Skip to content

Commit f880494

Browse files
aschackmullaschackmull
committed
Java: Change in/out barriers to be explicit in the configuration.
1 parent 6d022aa commit f880494

File tree

4 files changed

+45
-13
lines changed

4 files changed

+45
-13
lines changed

‎java/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ class ExtremeSourceFlowConfig extends DataFlow::Configuration {
4040

4141
override predicate isSink(DataFlow::Node sink) { sink(_, sink.asExpr()) }
4242

43-
override predicate isBarrier(DataFlow::Node n) {
44-
n.getType() instanceof BooleanType or isSource(n)
45-
}
43+
override predicate isBarrierIn(DataFlow::Node n) { isSource(n) }
44+
45+
override predicate isBarrier(DataFlow::Node n) { n.getType() instanceof BooleanType }
4646
}
4747

4848
predicate sink(ArithExpr exp, VarAccess use) {

‎java/ql/src/semmle/code/java/dataflow/TaintTracking.qll‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,23 @@ module TaintTracking {
6363
node.asExpr() instanceof ValidatedVariableAccess
6464
}
6565

66-
/** DEPRECATED: override `isSanitizer` instead. */
66+
/** DEPRECATED: override `isSanitizerIn` and `isSanitizerOut` instead. */
6767
deprecated predicate isSanitizerEdge(DataFlow::Node node1, DataFlow::Node node2) { none() }
6868

6969
deprecated final override predicate isBarrierEdge(DataFlow::Node node1, DataFlow::Node node2) {
7070
isSanitizerEdge(node1, node2)
7171
}
7272

73+
/** Holds if data flow into `node` is prohibited. */
74+
predicate isSanitizerIn(DataFlow::Node node) { none() }
75+
76+
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
77+
78+
/** Holds if data flow out of `node` is prohibited. */
79+
predicate isSanitizerOut(DataFlow::Node node) { none() }
80+
81+
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
82+
7383
/**
7484
* Holds if the additional taint propagation step from `node1` to `node2`
7585
* must be taken into account in the analysis.
@@ -135,13 +145,23 @@ module TaintTracking {
135145
node.asExpr() instanceof ValidatedVariableAccess
136146
}
137147

138-
/** DEPRECATED: override `isSanitizer` instead. */
148+
/** DEPRECATED: override `isSanitizerIn` and `isSanitizerOut` instead. */
139149
deprecated predicate isSanitizerEdge(DataFlow::Node node1, DataFlow::Node node2) { none() }
140150

141151
deprecated final override predicate isBarrierEdge(DataFlow::Node node1, DataFlow::Node node2) {
142152
isSanitizerEdge(node1, node2)
143153
}
144154

155+
/** Holds if data flow into `node` is prohibited. */
156+
predicate isSanitizerIn(DataFlow::Node node) { none() }
157+
158+
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
159+
160+
/** Holds if data flow out of `node` is prohibited. */
161+
predicate isSanitizerOut(DataFlow::Node node) { none() }
162+
163+
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
164+
145165
/**
146166
* Holds if the additional taint propagation step from `node1` to `node2`
147167
* must be taken into account in the analysis.

‎java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,15 @@ abstract class Configuration extends string {
5757
/** Holds if data flow through `node` is prohibited. */
5858
predicate isBarrier(Node node) { none() }
5959

60-
/** DEPRECATED: override `isBarrier` instead. */
60+
/** DEPRECATED: override `isBarrierIn` and `isBarrierOut` instead. */
6161
deprecated predicate isBarrierEdge(Node node1, Node node2) { none() }
6262

63+
/** Holds if data flow into `node` is prohibited. */
64+
predicate isBarrierIn(Node node) { none() }
65+
66+
/** Holds if data flow out of `node` is prohibited. */
67+
predicate isBarrierOut(Node node) { none() }
68+
6369
/**
6470
* Holds if the additional flow step from `node1` to `node2` must be taken
6571
* into account in the analysis.
@@ -104,18 +110,22 @@ abstract class Configuration extends string {
104110
}
105111

106112
private predicate inBarrier(Node node, Configuration config) {
107-
config.isBarrier(node) and
113+
config.isBarrierIn(node) and
108114
config.isSource(node)
109115
}
110116

111117
private predicate outBarrier(Node node, Configuration config) {
112-
config.isBarrier(node) and
118+
config.isBarrierOut(node) and
113119
config.isSink(node)
114120
}
115121

116122
private predicate fullBarrier(Node node, Configuration config) {
117-
config.isBarrier(node) and
118-
not config.isSource(node) and
123+
config.isBarrier(node)
124+
or
125+
config.isBarrierIn(node) and
126+
not config.isSource(node)
127+
or
128+
config.isBarrierOut(node) and
119129
not config.isSink(node)
120130
}
121131

‎java/ql/test/library-tests/dataflow/inoutbarriers/test.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ class Conf2 extends Configuration {
2929

3030
override predicate isSink(Node n) { sink0(n) }
3131

32-
override predicate isBarrier(Node n) { src0(n) }
32+
override predicate isBarrierIn(Node n) { src0(n) }
3333
}
3434

3535
class Conf3 extends Configuration {
@@ -39,7 +39,7 @@ class Conf3 extends Configuration {
3939

4040
override predicate isSink(Node n) { sink0(n) }
4141

42-
override predicate isBarrier(Node n) { sink0(n) }
42+
override predicate isBarrierOut(Node n) { sink0(n) }
4343
}
4444

4545
class Conf4 extends Configuration {
@@ -49,7 +49,9 @@ class Conf4 extends Configuration {
4949

5050
override predicate isSink(Node n) { sink0(n) }
5151

52-
override predicate isBarrier(Node n) { src0(n) or sink0(n) }
52+
override predicate isBarrierIn(Node n) { src0(n) }
53+
54+
override predicate isBarrierOut(Node n) { sink0(n) }
5355
}
5456

5557
predicate flow(Node src, Node sink, string s) {

0 commit comments

Comments
 (0)