Skip to content

Commit b49aa67

Browse files
author
Robert Marsh
authored
Merge pull request #4459 from geoffw0/setex
C++: Additional taint flows through std::set
2 parents 83937ba + 58727cb commit b49aa67

File tree

7 files changed

+146
-19
lines changed

7 files changed

+146
-19
lines changed

‎change-notes/1.26/analysis-cpp.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,6 @@ The following changes in version 1.26 affect C/C++ analysis in all applications.
2525
* The models library now models many more taint flows through `std::string`.
2626
* The models library now models many taint flows through `std::istream` and `std::ostream`.
2727
* The models library now models some taint flows through `std::shared_ptr`, `std::unique_ptr`, `std::make_shared` and `std::make_unique`.
28-
* The models library now models some taint flows through `std::pair`, `std::map` and `std::unordered_map`.
28+
* The models library now models many taint flows through `std::pair`, `std::map`, `std::unordered_map`, `std::set` and `std::unordered_set`.
2929
* The `SimpleRangeAnalysis` library now supports multiplications of the form
3030
`e1 * e2` and `x *= e2` when `e1` and `e2` are unsigned or constant.

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,29 @@ class StdSetInsert extends TaintFunction {
4949
}
5050
}
5151

52+
/**
53+
* The standard set `emplace` and `emplace_hint` functions.
54+
*/
55+
class StdSetEmplace extends TaintFunction {
56+
StdSetEmplace() {
57+
this.hasQualifiedName("std", ["set", "unordered_set"], ["emplace", "emplace_hint"])
58+
}
59+
60+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
61+
// flow from any parameter to qualifier and return value
62+
// (here we assume taint flow from any constructor parameter to the constructed object)
63+
// (where the return value is a pair, this should really flow just to the first part of it)
64+
input.isParameter([0 .. getNumberOfParameters() - 1]) and
65+
(
66+
output.isQualifierObject() or
67+
output.isReturnValue()
68+
)
69+
or
70+
input.isQualifierObject() and
71+
output.isReturnValue()
72+
}
73+
}
74+
5275
/**
5376
* The standard set `swap` functions.
5477
*/
@@ -65,6 +88,19 @@ class StdSetSwap extends TaintFunction {
6588
}
6689
}
6790

91+
/**
92+
* The standard set `merge` function.
93+
*/
94+
class StdSetMerge extends TaintFunction {
95+
StdSetMerge() { this.hasQualifiedName("std", ["set", "unordered_set"], "merge") }
96+
97+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
98+
// container1.merge(container2)
99+
input.isParameterDeref(0) and
100+
output.isQualifierObject()
101+
}
102+
}
103+
68104
/**
69105
* The standard set `find` function.
70106
*/
@@ -90,3 +126,20 @@ class StdSetErase extends TaintFunction {
90126
output.isReturnValue()
91127
}
92128
}
129+
130+
/**
131+
* The standard set `lower_bound`, `upper_bound` and `equal_range` functions.
132+
*/
133+
class StdSetEqualRange extends TaintFunction {
134+
StdSetEqualRange() {
135+
this
136+
.hasQualifiedName("std", ["set", "unordered_set"],
137+
["lower_bound", "upper_bound", "equal_range"])
138+
}
139+
140+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
141+
// flow from qualifier to return value
142+
input.isQualifierObject() and
143+
output.isReturnValue()
144+
}
145+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2368,13 +2368,17 @@
23682368
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:71:7:71:9 | s11 | |
23692369
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
23702370
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2371+
| set.cpp:69:7:69:9 | s11 | set.cpp:69:11:69:21 | call to lower_bound | TAINT |
23712372
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:71:7:71:9 | s11 | |
23722373
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
23732374
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2375+
| set.cpp:70:7:70:9 | s11 | set.cpp:70:11:70:21 | call to upper_bound | TAINT |
23742376
| set.cpp:71:7:71:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
23752377
| set.cpp:71:7:71:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2378+
| set.cpp:71:7:71:9 | s11 | set.cpp:71:11:71:21 | call to equal_range | TAINT |
23762379
| set.cpp:71:28:71:32 | first | set.cpp:71:7:71:32 | call to iterator | |
23772380
| set.cpp:72:7:72:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2381+
| set.cpp:72:7:72:9 | s11 | set.cpp:72:11:72:21 | call to equal_range | TAINT |
23782382
| set.cpp:72:28:72:33 | second | set.cpp:72:7:72:33 | call to iterator | |
23792383
| set.cpp:75:19:75:21 | call to set | set.cpp:76:2:76:4 | s12 | |
23802384
| set.cpp:75:19:75:21 | call to set | set.cpp:78:7:78:9 | s12 | |
@@ -2478,10 +2482,12 @@
24782482
| set.cpp:99:2:99:4 | ref arg s16 | set.cpp:126:1:126:1 | s16 | |
24792483
| set.cpp:99:12:99:14 | ref arg s17 | set.cpp:102:7:102:9 | s17 | |
24802484
| set.cpp:99:12:99:14 | ref arg s17 | set.cpp:126:1:126:1 | s17 | |
2485+
| set.cpp:99:12:99:14 | s17 | set.cpp:99:2:99:4 | ref arg s16 | TAINT |
24812486
| set.cpp:100:2:100:4 | ref arg s18 | set.cpp:103:7:103:9 | s18 | |
24822487
| set.cpp:100:2:100:4 | ref arg s18 | set.cpp:126:1:126:1 | s18 | |
24832488
| set.cpp:100:12:100:14 | ref arg s19 | set.cpp:104:7:104:9 | s19 | |
24842489
| set.cpp:100:12:100:14 | ref arg s19 | set.cpp:126:1:126:1 | s19 | |
2490+
| set.cpp:100:12:100:14 | s19 | set.cpp:100:2:100:4 | ref arg s18 | TAINT |
24852491
| set.cpp:101:7:101:9 | s16 | set.cpp:101:7:101:9 | call to set | |
24862492
| set.cpp:102:7:102:9 | s17 | set.cpp:102:7:102:9 | call to set | |
24872493
| set.cpp:103:7:103:9 | s18 | set.cpp:103:7:103:9 | call to set | |
@@ -2546,33 +2552,49 @@
25462552
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:120:7:120:9 | s21 | |
25472553
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:121:7:121:9 | s21 | |
25482554
| set.cpp:118:7:118:9 | ref arg s21 | set.cpp:126:1:126:1 | s21 | |
2555+
| set.cpp:118:7:118:9 | s21 | set.cpp:118:11:118:17 | call to emplace | TAINT |
2556+
| set.cpp:118:19:118:23 | abc | set.cpp:118:7:118:9 | ref arg s21 | TAINT |
2557+
| set.cpp:118:19:118:23 | abc | set.cpp:118:11:118:17 | call to emplace | TAINT |
25492558
| set.cpp:118:26:118:30 | first | set.cpp:118:7:118:30 | call to iterator | |
25502559
| set.cpp:119:7:119:9 | s21 | set.cpp:119:7:119:9 | call to set | |
25512560
| set.cpp:120:7:120:9 | ref arg s21 | set.cpp:121:7:121:9 | s21 | |
25522561
| set.cpp:120:7:120:9 | ref arg s21 | set.cpp:126:1:126:1 | s21 | |
2562+
| set.cpp:120:7:120:9 | s21 | set.cpp:120:11:120:17 | call to emplace | TAINT |
2563+
| set.cpp:120:19:120:24 | call to source | set.cpp:120:7:120:9 | ref arg s21 | TAINT |
2564+
| set.cpp:120:19:120:24 | call to source | set.cpp:120:11:120:17 | call to emplace | TAINT |
25532565
| set.cpp:120:29:120:33 | first | set.cpp:120:7:120:33 | call to iterator | |
25542566
| set.cpp:121:7:121:9 | s21 | set.cpp:121:7:121:9 | call to set | |
25552567
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:123:7:123:9 | s22 | |
25562568
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
25572569
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:124:24:124:26 | s22 | |
25582570
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
25592571
| set.cpp:122:7:122:9 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
2572+
| set.cpp:122:7:122:9 | s22 | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
25602573
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:122:7:122:9 | s22 | |
25612574
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:123:7:123:9 | s22 | |
25622575
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
25632576
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:124:24:124:26 | s22 | |
25642577
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
25652578
| set.cpp:122:24:122:26 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
25662579
| set.cpp:122:24:122:26 | s22 | set.cpp:122:28:122:32 | call to begin | TAINT |
2580+
| set.cpp:122:24:122:34 | call to iterator | set.cpp:122:7:122:9 | ref arg s22 | TAINT |
2581+
| set.cpp:122:24:122:34 | call to iterator | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
25672582
| set.cpp:122:28:122:32 | call to begin | set.cpp:122:24:122:34 | call to iterator | TAINT |
2583+
| set.cpp:122:37:122:41 | abc | set.cpp:122:7:122:9 | ref arg s22 | TAINT |
2584+
| set.cpp:122:37:122:41 | abc | set.cpp:122:11:122:22 | call to emplace_hint | TAINT |
25682585
| set.cpp:123:7:123:9 | s22 | set.cpp:123:7:123:9 | call to set | |
25692586
| set.cpp:124:7:124:9 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
25702587
| set.cpp:124:7:124:9 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
2588+
| set.cpp:124:7:124:9 | s22 | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
25712589
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:124:7:124:9 | s22 | |
25722590
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:125:7:125:9 | s22 | |
25732591
| set.cpp:124:24:124:26 | ref arg s22 | set.cpp:126:1:126:1 | s22 | |
25742592
| set.cpp:124:24:124:26 | s22 | set.cpp:124:28:124:32 | call to begin | TAINT |
2593+
| set.cpp:124:24:124:34 | call to iterator | set.cpp:124:7:124:9 | ref arg s22 | TAINT |
2594+
| set.cpp:124:24:124:34 | call to iterator | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
25752595
| set.cpp:124:28:124:32 | call to begin | set.cpp:124:24:124:34 | call to iterator | TAINT |
2596+
| set.cpp:124:37:124:42 | call to source | set.cpp:124:7:124:9 | ref arg s22 | TAINT |
2597+
| set.cpp:124:37:124:42 | call to source | set.cpp:124:11:124:22 | call to emplace_hint | TAINT |
25762598
| set.cpp:125:7:125:9 | s22 | set.cpp:125:7:125:9 | call to set | |
25772599
| set.cpp:131:29:131:30 | call to unordered_set | set.cpp:133:7:133:8 | s1 | |
25782600
| set.cpp:131:29:131:30 | call to unordered_set | set.cpp:137:12:137:13 | s1 | |
@@ -2834,8 +2856,10 @@
28342856
| set.cpp:182:13:182:15 | c | set.cpp:182:6:182:11 | call to insert | TAINT |
28352857
| set.cpp:183:7:183:9 | ref arg s11 | set.cpp:184:7:184:9 | s11 | |
28362858
| set.cpp:183:7:183:9 | ref arg s11 | set.cpp:238:1:238:1 | s11 | |
2859+
| set.cpp:183:7:183:9 | s11 | set.cpp:183:11:183:21 | call to equal_range | TAINT |
28372860
| set.cpp:183:28:183:32 | first | set.cpp:183:7:183:32 | call to iterator | |
28382861
| set.cpp:184:7:184:9 | ref arg s11 | set.cpp:238:1:238:1 | s11 | |
2862+
| set.cpp:184:7:184:9 | s11 | set.cpp:184:11:184:21 | call to equal_range | TAINT |
28392863
| set.cpp:184:28:184:33 | second | set.cpp:184:7:184:33 | call to iterator | |
28402864
| set.cpp:187:29:187:31 | call to unordered_set | set.cpp:188:2:188:4 | s12 | |
28412865
| set.cpp:187:29:187:31 | call to unordered_set | set.cpp:190:7:190:9 | s12 | |
@@ -2939,10 +2963,12 @@
29392963
| set.cpp:211:2:211:4 | ref arg s16 | set.cpp:238:1:238:1 | s16 | |
29402964
| set.cpp:211:12:211:14 | ref arg s17 | set.cpp:214:7:214:9 | s17 | |
29412965
| set.cpp:211:12:211:14 | ref arg s17 | set.cpp:238:1:238:1 | s17 | |
2966+
| set.cpp:211:12:211:14 | s17 | set.cpp:211:2:211:4 | ref arg s16 | TAINT |
29422967
| set.cpp:212:2:212:4 | ref arg s18 | set.cpp:215:7:215:9 | s18 | |
29432968
| set.cpp:212:2:212:4 | ref arg s18 | set.cpp:238:1:238:1 | s18 | |
29442969
| set.cpp:212:12:212:14 | ref arg s19 | set.cpp:216:7:216:9 | s19 | |
29452970
| set.cpp:212:12:212:14 | ref arg s19 | set.cpp:238:1:238:1 | s19 | |
2971+
| set.cpp:212:12:212:14 | s19 | set.cpp:212:2:212:4 | ref arg s18 | TAINT |
29462972
| set.cpp:213:7:213:9 | s16 | set.cpp:213:7:213:9 | call to unordered_set | |
29472973
| set.cpp:214:7:214:9 | s17 | set.cpp:214:7:214:9 | call to unordered_set | |
29482974
| set.cpp:215:7:215:9 | s18 | set.cpp:215:7:215:9 | call to unordered_set | |
@@ -3007,33 +3033,49 @@
30073033
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:232:7:232:9 | s21 | |
30083034
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:233:7:233:9 | s21 | |
30093035
| set.cpp:230:7:230:9 | ref arg s21 | set.cpp:238:1:238:1 | s21 | |
3036+
| set.cpp:230:7:230:9 | s21 | set.cpp:230:11:230:17 | call to emplace | TAINT |
3037+
| set.cpp:230:19:230:23 | abc | set.cpp:230:7:230:9 | ref arg s21 | TAINT |
3038+
| set.cpp:230:19:230:23 | abc | set.cpp:230:11:230:17 | call to emplace | TAINT |
30103039
| set.cpp:230:26:230:30 | first | set.cpp:230:7:230:30 | call to iterator | |
30113040
| set.cpp:231:7:231:9 | s21 | set.cpp:231:7:231:9 | call to unordered_set | |
30123041
| set.cpp:232:7:232:9 | ref arg s21 | set.cpp:233:7:233:9 | s21 | |
30133042
| set.cpp:232:7:232:9 | ref arg s21 | set.cpp:238:1:238:1 | s21 | |
3043+
| set.cpp:232:7:232:9 | s21 | set.cpp:232:11:232:17 | call to emplace | TAINT |
3044+
| set.cpp:232:19:232:24 | call to source | set.cpp:232:7:232:9 | ref arg s21 | TAINT |
3045+
| set.cpp:232:19:232:24 | call to source | set.cpp:232:11:232:17 | call to emplace | TAINT |
30143046
| set.cpp:232:29:232:33 | first | set.cpp:232:7:232:33 | call to iterator | |
30153047
| set.cpp:233:7:233:9 | s21 | set.cpp:233:7:233:9 | call to unordered_set | |
30163048
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:235:7:235:9 | s22 | |
30173049
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
30183050
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:236:24:236:26 | s22 | |
30193051
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
30203052
| set.cpp:234:7:234:9 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
3053+
| set.cpp:234:7:234:9 | s22 | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
30213054
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:234:7:234:9 | s22 | |
30223055
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:235:7:235:9 | s22 | |
30233056
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
30243057
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:236:24:236:26 | s22 | |
30253058
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
30263059
| set.cpp:234:24:234:26 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
30273060
| set.cpp:234:24:234:26 | s22 | set.cpp:234:28:234:32 | call to begin | TAINT |
3061+
| set.cpp:234:24:234:34 | call to iterator | set.cpp:234:7:234:9 | ref arg s22 | TAINT |
3062+
| set.cpp:234:24:234:34 | call to iterator | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
30283063
| set.cpp:234:28:234:32 | call to begin | set.cpp:234:24:234:34 | call to iterator | TAINT |
3064+
| set.cpp:234:37:234:41 | abc | set.cpp:234:7:234:9 | ref arg s22 | TAINT |
3065+
| set.cpp:234:37:234:41 | abc | set.cpp:234:11:234:22 | call to emplace_hint | TAINT |
30293066
| set.cpp:235:7:235:9 | s22 | set.cpp:235:7:235:9 | call to unordered_set | |
30303067
| set.cpp:236:7:236:9 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
30313068
| set.cpp:236:7:236:9 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
3069+
| set.cpp:236:7:236:9 | s22 | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
30323070
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:236:7:236:9 | s22 | |
30333071
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:237:7:237:9 | s22 | |
30343072
| set.cpp:236:24:236:26 | ref arg s22 | set.cpp:238:1:238:1 | s22 | |
30353073
| set.cpp:236:24:236:26 | s22 | set.cpp:236:28:236:32 | call to begin | TAINT |
3074+
| set.cpp:236:24:236:34 | call to iterator | set.cpp:236:7:236:9 | ref arg s22 | TAINT |
3075+
| set.cpp:236:24:236:34 | call to iterator | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
30363076
| set.cpp:236:28:236:32 | call to begin | set.cpp:236:24:236:34 | call to iterator | TAINT |
3077+
| set.cpp:236:37:236:42 | call to source | set.cpp:236:7:236:9 | ref arg s22 | TAINT |
3078+
| set.cpp:236:37:236:42 | call to source | set.cpp:236:11:236:22 | call to emplace_hint | TAINT |
30373079
| set.cpp:237:7:237:9 | s22 | set.cpp:237:7:237:9 | call to unordered_set | |
30383080
| smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p | |
30393081
| smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,10 @@ void test_set()
6666
s11.insert("a");
6767
s11.insert(source());
6868
s11.insert("c");
69-
sink(s11.lower_bound("b")); // tainted [NOT DETECTED]
70-
sink(s11.upper_bound("b")); // tainted [NOT DETECTED]
71-
sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
72-
sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
69+
sink(s11.lower_bound("b")); // tainted
70+
sink(s11.upper_bound("b")); // tainted
71+
sink(s11.equal_range("b").first); // tainted
72+
sink(s11.equal_range("b").second); // tainted
7373

7474
// swap
7575
std::set<char *> s12, s13, s14, s15;
@@ -99,8 +99,8 @@ void test_set()
9999
s16.merge(s17);
100100
s18.merge(s19);
101101
sink(s16); // tainted
102-
sink(s17); // tainted [NOT DETECTED]
103-
sink(s18); // tainted [NOT DETECTED]
102+
sink(s17);
103+
sink(s18); // tainted
104104
sink(s19); // tainted
105105

106106
// erase, clear
@@ -117,12 +117,12 @@ void test_set()
117117
std::set<char *> s21, s22;
118118
sink(s21.emplace("abc").first);
119119
sink(s21);
120-
sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
121-
sink(s21); // tainted [NOT DETECTED]
120+
sink(s21.emplace(source()).first); // tainted
121+
sink(s21); // tainted
122122
sink(s22.emplace_hint(s22.begin(), "abc"));
123123
sink(s22);
124-
sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
125-
sink(s22); // tainted [NOT DETECTED]
124+
sink(s22.emplace_hint(s22.begin(), source())); // tainted
125+
sink(s22); // tainted
126126
}
127127

128128
void test_unordered_set()
@@ -180,8 +180,8 @@ void test_unordered_set()
180180
s11.insert("a");
181181
s11.insert(source());
182182
s11.insert("c");
183-
sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
184-
sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
183+
sink(s11.equal_range("b").first); // tainted
184+
sink(s11.equal_range("b").second); // tainted
185185

186186
// swap
187187
std::unordered_set<char *> s12, s13, s14, s15;
@@ -211,8 +211,8 @@ void test_unordered_set()
211211
s16.merge(s17);
212212
s18.merge(s19);
213213
sink(s16); // tainted
214-
sink(s17); // tainted [NOT DETECTED]
215-
sink(s18); // tainted [NOT DETECTED]
214+
sink(s17);
215+
sink(s18); // tainted
216216
sink(s19); // tainted
217217

218218
// erase, clear
@@ -229,10 +229,10 @@ void test_unordered_set()
229229
std::unordered_set<char *> s21, s22;
230230
sink(s21.emplace("abc").first);
231231
sink(s21);
232-
sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
233-
sink(s21); // tainted [NOT DETECTED]
232+
sink(s21.emplace(source()).first); // tainted
233+
sink(s21); // tainted
234234
sink(s22.emplace_hint(s22.begin(), "abc"));
235235
sink(s22);
236-
sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
237-
sink(s22); // tainted [NOT DETECTED]
236+
sink(s22.emplace_hint(s22.begin(), source())); // tainted
237+
sink(s22); // tainted
238238
}

0 commit comments

Comments
 (0)