Skip to content

Commit 3a83cc7

Browse files
author
Robert Marsh
committed
C++: use qualifier flow in more models
1 parent 556ace0 commit 3a83cc7

File tree

5 files changed

+38
-18
lines changed

5 files changed

+38
-18
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/MemberFunction.qll‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,11 @@ class ConversionConstructorModel extends Constructor, TaintFunction {
2121
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
2222
// taint flow from the first constructor argument to the returned object
2323
input.isParameter(0) and
24-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
24+
(
25+
output.isReturnValue()
26+
or
27+
output.isQualifierObject()
28+
)
2529
}
2630
}
2731

@@ -32,7 +36,11 @@ class CopyConstructorModel extends CopyConstructor, DataFlowFunction {
3236
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
3337
// data flow from the first constructor argument to the returned object
3438
input.isParameter(0) and
35-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
39+
(
40+
output.isReturnValue()
41+
or
42+
output.isQualifierObject()
43+
)
3644
}
3745
}
3846

@@ -43,7 +51,11 @@ class MoveConstructorModel extends MoveConstructor, DataFlowFunction {
4351
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
4452
// data flow from the first constructor argument to the returned object
4553
input.isParameter(0) and
46-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
54+
(
55+
output.isReturnValue()
56+
or
57+
output.isQualifierObject()
58+
)
4759
}
4860
}
4961

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,9 @@ class StdSequenceContainerConstructor extends Constructor, TaintFunction {
3838
input.isParameterDeref(getAValueTypeParameterIndex()) or
3939
input.isParameter(getAnIteratorParameterIndex())
4040
) and
41-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
41+
output.isReturnValue()
42+
or
43+
output.isQualifierObject()
4244
}
4345
}
4446

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ class StdStringConstructor extends Constructor, TaintFunction {
4848
input.isParameter(getAnIteratorParameterIndex())
4949
) and
5050
(
51-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
51+
output.isReturnValue()
5252
or
5353
output.isQualifierObject()
5454
)
@@ -383,7 +383,9 @@ class StdStringStreamConstructor extends Constructor, TaintFunction {
383383
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
384384
// taint flow from any parameter of string type to the returned object
385385
input.isParameterDeref(getAStringParameterIndex()) and
386-
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
386+
output.isReturnValue()
387+
or
388+
output.isQualifierObject()
387389
}
388390
}
389391

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@
1515
| arrayassignment.cpp:146:7:146:13 | arrayassignment.cpp:144:12:144:17 | IR only |
1616
| copyableclass.cpp:67:11:67:11 | copyableclass.cpp:67:13:67:18 | AST only |
1717
| copyableclass.cpp:67:11:67:21 | copyableclass.cpp:67:13:67:18 | IR only |
18-
| copyableclass_declonly.cpp:40:8:40:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
19-
| copyableclass_declonly.cpp:41:8:41:9 | copyableclass_declonly.cpp:35:32:35:37 | AST only |
2018
| copyableclass_declonly.cpp:42:8:42:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
21-
| copyableclass_declonly.cpp:65:8:65:9 | copyableclass_declonly.cpp:60:56:60:61 | AST only |
2219
| copyableclass_declonly.cpp:67:11:67:11 | copyableclass_declonly.cpp:67:13:67:18 | AST only |
2320
| movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
2421
| movableclass.cpp:65:11:65:21 | movableclass.cpp:65:13:65:18 | IR only |
@@ -97,10 +94,6 @@
9794
| stringstream.cpp:67:7:67:10 | stringstream.cpp:64:36:64:41 | AST only |
9895
| stringstream.cpp:76:11:76:11 | stringstream.cpp:70:32:70:37 | AST only |
9996
| stringstream.cpp:100:11:100:11 | stringstream.cpp:100:31:100:36 | AST only |
100-
| stringstream.cpp:103:7:103:9 | stringstream.cpp:91:19:91:24 | AST only |
101-
| stringstream.cpp:105:7:105:9 | stringstream.cpp:95:44:95:49 | AST only |
102-
| stringstream.cpp:121:7:121:9 | stringstream.cpp:113:24:113:29 | AST only |
103-
| stringstream.cpp:123:7:123:9 | stringstream.cpp:115:24:115:29 | AST only |
10497
| stringstream.cpp:143:11:143:22 | stringstream.cpp:143:14:143:19 | IR only |
10598
| swap1.cpp:78:12:78:16 | swap1.cpp:69:23:69:23 | AST only |
10699
| swap1.cpp:87:13:87:17 | swap1.cpp:82:16:82:21 | AST only |
@@ -134,10 +127,7 @@
134127
| taint.cpp:431:9:431:17 | taint.cpp:428:13:428:18 | IR only |
135128
| taint.cpp:447:9:447:17 | taint.cpp:445:14:445:28 | AST only |
136129
| taint.cpp:471:7:471:7 | taint.cpp:462:6:462:11 | AST only |
137-
| vector.cpp:20:8:20:8 | vector.cpp:16:43:16:49 | AST only |
138-
| vector.cpp:24:8:24:8 | vector.cpp:16:43:16:49 | AST only |
139-
| vector.cpp:28:8:28:8 | vector.cpp:16:43:16:49 | AST only |
140-
| vector.cpp:33:8:33:8 | vector.cpp:16:43:16:49 | AST only |
130+
| vector.cpp:24:8:24:11 | vector.cpp:16:43:16:49 | IR only |
141131
| vector.cpp:52:7:52:8 | vector.cpp:51:10:51:15 | AST only |
142132
| vector.cpp:53:9:53:9 | vector.cpp:51:10:51:15 | AST only |
143133
| vector.cpp:54:9:54:9 | vector.cpp:51:10:51:15 | AST only |
@@ -171,4 +161,3 @@
171161
| vector.cpp:292:7:292:18 | vector.cpp:289:17:289:30 | AST only |
172162
| vector.cpp:308:9:308:14 | vector.cpp:303:14:303:19 | AST only |
173163
| vector.cpp:311:9:311:14 | vector.cpp:303:14:303:19 | AST only |
174-
| vector.cpp:326:7:326:8 | vector.cpp:318:15:318:20 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,10 @@
2424
| copyableclass.cpp:65:8:65:9 | s1 | copyableclass.cpp:60:40:60:45 | call to source |
2525
| copyableclass.cpp:66:8:66:9 | s2 | copyableclass.cpp:63:24:63:29 | call to source |
2626
| copyableclass.cpp:67:11:67:21 | (reference dereference) | copyableclass.cpp:67:13:67:18 | call to source |
27+
| copyableclass_declonly.cpp:40:8:40:9 | s1 | copyableclass_declonly.cpp:34:30:34:35 | call to source |
28+
| copyableclass_declonly.cpp:41:8:41:9 | s2 | copyableclass_declonly.cpp:35:32:35:37 | call to source |
2729
| copyableclass_declonly.cpp:43:8:43:9 | s4 | copyableclass_declonly.cpp:38:8:38:13 | call to source |
30+
| copyableclass_declonly.cpp:65:8:65:9 | s1 | copyableclass_declonly.cpp:60:56:60:61 | call to source |
2831
| copyableclass_declonly.cpp:66:8:66:9 | s2 | copyableclass_declonly.cpp:63:32:63:37 | call to source |
2932
| format.cpp:57:8:57:13 | Argument 0 indirection | format.cpp:56:36:56:49 | call to source |
3033
| format.cpp:62:8:62:13 | Argument 0 indirection | format.cpp:61:30:61:43 | call to source |
@@ -142,7 +145,11 @@
142145
| stringstream.cpp:66:7:66:10 | Argument 0 indirection | stringstream.cpp:63:18:63:23 | call to source |
143146
| stringstream.cpp:81:7:81:9 | Argument 0 indirection | stringstream.cpp:70:32:70:37 | source |
144147
| stringstream.cpp:83:11:83:13 | call to str | stringstream.cpp:70:32:70:37 | source |
148+
| stringstream.cpp:103:7:103:9 | Argument 0 indirection | stringstream.cpp:91:19:91:24 | call to source |
149+
| stringstream.cpp:105:7:105:9 | Argument 0 indirection | stringstream.cpp:95:44:95:49 | call to source |
145150
| stringstream.cpp:107:7:107:9 | Argument 0 indirection | stringstream.cpp:100:31:100:36 | call to source |
151+
| stringstream.cpp:121:7:121:9 | Argument 0 indirection | stringstream.cpp:113:24:113:29 | call to source |
152+
| stringstream.cpp:123:7:123:9 | Argument 0 indirection | stringstream.cpp:115:24:115:29 | call to source |
146153
| stringstream.cpp:143:11:143:11 | call to operator<< | stringstream.cpp:143:14:143:19 | call to source |
147154
| stringstream.cpp:143:11:143:22 | (reference dereference) | stringstream.cpp:143:14:143:19 | call to source |
148155
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
@@ -224,6 +231,13 @@
224231
| taint.cpp:465:7:465:7 | x | taint.cpp:462:6:462:11 | call to source |
225232
| taint.cpp:470:7:470:7 | x | taint.cpp:462:6:462:11 | call to source |
226233
| taint.cpp:485:7:485:10 | line | taint.cpp:480:26:480:32 | source1 |
234+
| vector.cpp:20:8:20:8 | x | vector.cpp:16:43:16:49 | source1 |
235+
| vector.cpp:24:8:24:8 | call to operator* | vector.cpp:16:43:16:49 | source1 |
236+
| vector.cpp:24:8:24:11 | (reference dereference) | vector.cpp:16:43:16:49 | source1 |
237+
| vector.cpp:28:8:28:8 | (reference dereference) | vector.cpp:16:43:16:49 | source1 |
238+
| vector.cpp:28:8:28:8 | x | vector.cpp:16:43:16:49 | source1 |
239+
| vector.cpp:33:8:33:8 | (reference dereference) | vector.cpp:16:43:16:49 | source1 |
240+
| vector.cpp:33:8:33:8 | x | vector.cpp:16:43:16:49 | source1 |
227241
| vector.cpp:70:7:70:8 | Argument 0 indirection | vector.cpp:69:15:69:20 | call to source |
228242
| vector.cpp:83:7:83:8 | Argument 0 indirection | vector.cpp:81:17:81:22 | call to source |
229243
| vector.cpp:109:7:109:8 | Argument 0 indirection | vector.cpp:106:15:106:20 | call to source |
@@ -251,3 +265,4 @@
251265
| vector.cpp:309:7:309:7 | Argument 0 indirection | vector.cpp:303:14:303:19 | call to source |
252266
| vector.cpp:312:7:312:7 | Argument 0 indirection | vector.cpp:303:14:303:19 | call to source |
253267
| vector.cpp:324:7:324:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |
268+
| vector.cpp:326:7:326:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |

0 commit comments

Comments
 (0)