@@ -145,7 +145,7 @@ private class TaintStore extends TaintState, TTaintStore {
145
145
*
146
146
* This can be used to generate Flow summaries for APIs from parameter to return.
147
147
*/
148
- module ThroughFlowConfig implements DataFlow:: StateConfigSig {
148
+ module PropagateFlowConfig implements DataFlow:: StateConfigSig {
149
149
class FlowState = TaintState ;
150
150
151
151
predicate isSource ( DataFlow:: Node source , FlowState state ) {
@@ -190,14 +190,14 @@ module ThroughFlowConfig implements DataFlow::StateConfigSig {
190
190
}
191
191
}
192
192
193
- private module ThroughFlow = TaintTracking:: GlobalWithState< ThroughFlowConfig > ;
193
+ private module PropagateFlow = TaintTracking:: GlobalWithState< PropagateFlowConfig > ;
194
194
195
195
/**
196
196
* Gets the summary model(s) of `api`, if there is flow from parameters to return value or parameter.
197
197
*/
198
198
string captureThroughFlow ( DataFlowTargetApi api ) {
199
199
exists ( DataFlow:: ParameterNode p , ReturnNodeExt returnNodeExt , string input , string output |
200
- ThroughFlow :: flow ( p , returnNodeExt ) and
200
+ PropagateFlow :: flow ( p , returnNodeExt ) and
201
201
returnNodeExt .( DataFlow:: Node ) .getEnclosingCallable ( ) = api and
202
202
input = parameterNodeAsInput ( p ) and
203
203
output = returnNodeExt .getOutput ( ) and
@@ -213,8 +213,13 @@ string captureThroughFlow(DataFlowTargetApi api) {
213
213
* This can be used to generate Source summaries for an API, if the API expose an already known source
214
214
* via its return (then the API itself becomes a source).
215
215
*/
216
- module FromSourceConfig implements DataFlow:: ConfigSig {
217
- predicate isSource ( DataFlow:: Node source ) { ExternalFlow:: sourceNode ( source , _) }
216
+ module PropagateFromSourceConfig implements DataFlow:: ConfigSig {
217
+ predicate isSource ( DataFlow:: Node source ) {
218
+ exists ( string kind |
219
+ isRelevantSourceKind ( kind ) and
220
+ ExternalFlow:: sourceNode ( source , kind )
221
+ )
222
+ }
218
223
219
224
predicate isSink ( DataFlow:: Node sink ) {
220
225
exists ( DataFlowTargetApi c |
@@ -234,17 +239,16 @@ module FromSourceConfig implements DataFlow::ConfigSig {
234
239
}
235
240
}
236
241
237
- private module FromSource = TaintTracking:: Global< FromSourceConfig > ;
242
+ private module PropagateFromSource = TaintTracking:: Global< PropagateFromSourceConfig > ;
238
243
239
244
/**
240
245
* Gets the source model(s) of `api`, if there is flow from an existing known source to the return of `api`.
241
246
*/
242
247
string captureSource ( DataFlowTargetApi api ) {
243
248
exists ( DataFlow:: Node source , ReturnNodeExt sink , string kind |
244
- FromSource :: flow ( source , sink ) and
249
+ PropagateFromSource :: flow ( source , sink ) and
245
250
ExternalFlow:: sourceNode ( source , kind ) and
246
251
api = sink .getEnclosingCallable ( ) and
247
- isRelevantSourceKind ( kind ) and
248
252
result = ModelPrinting:: asSourceModel ( api , sink .getOutput ( ) , kind )
249
253
)
250
254
}
@@ -259,7 +263,9 @@ string captureSource(DataFlowTargetApi api) {
259
263
module PropagateToSinkConfig implements DataFlow:: ConfigSig {
260
264
predicate isSource ( DataFlow:: Node source ) { apiSource ( source ) }
261
265
262
- predicate isSink ( DataFlow:: Node sink ) { ExternalFlow:: sinkNode ( sink , _) }
266
+ predicate isSink ( DataFlow:: Node sink ) {
267
+ exists ( string kind | isRelevantSinkKind ( kind ) and ExternalFlow:: sinkNode ( sink , kind ) )
268
+ }
263
269
264
270
predicate isBarrier ( DataFlow:: Node node ) {
265
271
exists ( Type t | t = node .getType ( ) and not isRelevantType ( t ) )
@@ -284,7 +290,6 @@ string captureSink(DataFlowTargetApi api) {
284
290
PropagateToSink:: flow ( src , sink ) and
285
291
ExternalFlow:: sinkNode ( sink , kind ) and
286
292
api = src .getEnclosingCallable ( ) and
287
- isRelevantSinkKind ( kind ) and
288
293
result = ModelPrinting:: asSinkModel ( api , asInputArgument ( src ) , kind )
289
294
)
290
295
}
0 commit comments