@@ -724,18 +724,16 @@ private predicate readStoreNode(
724724
725725private newtype TNodeExt =
726726 TNormalNode ( Node node ) { nodeCand1 ( node , _) } or
727- TReadStoreNode ( DataFlowCall call , ArgumentNode arg , Content f1 ) {
728- exists ( Configuration config |
729- nodeCand1 ( arg , config ) and
730- readStoreNode ( call , arg , f1 , config ) and
731- readStoreCand1 ( f1 , unbind ( config ) )
732- )
727+ TReadStoreNode ( DataFlowCall call , ArgumentNode arg , Content f1 , Configuration config ) {
728+ nodeCand1 ( arg , config ) and
729+ readStoreNode ( call , arg , f1 , config ) and
730+ readStoreCand1 ( f1 , unbind ( config ) )
733731 } or
734732 TReadTaintNode ( ArgumentNode arg , Content f , Configuration config ) {
735733 argumentFlowsThrough ( arg , _, _, _, TSummaryReadTaint ( f ) , config )
736734 } or
737- TTaintStoreNode ( ArgumentNode arg , Content f , DataFlowType t , Configuration config ) {
738- argumentFlowsThrough ( arg , _, t , _, TSummaryTaintStore ( f ) , config )
735+ TTaintStoreNode ( ArgumentNode arg , DataFlowType t , Configuration config ) {
736+ argumentFlowsThrough ( arg , _, t , _, TSummaryTaintStore ( _ ) , config )
739737 }
740738
741739/**
@@ -794,23 +792,24 @@ private class ReadStoreNodeExt extends CastingNodeExt, TReadStoreNode {
794792 private DataFlowCall call ;
795793 private ArgumentNode arg ;
796794 private Content f1 ;
795+ private Configuration config0 ;
797796
798- ReadStoreNodeExt ( ) { this = TReadStoreNode ( call , arg , f1 ) }
797+ ReadStoreNodeExt ( ) { this = TReadStoreNode ( call , arg , f1 , config0 ) }
799798
800799 override Node getNode ( ) { none ( ) }
801800
802801 override DataFlowType getErasedNodeTypeBound ( ) { result = f1 .getType ( ) }
803802
804803 override DataFlowCallable getEnclosingCallable ( ) { result = arg .getEnclosingCallable ( ) }
805804
806- override predicate isCand1 ( Configuration config ) { nodeCand1 ( arg , config ) }
805+ override predicate isCand1 ( Configuration config ) { config = config0 }
807806
808807 override string toString ( ) { result = "(inside) " + call .toString ( ) + " [read " + f1 + "]" }
809808
810809 override predicate hasLocationInfo (
811810 string filepath , int startline , int startcolumn , int endline , int endcolumn
812811 ) {
813- call .getLocation ( ) .hasLocationInfo ( filepath , startline , startcolumn , endline , endcolumn )
812+ arg .getLocation ( ) .hasLocationInfo ( filepath , startline , startcolumn , endline , endcolumn )
814813 }
815814}
816815
@@ -840,11 +839,10 @@ private class ReadTaintNode extends NodeExt, TReadTaintNode {
840839
841840private class TaintStoreNode extends NodeExt , TTaintStoreNode {
842841 private ArgumentNode arg ;
843- private Content f ;
844842 private DataFlowType t ;
845843 private Configuration config0 ;
846844
847- TaintStoreNode ( ) { this = TTaintStoreNode ( arg , f , t , config0 ) }
845+ TaintStoreNode ( ) { this = TTaintStoreNode ( arg , t , config0 ) }
848846
849847 override Node getNode ( ) { none ( ) }
850848
@@ -854,7 +852,7 @@ private class TaintStoreNode extends NodeExt, TTaintStoreNode {
854852
855853 override predicate isCand1 ( Configuration config ) { config = config0 }
856854
857- override string toString ( ) { result = arg .toString ( ) + " [taint store " + f + " ]" }
855+ override string toString ( ) { result = arg .toString ( ) + " [taint store]" }
858856
859857 override predicate hasLocationInfo (
860858 string filepath , int startline , int startcolumn , int endline , int endcolumn
@@ -871,15 +869,14 @@ private predicate additionalLocalFlowStepExt(
871869 argumentFlowsThrough ( arg , node2 .getNode ( ) , _, t , TSummaryReadTaint ( f ) , config )
872870 )
873871 or
874- node2 = TTaintStoreNode ( node1 .getNode ( ) , _ , t , config )
872+ node2 = TTaintStoreNode ( node1 .getNode ( ) , t , config )
875873}
876874
877875pragma [ nomagic]
878876private predicate readExt ( NodeExt node1 , Content f , NodeExt node2 , Configuration config ) {
879877 read ( node1 .getNode ( ) , f , node2 .getNode ( ) , config )
880878 or
881- node2 = TReadStoreNode ( _, node1 .getNode ( ) , f ) and
882- node2 .isCand1 ( config )
879+ node2 = TReadStoreNode ( _, node1 .getNode ( ) , f , config )
883880 or
884881 node2 = TReadTaintNode ( node1 .getNode ( ) , f , config )
885882}
@@ -889,15 +886,15 @@ private predicate storeExt(NodeExt node1, Content f, NodeExt node2, Configuratio
889886 store ( node1 .getNode ( ) , f , node2 .getNode ( ) , config )
890887 or
891888 exists ( DataFlowCall call , ArgumentNode arg , Content f1 , Node n2 |
892- node1 = TReadStoreNode ( call , arg , f1 ) and
889+ node1 = TReadStoreNode ( call , arg , f1 , config ) and
893890 n2 = node2 .getNode ( ) and
894891 argumentValueFlowsThrough ( call , arg , TContentSome ( f1 ) , TContentSome ( f ) , n2 ) and
895- nodeCand1 ( n2 , config ) and
892+ nodeCand1 ( n2 , unbind ( config ) ) and
896893 readStoreCand1 ( f , unbind ( config ) )
897894 )
898895 or
899896 exists ( ArgumentNode arg , DataFlowType t |
900- node1 = TTaintStoreNode ( arg , f , t , config ) and
897+ node1 = TTaintStoreNode ( arg , t , config ) and
901898 argumentFlowsThrough ( arg , node2 .getNode ( ) , t , _, TSummaryTaintStore ( f ) , config )
902899 )
903900}
@@ -1266,7 +1263,7 @@ private predicate flowOutOfCallableNodeCand2(
12661263 NodeExt node1 , NodeExt node2 , boolean allowsFieldFlow , Configuration config
12671264) {
12681265 flowOutOfCallableNodeCand1 ( node1 , node2 , allowsFieldFlow , config ) and
1269- nodeCand2 ( node2 , _ , _ , config ) and
1266+ nodeCand2 ( node2 , config ) and
12701267 nodeCand2 ( node1 , unbind ( config ) )
12711268}
12721269
@@ -1275,7 +1272,7 @@ private predicate flowIntoCallableNodeCand2(
12751272 NodeExt node1 , NodeExt node2 , boolean allowsFieldFlow , Configuration config
12761273) {
12771274 flowIntoCallableNodeCand1 ( node1 , node2 , allowsFieldFlow , config ) and
1278- nodeCand2 ( node2 , _ , _ , config ) and
1275+ nodeCand2 ( node2 , config ) and
12791276 nodeCand2 ( node1 , unbind ( config ) )
12801277}
12811278
0 commit comments