55import semmle.code.cpp.models.interfaces.Taint
66import semmle.code.cpp.models.interfaces.Iterator
77
8+ /**
9+ * The `std::array` template class.
10+ */
11+ private class Array extends Class {
12+ Array ( ) { this .hasQualifiedName ( [ "std" , "bsl" ] , "array" ) }
13+ }
14+
15+ /**
16+ * The `std::deque` template class.
17+ */
18+ private class Deque extends Class {
19+ Deque ( ) { this .hasQualifiedName ( [ "std" , "bsl" ] , "deque" ) }
20+ }
21+
22+ /**
23+ * The `std::forward_list` template class.
24+ */
25+ private class ForwardList extends Class {
26+ ForwardList ( ) { this .hasQualifiedName ( [ "std" , "bsl" ] , "forward_list" ) }
27+ }
28+
29+ /**
30+ * The `std::list` template class.
31+ */
32+ private class List extends Class {
33+ List ( ) { this .hasQualifiedName ( [ "std" , "bsl" ] , "list" ) }
34+ }
35+
36+ /**
37+ * The `std::vector` template class.
38+ */
39+ private class Vector extends Class {
40+ Vector ( ) { this .hasQualifiedName ( [ "std" , "bsl" ] , "vector" ) }
41+ }
42+
843/**
944 * Additional model for standard container constructors that reference the
1045 * value type of the container (that is, the `T` in `std::vector<T>`). For
@@ -15,7 +50,10 @@ import semmle.code.cpp.models.interfaces.Iterator
1550 */
1651private class StdSequenceContainerConstructor extends Constructor , TaintFunction {
1752 StdSequenceContainerConstructor ( ) {
18- this .getDeclaringType ( ) .hasQualifiedName ( "std" , [ "vector" , "deque" , "list" , "forward_list" ] )
53+ this .getDeclaringType ( ) instanceof Vector or
54+ this .getDeclaringType ( ) instanceof Deque or
55+ this .getDeclaringType ( ) instanceof List or
56+ this .getDeclaringType ( ) instanceof ForwardList
1957 }
2058
2159 /**
@@ -50,7 +88,10 @@ private class StdSequenceContainerConstructor extends Constructor, TaintFunction
5088 * The standard container function `data`.
5189 */
5290private class StdSequenceContainerData extends TaintFunction {
53- StdSequenceContainerData ( ) { this .hasQualifiedName ( "std" , [ "array" , "vector" ] , "data" ) }
91+ StdSequenceContainerData ( ) {
92+ this .getClassAndName ( "data" ) instanceof Array or
93+ this .getClassAndName ( "data" ) instanceof Vector
94+ }
5495
5596 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
5697 // flow from container itself (qualifier) to return value
@@ -69,8 +110,10 @@ private class StdSequenceContainerData extends TaintFunction {
69110 */
70111private class StdSequenceContainerPush extends TaintFunction {
71112 StdSequenceContainerPush ( ) {
72- this .hasQualifiedName ( "std" , [ "vector" , "deque" , "list" ] , "push_back" ) or
73- this .hasQualifiedName ( "std" , [ "deque" , "list" , "forward_list" ] , "push_front" )
113+ this .getClassAndName ( "push_back" ) instanceof Vector or
114+ this .getClassAndName ( [ "push_back" , "push_front" ] ) instanceof Deque or
115+ this .getClassAndName ( "push_front" ) instanceof ForwardList or
116+ this .getClassAndName ( [ "push_back" , "push_front" ] ) instanceof List
74117 }
75118
76119 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -85,8 +128,11 @@ private class StdSequenceContainerPush extends TaintFunction {
85128 */
86129private class StdSequenceContainerFrontBack extends TaintFunction {
87130 StdSequenceContainerFrontBack ( ) {
88- this .hasQualifiedName ( "std" , [ "array" , "vector" , "deque" , "list" , "forward_list" ] , "front" ) or
89- this .hasQualifiedName ( "std" , [ "array" , "vector" , "deque" , "list" ] , "back" )
131+ this .getClassAndName ( [ "front" , "back" ] ) instanceof Array or
132+ this .getClassAndName ( [ "front" , "back" ] ) instanceof Deque or
133+ this .getClassAndName ( "front" ) instanceof ForwardList or
134+ this .getClassAndName ( [ "front" , "back" ] ) instanceof List or
135+ this .getClassAndName ( [ "front" , "back" ] ) instanceof Vector
90136 }
91137
92138 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -101,8 +147,10 @@ private class StdSequenceContainerFrontBack extends TaintFunction {
101147 */
102148private class StdSequenceContainerInsert extends TaintFunction {
103149 StdSequenceContainerInsert ( ) {
104- this .hasQualifiedName ( "std" , [ "vector" , "deque" , "list" ] , "insert" ) or
105- this .hasQualifiedName ( "std" , "forward_list" , "insert_after" )
150+ this .getClassAndName ( "insert" ) instanceof Deque or
151+ this .getClassAndName ( "insert" ) instanceof List or
152+ this .getClassAndName ( "insert" ) instanceof Vector or
153+ this .getClassAndName ( "insert_after" ) instanceof ForwardList
106154 }
107155
108156 /**
@@ -138,7 +186,10 @@ private class StdSequenceContainerInsert extends TaintFunction {
138186 */
139187private class StdSequenceContainerAssign extends TaintFunction {
140188 StdSequenceContainerAssign ( ) {
141- this .hasQualifiedName ( "std" , [ "vector" , "deque" , "list" , "forward_list" ] , "assign" )
189+ this .getClassAndName ( "assign" ) instanceof Deque or
190+ this .getClassAndName ( "assign" ) instanceof ForwardList or
191+ this .getClassAndName ( "assign" ) instanceof List or
192+ this .getClassAndName ( "assign" ) instanceof Vector
142193 }
143194
144195 /**
@@ -170,7 +221,9 @@ private class StdSequenceContainerAssign extends TaintFunction {
170221 */
171222private class StdSequenceContainerAt extends TaintFunction {
172223 StdSequenceContainerAt ( ) {
173- this .hasQualifiedName ( "std" , [ "vector" , "array" , "deque" ] , [ "at" , "operator[]" ] )
224+ this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof Array or
225+ this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof Deque or
226+ this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof Vector
174227 }
175228
176229 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -188,7 +241,7 @@ private class StdSequenceContainerAt extends TaintFunction {
188241 * The standard vector `emplace` function.
189242 */
190243class StdVectorEmplace extends TaintFunction {
191- StdVectorEmplace ( ) { this .hasQualifiedName ( "std" , "vector" , " emplace") }
244+ StdVectorEmplace ( ) { this .getClassAndName ( " emplace") instanceof Vector }
192245
193246 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
194247 // flow from any parameter except the position iterator to qualifier and return value
@@ -205,7 +258,7 @@ class StdVectorEmplace extends TaintFunction {
205258 * The standard vector `emplace_back` function.
206259 */
207260class StdVectorEmplaceBack extends TaintFunction {
208- StdVectorEmplaceBack ( ) { this .hasQualifiedName ( "std" , "vector" , " emplace_back") }
261+ StdVectorEmplaceBack ( ) { this .getClassAndName ( " emplace_back") instanceof Vector }
209262
210263 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
211264 // flow from any parameter to qualifier
0 commit comments