Skip to content

Commit 36e0c68

Browse files
committed
C#: Add QL Doc to the primary predicate used for capturing flow.
1 parent e8aacb7 commit 36e0c68

File tree

2 files changed

+79
-2
lines changed

2 files changed

+79
-2
lines changed

csharp/ql/src/utils/model-generator/CaptureSummaryModelsQuery.ql

Lines changed: 78 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,85 @@
44
* @id csharp/utils/model-generator/summary-models
55
*/
66

7-
import CaptureSummaryModels
7+
private import CaptureSummaryModels
88

9+
/**
10+
* Capture fluent APIs that return `this`.
11+
* Example of a fluent API:
12+
* ```
13+
* public class BasicFlow {
14+
* public BasicFlow ReturnThis(object input)
15+
* {
16+
* // some side effect
17+
* return this;
18+
* }
19+
* ```
20+
* Captured Model:
21+
* ```
22+
* Summaries;BasicFlow;false;ReturnThis;(System.Object);Argument[Qualifier];ReturnValue;value
23+
* ```
24+
* Capture APIs that transfer taint from an input parameter to an output return
25+
* value or parameter.
26+
* Allows a sequence of read steps followed by a sequence of store steps.
27+
*
28+
* Examples:
29+
*
30+
* ```
31+
* public class BasicFlow {
32+
* private string tainted;
33+
*
34+
* public String ReturnField()
35+
* {
36+
* return tainted;
37+
* }
38+
*
39+
* public void AssignFieldToArray(object[] target)
40+
* {
41+
* target[0] = tainted;
42+
* }
43+
* }
44+
* ```
45+
* Captured Models:
46+
* ```
47+
* Summaries;BasicFlow;false;ReturnField;();Argument[Qualifier];ReturnValue;taint |
48+
* Summaries;BasicFlow;false;AssignFieldToArray;(System.Object[]);Argument[Qualifier];Argument[0].Element;taint
49+
* ```
50+
*
51+
* ```
52+
* public class BasicFlow {
53+
* private string tainted;
54+
*
55+
* public void SetField(string s)
56+
* {
57+
* tainted = s;
58+
* }
59+
* }
60+
* ```
61+
* Captured Model:
62+
* `Summaries;BasicFlow;false;SetField;(System.String);Argument[0];Argument[Qualifier];taint`
63+
*
64+
* ```
65+
* public class BasicFlow {
66+
* public void ReturnSubstring(string s)
67+
* {
68+
* return s.Substring(0, 1);
69+
* }
70+
* }
71+
* ```
72+
* Captured Model:
73+
* `Summaries;BasicFlow;false;ReturnSubstring;(System.String);Argument[0];ReturnValue;taint`
74+
*
75+
* ```
76+
* public class BasicFlow {
77+
* public void AssignToArray(int data, int[] target)
78+
* {
79+
* target[0] = data;
80+
* }
81+
* }
82+
* ```
83+
* Captured Model:
84+
* `Summaries;BasicFlow;false;AssignToArray;(System.Int32,System.Int32[]);Argument[0];Argument[1].Element;taint`
85+
*/
986
private string captureFlow(TargetAPI api) {
1087
result = captureQualifierFlow(api) or
1188
result = captureThroughFlow(api)

java/ql/src/utils/model-generator/CaptureSummaryModelsQuery.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @id java/utils/model-generator/summary-models
55
*/
66

7-
import CaptureSummaryModels
7+
private import CaptureSummaryModels
88

99
/**
1010
* Capture fluent APIs that return `this`.

0 commit comments

Comments
 (0)