Skip to content

Commit a42d9b1

Browse files
yh-semmleyh-semmle
authored
Merge pull request #1616 from aschackmull/java/dataflow-prunetype-bugfix
Java: Bugfix for flow through methods with taint step and upcast.
2 parents 05cad96 + cd8d161 commit a42d9b1

File tree

18 files changed

+292
-225
lines changed

18 files changed

+292
-225
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -851,8 +851,6 @@ private class AccessPathFrontNilNode extends Node {
851851
localFlowBigStep(_, this, false, _)
852852
or
853853
additionalJumpStep(_, this, _)
854-
or
855-
simpleArgumentFlowsThrough(_, this, _, _)
856854
)
857855
}
858856

@@ -914,10 +912,10 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
914912
argumentValueFlowsThrough(mid, node, _)
915913
)
916914
or
917-
exists(Node mid, AccessPathFrontNil nil |
915+
exists(Node mid, AccessPathFrontNil nil, DataFlowType t |
918916
flowCandFwd(mid, fromArg, nil, config) and
919-
simpleArgumentFlowsThrough(mid, node, _, config) and
920-
apf = node.(AccessPathFrontNilNode).getApf()
917+
simpleArgumentFlowsThrough(mid, node, t, config) and
918+
apf = TFrontNil(t)
921919
)
922920
)
923921
or
@@ -1187,10 +1185,10 @@ private predicate flowFwd0(
11871185
argumentValueFlowsThrough(mid, node, _)
11881186
)
11891187
or
1190-
exists(Node mid, AccessPathNil nil |
1188+
exists(Node mid, AccessPathNil nil, DataFlowType t |
11911189
flowFwd(mid, fromArg, _, nil, config) and
1192-
simpleArgumentFlowsThrough(mid, node, _, config) and
1193-
ap = node.(AccessPathNilNode).getAp() and
1190+
simpleArgumentFlowsThrough(mid, node, t, config) and
1191+
ap = TNil(t) and
11941192
apf = ap.(AccessPathNil).getFront()
11951193
)
11961194
)
@@ -1539,7 +1537,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
15391537
or
15401538
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
15411539
or
1542-
pathThroughCallable(mid, node, cc) and ap = node.(AccessPathNilNode).getAp()
1540+
pathThroughCallable(mid, node, cc, ap)
15431541
or
15441542
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
15451543
}
@@ -1670,14 +1668,14 @@ private predicate pathIntoCallable(
16701668
/** Holds if data may flow from `p` to a return of kind `kind`. */
16711669
pragma[nomagic]
16721670
private predicate paramFlowsThrough(
1673-
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
1671+
ParameterNode p, ReturnKind kind, CallContextCall cc, AccessPathNil apnil, Configuration config
16741672
) {
16751673
exists(PathNodeMid mid, ReturnNode ret |
16761674
mid.getNode() = ret and
16771675
kind = ret.getKind() and
16781676
cc = mid.getCallContext() and
16791677
config = mid.getConfiguration() and
1680-
mid.getAp() instanceof AccessPathNil
1678+
apnil = mid.getAp()
16811679
|
16821680
cc = TSomeCall(p, true)
16831681
or
@@ -1689,11 +1687,11 @@ private predicate paramFlowsThrough(
16891687

16901688
pragma[noinline]
16911689
private predicate pathThroughCallable0(
1692-
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
1690+
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc, AccessPathNil apnil
16931691
) {
16941692
exists(ParameterNode p, CallContext innercc |
16951693
pathIntoCallable(mid, p, cc, innercc, call) and
1696-
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
1694+
paramFlowsThrough(p, kind, innercc, apnil, unbind(mid.getConfiguration())) and
16971695
not parameterValueFlowsThrough(p, kind, innercc) and
16981696
mid.getAp() instanceof AccessPathNil
16991697
)
@@ -1704,9 +1702,11 @@ private predicate pathThroughCallable0(
17041702
* The context `cc` is restored to its value prior to entering the callable.
17051703
*/
17061704
pragma[noinline]
1707-
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
1705+
private predicate pathThroughCallable(
1706+
PathNodeMid mid, OutNode out, CallContext cc, AccessPathNil apnil
1707+
) {
17081708
exists(DataFlowCall call, ReturnKind kind |
1709-
pathThroughCallable0(call, mid, kind, cc) and
1709+
pathThroughCallable0(call, mid, kind, cc, apnil) and
17101710
out = getAnOutNode(call, kind)
17111711
)
17121712
}

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -851,8 +851,6 @@ private class AccessPathFrontNilNode extends Node {
851851
localFlowBigStep(_, this, false, _)
852852
or
853853
additionalJumpStep(_, this, _)
854-
or
855-
simpleArgumentFlowsThrough(_, this, _, _)
856854
)
857855
}
858856

@@ -914,10 +912,10 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
914912
argumentValueFlowsThrough(mid, node, _)
915913
)
916914
or
917-
exists(Node mid, AccessPathFrontNil nil |
915+
exists(Node mid, AccessPathFrontNil nil, DataFlowType t |
918916
flowCandFwd(mid, fromArg, nil, config) and
919-
simpleArgumentFlowsThrough(mid, node, _, config) and
920-
apf = node.(AccessPathFrontNilNode).getApf()
917+
simpleArgumentFlowsThrough(mid, node, t, config) and
918+
apf = TFrontNil(t)
921919
)
922920
)
923921
or
@@ -1187,10 +1185,10 @@ private predicate flowFwd0(
11871185
argumentValueFlowsThrough(mid, node, _)
11881186
)
11891187
or
1190-
exists(Node mid, AccessPathNil nil |
1188+
exists(Node mid, AccessPathNil nil, DataFlowType t |
11911189
flowFwd(mid, fromArg, _, nil, config) and
1192-
simpleArgumentFlowsThrough(mid, node, _, config) and
1193-
ap = node.(AccessPathNilNode).getAp() and
1190+
simpleArgumentFlowsThrough(mid, node, t, config) and
1191+
ap = TNil(t) and
11941192
apf = ap.(AccessPathNil).getFront()
11951193
)
11961194
)
@@ -1539,7 +1537,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
15391537
or
15401538
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
15411539
or
1542-
pathThroughCallable(mid, node, cc) and ap = node.(AccessPathNilNode).getAp()
1540+
pathThroughCallable(mid, node, cc, ap)
15431541
or
15441542
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
15451543
}
@@ -1670,14 +1668,14 @@ private predicate pathIntoCallable(
16701668
/** Holds if data may flow from `p` to a return of kind `kind`. */
16711669
pragma[nomagic]
16721670
private predicate paramFlowsThrough(
1673-
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
1671+
ParameterNode p, ReturnKind kind, CallContextCall cc, AccessPathNil apnil, Configuration config
16741672
) {
16751673
exists(PathNodeMid mid, ReturnNode ret |
16761674
mid.getNode() = ret and
16771675
kind = ret.getKind() and
16781676
cc = mid.getCallContext() and
16791677
config = mid.getConfiguration() and
1680-
mid.getAp() instanceof AccessPathNil
1678+
apnil = mid.getAp()
16811679
|
16821680
cc = TSomeCall(p, true)
16831681
or
@@ -1689,11 +1687,11 @@ private predicate paramFlowsThrough(
16891687

16901688
pragma[noinline]
16911689
private predicate pathThroughCallable0(
1692-
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
1690+
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc, AccessPathNil apnil
16931691
) {
16941692
exists(ParameterNode p, CallContext innercc |
16951693
pathIntoCallable(mid, p, cc, innercc, call) and
1696-
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
1694+
paramFlowsThrough(p, kind, innercc, apnil, unbind(mid.getConfiguration())) and
16971695
not parameterValueFlowsThrough(p, kind, innercc) and
16981696
mid.getAp() instanceof AccessPathNil
16991697
)
@@ -1704,9 +1702,11 @@ private predicate pathThroughCallable0(
17041702
* The context `cc` is restored to its value prior to entering the callable.
17051703
*/
17061704
pragma[noinline]
1707-
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
1705+
private predicate pathThroughCallable(
1706+
PathNodeMid mid, OutNode out, CallContext cc, AccessPathNil apnil
1707+
) {
17081708
exists(DataFlowCall call, ReturnKind kind |
1709-
pathThroughCallable0(call, mid, kind, cc) and
1709+
pathThroughCallable0(call, mid, kind, cc, apnil) and
17101710
out = getAnOutNode(call, kind)
17111711
)
17121712
}

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -851,8 +851,6 @@ private class AccessPathFrontNilNode extends Node {
851851
localFlowBigStep(_, this, false, _)
852852
or
853853
additionalJumpStep(_, this, _)
854-
or
855-
simpleArgumentFlowsThrough(_, this, _, _)
856854
)
857855
}
858856

@@ -914,10 +912,10 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
914912
argumentValueFlowsThrough(mid, node, _)
915913
)
916914
or
917-
exists(Node mid, AccessPathFrontNil nil |
915+
exists(Node mid, AccessPathFrontNil nil, DataFlowType t |
918916
flowCandFwd(mid, fromArg, nil, config) and
919-
simpleArgumentFlowsThrough(mid, node, _, config) and
920-
apf = node.(AccessPathFrontNilNode).getApf()
917+
simpleArgumentFlowsThrough(mid, node, t, config) and
918+
apf = TFrontNil(t)
921919
)
922920
)
923921
or
@@ -1187,10 +1185,10 @@ private predicate flowFwd0(
11871185
argumentValueFlowsThrough(mid, node, _)
11881186
)
11891187
or
1190-
exists(Node mid, AccessPathNil nil |
1188+
exists(Node mid, AccessPathNil nil, DataFlowType t |
11911189
flowFwd(mid, fromArg, _, nil, config) and
1192-
simpleArgumentFlowsThrough(mid, node, _, config) and
1193-
ap = node.(AccessPathNilNode).getAp() and
1190+
simpleArgumentFlowsThrough(mid, node, t, config) and
1191+
ap = TNil(t) and
11941192
apf = ap.(AccessPathNil).getFront()
11951193
)
11961194
)
@@ -1539,7 +1537,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
15391537
or
15401538
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
15411539
or
1542-
pathThroughCallable(mid, node, cc) and ap = node.(AccessPathNilNode).getAp()
1540+
pathThroughCallable(mid, node, cc, ap)
15431541
or
15441542
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
15451543
}
@@ -1670,14 +1668,14 @@ private predicate pathIntoCallable(
16701668
/** Holds if data may flow from `p` to a return of kind `kind`. */
16711669
pragma[nomagic]
16721670
private predicate paramFlowsThrough(
1673-
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
1671+
ParameterNode p, ReturnKind kind, CallContextCall cc, AccessPathNil apnil, Configuration config
16741672
) {
16751673
exists(PathNodeMid mid, ReturnNode ret |
16761674
mid.getNode() = ret and
16771675
kind = ret.getKind() and
16781676
cc = mid.getCallContext() and
16791677
config = mid.getConfiguration() and
1680-
mid.getAp() instanceof AccessPathNil
1678+
apnil = mid.getAp()
16811679
|
16821680
cc = TSomeCall(p, true)
16831681
or
@@ -1689,11 +1687,11 @@ private predicate paramFlowsThrough(
16891687

16901688
pragma[noinline]
16911689
private predicate pathThroughCallable0(
1692-
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
1690+
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc, AccessPathNil apnil
16931691
) {
16941692
exists(ParameterNode p, CallContext innercc |
16951693
pathIntoCallable(mid, p, cc, innercc, call) and
1696-
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
1694+
paramFlowsThrough(p, kind, innercc, apnil, unbind(mid.getConfiguration())) and
16971695
not parameterValueFlowsThrough(p, kind, innercc) and
16981696
mid.getAp() instanceof AccessPathNil
16991697
)
@@ -1704,9 +1702,11 @@ private predicate pathThroughCallable0(
17041702
* The context `cc` is restored to its value prior to entering the callable.
17051703
*/
17061704
pragma[noinline]
1707-
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
1705+
private predicate pathThroughCallable(
1706+
PathNodeMid mid, OutNode out, CallContext cc, AccessPathNil apnil
1707+
) {
17081708
exists(DataFlowCall call, ReturnKind kind |
1709-
pathThroughCallable0(call, mid, kind, cc) and
1709+
pathThroughCallable0(call, mid, kind, cc, apnil) and
17101710
out = getAnOutNode(call, kind)
17111711
)
17121712
}

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -851,8 +851,6 @@ private class AccessPathFrontNilNode extends Node {
851851
localFlowBigStep(_, this, false, _)
852852
or
853853
additionalJumpStep(_, this, _)
854-
or
855-
simpleArgumentFlowsThrough(_, this, _, _)
856854
)
857855
}
858856

@@ -914,10 +912,10 @@ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf,
914912
argumentValueFlowsThrough(mid, node, _)
915913
)
916914
or
917-
exists(Node mid, AccessPathFrontNil nil |
915+
exists(Node mid, AccessPathFrontNil nil, DataFlowType t |
918916
flowCandFwd(mid, fromArg, nil, config) and
919-
simpleArgumentFlowsThrough(mid, node, _, config) and
920-
apf = node.(AccessPathFrontNilNode).getApf()
917+
simpleArgumentFlowsThrough(mid, node, t, config) and
918+
apf = TFrontNil(t)
921919
)
922920
)
923921
or
@@ -1187,10 +1185,10 @@ private predicate flowFwd0(
11871185
argumentValueFlowsThrough(mid, node, _)
11881186
)
11891187
or
1190-
exists(Node mid, AccessPathNil nil |
1188+
exists(Node mid, AccessPathNil nil, DataFlowType t |
11911189
flowFwd(mid, fromArg, _, nil, config) and
1192-
simpleArgumentFlowsThrough(mid, node, _, config) and
1193-
ap = node.(AccessPathNilNode).getAp() and
1190+
simpleArgumentFlowsThrough(mid, node, t, config) and
1191+
ap = TNil(t) and
11941192
apf = ap.(AccessPathNil).getFront()
11951193
)
11961194
)
@@ -1539,7 +1537,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
15391537
or
15401538
pathOutOfCallable(mid, node, cc) and ap = mid.getAp()
15411539
or
1542-
pathThroughCallable(mid, node, cc) and ap = node.(AccessPathNilNode).getAp()
1540+
pathThroughCallable(mid, node, cc, ap)
15431541
or
15441542
valuePathThroughCallable(mid, node, cc) and ap = mid.getAp()
15451543
}
@@ -1670,14 +1668,14 @@ private predicate pathIntoCallable(
16701668
/** Holds if data may flow from `p` to a return of kind `kind`. */
16711669
pragma[nomagic]
16721670
private predicate paramFlowsThrough(
1673-
ParameterNode p, ReturnKind kind, CallContextCall cc, Configuration config
1671+
ParameterNode p, ReturnKind kind, CallContextCall cc, AccessPathNil apnil, Configuration config
16741672
) {
16751673
exists(PathNodeMid mid, ReturnNode ret |
16761674
mid.getNode() = ret and
16771675
kind = ret.getKind() and
16781676
cc = mid.getCallContext() and
16791677
config = mid.getConfiguration() and
1680-
mid.getAp() instanceof AccessPathNil
1678+
apnil = mid.getAp()
16811679
|
16821680
cc = TSomeCall(p, true)
16831681
or
@@ -1689,11 +1687,11 @@ private predicate paramFlowsThrough(
16891687

16901688
pragma[noinline]
16911689
private predicate pathThroughCallable0(
1692-
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc
1690+
DataFlowCall call, PathNodeMid mid, ReturnKind kind, CallContext cc, AccessPathNil apnil
16931691
) {
16941692
exists(ParameterNode p, CallContext innercc |
16951693
pathIntoCallable(mid, p, cc, innercc, call) and
1696-
paramFlowsThrough(p, kind, innercc, unbind(mid.getConfiguration())) and
1694+
paramFlowsThrough(p, kind, innercc, apnil, unbind(mid.getConfiguration())) and
16971695
not parameterValueFlowsThrough(p, kind, innercc) and
16981696
mid.getAp() instanceof AccessPathNil
16991697
)
@@ -1704,9 +1702,11 @@ private predicate pathThroughCallable0(
17041702
* The context `cc` is restored to its value prior to entering the callable.
17051703
*/
17061704
pragma[noinline]
1707-
private predicate pathThroughCallable(PathNodeMid mid, OutNode out, CallContext cc) {
1705+
private predicate pathThroughCallable(
1706+
PathNodeMid mid, OutNode out, CallContext cc, AccessPathNil apnil
1707+
) {
17081708
exists(DataFlowCall call, ReturnKind kind |
1709-
pathThroughCallable0(call, mid, kind, cc) and
1709+
pathThroughCallable0(call, mid, kind, cc, apnil) and
17101710
out = getAnOutNode(call, kind)
17111711
)
17121712
}

0 commit comments

Comments
 (0)