Skip to content

Commit 2f4ed45

Browse files
jbjjbj
committed
C++: No taint between field and struct
To compensate for the lack of field flow, the taint tracking library has previously considered taint to flow from fields to their containing structs and back again from the structs to any of their fields. This leads to false flow between unrelated fields and is not needed now that we have proper flow through fields.
1 parent c2d1a52 commit 2f4ed45

File tree

3 files changed

+4
-29
lines changed

3 files changed

+4
-29
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ private predicate noFlowFromChildExpr(Expr e) {
8686
e instanceof SizeofOperator
8787
or
8888
e instanceof AlignofOperator
89+
or
90+
e instanceof ClassAggregateLiteral
91+
or
92+
e instanceof FieldAccess
8993
}
9094

9195
private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,9 @@
1-
| file://:0:0:0:0 | t | taint.cpp:235:11:239:2 | {...} | TAINT |
2-
| file://:0:0:0:0 | t | taint.cpp:243:11:246:2 | {...} | TAINT |
3-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
4-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
5-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
6-
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
71
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
82
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
93
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
104
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
115
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
126
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
13-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
14-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
15-
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
16-
| file://:0:0:0:0 | this | file://:0:0:0:0 | v | TAINT |
17-
| file://:0:0:0:0 | this | taint.cpp:72:3:72:3 | c | TAINT |
18-
| file://:0:0:0:0 | this | taint.cpp:73:3:73:3 | d | TAINT |
19-
| file://:0:0:0:0 | this | taint.cpp:77:3:77:3 | d | TAINT |
20-
| file://:0:0:0:0 | u | taint.cpp:235:11:239:2 | {...} | TAINT |
21-
| file://:0:0:0:0 | u | taint.cpp:243:11:246:2 | {...} | TAINT |
22-
| file://:0:0:0:0 | v | taint.cpp:235:11:239:2 | {...} | TAINT |
237
| taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 | |
248
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 | |
259
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 | |
@@ -87,14 +71,6 @@
8771
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:89:7:89:9 | mc1 | |
8872
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:90:7:90:9 | mc1 | |
8973
| taint.cpp:86:2:86:4 | mc1 [post update] | taint.cpp:91:7:91:9 | mc1 | |
90-
| taint.cpp:88:7:88:9 | mc1 | taint.cpp:88:11:88:11 | a | TAINT |
91-
| taint.cpp:89:7:89:9 | mc1 | taint.cpp:89:11:89:11 | b | TAINT |
92-
| taint.cpp:90:7:90:9 | mc1 | taint.cpp:90:11:90:11 | c | TAINT |
93-
| taint.cpp:91:7:91:9 | mc1 | taint.cpp:91:11:91:11 | d | TAINT |
94-
| taint.cpp:92:7:92:9 | mc2 | taint.cpp:92:11:92:11 | a | TAINT |
95-
| taint.cpp:93:7:93:9 | mc2 | taint.cpp:93:11:93:11 | b | TAINT |
96-
| taint.cpp:94:7:94:9 | mc2 | taint.cpp:94:11:94:11 | c | TAINT |
97-
| taint.cpp:95:7:95:9 | mc2 | taint.cpp:95:11:95:11 | d | TAINT |
9874
| taint.cpp:100:21:100:21 | i | taint.cpp:106:7:106:7 | i | |
9975
| taint.cpp:100:21:100:21 | i | taint.cpp:110:12:110:12 | i | |
10076
| taint.cpp:100:21:100:21 | i | taint.cpp:112:12:112:12 | i | |
@@ -220,8 +196,6 @@
220196
| taint.cpp:228:11:228:11 | `this` parameter in (constructor) | taint.cpp:243:11:243:11 | constructor init of field t [pre-this] | |
221197
| taint.cpp:228:11:232:2 | [...](...){...} | taint.cpp:233:7:233:7 | a | |
222198
| taint.cpp:228:11:232:2 | {...} | taint.cpp:228:11:232:2 | [...](...){...} | |
223-
| taint.cpp:228:12:228:12 | t | taint.cpp:228:11:232:2 | {...} | TAINT |
224-
| taint.cpp:228:15:228:15 | u | taint.cpp:228:11:232:2 | {...} | TAINT |
225199
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
226200
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
227201
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field t | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
22
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
33
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
4-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
5-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
6-
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
74
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |
85
| taint.cpp:16:8:16:14 | source1 | taint.cpp:12:22:12:27 | call to source |
96
| taint.cpp:17:8:17:16 | ++ ... | taint.cpp:12:22:12:27 | call to source |

0 commit comments

Comments
 (0)