlowConf > ;
63
+
50
64
class DefaultValueFlowConf extends DataFlow:: Configuration {
51
65
DefaultValueFlowConf ( ) { this = "qltest:defaultValueFlowConf" }
52
66
@@ -76,26 +90,47 @@ private string getSourceArgString(DataFlow::Node src) {
76
90
src .asExpr ( ) .( MethodAccess ) .getAnArgument ( ) .( StringLiteral ) .getValue ( ) = result
77
91
}
78
92
93
+ abstract class EnableLegacyConfiguration extends Unit { }
94
+
79
95
class InlineFlowTest extends InlineExpectationsTest {
80
96
InlineFlowTest ( ) { this = "HasFlowTest" }
81
97
82
98
override string getARelevantTag ( ) { result = [ "hasValueFlow" , "hasTaintFlow" ] }
83
99
84
100
override predicate hasActualResult ( Location location , string element , string tag , string value ) {
85
- tag = "hasValueFlow" and
86
- exists ( DataFlow:: Node src , DataFlow:: Node sink | getValueFlowConfig ( ) .hasFlow ( src , sink ) |
87
- sink .getLocation ( ) = location and
88
- element = sink .toString ( ) and
89
- if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
90
- )
91
- or
92
- tag = "hasTaintFlow" and
93
- exists ( DataFlow:: Node src , DataFlow:: Node sink |
94
- getTaintFlowConfig ( ) .hasFlow ( src , sink ) and not getValueFlowConfig ( ) .hasFlow ( src , sink )
95
- |
96
- sink .getLocation ( ) = location and
97
- element = sink .toString ( ) and
98
- if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
101
+ if exists ( EnableLegacyConfiguration e )
102
+ then
103
+ tag = "hasValueFlow" and
104
+ exists ( DataFlow:: Node src , DataFlow:: Node sink | getValueFlowConfig ( ) .hasFlow ( src , sink ) |
105
+ sink .getLocation ( ) = location and
106
+ element = sink .toString ( ) and
107
+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
108
+ )
109
+ or
110
+ tag = "hasTaintFlow" and
111
+ exists ( DataFlow:: Node src , DataFlow:: Node sink |
112
+ getTaintFlowConfig ( ) .hasFlow ( src , sink ) and not getValueFlowConfig ( ) .hasFlow ( src , sink )
113
+ |
114
+ sink .getLocation ( ) = location and
115
+ element = sink .toString ( ) and
116
+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
117
+ )
118
+ else (
119
+ tag = "hasValueFlow" and
120
+ exists ( DataFlow:: Node src , DataFlow:: Node sink | DefaultValueFlow:: hasFlow ( src , sink ) |
121
+ sink .getLocation ( ) = location and
122
+ element = sink .toString ( ) and
123
+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
124
+ )
125
+ or
126
+ tag = "hasTaintFlow" and
127
+ exists ( DataFlow:: Node src , DataFlow:: Node sink |
128
+ DefaultTaintFlow:: hasFlow ( src , sink ) and not DefaultValueFlow:: hasFlow ( src , sink )
129
+ |
130
+ sink .getLocation ( ) = location and
131
+ element = sink .toString ( ) and
132
+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
133
+ )
99
134
)
100
135
}
101
136
0 commit comments