Skip to content

Commit eea8934

Browse files
jbjjbj
authored
Merge pull request #4209 from geoffw0/taintbits
C++: Fix a few remaining holes in taint through std::string
2 parents f92139d + 43d8e83 commit eea8934

File tree

6 files changed

+279
-29
lines changed

6 files changed

+279
-29
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* Provides implementation classes modeling `std::string` and other
3-
* instantiations of`std::basic_string`. See `semmle.code.cpp.models.Models`
3+
* instantiations of `std::basic_string`. See `semmle.code.cpp.models.Models`
44
* for usage information.
55
*/
66

@@ -82,6 +82,32 @@ class StdStringData extends TaintFunction {
8282
}
8383
}
8484

85+
/**
86+
* The `std::string` function `push_back`.
87+
*/
88+
class StdStringPush extends TaintFunction {
89+
StdStringPush() { this.hasQualifiedName("std", "basic_string", "push_back") }
90+
91+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
92+
// flow from parameter to qualifier
93+
input.isParameterDeref(0) and
94+
output.isQualifierObject()
95+
}
96+
}
97+
98+
/**
99+
* The `std::string` functions `front` and `back`.
100+
*/
101+
class StdStringFrontBack extends TaintFunction {
102+
StdStringFrontBack() { this.hasQualifiedName("std", "basic_string", ["front", "back"]) }
103+
104+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
105+
// flow from object to returned reference
106+
input.isQualifierObject() and
107+
output.isReturnValueDeref()
108+
}
109+
}
110+
85111
/**
86112
* The `std::string` function `operator+`.
87113
*/
@@ -138,6 +164,11 @@ class StdStringAppend extends TaintFunction {
138164
output.isQualifierObject() or
139165
output.isReturnValueDeref()
140166
)
167+
or
168+
// reverse flow from returned reference to the qualifier (for writes to
169+
// the result)
170+
input.isReturnValueDeref() and
171+
output.isQualifierObject()
141172
}
142173
}
143174

@@ -173,6 +204,11 @@ class StdStringAssign extends TaintFunction {
173204
output.isQualifierObject() or
174205
output.isReturnValueDeref()
175206
)
207+
or
208+
// reverse flow from returned reference to the qualifier (for writes to
209+
// the result)
210+
input.isReturnValueDeref() and
211+
output.isQualifierObject()
176212
}
177213
}
178214

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 142 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -461,12 +461,12 @@
461461
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:53:12:53:18 | source1 | |
462462
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
463463
| standalone_iterators.cpp:53:12:53:18 | ref arg source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
464-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
465-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
466-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
467-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
468-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
469-
| stl.h:172:53:172:63 | 0 | stl.h:172:46:172:64 | (no string representation) | TAINT |
464+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
465+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
466+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
467+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
468+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
469+
| stl.h:179:53:179:63 | 0 | stl.h:179:46:179:64 | (no string representation) | TAINT |
470470
| string.cpp:24:12:24:17 | call to source | string.cpp:28:7:28:7 | a | |
471471
| string.cpp:25:16:25:20 | 123 | string.cpp:25:16:25:21 | call to basic_string | TAINT |
472472
| string.cpp:25:16:25:21 | call to basic_string | string.cpp:29:7:29:7 | b | |
@@ -624,32 +624,32 @@
624624
| string.cpp:153:18:153:23 | call to basic_string | string.cpp:173:8:173:9 | s3 | |
625625
| string.cpp:154:18:154:23 | call to source | string.cpp:154:18:154:26 | call to basic_string | TAINT |
626626
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:157:13:157:14 | s4 | |
627-
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:161:9:161:10 | s4 | |
627+
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:161:14:161:15 | s4 | |
628628
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:170:13:170:14 | s4 | |
629629
| string.cpp:157:8:157:9 | s3 | string.cpp:157:11:157:11 | call to operator+ | TAINT |
630630
| string.cpp:157:11:157:11 | call to operator+ | string.cpp:157:3:157:14 | ... = ... | |
631631
| string.cpp:157:11:157:11 | call to operator+ | string.cpp:158:8:158:9 | s5 | |
632632
| string.cpp:157:13:157:14 | s4 | string.cpp:157:11:157:11 | call to operator+ | TAINT |
633633
| string.cpp:160:8:160:9 | s3 | string.cpp:160:3:160:9 | ... = ... | |
634-
| string.cpp:160:8:160:9 | s3 | string.cpp:161:3:161:4 | s6 | |
634+
| string.cpp:160:8:160:9 | s3 | string.cpp:161:8:161:9 | s6 | |
635635
| string.cpp:160:8:160:9 | s3 | string.cpp:162:8:162:9 | s6 | |
636-
| string.cpp:161:3:161:4 | ref arg s6 | string.cpp:162:8:162:9 | s6 | |
637-
| string.cpp:161:3:161:4 | s6 | string.cpp:161:6:161:6 | call to operator+= | TAINT |
638-
| string.cpp:161:9:161:10 | s4 | string.cpp:161:3:161:4 | ref arg s6 | TAINT |
639-
| string.cpp:161:9:161:10 | s4 | string.cpp:161:6:161:6 | call to operator+= | TAINT |
636+
| string.cpp:161:8:161:9 | ref arg s6 | string.cpp:162:8:162:9 | s6 | |
637+
| string.cpp:161:8:161:9 | s6 | string.cpp:161:11:161:11 | call to operator+= | TAINT |
638+
| string.cpp:161:14:161:15 | s4 | string.cpp:161:8:161:9 | ref arg s6 | TAINT |
639+
| string.cpp:161:14:161:15 | s4 | string.cpp:161:11:161:11 | call to operator+= | TAINT |
640640
| string.cpp:164:8:164:9 | s3 | string.cpp:164:3:164:9 | ... = ... | |
641-
| string.cpp:164:8:164:9 | s3 | string.cpp:165:3:165:4 | s7 | |
642-
| string.cpp:164:8:164:9 | s3 | string.cpp:166:3:166:4 | s7 | |
641+
| string.cpp:164:8:164:9 | s3 | string.cpp:165:8:165:9 | s7 | |
642+
| string.cpp:164:8:164:9 | s3 | string.cpp:166:8:166:9 | s7 | |
643643
| string.cpp:164:8:164:9 | s3 | string.cpp:167:8:167:9 | s7 | |
644-
| string.cpp:165:3:165:4 | ref arg s7 | string.cpp:166:3:166:4 | s7 | |
645-
| string.cpp:165:3:165:4 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
646-
| string.cpp:165:3:165:4 | s7 | string.cpp:165:6:165:6 | call to operator+= | TAINT |
647-
| string.cpp:165:9:165:14 | call to source | string.cpp:165:3:165:4 | ref arg s7 | TAINT |
648-
| string.cpp:165:9:165:14 | call to source | string.cpp:165:6:165:6 | call to operator+= | TAINT |
649-
| string.cpp:166:3:166:4 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
650-
| string.cpp:166:3:166:4 | s7 | string.cpp:166:6:166:6 | call to operator+= | TAINT |
651-
| string.cpp:166:9:166:11 | | string.cpp:166:3:166:4 | ref arg s7 | TAINT |
652-
| string.cpp:166:9:166:11 | | string.cpp:166:6:166:6 | call to operator+= | TAINT |
644+
| string.cpp:165:8:165:9 | ref arg s7 | string.cpp:166:8:166:9 | s7 | |
645+
| string.cpp:165:8:165:9 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
646+
| string.cpp:165:8:165:9 | s7 | string.cpp:165:11:165:11 | call to operator+= | TAINT |
647+
| string.cpp:165:14:165:19 | call to source | string.cpp:165:8:165:9 | ref arg s7 | TAINT |
648+
| string.cpp:165:14:165:19 | call to source | string.cpp:165:11:165:11 | call to operator+= | TAINT |
649+
| string.cpp:166:8:166:9 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
650+
| string.cpp:166:8:166:9 | s7 | string.cpp:166:11:166:11 | call to operator+= | TAINT |
651+
| string.cpp:166:14:166:16 | | string.cpp:166:8:166:9 | ref arg s7 | TAINT |
652+
| string.cpp:166:14:166:16 | | string.cpp:166:11:166:11 | call to operator+= | TAINT |
653653
| string.cpp:169:8:169:9 | s3 | string.cpp:169:3:169:9 | ... = ... | |
654654
| string.cpp:169:8:169:9 | s3 | string.cpp:170:3:170:4 | s8 | |
655655
| string.cpp:169:8:169:9 | s3 | string.cpp:171:8:171:9 | s8 | |
@@ -1237,6 +1237,125 @@
12371237
| string.cpp:501:29:501:30 | ref arg s2 | string.cpp:504:7:504:8 | s2 | |
12381238
| string.cpp:501:29:501:30 | s2 | string.cpp:501:32:501:34 | call to end | TAINT |
12391239
| string.cpp:501:32:501:34 | call to end | string.cpp:501:17:501:37 | call to basic_string | TAINT |
1240+
| string.cpp:510:16:510:19 | aa | string.cpp:510:16:510:20 | call to basic_string | TAINT |
1241+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:512:7:512:7 | a | |
1242+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:513:7:513:7 | a | |
1243+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:514:2:514:2 | a | |
1244+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:515:7:515:7 | a | |
1245+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:516:7:516:7 | a | |
1246+
| string.cpp:512:7:512:7 | a | string.cpp:512:9:512:13 | call to front | TAINT |
1247+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:513:7:513:7 | a | |
1248+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:514:2:514:2 | a | |
1249+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:515:7:515:7 | a | |
1250+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1251+
| string.cpp:513:7:513:7 | a | string.cpp:513:9:513:12 | call to back | TAINT |
1252+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:514:2:514:2 | a | |
1253+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:515:7:515:7 | a | |
1254+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1255+
| string.cpp:514:2:514:2 | ref arg a | string.cpp:515:7:515:7 | a | |
1256+
| string.cpp:514:2:514:2 | ref arg a | string.cpp:516:7:516:7 | a | |
1257+
| string.cpp:514:14:514:28 | call to source | string.cpp:514:2:514:2 | ref arg a | TAINT |
1258+
| string.cpp:515:7:515:7 | a | string.cpp:515:9:515:13 | call to front | TAINT |
1259+
| string.cpp:515:7:515:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1260+
| string.cpp:516:7:516:7 | a | string.cpp:516:9:516:12 | call to back | TAINT |
1261+
| string.cpp:521:17:521:20 | aa | string.cpp:521:17:521:21 | call to basic_string | TAINT |
1262+
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:528:9:528:9 | a | |
1263+
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:532:8:532:8 | a | |
1264+
| string.cpp:522:17:522:20 | bb | string.cpp:522:17:522:21 | call to basic_string | TAINT |
1265+
| string.cpp:522:17:522:21 | call to basic_string | string.cpp:528:15:528:15 | b | |
1266+
| string.cpp:522:17:522:21 | call to basic_string | string.cpp:533:8:533:8 | b | |
1267+
| string.cpp:523:17:523:20 | cc | string.cpp:523:17:523:21 | call to basic_string | TAINT |
1268+
| string.cpp:523:17:523:21 | call to basic_string | string.cpp:529:9:529:9 | c | |
1269+
| string.cpp:523:17:523:21 | call to basic_string | string.cpp:534:8:534:8 | c | |
1270+
| string.cpp:524:17:524:20 | dd | string.cpp:524:17:524:21 | call to basic_string | TAINT |
1271+
| string.cpp:524:17:524:21 | call to basic_string | string.cpp:529:15:529:15 | d | |
1272+
| string.cpp:524:17:524:21 | call to basic_string | string.cpp:535:8:535:8 | d | |
1273+
| string.cpp:525:17:525:20 | ee | string.cpp:525:17:525:21 | call to basic_string | TAINT |
1274+
| string.cpp:525:17:525:21 | call to basic_string | string.cpp:530:10:530:10 | e | |
1275+
| string.cpp:525:17:525:21 | call to basic_string | string.cpp:536:8:536:8 | e | |
1276+
| string.cpp:526:17:526:20 | ff | string.cpp:526:17:526:21 | call to basic_string | TAINT |
1277+
| string.cpp:526:17:526:21 | call to basic_string | string.cpp:531:10:531:10 | f | |
1278+
| string.cpp:526:17:526:21 | call to basic_string | string.cpp:537:8:537:8 | f | |
1279+
| string.cpp:528:9:528:9 | a | string.cpp:528:11:528:11 | call to operator+= | TAINT |
1280+
| string.cpp:528:9:528:9 | ref arg a | string.cpp:532:8:532:8 | a | |
1281+
| string.cpp:528:15:528:15 | b | string.cpp:528:17:528:17 | call to operator+= | TAINT |
1282+
| string.cpp:528:15:528:15 | ref arg b | string.cpp:533:8:533:8 | b | |
1283+
| string.cpp:528:17:528:17 | call to operator+= | string.cpp:528:9:528:9 | ref arg a | TAINT |
1284+
| string.cpp:528:17:528:17 | call to operator+= | string.cpp:528:11:528:11 | call to operator+= | TAINT |
1285+
| string.cpp:528:20:528:23 | bb | string.cpp:528:15:528:15 | ref arg b | TAINT |
1286+
| string.cpp:528:20:528:23 | bb | string.cpp:528:17:528:17 | call to operator+= | TAINT |
1287+
| string.cpp:529:9:529:9 | c | string.cpp:529:11:529:11 | call to operator+= | TAINT |
1288+
| string.cpp:529:9:529:9 | ref arg c | string.cpp:534:8:534:8 | c | |
1289+
| string.cpp:529:15:529:15 | d | string.cpp:529:17:529:17 | call to operator+= | TAINT |
1290+
| string.cpp:529:15:529:15 | ref arg d | string.cpp:535:8:535:8 | d | |
1291+
| string.cpp:529:17:529:17 | call to operator+= | string.cpp:529:9:529:9 | ref arg c | TAINT |
1292+
| string.cpp:529:17:529:17 | call to operator+= | string.cpp:529:11:529:11 | call to operator+= | TAINT |
1293+
| string.cpp:529:20:529:25 | call to source | string.cpp:529:15:529:15 | ref arg d | TAINT |
1294+
| string.cpp:529:20:529:25 | call to source | string.cpp:529:17:529:17 | call to operator+= | TAINT |
1295+
| string.cpp:530:10:530:10 | e | string.cpp:530:12:530:12 | call to operator+= | TAINT |
1296+
| string.cpp:530:10:530:10 | ref arg e | string.cpp:536:8:536:8 | e | |
1297+
| string.cpp:530:12:530:12 | call to operator+= | string.cpp:530:21:530:21 | call to operator+= | TAINT |
1298+
| string.cpp:530:12:530:12 | ref arg call to operator+= | string.cpp:530:10:530:10 | ref arg e | TAINT |
1299+
| string.cpp:530:15:530:18 | ee | string.cpp:530:10:530:10 | ref arg e | TAINT |
1300+
| string.cpp:530:15:530:18 | ee | string.cpp:530:12:530:12 | call to operator+= | TAINT |
1301+
| string.cpp:530:24:530:29 | call to source | string.cpp:530:12:530:12 | ref arg call to operator+= | TAINT |
1302+
| string.cpp:530:24:530:29 | call to source | string.cpp:530:21:530:21 | call to operator+= | TAINT |
1303+
| string.cpp:531:10:531:10 | f | string.cpp:531:12:531:12 | call to operator+= | TAINT |
1304+
| string.cpp:531:10:531:10 | ref arg f | string.cpp:537:8:537:8 | f | |
1305+
| string.cpp:531:12:531:12 | call to operator+= | string.cpp:531:25:531:25 | call to operator+= | TAINT |
1306+
| string.cpp:531:12:531:12 | ref arg call to operator+= | string.cpp:531:10:531:10 | ref arg f | TAINT |
1307+
| string.cpp:531:15:531:20 | call to source | string.cpp:531:10:531:10 | ref arg f | TAINT |
1308+
| string.cpp:531:15:531:20 | call to source | string.cpp:531:12:531:12 | call to operator+= | TAINT |
1309+
| string.cpp:531:28:531:31 | ff | string.cpp:531:12:531:12 | ref arg call to operator+= | TAINT |
1310+
| string.cpp:531:28:531:31 | ff | string.cpp:531:25:531:25 | call to operator+= | TAINT |
1311+
| string.cpp:541:17:541:20 | aa | string.cpp:541:17:541:21 | call to basic_string | TAINT |
1312+
| string.cpp:541:17:541:21 | call to basic_string | string.cpp:548:9:548:9 | a | |
1313+
| string.cpp:541:17:541:21 | call to basic_string | string.cpp:552:8:552:8 | a | |
1314+
| string.cpp:542:17:542:20 | bb | string.cpp:542:17:542:21 | call to basic_string | TAINT |
1315+
| string.cpp:542:17:542:21 | call to basic_string | string.cpp:548:18:548:18 | b | |
1316+
| string.cpp:542:17:542:21 | call to basic_string | string.cpp:553:8:553:8 | b | |
1317+
| string.cpp:543:17:543:20 | cc | string.cpp:543:17:543:21 | call to basic_string | TAINT |
1318+
| string.cpp:543:17:543:21 | call to basic_string | string.cpp:549:9:549:9 | c | |
1319+
| string.cpp:543:17:543:21 | call to basic_string | string.cpp:554:8:554:8 | c | |
1320+
| string.cpp:544:17:544:20 | dd | string.cpp:544:17:544:21 | call to basic_string | TAINT |
1321+
| string.cpp:544:17:544:21 | call to basic_string | string.cpp:549:18:549:18 | d | |
1322+
| string.cpp:544:17:544:21 | call to basic_string | string.cpp:555:8:555:8 | d | |
1323+
| string.cpp:545:17:545:20 | ee | string.cpp:545:17:545:21 | call to basic_string | TAINT |
1324+
| string.cpp:545:17:545:21 | call to basic_string | string.cpp:550:9:550:9 | e | |
1325+
| string.cpp:545:17:545:21 | call to basic_string | string.cpp:556:8:556:8 | e | |
1326+
| string.cpp:546:17:546:20 | ff | string.cpp:546:17:546:21 | call to basic_string | TAINT |
1327+
| string.cpp:546:17:546:21 | call to basic_string | string.cpp:551:9:551:9 | f | |
1328+
| string.cpp:546:17:546:21 | call to basic_string | string.cpp:557:8:557:8 | f | |
1329+
| string.cpp:548:9:548:9 | ref arg a | string.cpp:552:8:552:8 | a | |
1330+
| string.cpp:548:18:548:18 | ref arg b | string.cpp:553:8:553:8 | b | |
1331+
| string.cpp:548:20:548:25 | call to assign | string.cpp:548:9:548:9 | ref arg a | TAINT |
1332+
| string.cpp:548:20:548:25 | call to assign | string.cpp:548:11:548:16 | call to assign | TAINT |
1333+
| string.cpp:548:27:548:30 | bb | string.cpp:548:27:548:30 | call to basic_string | TAINT |
1334+
| string.cpp:548:27:548:30 | call to basic_string | string.cpp:548:18:548:18 | ref arg b | TAINT |
1335+
| string.cpp:548:27:548:30 | call to basic_string | string.cpp:548:20:548:25 | call to assign | TAINT |
1336+
| string.cpp:549:9:549:9 | ref arg c | string.cpp:554:8:554:8 | c | |
1337+
| string.cpp:549:18:549:18 | ref arg d | string.cpp:555:8:555:8 | d | |
1338+
| string.cpp:549:20:549:25 | call to assign | string.cpp:549:9:549:9 | ref arg c | TAINT |
1339+
| string.cpp:549:20:549:25 | call to assign | string.cpp:549:11:549:16 | call to assign | TAINT |
1340+
| string.cpp:549:27:549:32 | call to source | string.cpp:549:27:549:34 | call to basic_string | TAINT |
1341+
| string.cpp:549:27:549:34 | call to basic_string | string.cpp:549:18:549:18 | ref arg d | TAINT |
1342+
| string.cpp:549:27:549:34 | call to basic_string | string.cpp:549:20:549:25 | call to assign | TAINT |
1343+
| string.cpp:550:9:550:9 | ref arg e | string.cpp:556:8:556:8 | e | |
1344+
| string.cpp:550:11:550:16 | ref arg call to assign | string.cpp:550:9:550:9 | ref arg e | TAINT |
1345+
| string.cpp:550:18:550:21 | call to basic_string | string.cpp:550:9:550:9 | ref arg e | TAINT |
1346+
| string.cpp:550:18:550:21 | call to basic_string | string.cpp:550:11:550:16 | call to assign | TAINT |
1347+
| string.cpp:550:18:550:21 | ee | string.cpp:550:18:550:21 | call to basic_string | TAINT |
1348+
| string.cpp:550:31:550:36 | call to source | string.cpp:550:31:550:38 | call to basic_string | TAINT |
1349+
| string.cpp:550:31:550:38 | call to basic_string | string.cpp:550:11:550:16 | ref arg call to assign | TAINT |
1350+
| string.cpp:550:31:550:38 | call to basic_string | string.cpp:550:24:550:29 | call to assign | TAINT |
1351+
| string.cpp:551:9:551:9 | ref arg f | string.cpp:557:8:557:8 | f | |
1352+
| string.cpp:551:11:551:16 | ref arg call to assign | string.cpp:551:9:551:9 | ref arg f | TAINT |
1353+
| string.cpp:551:18:551:23 | call to source | string.cpp:551:18:551:25 | call to basic_string | TAINT |
1354+
| string.cpp:551:18:551:25 | call to basic_string | string.cpp:551:9:551:9 | ref arg f | TAINT |
1355+
| string.cpp:551:18:551:25 | call to basic_string | string.cpp:551:11:551:16 | call to assign | TAINT |
1356+
| string.cpp:551:35:551:38 | call to basic_string | string.cpp:551:11:551:16 | ref arg call to assign | TAINT |
1357+
| string.cpp:551:35:551:38 | call to basic_string | string.cpp:551:28:551:33 | call to assign | TAINT |
1358+
| string.cpp:551:35:551:38 | ff | string.cpp:551:35:551:38 | call to basic_string | TAINT |
12401359
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:16:2:16:4 | ss1 | |
12411360
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:22:7:22:9 | ss1 | |
12421361
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:27:7:27:9 | ss1 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,13 @@ namespace std
9191
const_iterator cbegin() const;
9292
const_iterator cend() const;
9393

94+
void push_back(charT c);
95+
96+
const charT& front() const;
97+
charT& front();
98+
const charT& back() const;
99+
charT& back();
100+
94101
const_reference operator[](size_type pos) const;
95102
reference operator[](size_type pos);
96103
const_reference at(size_type n) const;

0 commit comments

Comments
 (0)