Skip to content

Commit c51294e

Browse files
geoffw0geoffw0
committed
C++: Model operator[] and at.
1 parent 13b15d9 commit c51294e

File tree

5 files changed

+53
-4
lines changed

5 files changed

+53
-4
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,20 @@ class StdMapSwap extends TaintFunction {
5656
output.isQualifierObject()
5757
}
5858
}
59+
60+
/**
61+
* The standard map functions `at` and `operator[]`.
62+
*/
63+
class StdMapAt extends TaintFunction {
64+
StdMapAt() { this.hasQualifiedName("std", ["map", "unordered_map"], ["at", "operator[]"]) }
65+
66+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
67+
// flow from qualifier to referenced return value
68+
input.isQualifierObject() and
69+
output.isReturnValueDeref()
70+
or
71+
// reverse flow from returned reference to the qualifier
72+
input.isReturnValueDeref() and
73+
output.isQualifierObject()
74+
}
75+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -852,25 +852,37 @@
852852
| map.cpp:163:42:163:44 | call to map | map.cpp:167:7:167:9 | m13 | |
853853
| map.cpp:163:42:163:44 | call to map | map.cpp:171:7:171:9 | m13 | |
854854
| map.cpp:163:42:163:44 | call to map | map.cpp:249:1:249:1 | m13 | |
855+
| map.cpp:164:7:164:9 | m10 | map.cpp:164:10:164:10 | call to operator[] | TAINT |
855856
| map.cpp:164:7:164:9 | ref arg m10 | map.cpp:168:7:168:9 | m10 | |
856857
| map.cpp:164:7:164:9 | ref arg m10 | map.cpp:249:1:249:1 | m10 | |
857858
| map.cpp:164:7:164:24 | ... = ... | map.cpp:164:10:164:10 | call to operator[] [post update] | |
859+
| map.cpp:164:10:164:10 | call to operator[] [post update] | map.cpp:164:7:164:9 | ref arg m10 | TAINT |
858860
| map.cpp:164:20:164:24 | def | map.cpp:164:7:164:24 | ... = ... | |
861+
| map.cpp:165:7:165:9 | m11 | map.cpp:165:10:165:10 | call to operator[] | TAINT |
859862
| map.cpp:165:7:165:9 | ref arg m11 | map.cpp:169:7:169:9 | m11 | |
860863
| map.cpp:165:7:165:9 | ref arg m11 | map.cpp:249:1:249:1 | m11 | |
861864
| map.cpp:165:7:165:27 | ... = ... | map.cpp:165:10:165:10 | call to operator[] [post update] | |
865+
| map.cpp:165:10:165:10 | call to operator[] [post update] | map.cpp:165:7:165:9 | ref arg m11 | TAINT |
862866
| map.cpp:165:20:165:25 | call to source | map.cpp:165:7:165:27 | ... = ... | |
867+
| map.cpp:166:7:166:9 | m12 | map.cpp:166:11:166:12 | call to at | TAINT |
863868
| map.cpp:166:7:166:9 | ref arg m12 | map.cpp:170:7:170:9 | m12 | |
864869
| map.cpp:166:7:166:9 | ref arg m12 | map.cpp:249:1:249:1 | m12 | |
865870
| map.cpp:166:7:166:27 | ... = ... | map.cpp:166:11:166:12 | call to at [post update] | |
871+
| map.cpp:166:11:166:12 | call to at [post update] | map.cpp:166:7:166:9 | ref arg m12 | TAINT |
866872
| map.cpp:166:23:166:27 | def | map.cpp:166:7:166:27 | ... = ... | |
873+
| map.cpp:167:7:167:9 | m13 | map.cpp:167:11:167:12 | call to at | TAINT |
867874
| map.cpp:167:7:167:9 | ref arg m13 | map.cpp:171:7:171:9 | m13 | |
868875
| map.cpp:167:7:167:9 | ref arg m13 | map.cpp:249:1:249:1 | m13 | |
869876
| map.cpp:167:7:167:30 | ... = ... | map.cpp:167:11:167:12 | call to at [post update] | |
877+
| map.cpp:167:11:167:12 | call to at [post update] | map.cpp:167:7:167:9 | ref arg m13 | TAINT |
870878
| map.cpp:167:23:167:28 | call to source | map.cpp:167:7:167:30 | ... = ... | |
879+
| map.cpp:168:7:168:9 | m10 | map.cpp:168:10:168:10 | call to operator[] | TAINT |
871880
| map.cpp:168:7:168:9 | ref arg m10 | map.cpp:249:1:249:1 | m10 | |
881+
| map.cpp:169:7:169:9 | m11 | map.cpp:169:10:169:10 | call to operator[] | TAINT |
872882
| map.cpp:169:7:169:9 | ref arg m11 | map.cpp:249:1:249:1 | m11 | |
883+
| map.cpp:170:7:170:9 | m12 | map.cpp:170:10:170:10 | call to operator[] | TAINT |
873884
| map.cpp:170:7:170:9 | ref arg m12 | map.cpp:249:1:249:1 | m12 | |
885+
| map.cpp:171:7:171:9 | m13 | map.cpp:171:10:171:10 | call to operator[] | TAINT |
874886
| map.cpp:171:7:171:9 | ref arg m13 | map.cpp:249:1:249:1 | m13 | |
875887
| map.cpp:174:27:174:29 | call to map | map.cpp:175:2:175:4 | m14 | |
876888
| map.cpp:174:27:174:29 | call to map | map.cpp:176:2:176:4 | m14 | |
@@ -1467,25 +1479,37 @@
14671479
| map.cpp:315:52:315:54 | call to unordered_map | map.cpp:319:7:319:9 | m13 | |
14681480
| map.cpp:315:52:315:54 | call to unordered_map | map.cpp:323:7:323:9 | m13 | |
14691481
| map.cpp:315:52:315:54 | call to unordered_map | map.cpp:398:1:398:1 | m13 | |
1482+
| map.cpp:316:7:316:9 | m10 | map.cpp:316:10:316:10 | call to operator[] | TAINT |
14701483
| map.cpp:316:7:316:9 | ref arg m10 | map.cpp:320:7:320:9 | m10 | |
14711484
| map.cpp:316:7:316:9 | ref arg m10 | map.cpp:398:1:398:1 | m10 | |
14721485
| map.cpp:316:7:316:24 | ... = ... | map.cpp:316:10:316:10 | call to operator[] [post update] | |
1486+
| map.cpp:316:10:316:10 | call to operator[] [post update] | map.cpp:316:7:316:9 | ref arg m10 | TAINT |
14731487
| map.cpp:316:20:316:24 | def | map.cpp:316:7:316:24 | ... = ... | |
1488+
| map.cpp:317:7:317:9 | m11 | map.cpp:317:10:317:10 | call to operator[] | TAINT |
14741489
| map.cpp:317:7:317:9 | ref arg m11 | map.cpp:321:7:321:9 | m11 | |
14751490
| map.cpp:317:7:317:9 | ref arg m11 | map.cpp:398:1:398:1 | m11 | |
14761491
| map.cpp:317:7:317:27 | ... = ... | map.cpp:317:10:317:10 | call to operator[] [post update] | |
1492+
| map.cpp:317:10:317:10 | call to operator[] [post update] | map.cpp:317:7:317:9 | ref arg m11 | TAINT |
14771493
| map.cpp:317:20:317:25 | call to source | map.cpp:317:7:317:27 | ... = ... | |
1494+
| map.cpp:318:7:318:9 | m12 | map.cpp:318:11:318:12 | call to at | TAINT |
14781495
| map.cpp:318:7:318:9 | ref arg m12 | map.cpp:322:7:322:9 | m12 | |
14791496
| map.cpp:318:7:318:9 | ref arg m12 | map.cpp:398:1:398:1 | m12 | |
14801497
| map.cpp:318:7:318:27 | ... = ... | map.cpp:318:11:318:12 | call to at [post update] | |
1498+
| map.cpp:318:11:318:12 | call to at [post update] | map.cpp:318:7:318:9 | ref arg m12 | TAINT |
14811499
| map.cpp:318:23:318:27 | def | map.cpp:318:7:318:27 | ... = ... | |
1500+
| map.cpp:319:7:319:9 | m13 | map.cpp:319:11:319:12 | call to at | TAINT |
14821501
| map.cpp:319:7:319:9 | ref arg m13 | map.cpp:323:7:323:9 | m13 | |
14831502
| map.cpp:319:7:319:9 | ref arg m13 | map.cpp:398:1:398:1 | m13 | |
14841503
| map.cpp:319:7:319:30 | ... = ... | map.cpp:319:11:319:12 | call to at [post update] | |
1504+
| map.cpp:319:11:319:12 | call to at [post update] | map.cpp:319:7:319:9 | ref arg m13 | TAINT |
14851505
| map.cpp:319:23:319:28 | call to source | map.cpp:319:7:319:30 | ... = ... | |
1506+
| map.cpp:320:7:320:9 | m10 | map.cpp:320:10:320:10 | call to operator[] | TAINT |
14861507
| map.cpp:320:7:320:9 | ref arg m10 | map.cpp:398:1:398:1 | m10 | |
1508+
| map.cpp:321:7:321:9 | m11 | map.cpp:321:10:321:10 | call to operator[] | TAINT |
14871509
| map.cpp:321:7:321:9 | ref arg m11 | map.cpp:398:1:398:1 | m11 | |
1510+
| map.cpp:322:7:322:9 | m12 | map.cpp:322:10:322:10 | call to operator[] | TAINT |
14881511
| map.cpp:322:7:322:9 | ref arg m12 | map.cpp:398:1:398:1 | m12 | |
1512+
| map.cpp:323:7:323:9 | m13 | map.cpp:323:10:323:10 | call to operator[] | TAINT |
14891513
| map.cpp:323:7:323:9 | ref arg m13 | map.cpp:398:1:398:1 | m13 | |
14901514
| map.cpp:326:37:326:39 | call to unordered_map | map.cpp:327:2:327:4 | m14 | |
14911515
| map.cpp:326:37:326:39 | call to unordered_map | map.cpp:328:2:328:4 | m14 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -166,9 +166,9 @@ void test_map()
166166
sink(m12.at("abc") = "def");
167167
sink(m13.at("abc") = source()); // tainted
168168
sink(m10["abc"]);
169-
sink(m11["abc"]); // tainted [NOT DETECTED]
169+
sink(m11["abc"]); // tainted
170170
sink(m12["abc"]);
171-
sink(m13["abc"]); // tainted [NOT DETECTED]
171+
sink(m13["abc"]); // tainted
172172

173173
// ranges
174174
std::map<char *, char *> m14;
@@ -318,9 +318,9 @@ void test_unordered_map()
318318
sink(m12.at("abc") = "def");
319319
sink(m13.at("abc") = source()); // tainted
320320
sink(m10["abc"]);
321-
sink(m11["abc"]); // tainted [NOT DETECTED]
321+
sink(m11["abc"]); // tainted
322322
sink(m12["abc"]);
323-
sink(m13["abc"]); // tainted [NOT DETECTED]
323+
sink(m13["abc"]); // tainted
324324

325325
// ranges
326326
std::unordered_map<char *, char *> m14;

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@
5757
| map.cpp:157:8:157:10 | call to pair | map.cpp:106:32:106:37 | call to source |
5858
| map.cpp:165:7:165:27 | ... = ... | map.cpp:165:20:165:25 | call to source |
5959
| map.cpp:167:7:167:30 | ... = ... | map.cpp:167:23:167:28 | call to source |
60+
| map.cpp:169:10:169:10 | call to operator[] | map.cpp:165:20:165:25 | call to source |
61+
| map.cpp:171:10:171:10 | call to operator[] | map.cpp:167:23:167:28 | call to source |
6062
| map.cpp:190:7:190:9 | call to map | map.cpp:188:39:188:44 | call to source |
6163
| map.cpp:190:7:190:9 | call to map | map.cpp:188:49:188:54 | call to source |
6264
| map.cpp:193:7:193:9 | call to map | map.cpp:189:39:189:44 | call to source |
@@ -100,6 +102,8 @@
100102
| map.cpp:309:8:309:10 | call to pair | map.cpp:258:32:258:37 | call to source |
101103
| map.cpp:317:7:317:27 | ... = ... | map.cpp:317:20:317:25 | call to source |
102104
| map.cpp:319:7:319:30 | ... = ... | map.cpp:319:23:319:28 | call to source |
105+
| map.cpp:321:10:321:10 | call to operator[] | map.cpp:317:20:317:25 | call to source |
106+
| map.cpp:323:10:323:10 | call to operator[] | map.cpp:319:23:319:28 | call to source |
103107
| map.cpp:339:7:339:9 | call to unordered_map | map.cpp:337:39:337:44 | call to source |
104108
| map.cpp:339:7:339:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
105109
| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:338:39:338:44 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@
5454
| map.cpp:153:12:153:17 | map.cpp:105:39:105:44 | IR only |
5555
| map.cpp:158:12:158:16 | map.cpp:105:39:105:44 | IR only |
5656
| map.cpp:159:12:159:17 | map.cpp:105:39:105:44 | IR only |
57+
| map.cpp:169:10:169:10 | map.cpp:165:20:165:25 | AST only |
58+
| map.cpp:171:10:171:10 | map.cpp:167:23:167:28 | AST only |
5759
| map.cpp:190:7:190:9 | map.cpp:188:39:188:44 | AST only |
5860
| map.cpp:190:7:190:9 | map.cpp:188:49:188:54 | AST only |
5961
| map.cpp:193:7:193:9 | map.cpp:189:39:189:44 | AST only |
@@ -98,6 +100,8 @@
98100
| map.cpp:305:12:305:17 | map.cpp:257:39:257:44 | IR only |
99101
| map.cpp:310:12:310:16 | map.cpp:257:39:257:44 | IR only |
100102
| map.cpp:311:12:311:17 | map.cpp:257:39:257:44 | IR only |
103+
| map.cpp:321:10:321:10 | map.cpp:317:20:317:25 | AST only |
104+
| map.cpp:323:10:323:10 | map.cpp:319:23:319:28 | AST only |
101105
| map.cpp:339:7:339:9 | map.cpp:337:39:337:44 | AST only |
102106
| map.cpp:339:7:339:9 | map.cpp:337:49:337:54 | AST only |
103107
| map.cpp:342:7:342:9 | map.cpp:338:39:338:44 | AST only |

0 commit comments

Comments
 (0)