@@ -4,26 +4,48 @@ class CustomFlowLabel extends DataFlow::FlowLabel {
44 CustomFlowLabel ( ) { this = "A" or this = "B" }
55}
66
7- class Config extends TaintTracking :: Configuration {
8- Config ( ) { this = "Config" }
7+ module TestConfig implements DataFlow :: StateConfigSig {
8+ class FlowState = DataFlow :: FlowLabel ;
99
10- override predicate isSource ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
10+ predicate isSource ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
1111 node .( DataFlow:: CallNode ) .getCalleeName ( ) = "source" and
1212 lbl instanceof CustomFlowLabel
1313 }
1414
15- override predicate isSink ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
15+ predicate isSink ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
1616 exists ( DataFlow:: CallNode call |
1717 call .getCalleeName ( ) = "sink" and
1818 node = call .getAnArgument ( ) and
1919 lbl instanceof CustomFlowLabel
2020 )
2121 }
2222
23- override predicate isSanitizerGuard ( TaintTracking :: SanitizerGuardNode node ) {
23+ additional predicate isBarrierGuard ( DataFlow :: BarrierGuardNode node ) {
2424 node instanceof IsTypeAGuard or
2525 node instanceof IsSanitizedGuard
2626 }
27+
28+ predicate isBarrier ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
29+ node = DataFlow:: MakeLegacyBarrierGuardLabeled< isBarrierGuard / 1 > :: getABarrierNode ( lbl )
30+ }
31+ }
32+
33+ module TestFlow = TaintTracking:: GlobalWithState< TestConfig > ;
34+
35+ class LegacyConfig extends TaintTracking:: Configuration {
36+ LegacyConfig ( ) { this = "LegacyConfig" }
37+
38+ override predicate isSource ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
39+ TestConfig:: isSource ( node , lbl )
40+ }
41+
42+ override predicate isSink ( DataFlow:: Node node , DataFlow:: FlowLabel lbl ) {
43+ TestConfig:: isSink ( node , lbl )
44+ }
45+
46+ override predicate isSanitizerGuard ( TaintTracking:: SanitizerGuardNode node ) {
47+ TestConfig:: isBarrierGuard ( node )
48+ }
2749}
2850
2951/**
@@ -34,6 +56,10 @@ class IsTypeAGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlow::C
3456 IsTypeAGuard ( ) { this .getCalleeName ( ) = "isTypeA" }
3557
3658 override predicate sanitizes ( boolean outcome , Expr e , DataFlow:: FlowLabel lbl ) {
59+ this .blocksExpr ( outcome , e , lbl )
60+ }
61+
62+ predicate blocksExpr ( boolean outcome , Expr e , DataFlow:: FlowLabel lbl ) {
3763 e = this .getArgument ( 0 ) .asExpr ( ) and
3864 (
3965 outcome = true and lbl = "B"
@@ -47,6 +73,10 @@ class IsSanitizedGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlo
4773 IsSanitizedGuard ( ) { this .getCalleeName ( ) = "sanitizeA" or this .getCalleeName ( ) = "sanitizeB" }
4874
4975 override predicate sanitizes ( boolean outcome , Expr e , DataFlow:: FlowLabel lbl ) {
76+ this .blocksExpr ( outcome , e , lbl )
77+ }
78+
79+ predicate blocksExpr ( boolean outcome , Expr e , DataFlow:: FlowLabel lbl ) {
5080 e = this .getArgument ( 0 ) .asExpr ( ) and
5181 outcome = true and
5282 (
@@ -57,6 +87,8 @@ class IsSanitizedGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlo
5787 }
5888}
5989
60- from Config cfg , DataFlow:: Node source , DataFlow:: Node sink
61- where cfg .hasFlow ( source , sink )
90+ import testUtilities.LegacyDataFlowDiff:: DataFlowDiff< TestFlow , LegacyConfig >
91+
92+ from DataFlow:: Node source , DataFlow:: Node sink
93+ where TestFlow:: flow ( source , sink )
6294select source , sink
0 commit comments