Skip to content

Commit 4363f08

Browse files
geoffw0geoffw0
committed
C++: Model std::set::emplace and emplace_hint.
1 parent 5d87117 commit 4363f08

File tree

6 files changed

+79
-8
lines changed

6 files changed

+79
-8
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,29 @@ class StdSetInsert extends TaintFunction {
4949
}
5050
}
5151

52+
/**
53+
* The standard set `emplace` and `emplace_hint` functions.
54+
*/
55+
class StdSetEmplace extends TaintFunction {
56+
StdSetEmplace() {
57+
this.hasQualifiedName("std", ["set", "unordered_set"], ["emplace", "emplace_hint"])
58+
}
59+
60+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
61+
// flow from any parameter to qualifier and return value
62+
// (here we assume taint flow from any constructor parameter to the constructed object)
63+
// (where the return value is a pair, this should really flow just to the first part of it)
64+
input.isParameter([0 .. getNumberOfParameters() - 1]) and
65+
(
66+
output.isQualifierObject() or
67+
output.isReturnValue()
68+
)
69+
or
70+
input.isQualifierObject() and
71+
output.isReturnValue()
72+
}
73+
}
74+
5275
/**
5376
* The standard set `swap` functions.
5477
*/

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2298,33 +2298,49 @@
22982298
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:120:7:120:9 | s21 | |
22992299
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:121:7:121:9 | s21 | |
23002300
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:126:1:126:1 | s21 | |
2301+
| set.cpp:118:7:118:9 | s21 | set.cpp:118:11:118:17 | call to emplace | TAINT |
2302+
| set.cpp:118:19:118:23 | abc | set.cpp:118:7:118:9 | ref arg s21 | TAINT |
2303+
| set.cpp:118:19:118:23 | abc | set.cpp:118:11:118:17 | call to emplace | TAINT |
23012304
| set.cpp:118:26:118:30 | first | set.cpp:118:7:118:30 | call to iterator | |
23022305
| set.cpp:119:7:119:9 | s21 | set.cpp:119:7:119:9 | call to set | |
23032306
| set.cpp:120:7:120:9 | ref arg s21 | set.cpp:121:7:121:9 | s21 | |
23042307
| set.cpp:120:7:120:9 | ref arg s21 | set.cpp:126:1:126:1 | s21 | |
2308+
| set.cpp:120:7:120:9 | s21 | set.cpp:120:11:120:17 | call to emplace | TAINT |
2309+
| set.cpp:120:19:120:24 | call to source | set.cpp:120:7:120:9 | ref arg s21 | TAINT |
2310+
| set.cpp:120:19:120:24 | call to source | set.cpp:120:11:120:17 | call to emplace | TAINT |
23052311
| set.cpp:120:29:120:33 | first | set.cpp:120:7:120:33 | call to iterator | |
23062312
| set.cpp:121:7:121:9 | s21 | set.cpp:121:7:121:9 | call to set | |
23072313
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:123:7:123:9 | s22 | |
23082314
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
23092315
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:124:24:124:26 | s22 | |
23102316
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
23112317
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
2318+
| set.cpp:122:7:122:9 | s22 | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
23122319
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:122:7:122:9 | s22 | |
23132320
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:123:7:123:9 | s22 | |
23142321
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
23152322
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:124:24:124:26 | s22 | |
23162323
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
23172324
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
23182325
| set.cpp:122:24:122:26 | s22 | set.cpp:122:28:122:32 | call to begin | TAINT |
2326+
| set.cpp:122:24:122:34 | call to iterator | set.cpp:122:7:122:9 | ref arg s22 | TAINT |
2327+
| set.cpp:122:24:122:34 | call to iterator | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
23192328
| set.cpp:122:28:122:32 | call to begin | set.cpp:122:24:122:34 | call to iterator | TAINT |
2329+
| set.cpp:122:37:122:41 | abc | set.cpp:122:7:122:9 | ref arg s22 | TAINT |
2330+
| set.cpp:122:37:122:41 | abc | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
23202331
| set.cpp:123:7:123:9 | s22 | set.cpp:123:7:123:9 | call to set | |
23212332
| set.cpp:124:7:124:9 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
23222333
| set.cpp:124:7:124:9 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
2334+
| set.cpp:124:7:124:9 | s22 | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
23232335
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
23242336
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
23252337
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
23262338
| set.cpp:124:24:124:26 | s22 | set.cpp:124:28:124:32 | call to begin | TAINT |
2339+
| set.cpp:124:24:124:34 | call to iterator | set.cpp:124:7:124:9 | ref arg s22 | TAINT |
2340+
| set.cpp:124:24:124:34 | call to iterator | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
23272341
| set.cpp:124:28:124:32 | call to begin | set.cpp:124:24:124:34 | call to iterator | TAINT |
2342+
| set.cpp:124:37:124:42 | call to source | set.cpp:124:7:124:9 | ref arg s22 | TAINT |
2343+
| set.cpp:124:37:124:42 | call to source | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
23282344
| set.cpp:125:7:125:9 | s22 | set.cpp:125:7:125:9 | call to set | |
23292345
| set.cpp:131:29:131:30 | call to unordered_set | set.cpp:133:7:133:8 | s1 | |
23302346
| set.cpp:131:29:131:30 | call to unordered_set | set.cpp:137:12:137:13 | s1 | |
@@ -2763,33 +2779,49 @@
27632779
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:232:7:232:9 | s21 | |
27642780
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:233:7:233:9 | s21 | |
27652781
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:238:1:238:1 | s21 | |
2782+
| set.cpp:230:7:230:9 | s21 | set.cpp:230:11:230:17 | call to emplace | TAINT |
2783+
| set.cpp:230:19:230:23 | abc | set.cpp:230:7:230:9 | ref arg s21 | TAINT |
2784+
| set.cpp:230:19:230:23 | abc | set.cpp:230:11:230:17 | call to emplace | TAINT |
27662785
| set.cpp:230:26:230:30 | first | set.cpp:230:7:230:30 | call to iterator | |
27672786
| set.cpp:231:7:231:9 | s21 | set.cpp:231:7:231:9 | call to unordered_set | |
27682787
| set.cpp:232:7:232:9 | ref arg s21 | set.cpp:233:7:233:9 | s21 | |
27692788
| set.cpp:232:7:232:9 | ref arg s21 | set.cpp:238:1:238:1 | s21 | |
2789+
| set.cpp:232:7:232:9 | s21 | set.cpp:232:11:232:17 | call to emplace | TAINT |
2790+
| set.cpp:232:19:232:24 | call to source | set.cpp:232:7:232:9 | ref arg s21 | TAINT |
2791+
| set.cpp:232:19:232:24 | call to source | set.cpp:232:11:232:17 | call to emplace | TAINT |
27702792
| set.cpp:232:29:232:33 | first | set.cpp:232:7:232:33 | call to iterator | |
27712793
| set.cpp:233:7:233:9 | s21 | set.cpp:233:7:233:9 | call to unordered_set | |
27722794
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:235:7:235:9 | s22 | |
27732795
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
27742796
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:236:24:236:26 | s22 | |
27752797
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
27762798
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
2799+
| set.cpp:234:7:234:9 | s22 | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
27772800
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:234:7:234:9 | s22 | |
27782801
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:235:7:235:9 | s22 | |
27792802
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
27802803
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:236:24:236:26 | s22 | |
27812804
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
27822805
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
27832806
| set.cpp:234:24:234:26 | s22 | set.cpp:234:28:234:32 | call to begin | TAINT |
2807+
| set.cpp:234:24:234:34 | call to iterator | set.cpp:234:7:234:9 | ref arg s22 | TAINT |
2808+
| set.cpp:234:24:234:34 | call to iterator | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
27842809
| set.cpp:234:28:234:32 | call to begin | set.cpp:234:24:234:34 | call to iterator | TAINT |
2810+
| set.cpp:234:37:234:41 | abc | set.cpp:234:7:234:9 | ref arg s22 | TAINT |
2811+
| set.cpp:234:37:234:41 | abc | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
27852812
| set.cpp:235:7:235:9 | s22 | set.cpp:235:7:235:9 | call to unordered_set | |
27862813
| set.cpp:236:7:236:9 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
27872814
| set.cpp:236:7:236:9 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
2815+
| set.cpp:236:7:236:9 | s22 | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
27882816
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
27892817
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
27902818
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
27912819
| set.cpp:236:24:236:26 | s22 | set.cpp:236:28:236:32 | call to begin | TAINT |
2820+
| set.cpp:236:24:236:34 | call to iterator | set.cpp:236:7:236:9 | ref arg s22 | TAINT |
2821+
| set.cpp:236:24:236:34 | call to iterator | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
27922822
| set.cpp:236:28:236:32 | call to begin | set.cpp:236:24:236:34 | call to iterator | TAINT |
2823+
| set.cpp:236:37:236:42 | call to source | set.cpp:236:7:236:9 | ref arg s22 | TAINT |
2824+
| set.cpp:236:37:236:42 | call to source | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
27932825
| set.cpp:237:7:237:9 | s22 | set.cpp:237:7:237:9 | call to unordered_set | |
27942826
| smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p | |
27952827
| smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -117,12 +117,12 @@ void test_set()
117117
std::set<char *> s21, s22;
118118
sink(s21.emplace("abc").first);
119119
sink(s21);
120-
sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
121-
sink(s21); // tainted [NOT DETECTED]
120+
sink(s21.emplace(source()).first); // tainted
121+
sink(s21); // tainted
122122
sink(s22.emplace_hint(s22.begin(), "abc"));
123123
sink(s22);
124-
sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
125-
sink(s22); // tainted [NOT DETECTED]
124+
sink(s22.emplace_hint(s22.begin(), source())); // tainted
125+
sink(s22); // tainted
126126
}
127127

128128
void test_unordered_set()
@@ -229,10 +229,10 @@ void test_unordered_set()
229229
std::unordered_set<char *> s21, s22;
230230
sink(s21.emplace("abc").first);
231231
sink(s21);
232-
sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
233-
sink(s21); // tainted [NOT DETECTED]
232+
sink(s21.emplace(source()).first); // tainted
233+
sink(s21); // tainted
234234
sink(s22.emplace_hint(s22.begin(), "abc"));
235235
sink(s22);
236-
sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
237-
sink(s22); // tainted [NOT DETECTED]
236+
sink(s22.emplace_hint(s22.begin(), source())); // tainted
237+
sink(s22); // tainted
238238
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,9 @@
179179
| set.cpp:112:7:112:9 | call to set | set.cpp:109:13:109:18 | call to source |
180180
| set.cpp:114:7:114:9 | call to set | set.cpp:108:13:108:18 | call to source |
181181
| set.cpp:114:7:114:9 | call to set | set.cpp:109:13:109:18 | call to source |
182+
| set.cpp:121:7:121:9 | call to set | set.cpp:120:19:120:24 | call to source |
183+
| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
184+
| set.cpp:125:7:125:9 | call to set | set.cpp:124:37:124:42 | call to source |
182185
| set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
183186
| set.cpp:140:7:140:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
184187
| set.cpp:142:7:142:8 | call to unordered_set | set.cpp:136:29:136:34 | call to source |
@@ -214,6 +217,9 @@
214217
| set.cpp:224:7:224:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
215218
| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
216219
| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
220+
| set.cpp:233:7:233:9 | call to unordered_set | set.cpp:232:19:232:24 | call to source |
221+
| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
222+
| set.cpp:237:7:237:9 | call to unordered_set | set.cpp:236:37:236:42 | call to source |
217223
| smart_pointer.cpp:12:10:12:10 | call to operator* | smart_pointer.cpp:11:52:11:57 | call to source |
218224
| smart_pointer.cpp:13:10:13:10 | p | smart_pointer.cpp:11:52:11:57 | call to source |
219225
| smart_pointer.cpp:24:10:24:10 | call to operator* | smart_pointer.cpp:23:52:23:57 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,9 @@
134134
| set.cpp:112:7:112:9 | set.cpp:109:13:109:18 | AST only |
135135
| set.cpp:114:7:114:9 | set.cpp:108:13:108:18 | AST only |
136136
| set.cpp:114:7:114:9 | set.cpp:109:13:109:18 | AST only |
137+
| set.cpp:120:7:120:33 | set.cpp:120:19:120:24 | IR only |
138+
| set.cpp:121:7:121:9 | set.cpp:120:19:120:24 | AST only |
139+
| set.cpp:125:7:125:9 | set.cpp:124:37:124:42 | AST only |
137140
| set.cpp:134:7:134:31 | set.cpp:134:17:134:22 | IR only |
138141
| set.cpp:140:7:140:8 | set.cpp:134:17:134:22 | AST only |
139142
| set.cpp:142:7:142:8 | set.cpp:136:29:136:34 | AST only |
@@ -164,6 +167,9 @@
164167
| set.cpp:224:7:224:9 | set.cpp:221:13:221:18 | AST only |
165168
| set.cpp:226:7:226:9 | set.cpp:220:13:220:18 | AST only |
166169
| set.cpp:226:7:226:9 | set.cpp:221:13:221:18 | AST only |
170+
| set.cpp:232:7:232:33 | set.cpp:232:19:232:24 | IR only |
171+
| set.cpp:233:7:233:9 | set.cpp:232:19:232:24 | AST only |
172+
| set.cpp:237:7:237:9 | set.cpp:236:37:236:42 | AST only |
167173
| smart_pointer.cpp:12:10:12:10 | smart_pointer.cpp:11:52:11:57 | AST only |
168174
| smart_pointer.cpp:24:10:24:10 | smart_pointer.cpp:23:52:23:57 | AST only |
169175
| standalone_iterators.cpp:41:10:41:10 | standalone_iterators.cpp:39:45:39:51 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@
127127
| set.cpp:72:7:72:33 | call to iterator | set.cpp:67:13:67:18 | call to source |
128128
| set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
129129
| set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
130+
| set.cpp:120:7:120:33 | call to iterator | set.cpp:120:19:120:24 | call to source |
131+
| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
130132
| set.cpp:134:7:134:31 | call to iterator | set.cpp:134:17:134:22 | call to source |
131133
| set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
132134
| set.cpp:146:10:146:13 | call to find | set.cpp:134:17:134:22 | call to source |
@@ -140,6 +142,8 @@
140142
| set.cpp:184:7:184:33 | call to iterator | set.cpp:181:13:181:18 | call to source |
141143
| set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
142144
| set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
145+
| set.cpp:232:7:232:33 | call to iterator | set.cpp:232:19:232:24 | call to source |
146+
| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
143147
| smart_pointer.cpp:13:10:13:10 | Argument 0 indirection | smart_pointer.cpp:11:52:11:57 | call to source |
144148
| smart_pointer.cpp:25:10:25:10 | Argument 0 indirection | smart_pointer.cpp:23:52:23:57 | call to source |
145149
| smart_pointer.cpp:52:12:52:14 | call to get | smart_pointer.cpp:51:52:51:57 | call to source |

0 commit comments

Comments
 (0)