Skip to content

Commit c8783b5

Browse files
committed
Revert "C++: Create a module for models of things in Std."
This reverts commit ddc5150.
1 parent b68f98b commit c8783b5

File tree

1 file changed

+34
-36
lines changed
  • cpp/ql/src/semmle/code/cpp/models/implementations

1 file changed

+34
-36
lines changed

cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll

Lines changed: 34 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4,47 +4,45 @@
44

55
import semmle.code.cpp.models.interfaces.Taint
66

7-
module Std {
8-
/**
9-
* Additional model for `std::pair` constructors.
10-
*/
11-
private class PairConstructor extends Constructor, TaintFunction {
12-
PairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
13-
14-
/**
15-
* Gets the index of a parameter to this function that is a reference to
16-
* either value type of the pair.
17-
*/
18-
int getAValueTypeParameterIndex() {
19-
getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
20-
getDeclaringType().getTemplateArgument(_).(Type).getUnspecifiedType() // i.e. the `T1` or `T2` of this `std::pair<T1, T2>`
21-
}
22-
23-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
24-
// taint flow from second parameter of a value type to the qualifier
25-
getAValueTypeParameterIndex() = 1 and
26-
input.isParameterDeref(1) and
27-
(
28-
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
29-
or
30-
output.isQualifierObject()
31-
)
32-
}
33-
}
7+
/**
8+
* Additional model for `std::pair` constructors.
9+
*/
10+
private class StdPairConstructor extends Constructor, TaintFunction {
11+
StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
3412

3513
/**
36-
* The standard pair `swap` function.
14+
* Gets the index of a parameter to this function that is a reference to
15+
* either value type of the pair.
3716
*/
38-
private class PairSwap extends TaintFunction {
39-
PairSwap() { this.hasQualifiedName("std", "pair", "swap") }
17+
int getAValueTypeParameterIndex() {
18+
getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
19+
getDeclaringType().getTemplateArgument(_).(Type).getUnspecifiedType() // i.e. the `T1` or `T2` of this `std::pair<T1, T2>`
20+
}
4021

41-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
42-
// container1.swap(container2)
43-
input.isQualifierObject() and
44-
output.isParameterDeref(0)
22+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
23+
// taint flow from second parameter of a value type to the qualifier
24+
getAValueTypeParameterIndex() = 1 and
25+
input.isParameterDeref(1) and
26+
(
27+
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
4528
or
46-
input.isParameterDeref(0) and
4729
output.isQualifierObject()
48-
}
30+
)
31+
}
32+
}
33+
34+
/**
35+
* The standard pair `swap` function.
36+
*/
37+
private class StdPairSwap extends TaintFunction {
38+
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
39+
40+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
41+
// container1.swap(container2)
42+
input.isQualifierObject() and
43+
output.isParameterDeref(0)
44+
or
45+
input.isParameterDeref(0) and
46+
output.isQualifierObject()
4947
}
5048
}

0 commit comments

Comments
 (0)