Skip to content

Commit 4d58154

Browse files
hvitvedhvitved
committed
C#: Fix data flow for out/ref parameters
1 parent 04db1bf commit 4d58154

File tree

7 files changed

+2
-77
lines changed

7 files changed

+2
-77
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,8 @@ private module ReturnNodes {
738738

739739
OutRefReturnNode() {
740740
exists(Parameter p |
741-
this.getDefinition().(Ssa::ExplicitDefinition).isLiveOutRefParameterDefinition(p)
741+
this.getDefinition().(Ssa::ExplicitDefinition).isLiveOutRefParameterDefinition(p) and
742+
kind.getPosition() = p.getPosition()
742743
|
743744
p.isOut() and kind instanceof OutReturnKind
744745
or

‎csharp/ql/test/library-tests/dataflow/global/DataFlow.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@
1717
| GlobalDataFlow.cs:73:15:73:19 | access to local variable sink1 |
1818
| GlobalDataFlow.cs:76:15:76:19 | access to local variable sink2 |
1919
| GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 |
20-
| GlobalDataFlow.cs:107:15:107:22 | access to local variable nonSink0 |
21-
| GlobalDataFlow.cs:109:15:109:22 | access to local variable nonSink0 |
22-
| GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 |
2320
| GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 |
2421
| GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 |
2522
| GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1291,8 +1291,6 @@
12911291
| GlobalDataFlow.cs:78:30:78:34 | access to local variable sink3 | GlobalDataFlow.cs:78:30:78:34 | access to local variable sink3 |
12921292
| GlobalDataFlow.cs:78:30:78:34 | access to local variable sink3 | GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 |
12931293
| GlobalDataFlow.cs:78:30:78:34 | access to local variable sink3 | GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 |
1294-
| GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) |
1295-
| GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) |
12961294
| GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 | GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 |
12971295
| GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 | GlobalDataFlow.cs:287:50:287:50 | z |
12981296
| GlobalDataFlow.cs:78:41:78:45 | access to local variable sink3 | GlobalDataFlow.cs:287:50:287:50 | z |
@@ -1690,8 +1688,6 @@
16901688
| GlobalDataFlow.cs:105:15:105:22 | access to local variable nonSink0 | GlobalDataFlow.cs:105:15:105:22 | access to local variable nonSink0 |
16911689
| GlobalDataFlow.cs:106:9:106:49 | call to method ReturnOut | GlobalDataFlow.cs:106:9:106:49 | call to method ReturnOut |
16921690
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 |
1693-
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
1694-
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
16951691
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:110:19:110:23 | access to local variable sink1 |
16961692
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:110:19:110:23 | access to local variable sink1 |
16971693
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:110:30:110:34 | access to local variable sink1 |
@@ -1731,8 +1727,6 @@
17311727
| GlobalDataFlow.cs:108:27:108:34 | access to local variable nonSink0 | GlobalDataFlow.cs:108:27:108:34 | access to local variable nonSink0 |
17321728
| GlobalDataFlow.cs:108:27:108:34 | access to local variable nonSink0 | GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 |
17331729
| GlobalDataFlow.cs:108:27:108:34 | access to local variable nonSink0 | GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 |
1734-
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) |
1735-
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) |
17361730
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 |
17371731
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:287:50:287:50 | z |
17381732
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:287:50:287:50 | z |
@@ -1758,8 +1752,6 @@
17581752
| GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) | GlobalDataFlow.cs:124:39:124:43 | access to local variable sink1 |
17591753
| GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) | GlobalDataFlow.cs:124:39:124:43 | access to local variable sink1 |
17601754
| GlobalDataFlow.cs:110:30:110:34 | access to local variable sink1 | GlobalDataFlow.cs:110:30:110:34 | access to local variable sink1 |
1761-
| GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 | GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) |
1762-
| GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 | GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) |
17631755
| GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 | GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 |
17641756
| GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 | GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 |
17651757
| GlobalDataFlow.cs:110:41:110:48 | access to local variable nonSink0 | GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 |
@@ -3108,19 +3100,13 @@
31083100
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:75:30:75:34 | SSA def(sink2) |
31093101
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:104:27:104:34 | SSA def(nonSink0) |
31103102
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:104:27:104:34 | SSA def(nonSink0) |
3111-
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
3112-
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
31133103
| GlobalDataFlow.cs:283:9:283:13 | SSA def(y) | GlobalDataFlow.cs:283:9:283:13 | SSA def(y) |
31143104
| GlobalDataFlow.cs:283:13:283:13 | access to parameter x | GlobalDataFlow.cs:283:9:283:13 | SSA def(y) |
31153105
| GlobalDataFlow.cs:283:13:283:13 | access to parameter x | GlobalDataFlow.cs:283:9:283:13 | SSA def(y) |
31163106
| GlobalDataFlow.cs:283:13:283:13 | access to parameter x | GlobalDataFlow.cs:283:9:283:13 | SSA def(y) |
31173107
| GlobalDataFlow.cs:283:13:283:13 | access to parameter x | GlobalDataFlow.cs:283:9:283:13 | SSA def(y) |
31183108
| GlobalDataFlow.cs:283:13:283:13 | access to parameter x | GlobalDataFlow.cs:283:13:283:13 | access to parameter x |
31193109
| GlobalDataFlow.cs:284:9:284:22 | ... = ... | GlobalDataFlow.cs:284:9:284:22 | ... = ... |
3120-
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:75:30:75:34 | SSA def(sink2) |
3121-
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:75:30:75:34 | SSA def(sink2) |
3122-
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:104:27:104:34 | SSA def(nonSink0) |
3123-
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:104:27:104:34 | SSA def(nonSink0) |
31243110
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
31253111
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
31263112
| GlobalDataFlow.cs:284:9:284:22 | SSA def(z) | GlobalDataFlow.cs:284:9:284:22 | SSA def(z) |
@@ -3137,12 +3123,6 @@
31373123
| GlobalDataFlow.cs:287:32:287:32 | x | GlobalDataFlow.cs:289:13:289:13 | access to parameter x |
31383124
| GlobalDataFlow.cs:287:32:287:32 | x | GlobalDataFlow.cs:289:13:289:13 | access to parameter x |
31393125
| GlobalDataFlow.cs:287:32:287:32 | x | GlobalDataFlow.cs:289:13:289:13 | access to parameter x |
3140-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) |
3141-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) |
3142-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) |
3143-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) |
3144-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) |
3145-
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:110:30:110:34 | SSA def(sink1) |
31463126
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:287:50:287:50 | z |
31473127
| GlobalDataFlow.cs:287:50:287:50 | z | GlobalDataFlow.cs:287:50:287:50 | z |
31483128
| GlobalDataFlow.cs:289:9:289:13 | ... = ... | GlobalDataFlow.cs:289:9:289:13 | ... = ... |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,6 @@ edges
122122
| GlobalDataFlow.cs:70:28:70:45 | access to property SinkProperty0 | GlobalDataFlow.cs:70:21:70:46 | call to method Return |
123123
| GlobalDataFlow.cs:72:21:72:101 | (...) ... | GlobalDataFlow.cs:73:15:73:19 | access to local variable sink1 |
124124
| GlobalDataFlow.cs:72:21:72:101 | (...) ... | GlobalDataFlow.cs:75:19:75:23 | access to local variable sink1 |
125-
| GlobalDataFlow.cs:72:21:72:101 | (...) ... | GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 |
126125
| GlobalDataFlow.cs:72:29:72:101 | call to method Invoke | GlobalDataFlow.cs:72:21:72:101 | (...) ... |
127126
| GlobalDataFlow.cs:72:94:72:98 | access to local variable sink0 | GlobalDataFlow.cs:72:29:72:101 | call to method Invoke |
128127
| GlobalDataFlow.cs:75:19:75:23 | access to local variable sink1 | GlobalDataFlow.cs:75:30:75:34 | SSA def(sink2) |
@@ -131,12 +130,6 @@ edges
131130
| GlobalDataFlow.cs:78:19:78:23 | access to local variable sink2 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) |
132131
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) | GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 |
133132
| GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) | GlobalDataFlow.cs:135:29:135:33 | access to local variable sink3 |
134-
| GlobalDataFlow.cs:106:19:106:23 | access to local variable sink1 | GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) |
135-
| GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) | GlobalDataFlow.cs:107:15:107:22 | access to local variable nonSink0 |
136-
| GlobalDataFlow.cs:106:41:106:48 | SSA def(nonSink0) | GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 |
137-
| GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) | GlobalDataFlow.cs:109:15:109:22 | access to local variable nonSink0 |
138-
| GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) | GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 |
139-
| GlobalDataFlow.cs:108:41:108:48 | access to local variable nonSink0 | GlobalDataFlow.cs:108:27:108:34 | SSA def(nonSink0) |
140133
| GlobalDataFlow.cs:135:21:135:34 | delegate call | GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 |
141134
| GlobalDataFlow.cs:135:21:135:34 | delegate call | GlobalDataFlow.cs:143:39:143:43 | access to local variable sink4 |
142135
| GlobalDataFlow.cs:135:29:135:33 | access to local variable sink3 | GlobalDataFlow.cs:135:21:135:34 | delegate call |
@@ -205,9 +198,6 @@ edges
205198
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x |
206199
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x |
207200
| GlobalDataFlow.cs:18:15:18:29 | access to field SinkField0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:18:15:18:29 | access to field SinkField0 | access to field SinkField0 |
208-
| GlobalDataFlow.cs:107:15:107:22 | access to local variable nonSink0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:107:15:107:22 | access to local variable nonSink0 | access to local variable nonSink0 |
209-
| GlobalDataFlow.cs:109:15:109:22 | access to local variable nonSink0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:109:15:109:22 | access to local variable nonSink0 | access to local variable nonSink0 |
210-
| GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 | access to local variable nonSink0 |
211201
| GlobalDataFlow.cs:71:15:71:19 | access to local variable sink0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:71:15:71:19 | access to local variable sink0 | access to local variable sink0 |
212202
| GlobalDataFlow.cs:73:15:73:19 | access to local variable sink1 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:73:15:73:19 | access to local variable sink1 | access to local variable sink1 |
213203
| GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 | GlobalDataFlow.cs:318:16:318:29 | "taint source" | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 | access to local variable sink10 |

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,6 @@
2525
| GlobalDataFlow.cs:91:15:91:20 | access to local variable sink18 |
2626
| GlobalDataFlow.cs:94:15:94:20 | access to local variable sink21 |
2727
| GlobalDataFlow.cs:97:15:97:20 | access to local variable sink22 |
28-
| GlobalDataFlow.cs:107:15:107:22 | access to local variable nonSink0 |
29-
| GlobalDataFlow.cs:109:15:109:22 | access to local variable nonSink0 |
30-
| GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 |
31-
| GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
32-
| GlobalDataFlow.cs:115:15:115:22 | access to local variable nonSink1 |
3328
| GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 |
3429
| GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 |
3530
| GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |

0 commit comments

Comments
 (0)