-
Notifications
You must be signed in to change notification settings - Fork 2k
Expand file tree
/
Copy pathFoo.qll
More file actions
79 lines (63 loc) · 1.58 KB
/
Foo.qll
File metadata and controls
79 lines (63 loc) · 1.58 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
predicate isLeft(string s) { none() }
predicate isRight(string s) { none() }
predicate disjunct() {
exists(string x |
x = "left_1" and
isLeft(x) // $ getAStringValue=left_1
or
x = "right_1" and
isRight(x) // $ getAStringValue=right_1
)
}
string sourceLeft2() { result = "left_2" }
predicate sinkLeft2(string x) {
isLeft(x) // $ getAStringValue=left_2
}
string sourceRight2() { result = "right_2" }
predicate sinkRight2(string x) {
isRight(x) // $ getAStringValue=right_2
}
predicate disjunctViaCall() {
exists(string x |
x = sourceLeft2() and
sinkLeft2(x) // $ getAStringValue=left_2
or
x = sourceRight2() and
sinkRight2(x) // $ getAStringValue=right_2
)
}
predicate distribute() {
exists(string x |
x = "left_3"
or
x = "right_3"
|
isLeft(x) // $ getAStringValue=left_3 getAStringValue=right_3
or
isRight(x) // $ getAStringValue=left_3 getAStringValue=right_3
)
}
predicate distributeSet() {
exists(string x | x = ["left_4", "right_4"] |
isLeft(x) // $ getAStringValue=left_4 getAStringValue=right_4
or
isRight(x) // $ getAStringValue=left_4 getAStringValue=right_4
)
}
predicate noFlowBackOut() {
exists(string x |
isLeft(x) // no value
)
}
class StringClass extends string {
StringClass() { this = "StringClass" }
}
class FieldClass extends int {
StringClass field;
FieldClass() { this = 0 }
StringClass getField() { result = field }
}
predicate isStringClass(string s) { none() }
predicate test() {
isStringClass(any(FieldClass f).getField()) // $ getAStringValue=StringClass
}