-
Notifications
You must be signed in to change notification settings - Fork 2k
Expand file tree
/
Copy pathflow.ql
More file actions
60 lines (46 loc) · 1.63 KB
/
flow.ql
File metadata and controls
60 lines (46 loc) · 1.63 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
import java
import semmle.code.java.dataflow.DataFlow
import utils.test.InlineExpectationsTest
module Base {
predicate isSource(DataFlow::Node n) { n.asExpr().(MethodCall).getMethod().hasName("source") }
predicate isSink(DataFlow::Node n) {
exists(MethodCall ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
}
}
module ConfigSourceCc implements DataFlow::ConfigSig {
import Base
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
}
module ConfigSinkCc implements DataFlow::ConfigSig {
import Base
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSinkCallContext }
}
module ConfigEqualCc implements DataFlow::ConfigSig {
import Base
DataFlow::FlowFeature getAFeature() {
result instanceof DataFlow::FeatureEqualSourceSinkCallContext
}
}
module FlowSourceCc = DataFlow::Global<ConfigSourceCc>;
module FlowSinkCc = DataFlow::Global<ConfigSinkCc>;
module FlowEqualCc = DataFlow::Global<ConfigEqualCc>;
module HasFlowTest implements TestSig {
string getARelevantTag() { result = ["SrcCc", "SinkCc", "EqCc"] }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(DataFlow::Node src, DataFlow::Node sink |
tag = "SrcCc" and
FlowSourceCc::flow(src, sink)
or
tag = "SinkCc" and
FlowSinkCc::flow(src, sink)
or
tag = "EqCc" and
FlowEqualCc::flow(src, sink)
|
sink.getLocation() = location and
element = sink.toString() and
value = src.asExpr().(MethodCall).getAnArgument().toString()
)
}
}
import MakeTest<HasFlowTest>