Skip to content

Commit f2f9944

Browse files
michaelnebelmichaelnebel
authored
Merge pull request github#12931 from michaelnebel/neutralkinds
Java/C#: Introduce kind for neutrals.
2 parents 05b1bd8 + baee4ce commit f2f9944

File tree

51 files changed

+47500
-47469
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+47500
-47469
lines changed

‎csharp/ql/lib/change-notes/2023-04-26-neutral-model-kinds.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Updated the `neutralModel` extensible predicate to include a `kind` column.

‎csharp/ql/lib/ext/generated/dotnet_runtime.model.yml

Lines changed: 41750 additions & 41750 deletions
Large diffs are not rendered by default.

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
* - Summaries:
1313
* `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
1414
* - Neutrals:
15-
* `namespace; type; name; signature; provenance`
16-
* A neutral is used to indicate that there is no flow via a callable.
15+
* `namespace; type; name; signature; kind; provenance`
16+
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
1717
*
1818
* The interpretation of a row is similar to API-graphs with a left-to-right
1919
* reading.
@@ -72,7 +72,9 @@
7272
* which classes the interpreted elements should be added. For example, for
7373
* sources "remote" indicates a default remote flow source, and for summaries
7474
* "taint" indicates a default additional taint step and "value" indicates a
75-
* globally applicable value-preserving step.
75+
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
76+
* `source` or `sink` to indicate that the neutral is neutral with respect to
77+
* flow (no summary), source (is not a source) or sink (is not a sink).
7678
* 9. The `provenance` column is a tag to indicate the origin and verification of a model.
7779
* The format is {origin}-{verification} or just "manual" where the origin describes
7880
* the origin of the model and verification describes how the model has been verified.
@@ -103,8 +105,8 @@ predicate sinkModel = Extensions::sinkModel/9;
103105
/** Holds if a summary model exists for the given parameters. */
104106
predicate summaryModel = Extensions::summaryModel/10;
105107

106-
/** Holds if a model exists indicating there is no flow for the given parameters. */
107-
predicate neutralModel = Extensions::neutralModel/5;
108+
/** Holds if a neutral model exists for the given parameters. */
109+
predicate neutralModel = Extensions::neutralModel/6;
108110

109111
private predicate relevantNamespace(string namespace) {
110112
sourceModel(namespace, _, _, _, _, _, _, _, _) or
@@ -218,6 +220,11 @@ module ModelValidation {
218220
not kind = ["local", "remote", "file", "file-write"] and
219221
result = "Invalid kind \"" + kind + "\" in source model."
220222
)
223+
or
224+
exists(string kind | neutralModel(_, _, _, _, kind, _) |
225+
not kind = ["summary", "source", "sink"] and
226+
result = "Invalid kind \"" + kind + "\" in neutral model."
227+
)
221228
}
222229

223230
private string getInvalidModelSignature() {
@@ -232,7 +239,7 @@ module ModelValidation {
232239
summaryModel(namespace, type, _, name, signature, ext, _, _, _, provenance) and
233240
pred = "summary"
234241
or
235-
neutralModel(namespace, type, name, signature, provenance) and
242+
neutralModel(namespace, type, name, signature, _, provenance) and
236243
ext = "" and
237244
pred = "neutral"
238245
|
@@ -275,7 +282,7 @@ private predicate elementSpec(
275282
or
276283
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _)
277284
or
278-
neutralModel(namespace, type, name, signature, _) and ext = "" and subtypes = false
285+
neutralModel(namespace, type, name, signature, _, _) and ext = "" and subtypes = false
279286
}
280287

281288
private predicate elementSpec(

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlowExtensions.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ extensible predicate summaryModel(
2727
);
2828

2929
/**
30-
* Holds if a model exists indicating there is no flow for the given parameters.
30+
* Holds if a neutral model exists for the given parameters.
3131
*/
3232
extensible predicate neutralModel(
33-
string namespace, string type, string name, string signature, string provenance
33+
string namespace, string type, string name, string signature, string kind, string provenance
3434
);

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ module Public {
335335
class NeutralCallable extends SummarizedCallableBase {
336336
private Provenance provenance;
337337

338-
NeutralCallable() { neutralElement(this, provenance) }
338+
NeutralCallable() { neutralSummaryElement(this, provenance) }
339339

340340
/**
341341
* Holds if the neutral is auto generated.

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,12 +111,12 @@ predicate summaryElement(Callable c, string input, string output, string kind, s
111111
}
112112

113113
/**
114-
* Holds if a neutral model exists for `c` with provenance `provenace`,
114+
* Holds if a neutral summary model exists for `c` with provenance `provenace`,
115115
* which means that there is no flow through `c`.
116116
*/
117-
predicate neutralElement(Callable c, string provenance) {
117+
predicate neutralSummaryElement(Callable c, string provenance) {
118118
exists(string namespace, string type, string name, string signature |
119-
neutralModel(namespace, type, name, signature, provenance) and
119+
neutralModel(namespace, type, name, signature, "summary", provenance) and
120120
c = interpretElement(namespace, type, false, name, signature, "")
121121
)
122122
}

‎csharp/ql/src/utils/modelconverter/ExtractNeutrals.ql

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@
77
import csharp
88
import semmle.code.csharp.dataflow.ExternalFlow
99

10-
from string package, string type, string name, string signature, string provenance
10+
from string package, string type, string name, string signature, string kind, string provenance
1111
where
12-
neutralModel(package, type, name, signature, provenance) and
12+
neutralModel(package, type, name, signature, kind, provenance) and
1313
not provenance.matches("%generated")
14-
select package, type, name, signature, provenance order by package, type, name, signature
14+
select package, type, name, signature, kind, provenance order by
15+
package, type, name, signature, kind

‎csharp/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,11 @@ module PrintingImpl<PrintingSig Printing> {
2525
+ Printing::getProvenance()
2626
}
2727

28-
string asNeutralModel(Printing::Api api) {
29-
result = asPartialNeutralModel(api) + Printing::getProvenance()
28+
string asNeutralSummaryModel(Printing::Api api) {
29+
result =
30+
asPartialNeutralModel(api) //
31+
+ "summary" + ";" //
32+
+ Printing::getProvenance()
3033
}
3134

3235
/**

‎csharp/ql/src/utils/modelgenerator/internal/CaptureSummaryFlowQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,5 +86,5 @@ string captureFlow(DataFlowTargetApi api) {
8686
*/
8787
string captureNoFlow(DataFlowTargetApi api) {
8888
not exists(captureFlow(api)) and
89-
result = ModelPrinting::asNeutralModel(api)
89+
result = ModelPrinting::asNeutralSummaryModel(api)
9090
}

‎csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.expected

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
1-
| NoSummaries;BaseClass;M1;(System.String);df-generated |
2-
| NoSummaries;BaseClass;M2;(System.String);df-generated |
3-
| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);df-generated |
4-
| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);df-generated |
5-
| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);df-generated |
6-
| NoSummaries;EquatableBound;Equals;(System.Object);df-generated |
7-
| NoSummaries;EquatableUnBound<>;Equals;(T);df-generated |
8-
| NoSummaries;SimpleTypes;M1;(System.Boolean);df-generated |
9-
| NoSummaries;SimpleTypes;M2;(System.Boolean);df-generated |
10-
| NoSummaries;SimpleTypes;M3;(System.Int32);df-generated |
11-
| NoSummaries;SimpleTypes;M4;(System.Int32);df-generated |
12-
| Sinks;NewSinks;WrapFieldResponseWriteFile;();df-generated |
13-
| Sinks;NewSinks;WrapPrivateFieldResponseWriteFile;();df-generated |
14-
| Sinks;NewSinks;WrapPrivatePropResponseWriteFile;();df-generated |
15-
| Sinks;NewSinks;WrapPropPrivateSetResponseWriteFile;();df-generated |
16-
| Sinks;NewSinks;WrapPropResponseWriteFile;();df-generated |
17-
| Sinks;NewSinks;WrapResponseWrite;(System.Object);df-generated |
18-
| Sinks;NewSinks;WrapResponseWriteFile;(System.String);df-generated |
19-
| Sinks;NewSinks;get_PrivateSetTaintedProp;();df-generated |
20-
| Sinks;NewSinks;get_TaintedProp;();df-generated |
21-
| Sinks;NewSinks;set_PrivateSetTaintedProp;(System.String);df-generated |
22-
| Sinks;NewSinks;set_TaintedProp;(System.String);df-generated |
23-
| Sources;NewSources;WrapConsoleReadKey;();df-generated |
24-
| Sources;NewSources;WrapConsoleReadLine;();df-generated |
25-
| Sources;NewSources;WrapConsoleReadLineAndProcees;(System.String);df-generated |
26-
| Summaries;EqualsGetHashCodeNoFlow;Equals;(System.Object);df-generated |
27-
| Summaries;EqualsGetHashCodeNoFlow;GetHashCode;();df-generated |
28-
| Summaries;OperatorFlow;op_Increment;(Summaries.OperatorFlow);df-generated |
1+
| NoSummaries;BaseClass;M1;(System.String);summary;df-generated |
2+
| NoSummaries;BaseClass;M2;(System.String);summary;df-generated |
3+
| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);summary;df-generated |
4+
| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);summary;df-generated |
5+
| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);summary;df-generated |
6+
| NoSummaries;EquatableBound;Equals;(System.Object);summary;df-generated |
7+
| NoSummaries;EquatableUnBound<>;Equals;(T);summary;df-generated |
8+
| NoSummaries;SimpleTypes;M1;(System.Boolean);summary;df-generated |
9+
| NoSummaries;SimpleTypes;M2;(System.Boolean);summary;df-generated |
10+
| NoSummaries;SimpleTypes;M3;(System.Int32);summary;df-generated |
11+
| NoSummaries;SimpleTypes;M4;(System.Int32);summary;df-generated |
12+
| Sinks;NewSinks;WrapFieldResponseWriteFile;();summary;df-generated |
13+
| Sinks;NewSinks;WrapPrivateFieldResponseWriteFile;();summary;df-generated |
14+
| Sinks;NewSinks;WrapPrivatePropResponseWriteFile;();summary;df-generated |
15+
| Sinks;NewSinks;WrapPropPrivateSetResponseWriteFile;();summary;df-generated |
16+
| Sinks;NewSinks;WrapPropResponseWriteFile;();summary;df-generated |
17+
| Sinks;NewSinks;WrapResponseWrite;(System.Object);summary;df-generated |
18+
| Sinks;NewSinks;WrapResponseWriteFile;(System.String);summary;df-generated |
19+
| Sinks;NewSinks;get_PrivateSetTaintedProp;();summary;df-generated |
20+
| Sinks;NewSinks;get_TaintedProp;();summary;df-generated |
21+
| Sinks;NewSinks;set_PrivateSetTaintedProp;(System.String);summary;df-generated |
22+
| Sinks;NewSinks;set_TaintedProp;(System.String);summary;df-generated |
23+
| Sources;NewSources;WrapConsoleReadKey;();summary;df-generated |
24+
| Sources;NewSources;WrapConsoleReadLine;();summary;df-generated |
25+
| Sources;NewSources;WrapConsoleReadLineAndProcees;(System.String);summary;df-generated |
26+
| Summaries;EqualsGetHashCodeNoFlow;Equals;(System.Object);summary;df-generated |
27+
| Summaries;EqualsGetHashCodeNoFlow;GetHashCode;();summary;df-generated |
28+
| Summaries;OperatorFlow;op_Increment;(Summaries.OperatorFlow);summary;df-generated |

0 commit comments

Comments
 (0)