@@ -120,7 +120,7 @@ predicate isNonConst(DataFlow::Node node, boolean isIndirect) {
120
120
}
121
121
122
122
pragma [ noinline]
123
- predicate isSanitizerNode ( DataFlow:: Node node ) {
123
+ predicate isBarrierNode ( DataFlow:: Node node ) {
124
124
underscoreMacro ( [ node .asExpr ( ) , node .asIndirectExpr ( ) ] )
125
125
or
126
126
exists ( node .asExpr ( ) ) and
@@ -132,27 +132,27 @@ predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
132
132
exists ( FormattingFunctionCall fc | formatString = fc .getArgument ( fc .getFormatParameterIndex ( ) ) )
133
133
}
134
134
135
- class NonConstFlow extends TaintTracking:: Configuration {
136
- NonConstFlow ( ) { this = "NonConstFlow" }
137
-
138
- override predicate isSource ( DataFlow:: Node source ) {
135
+ module NonConstFlowConfiguration implements DataFlow:: ConfigSig {
136
+ predicate isSource ( DataFlow:: Node source ) {
139
137
exists ( boolean isIndirect , Type t |
140
138
isNonConst ( source , isIndirect ) and
141
139
t = source .getType ( ) and
142
140
not cannotContainString ( t , isIndirect )
143
141
)
144
142
}
145
143
146
- override predicate isSink ( DataFlow:: Node sink ) { isSinkImpl ( sink , _) }
144
+ predicate isSink ( DataFlow:: Node sink ) { isSinkImpl ( sink , _) }
147
145
148
- override predicate isSanitizer ( DataFlow:: Node node ) { isSanitizerNode ( node ) }
146
+ predicate isBarrier ( DataFlow:: Node node ) { isBarrierNode ( node ) }
149
147
}
150
148
149
+ module NonConstFlow = TaintTracking:: Make< NonConstFlowConfiguration > ;
150
+
151
151
from FormattingFunctionCall call , Expr formatString
152
152
where
153
153
call .getArgument ( call .getFormatParameterIndex ( ) ) = formatString and
154
- exists ( NonConstFlow cf , DataFlow:: Node sink |
155
- cf . hasFlowTo ( sink ) and
154
+ exists ( DataFlow:: Node sink |
155
+ NonConstFlow :: hasFlowTo ( sink ) and
156
156
isSinkImpl ( sink , formatString )
157
157
)
158
158
select formatString ,
0 commit comments