Skip to content

Commit 94664f1

Browse files
michaelnebelmichaelnebel
committed
C#/Java/Ruby: Sync files.
1 parent eed02a2 commit 94664f1

File tree

6 files changed

+60
-44
lines changed

6 files changed

+60
-44
lines changed

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ private module Cached {
112112
or
113113
// Simple flow through library code is included in the exposed local
114114
// step relation, even though flow is technically inter-procedural
115-
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(node1, node2)
115+
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(node1, node2, _)
116116
}
117117

118118
/**
@@ -154,7 +154,7 @@ private predicate simpleLocalFlowStep0(Node node1, Node node2) {
154154
not exists(FieldRead fr |
155155
hasNonlocalValue(fr) and fr.getField().isStatic() and fr = node1.asExpr()
156156
) and
157-
not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(node1)
157+
not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(node1, _)
158158
or
159159
ThisFlow::adjacentThisRefs(node1, node2)
160160
or

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -759,8 +759,8 @@ module Private {
759759
}
760760

761761
pragma[nomagic]
762-
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg) {
763-
exists(ParameterPosition ppos, SummarizedCallable sc |
762+
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
763+
exists(ParameterPosition ppos |
764764
argumentPositionMatch(call, arg, ppos) and
765765
viableParam(call, sc, ppos, result)
766766
)
@@ -774,9 +774,9 @@ module Private {
774774
* or expects contents.
775775
*/
776776
pragma[nomagic]
777-
predicate prohibitsUseUseFlow(ArgNode arg) {
777+
predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
778778
exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
779-
p = summaryArgParam0(_, arg) and
779+
p = summaryArgParam0(_, arg, sc) and
780780
p.isParameterOf(_, ppos) and
781781
summaryLocalStep(p, mid, true) and
782782
summaryLocalStep(mid, ret, true) and
@@ -788,9 +788,11 @@ module Private {
788788
}
789789

790790
bindingset[ret]
791-
private ParamNode summaryArgParam(ArgNode arg, ReturnNodeExt ret, OutNodeExt out) {
791+
private ParamNode summaryArgParam(
792+
ArgNode arg, ReturnNodeExt ret, OutNodeExt out, SummarizedCallable sc
793+
) {
792794
exists(DataFlowCall call, ReturnKindExt rk |
793-
result = summaryArgParam0(call, arg) and
795+
result = summaryArgParam0(call, arg, sc) and
794796
ret.getKind() = pragma[only_bind_into](rk) and
795797
out = pragma[only_bind_into](rk).getAnOutNode(call)
796798
)
@@ -803,9 +805,9 @@ module Private {
803805
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
804806
* be useful to include in the exposed local data-flow/taint-tracking relations.
805807
*/
806-
predicate summaryThroughStepValue(ArgNode arg, Node out) {
808+
predicate summaryThroughStepValue(ArgNode arg, Node out, SummarizedCallable sc) {
807809
exists(ReturnKind rk, ReturnNode ret, DataFlowCall call |
808-
summaryLocalStep(summaryArgParam0(call, arg), ret, true) and
810+
summaryLocalStep(summaryArgParam0(call, arg, sc), ret, true) and
809811
ret.getKind() = pragma[only_bind_into](rk) and
810812
out = getAnOutNode(call, pragma[only_bind_into](rk))
811813
)
@@ -818,8 +820,8 @@ module Private {
818820
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
819821
* be useful to include in the exposed local data-flow/taint-tracking relations.
820822
*/
821-
predicate summaryThroughStepTaint(ArgNode arg, Node out) {
822-
exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out), ret, false))
823+
predicate summaryThroughStepTaint(ArgNode arg, Node out, SummarizedCallable sc) {
824+
exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out, sc), ret, false))
823825
}
824826

825827
/**
@@ -829,9 +831,9 @@ module Private {
829831
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
830832
* be useful to include in the exposed local data-flow/taint-tracking relations.
831833
*/
832-
predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out) {
834+
predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
833835
exists(Node mid, ReturnNodeExt ret |
834-
summaryReadStep(summaryArgParam(arg, ret, out), c, mid) and
836+
summaryReadStep(summaryArgParam(arg, ret, out, sc), c, mid) and
835837
summaryLocalStep(mid, ret, _)
836838
)
837839
}
@@ -843,9 +845,9 @@ module Private {
843845
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
844846
* be useful to include in the exposed local data-flow/taint-tracking relations.
845847
*/
846-
predicate summarySetterStep(ArgNode arg, ContentSet c, Node out) {
848+
predicate summarySetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
847849
exists(Node mid, ReturnNodeExt ret |
848-
summaryLocalStep(summaryArgParam(arg, ret, out), mid, _) and
850+
summaryLocalStep(summaryArgParam(arg, ret, out, sc), mid, _) and
849851
summaryStoreStep(mid, c, ret)
850852
)
851853
}
@@ -929,14 +931,20 @@ module Private {
929931
private class SummarizedCallableExternal extends SummarizedCallable {
930932
SummarizedCallableExternal() { summaryElement(this, _, _, _, _) }
931933

932-
private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
933-
summaryElement(this, inSpec, outSpec, kind, false)
934-
or
934+
private predicate relevantSummaryElementGenerated(
935+
AccessPath inSpec, AccessPath outSpec, string kind
936+
) {
935937
summaryElement(this, inSpec, outSpec, kind, true) and
936938
not summaryElement(this, _, _, _, false) and
937939
not this.clearsContent(_, _)
938940
}
939941

942+
private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
943+
summaryElement(this, inSpec, outSpec, kind, false)
944+
or
945+
this.relevantSummaryElementGenerated(inSpec, outSpec, kind)
946+
}
947+
940948
override predicate propagatesFlow(
941949
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
942950
) {
@@ -951,7 +959,7 @@ module Private {
951959
)
952960
}
953961

954-
override predicate isAutoGenerated() { summaryElement(this, _, _, _, true) }
962+
override predicate isAutoGenerated() { this.relevantSummaryElementGenerated(_, _, _) }
955963
}
956964

957965
/** Holds if component `c` of specification `spec` cannot be parsed. */

‎java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,14 +51,14 @@ private module Cached {
5151
or
5252
// Simple flow through library code is included in the exposed local
5353
// step relation, even though flow is technically inter-procedural
54-
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(src, sink)
54+
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(src, sink, _)
5555
or
5656
// Treat container flow as taint for the local taint flow relation
5757
exists(DataFlow::Content c | containerContent(c) |
5858
readStep(src, c, sink) or
5959
storeStep(src, c, sink) or
60-
FlowSummaryImpl::Private::Steps::summaryGetterStep(src, c, sink) or
61-
FlowSummaryImpl::Private::Steps::summarySetterStep(src, c, sink)
60+
FlowSummaryImpl::Private::Steps::summaryGetterStep(src, c, sink, _) or
61+
FlowSummaryImpl::Private::Steps::summarySetterStep(src, c, sink, _)
6262
)
6363
}
6464

‎ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ private module Cached {
254254
nodeTo.(SynthReturnNode).getAnInput() = nodeFrom
255255
or
256256
LocalFlow::localSsaFlowStepUseUse(_, nodeFrom, nodeTo) and
257-
not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom)
257+
not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _)
258258
or
259259
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
260260
}
@@ -272,7 +272,7 @@ private module Cached {
272272
or
273273
// Simple flow through library code is included in the exposed local
274274
// step relation, even though flow is technically inter-procedural
275-
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(nodeFrom, nodeTo)
275+
FlowSummaryImpl::Private::Steps::summaryThroughStepValue(nodeFrom, nodeTo, _)
276276
}
277277

278278
/** This is the local flow predicate that is used in type tracking. */

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -759,8 +759,8 @@ module Private {
759759
}
760760

761761
pragma[nomagic]
762-
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg) {
763-
exists(ParameterPosition ppos, SummarizedCallable sc |
762+
private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
763+
exists(ParameterPosition ppos |
764764
argumentPositionMatch(call, arg, ppos) and
765765
viableParam(call, sc, ppos, result)
766766
)
@@ -774,9 +774,9 @@ module Private {
774774
* or expects contents.
775775
*/
776776
pragma[nomagic]
777-
predicate prohibitsUseUseFlow(ArgNode arg) {
777+
predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
778778
exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
779-
p = summaryArgParam0(_, arg) and
779+
p = summaryArgParam0(_, arg, sc) and
780780
p.isParameterOf(_, ppos) and
781781
summaryLocalStep(p, mid, true) and
782782
summaryLocalStep(mid, ret, true) and
@@ -788,9 +788,11 @@ module Private {
788788
}
789789

790790
bindingset[ret]
791-
private ParamNode summaryArgParam(ArgNode arg, ReturnNodeExt ret, OutNodeExt out) {
791+
private ParamNode summaryArgParam(
792+
ArgNode arg, ReturnNodeExt ret, OutNodeExt out, SummarizedCallable sc
793+
) {
792794
exists(DataFlowCall call, ReturnKindExt rk |
793-
result = summaryArgParam0(call, arg) and
795+
result = summaryArgParam0(call, arg, sc) and
794796
ret.getKind() = pragma[only_bind_into](rk) and
795797
out = pragma[only_bind_into](rk).getAnOutNode(call)
796798
)
@@ -803,9 +805,9 @@ module Private {
803805
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
804806
* be useful to include in the exposed local data-flow/taint-tracking relations.
805807
*/
806-
predicate summaryThroughStepValue(ArgNode arg, Node out) {
808+
predicate summaryThroughStepValue(ArgNode arg, Node out, SummarizedCallable sc) {
807809
exists(ReturnKind rk, ReturnNode ret, DataFlowCall call |
808-
summaryLocalStep(summaryArgParam0(call, arg), ret, true) and
810+
summaryLocalStep(summaryArgParam0(call, arg, sc), ret, true) and
809811
ret.getKind() = pragma[only_bind_into](rk) and
810812
out = getAnOutNode(call, pragma[only_bind_into](rk))
811813
)
@@ -818,8 +820,8 @@ module Private {
818820
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
819821
* be useful to include in the exposed local data-flow/taint-tracking relations.
820822
*/
821-
predicate summaryThroughStepTaint(ArgNode arg, Node out) {
822-
exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out), ret, false))
823+
predicate summaryThroughStepTaint(ArgNode arg, Node out, SummarizedCallable sc) {
824+
exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out, sc), ret, false))
823825
}
824826

825827
/**
@@ -829,9 +831,9 @@ module Private {
829831
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
830832
* be useful to include in the exposed local data-flow/taint-tracking relations.
831833
*/
832-
predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out) {
834+
predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
833835
exists(Node mid, ReturnNodeExt ret |
834-
summaryReadStep(summaryArgParam(arg, ret, out), c, mid) and
836+
summaryReadStep(summaryArgParam(arg, ret, out, sc), c, mid) and
835837
summaryLocalStep(mid, ret, _)
836838
)
837839
}
@@ -843,9 +845,9 @@ module Private {
843845
* NOTE: This step should not be used in global data-flow/taint-tracking, but may
844846
* be useful to include in the exposed local data-flow/taint-tracking relations.
845847
*/
846-
predicate summarySetterStep(ArgNode arg, ContentSet c, Node out) {
848+
predicate summarySetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
847849
exists(Node mid, ReturnNodeExt ret |
848-
summaryLocalStep(summaryArgParam(arg, ret, out), mid, _) and
850+
summaryLocalStep(summaryArgParam(arg, ret, out, sc), mid, _) and
849851
summaryStoreStep(mid, c, ret)
850852
)
851853
}
@@ -929,14 +931,20 @@ module Private {
929931
private class SummarizedCallableExternal extends SummarizedCallable {
930932
SummarizedCallableExternal() { summaryElement(this, _, _, _, _) }
931933

932-
private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
933-
summaryElement(this, inSpec, outSpec, kind, false)
934-
or
934+
private predicate relevantSummaryElementGenerated(
935+
AccessPath inSpec, AccessPath outSpec, string kind
936+
) {
935937
summaryElement(this, inSpec, outSpec, kind, true) and
936938
not summaryElement(this, _, _, _, false) and
937939
not this.clearsContent(_, _)
938940
}
939941

942+
private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
943+
summaryElement(this, inSpec, outSpec, kind, false)
944+
or
945+
this.relevantSummaryElementGenerated(inSpec, outSpec, kind)
946+
}
947+
940948
override predicate propagatesFlow(
941949
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
942950
) {
@@ -951,7 +959,7 @@ module Private {
951959
)
952960
}
953961

954-
override predicate isAutoGenerated() { summaryElement(this, _, _, _, true) }
962+
override predicate isAutoGenerated() { this.relevantSummaryElementGenerated(_, _, _) }
955963
}
956964

957965
/** Holds if component `c` of specification `spec` cannot be parsed. */

‎ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingPrivate.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ private module Cached {
122122
or
123123
// Simple flow through library code is included in the exposed local
124124
// step relation, even though flow is technically inter-procedural
125-
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(nodeFrom, nodeTo)
125+
FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(nodeFrom, nodeTo, _)
126126
}
127127
}
128128

0 commit comments

Comments
 (0)