Skip to content

Commit d550741

Browse files
geoffw0geoffw0
committed
C++: Model insert_or_assign.
1 parent c51294e commit d550741

File tree

6 files changed

+34
-10
lines changed

6 files changed

+34
-10
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ import semmle.code.cpp.models.interfaces.Taint
66
import semmle.code.cpp.models.implementations.Iterator
77

88
/**
9-
* The standard map `insert` function.
9+
* The standard map `insert` and `insert_or_assign` functions.
1010
*/
1111
class StdMapInsert extends TaintFunction {
1212
StdMapInsert() {
13-
this.hasQualifiedName("std", ["map", "unordered_map"], "insert")
13+
this.hasQualifiedName("std", ["map", "unordered_map"], ["insert", "insert_or_assign"])
1414
}
1515

1616
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -673,6 +673,8 @@
673673
| map.cpp:108:7:108:8 | ref arg m5 | map.cpp:120:7:120:8 | m5 | |
674674
| map.cpp:108:7:108:8 | ref arg m5 | map.cpp:126:7:126:8 | m5 | |
675675
| map.cpp:108:7:108:8 | ref arg m5 | map.cpp:249:1:249:1 | m5 | |
676+
| map.cpp:108:34:108:39 | call to source | map.cpp:108:7:108:8 | ref arg m5 | TAINT |
677+
| map.cpp:108:34:108:39 | call to source | map.cpp:108:10:108:25 | call to insert_or_assign | TAINT |
676678
| map.cpp:108:44:108:48 | first | map.cpp:108:7:108:48 | call to iterator | |
677679
| map.cpp:109:7:109:8 | ref arg m6 | map.cpp:115:7:115:8 | m6 | |
678680
| map.cpp:109:7:109:8 | ref arg m6 | map.cpp:121:7:121:8 | m6 | |
@@ -685,6 +687,8 @@
685687
| map.cpp:109:27:109:28 | ref arg m6 | map.cpp:127:7:127:8 | m6 | |
686688
| map.cpp:109:27:109:28 | ref arg m6 | map.cpp:249:1:249:1 | m6 | |
687689
| map.cpp:109:30:109:34 | call to begin | map.cpp:109:27:109:36 | call to iterator | TAINT |
690+
| map.cpp:109:46:109:51 | call to source | map.cpp:109:7:109:8 | ref arg m6 | TAINT |
691+
| map.cpp:109:46:109:51 | call to source | map.cpp:109:10:109:25 | call to insert_or_assign | TAINT |
688692
| map.cpp:110:7:110:8 | m1 | map.cpp:110:7:110:8 | call to map | |
689693
| map.cpp:111:7:111:8 | m2 | map.cpp:111:7:111:8 | call to map | |
690694
| map.cpp:112:7:112:8 | m3 | map.cpp:112:7:112:8 | call to map | |
@@ -1312,6 +1316,8 @@
13121316
| map.cpp:260:7:260:8 | ref arg m5 | map.cpp:272:7:272:8 | m5 | |
13131317
| map.cpp:260:7:260:8 | ref arg m5 | map.cpp:278:7:278:8 | m5 | |
13141318
| map.cpp:260:7:260:8 | ref arg m5 | map.cpp:398:1:398:1 | m5 | |
1319+
| map.cpp:260:34:260:39 | call to source | map.cpp:260:7:260:8 | ref arg m5 | TAINT |
1320+
| map.cpp:260:34:260:39 | call to source | map.cpp:260:10:260:25 | call to insert_or_assign | TAINT |
13151321
| map.cpp:260:44:260:48 | first | map.cpp:260:7:260:48 | call to iterator | |
13161322
| map.cpp:261:7:261:8 | ref arg m6 | map.cpp:267:7:267:8 | m6 | |
13171323
| map.cpp:261:7:261:8 | ref arg m6 | map.cpp:273:7:273:8 | m6 | |
@@ -1324,6 +1330,8 @@
13241330
| map.cpp:261:27:261:28 | ref arg m6 | map.cpp:279:7:279:8 | m6 | |
13251331
| map.cpp:261:27:261:28 | ref arg m6 | map.cpp:398:1:398:1 | m6 | |
13261332
| map.cpp:261:30:261:34 | call to begin | map.cpp:261:27:261:36 | call to iterator | TAINT |
1333+
| map.cpp:261:46:261:51 | call to source | map.cpp:261:7:261:8 | ref arg m6 | TAINT |
1334+
| map.cpp:261:46:261:51 | call to source | map.cpp:261:10:261:25 | call to insert_or_assign | TAINT |
13271335
| map.cpp:262:7:262:8 | m1 | map.cpp:262:7:262:8 | call to unordered_map | |
13281336
| map.cpp:263:7:263:8 | m2 | map.cpp:263:7:263:8 | call to unordered_map | |
13291337
| map.cpp:264:7:264:8 | m3 | map.cpp:264:7:264:8 | call to unordered_map | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -105,14 +105,14 @@ void test_map()
105105
sink(m2.insert(std::make_pair("abc", source())).first); // tainted [NOT DETECTED]
106106
sink(m3.insert(std::make_pair(source(), "def")).first); // tainted [NOT DETECTED]
107107
sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // tainted
108-
sink(m5.insert_or_assign("abc", source()).first); // tainted [NOT DETECTED]
109-
sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted [NOT DETECTED]
108+
sink(m5.insert_or_assign("abc", source()).first); // tainted
109+
sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted
110110
sink(m1);
111111
sink(m2); // tainted
112112
sink(m3); // tainted
113113
sink(m4); // tainted
114-
sink(m5); // tainted [NOT DETECTED]
115-
sink(m6); // tainted [NOT DETECTED]
114+
sink(m5); // tainted
115+
sink(m6); // tainted
116116
sink(m1.find("abc"));
117117
sink(m2.find("abc")); // tainted [NOT DETECTED]
118118
sink(m3.find("abc"));
@@ -257,14 +257,14 @@ void test_unordered_map()
257257
sink(m2.insert(std::make_pair("abc", source())).first); // tainted [NOT DETECTED]
258258
sink(m3.insert(std::make_pair(source(), "def")).first); // tainted [NOT DETECTED]
259259
sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // tainted
260-
sink(m5.insert_or_assign("abc", source()).first); // tainted [NOT DETECTED]
261-
sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted [NOT DETECTED]
260+
sink(m5.insert_or_assign("abc", source()).first); // tainted
261+
sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted
262262
sink(m1);
263263
sink(m2); // tainted
264264
sink(m3); // tainted
265265
sink(m4); // tainted
266-
sink(m5); // tainted [NOT DETECTED]
267-
sink(m6); // tainted [NOT DETECTED]
266+
sink(m5); // tainted
267+
sink(m6); // tainted
268268
sink(m1.find("abc"));
269269
sink(m2.find("abc")); // tainted [NOT DETECTED]
270270
sink(m3.find("abc"));

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,12 @@
4747
| map.cpp:86:7:86:32 | call to pair | map.cpp:86:24:86:29 | call to source |
4848
| map.cpp:92:7:92:7 | call to pair | map.cpp:91:33:91:38 | call to source |
4949
| map.cpp:107:10:107:15 | call to insert | map.cpp:107:62:107:67 | call to source |
50+
| map.cpp:109:10:109:25 | call to insert_or_assign | map.cpp:109:46:109:51 | call to source |
5051
| map.cpp:111:7:111:8 | call to map | map.cpp:105:39:105:44 | call to source |
5152
| map.cpp:112:7:112:8 | call to map | map.cpp:106:32:106:37 | call to source |
5253
| map.cpp:113:7:113:8 | call to map | map.cpp:107:62:107:67 | call to source |
54+
| map.cpp:114:7:114:8 | call to map | map.cpp:108:34:108:39 | call to source |
55+
| map.cpp:115:7:115:8 | call to map | map.cpp:109:46:109:51 | call to source |
5356
| map.cpp:134:7:134:8 | call to map | map.cpp:105:39:105:44 | call to source |
5457
| map.cpp:135:7:135:8 | call to map | map.cpp:105:39:105:44 | call to source |
5558
| map.cpp:136:7:136:8 | call to map | map.cpp:105:39:105:44 | call to source |
@@ -92,9 +95,12 @@
9295
| map.cpp:226:7:226:9 | call to map | map.cpp:221:39:221:44 | call to source |
9396
| map.cpp:226:7:226:9 | call to map | map.cpp:221:49:221:54 | call to source |
9497
| map.cpp:259:10:259:15 | call to insert | map.cpp:259:62:259:67 | call to source |
98+
| map.cpp:261:10:261:25 | call to insert_or_assign | map.cpp:261:46:261:51 | call to source |
9599
| map.cpp:263:7:263:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
96100
| map.cpp:264:7:264:8 | call to unordered_map | map.cpp:258:32:258:37 | call to source |
97101
| map.cpp:265:7:265:8 | call to unordered_map | map.cpp:259:62:259:67 | call to source |
102+
| map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:34:260:39 | call to source |
103+
| map.cpp:267:7:267:8 | call to unordered_map | map.cpp:261:46:261:51 | call to source |
98104
| map.cpp:286:7:286:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
99105
| map.cpp:287:7:287:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
100106
| map.cpp:288:7:288:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,12 @@
4444
| map.cpp:96:9:96:14 | map.cpp:91:33:91:38 | IR only |
4545
| map.cpp:105:7:105:54 | map.cpp:105:39:105:44 | IR only |
4646
| map.cpp:106:7:106:54 | map.cpp:106:32:106:37 | IR only |
47+
| map.cpp:108:7:108:48 | map.cpp:108:34:108:39 | IR only |
4748
| map.cpp:111:7:111:8 | map.cpp:105:39:105:44 | AST only |
4849
| map.cpp:112:7:112:8 | map.cpp:106:32:106:37 | AST only |
4950
| map.cpp:113:7:113:8 | map.cpp:107:62:107:67 | AST only |
51+
| map.cpp:114:7:114:8 | map.cpp:108:34:108:39 | AST only |
52+
| map.cpp:115:7:115:8 | map.cpp:109:46:109:51 | AST only |
5053
| map.cpp:134:7:134:8 | map.cpp:105:39:105:44 | AST only |
5154
| map.cpp:135:7:135:8 | map.cpp:105:39:105:44 | AST only |
5255
| map.cpp:136:7:136:8 | map.cpp:105:39:105:44 | AST only |
@@ -90,9 +93,12 @@
9093
| map.cpp:226:7:226:9 | map.cpp:221:49:221:54 | AST only |
9194
| map.cpp:257:7:257:54 | map.cpp:257:39:257:44 | IR only |
9295
| map.cpp:258:7:258:54 | map.cpp:258:32:258:37 | IR only |
96+
| map.cpp:260:7:260:48 | map.cpp:260:34:260:39 | IR only |
9397
| map.cpp:263:7:263:8 | map.cpp:257:39:257:44 | AST only |
9498
| map.cpp:264:7:264:8 | map.cpp:258:32:258:37 | AST only |
9599
| map.cpp:265:7:265:8 | map.cpp:259:62:259:67 | AST only |
100+
| map.cpp:266:7:266:8 | map.cpp:260:34:260:39 | AST only |
101+
| map.cpp:267:7:267:8 | map.cpp:261:46:261:51 | AST only |
96102
| map.cpp:286:7:286:8 | map.cpp:257:39:257:44 | AST only |
97103
| map.cpp:287:7:287:8 | map.cpp:257:39:257:44 | AST only |
98104
| map.cpp:288:7:288:8 | map.cpp:257:39:257:44 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@
8181
| map.cpp:105:7:105:54 | call to iterator | map.cpp:105:39:105:44 | call to source |
8282
| map.cpp:106:7:106:54 | call to iterator | map.cpp:106:32:106:37 | call to source |
8383
| map.cpp:107:10:107:15 | call to insert | map.cpp:107:62:107:67 | call to source |
84+
| map.cpp:108:7:108:48 | call to iterator | map.cpp:108:34:108:39 | call to source |
85+
| map.cpp:109:10:109:25 | call to insert_or_assign | map.cpp:109:46:109:51 | call to source |
8486
| map.cpp:151:8:151:10 | call to pair | map.cpp:105:39:105:44 | call to source |
8587
| map.cpp:152:12:152:16 | first | map.cpp:105:39:105:44 | call to source |
8688
| map.cpp:153:12:153:17 | second | map.cpp:105:39:105:44 | call to source |
@@ -92,6 +94,8 @@
9294
| map.cpp:257:7:257:54 | call to iterator | map.cpp:257:39:257:44 | call to source |
9395
| map.cpp:258:7:258:54 | call to iterator | map.cpp:258:32:258:37 | call to source |
9496
| map.cpp:259:10:259:15 | call to insert | map.cpp:259:62:259:67 | call to source |
97+
| map.cpp:260:7:260:48 | call to iterator | map.cpp:260:34:260:39 | call to source |
98+
| map.cpp:261:10:261:25 | call to insert_or_assign | map.cpp:261:46:261:51 | call to source |
9599
| map.cpp:303:8:303:10 | call to pair | map.cpp:257:39:257:44 | call to source |
96100
| map.cpp:304:12:304:16 | first | map.cpp:257:39:257:44 | call to source |
97101
| map.cpp:305:12:305:17 | second | map.cpp:257:39:257:44 | call to source |

0 commit comments

Comments
 (0)