C++/C#/Java: defaultAdditionalTaintStep

jbj · jbj · commit ad9ee54b659e · 2019-08-22T11:14:06.000+02:00
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
@@ -25,9 +25,11 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
 
 /**
  * Holds if the additional step from `src` to `sink` should be included in all
- * global taint flow configurations but not in local taint.
+ * global taint flow configurations.
  */
-predicate globalAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) { none() }
+predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
+  localAdditionalTaintStep(src, sink)
+}
 
 /**
  * Holds if `node` should be a barrier in all global taint flow configurations
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
@@ -18,9 +18,11 @@ predicate defaultTaintBarrier(DataFlow::Node node) { none() }
 
 /**
  * Holds if the additional step from `src` to `sink` should be included in all
- * global taint flow configurations but not in local taint.
+ * global taint flow configurations.
  */
-predicate globalAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+predicate defaultAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  localAdditionalTaintStep(pred, succ)
+  or
   succ = pred.(DataFlow::NonLocalJumpNode).getAJumpSuccessor(false)
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -42,9 +42,11 @@ predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
 
 /**
  * Holds if the additional step from `src` to `sink` should be included in all
- * global taint flow configurations but not in local taint.
+ * global taint flow configurations.
  */
-predicate globalAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) { none() }
+predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
+  localAdditionalTaintStep(src, sink)
+}
 
 /**
  * Holds if `node` should be a barrier in all global taint flow configurations
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {
 
   final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isAdditionalTaintStep(node1, node2) or
-    localAdditionalTaintStep(node1, node2) or
-    globalAdditionalTaintStep(node1, node2)
+    defaultAdditionalTaintStep(node1, node2)
   }
 
   /**

Original file line number	Diff line number	Diff line change
`@@ -99,8 +99,7 @@ abstract class Configuration extends DataFlow::Configuration {`
`99`	`99`
`100`	`100`	`final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {`
`101`	`101`	`isAdditionalTaintStep(node1, node2) or`
`102`		`- localAdditionalTaintStep(node1, node2) or`
`103`		`- globalAdditionalTaintStep(node1, node2)`
	`102`	`+ defaultAdditionalTaintStep(node1, node2)`
`104`	`103`	`}`
`105`	`104`
`106`	`105`	`/**`