|
4 | 4 |
|
5 | 5 | import semmle.code.cpp.models.interfaces.Taint |
6 | 6 |
|
7 | | -module Std { |
8 | | - /** |
9 | | - * Additional model for `std::pair` constructors. |
10 | | - */ |
11 | | - private class PairConstructor extends Constructor, TaintFunction { |
12 | | - PairConstructor() { this.hasQualifiedName("std", "pair", "pair") } |
13 | | - |
14 | | - /** |
15 | | - * Gets the index of a parameter to this function that is a reference to |
16 | | - * either value type of the pair. |
17 | | - */ |
18 | | - int getAValueTypeParameterIndex() { |
19 | | - getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() = |
20 | | - getDeclaringType().getTemplateArgument(_).(Type).getUnspecifiedType() // i.e. the `T1` or `T2` of this `std::pair<T1, T2>` |
21 | | - } |
22 | | - |
23 | | - override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
24 | | - // taint flow from second parameter of a value type to the qualifier |
25 | | - getAValueTypeParameterIndex() = 1 and |
26 | | - input.isParameterDeref(1) and |
27 | | - ( |
28 | | - output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object |
29 | | - or |
30 | | - output.isQualifierObject() |
31 | | - ) |
32 | | - } |
33 | | - } |
| 7 | +/** |
| 8 | + * Additional model for `std::pair` constructors. |
| 9 | + */ |
| 10 | +private class StdPairConstructor extends Constructor, TaintFunction { |
| 11 | + StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") } |
34 | 12 |
|
35 | 13 | /** |
36 | | - * The standard pair `swap` function. |
| 14 | + * Gets the index of a parameter to this function that is a reference to |
| 15 | + * either value type of the pair. |
37 | 16 | */ |
38 | | - private class PairSwap extends TaintFunction { |
39 | | - PairSwap() { this.hasQualifiedName("std", "pair", "swap") } |
| 17 | + int getAValueTypeParameterIndex() { |
| 18 | + getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() = |
| 19 | + getDeclaringType().getTemplateArgument(_).(Type).getUnspecifiedType() // i.e. the `T1` or `T2` of this `std::pair<T1, T2>` |
| 20 | + } |
40 | 21 |
|
41 | | - override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
42 | | - // container1.swap(container2) |
43 | | - input.isQualifierObject() and |
44 | | - output.isParameterDeref(0) |
| 22 | + override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
| 23 | + // taint flow from second parameter of a value type to the qualifier |
| 24 | + getAValueTypeParameterIndex() = 1 and |
| 25 | + input.isParameterDeref(1) and |
| 26 | + ( |
| 27 | + output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object |
45 | 28 | or |
46 | | - input.isParameterDeref(0) and |
47 | 29 | output.isQualifierObject() |
48 | | - } |
| 30 | + ) |
| 31 | + } |
| 32 | +} |
| 33 | + |
| 34 | +/** |
| 35 | + * The standard pair `swap` function. |
| 36 | + */ |
| 37 | +private class StdPairSwap extends TaintFunction { |
| 38 | + StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") } |
| 39 | + |
| 40 | + override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
| 41 | + // container1.swap(container2) |
| 42 | + input.isQualifierObject() and |
| 43 | + output.isParameterDeref(0) |
| 44 | + or |
| 45 | + input.isParameterDeref(0) and |
| 46 | + output.isQualifierObject() |
49 | 47 | } |
50 | 48 | } |
0 commit comments