Skip to content

Commit 1b63395

Browse files
author
Robert Marsh
authored
Merge pull request #1783 from jbj/taint-fields-structs
C++: Don't propagate taint between field and struct [CPP-410]
2 parents 9012c32 + 2f4ed45 commit 1b63395

File tree

3 files changed

+4
-29
lines changed

3 files changed

+4
-29
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ private predicate noFlowFromChildExpr(Expr e) {
8686
e instanceof SizeofOperator
8787
or
8888
e instanceof AlignofOperator
89+
or
90+
e instanceof ClassAggregateLiteral
91+
or
92+
e instanceof FieldAccess
8993
}
9094

9195
private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,9 @@
1-
| file://:0:0:0:0 | t | taint.cpp:235:11:239:2 | {...} | TAINT |
2-
| file://:0:0:0:0 | t | taint.cpp:243:11:246:2 | {...} | TAINT |
3-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
4-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
5-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
6-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
71
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
82
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
93
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
104
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
115
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
126
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
13-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
14-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
15-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
16-
| file://:0:0:0:0 | this | file://:0:0:0:0 | v | TAINT |
17-
| file://:0:0:0:0 | this | taint.cpp:72:3:72:3 | c | TAINT |
18-
| file://:0:0:0:0 | this | taint.cpp:73:3:73:3 | d | TAINT |
19-
| file://:0:0:0:0 | this | taint.cpp:77:3:77:3 | d | TAINT |
20-
| file://:0:0:0:0 | u | taint.cpp:235:11:239:2 | {...} | TAINT |
21-
| file://:0:0:0:0 | u | taint.cpp:243:11:246:2 | {...} | TAINT |
22-
| file://:0:0:0:0 | v | taint.cpp:235:11:239:2 | {...} | TAINT |
237
| taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 | |
248
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 | |
259
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 | |
@@ -87,14 +71,6 @@
8771
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:89:7:89:9 | mc1 | |
8872
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:90:7:90:9 | mc1 | |
8973
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:91:7:91:9 | mc1 | |
90-
| taint.cpp:88:7:88:9 | mc1 | taint.cpp:88:11:88:11 | a | TAINT |
91-
| taint.cpp:89:7:89:9 | mc1 | taint.cpp:89:11:89:11 | b | TAINT |
92-
| taint.cpp:90:7:90:9 | mc1 | taint.cpp:90:11:90:11 | c | TAINT |
93-
| taint.cpp:91:7:91:9 | mc1 | taint.cpp:91:11:91:11 | d | TAINT |
94-
| taint.cpp:92:7:92:9 | mc2 | taint.cpp:92:11:92:11 | a | TAINT |
95-
| taint.cpp:93:7:93:9 | mc2 | taint.cpp:93:11:93:11 | b | TAINT |
96-
| taint.cpp:94:7:94:9 | mc2 | taint.cpp:94:11:94:11 | c | TAINT |
97-
| taint.cpp:95:7:95:9 | mc2 | taint.cpp:95:11:95:11 | d | TAINT |
9874
| taint.cpp:100:21:100:21 | i | taint.cpp:106:7:106:7 | i | |
9975
| taint.cpp:100:21:100:21 | i | taint.cpp:110:12:110:12 | i | |
10076
| taint.cpp:100:21:100:21 | i | taint.cpp:112:12:112:12 | i | |
@@ -220,8 +196,6 @@
220196
| taint.cpp:228:11:228:11 | `this` parameter in (constructor) | taint.cpp:243:11:243:11 | constructor init of field t [pre-this] | |
221197
| taint.cpp:228:11:232:2 | [...](...){...} | taint.cpp:233:7:233:7 | a | |
222198
| taint.cpp:228:11:232:2 | {...} | taint.cpp:228:11:232:2 | [...](...){...} | |
223-
| taint.cpp:228:12:228:12 | t | taint.cpp:228:11:232:2 | {...} | TAINT |
224-
| taint.cpp:228:15:228:15 | u | taint.cpp:228:11:232:2 | {...} | TAINT |
225199
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
226200
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
227201
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field t | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
22
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
33
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
4-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
5-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
6-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
74
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |
85
| taint.cpp:16:8:16:14 | source1 | taint.cpp:12:22:12:27 | call to source |
96
| taint.cpp:17:8:17:16 | ++ ... | taint.cpp:12:22:12:27 | call to source |

0 commit comments

Comments
 (0)