11import cpp
22
3-
43// A type modelling a (taint propagating) hash function.
54abstract class HashFunction extends TaintFunction {
65 // Returns the index of the input data argument.
@@ -16,15 +15,15 @@ abstract class HashFunction extends TaintFunction {
1615 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
1716 input .isParameterDeref ( this .getInput ( ) ) and
1817 (
19- output .isParameterDeref ( this .getAnOutput ( ) ) or
20- ( this .returnsOutput ( ) = true and output .isReturnValueDeref ( ) )
18+ output .isParameterDeref ( this .getAnOutput ( ) )
19+ or
20+ this .returnsOutput ( ) = true and output .isReturnValueDeref ( )
2121 )
2222 }
2323}
2424
2525// A type modelling a (taint propagating) hash context.
26- class HashContext extends Expr {
27- }
26+ class HashContext extends Expr { }
2827
2928// A type modelling a hash context initializer.
3029abstract class HashContextInitializer extends Function {
@@ -40,14 +39,13 @@ class HashContextInitializerCall extends FunctionCall {
4039
4140 // Returns the hash context argument.
4241 HashContext getContext ( ) {
43- ( init .returnsContext ( ) = true and result = this ) or
44- ( result = this .getArgument ( init .getAContext ( ) ) )
42+ init .returnsContext ( ) = true and result = this
43+ or
44+ result = this .getArgument ( init .getAContext ( ) )
4545 }
4646
4747 // Returns the corresponding initializer function.
48- HashContextInitializer getInitializer ( ) {
49- result = init
50- }
48+ HashContextInitializer getInitializer ( ) { result = init }
5149}
5250
5351// A type modelling a hash context update function.
@@ -70,40 +68,35 @@ class HashContextUpdaterCall extends FunctionCall {
7068 HashContextUpdater update ;
7169
7270 // Returns the hash context argument.
73- HashContext getContext ( ) {
74- result = this .getArgument ( update .getContext ( ) )
75- }
71+ HashContext getContext ( ) { result = this .getArgument ( update .getContext ( ) ) }
7672
7773 // Returns the corresponding update function.
78- HashContextInitializer getUpdater ( ) {
79- result = update
80- }
81-
74+ HashContextInitializer getUpdater ( ) { result = update }
75+
8276 // Returns an input data argument.
83- Expr getAnInput ( ) {
84- result = this .getArgument ( update .getAnInput ( ) )
85- }
77+ Expr getAnInput ( ) { result = this .getArgument ( update .getAnInput ( ) ) }
8678}
8779
8880// A type modelling a hash context finalizer function.
8981abstract class HashContextFinalizer extends TaintFunction {
9082 // Returns the index of the context argument.
9183 abstract int getContext ( ) ;
92-
84+
9385 // Returns the output digest argument (if it exists).
9486 abstract int getAnOutput ( ) ;
9587
9688 // True iff the finalizer function returns a pointer or reference to the
9789 // output digest.
9890 abstract boolean returnsOutput ( ) ;
99-
91+
10092 // Since C++ does not have AdditionalTaintFlow we use TaintFunction to model
10193 // taint from input to output through the hash context.
10294 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
10395 input .isParameterDeref ( this .getContext ( ) ) and
10496 (
105- output .isParameterDeref ( this .getAnOutput ( ) ) or
106- ( this .returnsOutput ( ) = true and output .isReturnValueDeref ( ) )
97+ output .isParameterDeref ( this .getAnOutput ( ) )
98+ or
99+ this .returnsOutput ( ) = true and output .isReturnValueDeref ( )
107100 )
108101 }
109102}
@@ -112,19 +105,15 @@ class HashContextFinalizerCall extends FunctionCall {
112105 HashContextFinalizer final ;
113106
114107 // Returns the hash context argument.
115- HashContext getContext ( ) {
116- result = this .getArgument ( final .getContext ( ) )
117- }
108+ HashContext getContext ( ) { result = this .getArgument ( final .getContext ( ) ) }
118109
119110 // Returns the corresponding finalizer function.
120- HashContextInitializer getFinalizer ( ) {
121- result = final
122- }
111+ HashContextInitializer getFinalizer ( ) { result = final }
123112
124113 // Returns an expression representing the output digest.
125114 Expr getAnOutput ( ) {
126- ( final .returnsOutput ( ) = true and result = this ) or
127- ( result = this .getArgument ( final .getAnOutput ( ) ) )
115+ final .returnsOutput ( ) = true and result = this
116+ or
117+ result = this .getArgument ( final .getAnOutput ( ) )
128118 }
129119}
130-
0 commit comments