Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 09df318

Browse files
MathiasVPMathiasVP
committed
C++: Also track flow out of indirect sources.
1 parent a806569 commit 09df318

2 files changed

Lines changed: 4 additions & 64 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -15,42 +15,27 @@
1515
| smart_pointer.cpp:38:14:38:24 | // $ ast,ir | Missing result:ir= |
1616
| smart_pointer.cpp:46:14:46:24 | // $ ast,ir | Missing result:ir= |
1717
| string.cpp:31:11:31:21 | // $ ast,ir | Missing result:ir= |
18-
| string.cpp:33:19:33:29 | // $ ast,ir | Missing result:ir= |
19-
| string.cpp:39:28:39:38 | // $ ast,ir | Missing result:ir= |
20-
| string.cpp:43:28:43:38 | // $ ast,ir | Missing result:ir= |
21-
| string.cpp:46:28:46:38 | // $ ast,ir | Missing result:ir= |
2218
| string.cpp:57:12:57:22 | // $ ast,ir | Missing result:ir= |
23-
| string.cpp:70:12:70:22 | // $ ast,ir | Missing result:ir= |
2419
| string.cpp:71:12:71:22 | // $ ast,ir | Missing result:ir= |
2520
| string.cpp:93:13:93:23 | // $ ast,ir | Missing result:ir= |
2621
| string.cpp:94:13:94:23 | // $ ast,ir | Missing result:ir= |
2722
| string.cpp:95:13:95:23 | // $ ast,ir | Missing result:ir= |
2823
| string.cpp:114:13:114:23 | // $ ast,ir | Missing result:ir= |
2924
| string.cpp:115:13:115:23 | // $ ast,ir | Missing result:ir= |
3025
| string.cpp:159:13:159:23 | // $ ast,ir | Missing result:ir= |
31-
| string.cpp:162:19:162:29 | // $ ast,ir | Missing result:ir= |
3226
| string.cpp:163:13:163:23 | // $ ast,ir | Missing result:ir= |
33-
| string.cpp:167:20:167:30 | // $ ast,ir | Missing result:ir= |
3427
| string.cpp:168:13:168:23 | // $ ast,ir | Missing result:ir= |
3528
| string.cpp:172:13:172:23 | // $ ast,ir | Missing result:ir= |
3629
| string.cpp:177:13:177:23 | // $ ast,ir | Missing result:ir= |
3730
| string.cpp:185:14:185:24 | // $ ast,ir | Missing result:ir= |
38-
| string.cpp:199:23:199:33 | // $ ast,ir | Missing result:ir= |
3931
| string.cpp:200:12:200:22 | // $ ast,ir | Missing result:ir= |
40-
| string.cpp:202:26:202:36 | // $ ast,ir | Missing result:ir= |
4132
| string.cpp:203:12:203:22 | // $ ast,ir | Missing result:ir= |
4233
| string.cpp:206:12:206:32 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
43-
| string.cpp:220:26:220:36 | // $ ast,ir | Missing result:ir= |
4434
| string.cpp:221:12:221:22 | // $ ast,ir | Missing result:ir= |
45-
| string.cpp:224:26:224:36 | // $ ast,ir | Missing result:ir= |
4635
| string.cpp:225:12:225:22 | // $ ast,ir | Missing result:ir= |
47-
| string.cpp:228:29:228:39 | // $ ast,ir | Missing result:ir= |
4836
| string.cpp:229:12:229:22 | // $ ast,ir | Missing result:ir= |
49-
| string.cpp:243:30:243:40 | // $ ast,ir | Missing result:ir= |
5037
| string.cpp:244:12:244:22 | // $ ast,ir | Missing result:ir= |
51-
| string.cpp:247:30:247:40 | // $ ast,ir | Missing result:ir= |
5238
| string.cpp:248:12:248:22 | // $ ast,ir | Missing result:ir= |
53-
| string.cpp:251:33:251:43 | // $ ast,ir | Missing result:ir= |
5439
| string.cpp:252:12:252:22 | // $ ast,ir | Missing result:ir= |
5540
| string.cpp:265:12:265:22 | // $ ast,ir | Missing result:ir= |
5641
| string.cpp:275:12:275:22 | // $ ast,ir | Missing result:ir= |
@@ -64,36 +49,25 @@
6449
| string.cpp:295:12:295:22 | // $ ast,ir | Missing result:ir= |
6550
| string.cpp:301:12:301:32 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
6651
| string.cpp:303:12:303:22 | // $ ast,ir | Missing result:ir= |
67-
| string.cpp:312:18:312:28 | // $ ast,ir | Missing result:ir= |
6852
| string.cpp:340:11:340:21 | // $ ast,ir | Missing result:ir= |
6953
| string.cpp:341:11:341:21 | // $ ast,ir | Missing result:ir= |
7054
| string.cpp:342:11:342:21 | // $ ast,ir | Missing result:ir= |
7155
| string.cpp:350:13:350:23 | // $ ast,ir | Missing result:ir= |
72-
| string.cpp:351:20:351:30 | // $ ast,ir | Missing result:ir= |
73-
| string.cpp:363:42:363:52 | // $ ast,ir | Missing result:ir= |
7456
| string.cpp:364:13:364:23 | // $ ast,ir | Missing result:ir= |
75-
| string.cpp:436:27:436:37 | // $ ast,ir | Missing result:ir= |
7657
| string.cpp:437:12:437:22 | // $ ast,ir | Missing result:ir= |
7758
| string.cpp:450:12:450:22 | // $ ast,ir | Missing result:ir= |
7859
| string.cpp:463:12:463:22 | // $ ast,ir | Missing result:ir= |
7960
| string.cpp:466:13:466:23 | // $ ast,ir | Missing result:ir= |
80-
| string.cpp:478:41:478:51 | // $ ast,ir | Missing result:ir= |
8161
| string.cpp:479:12:479:22 | // $ ast,ir | Missing result:ir= |
82-
| string.cpp:481:42:481:52 | // $ ast,ir | Missing result:ir= |
8362
| string.cpp:482:13:482:23 | // $ ast,ir | Missing result:ir= |
84-
| string.cpp:494:43:494:53 | // $ ast,ir | Missing result:ir= |
8563
| string.cpp:495:12:495:22 | // $ ast,ir | Missing result:ir= |
8664
| string.cpp:498:13:498:33 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
8765
| string.cpp:511:12:511:22 | // $ ast,ir | Missing result:ir= |
8866
| string.cpp:513:12:513:22 | // $ ast,ir | Missing result:ir= |
89-
| string.cpp:536:33:536:43 | // $ ast,ir | Missing result:ir= |
90-
| string.cpp:538:36:538:46 | // $ ast,ir | Missing result:ir= |
9167
| string.cpp:541:12:541:22 | // $ ast,ir | Missing result:ir= |
9268
| string.cpp:542:12:542:22 | // $ ast,ir | Missing result:ir= |
9369
| string.cpp:543:12:543:22 | // $ ast,ir | Missing result:ir= |
9470
| string.cpp:544:12:544:22 | // $ ast,ir | Missing result:ir= |
95-
| string.cpp:556:41:556:51 | // $ ast,ir | Missing result:ir= |
96-
| string.cpp:557:44:557:54 | // $ ast,ir | Missing result:ir= |
9771
| string.cpp:561:12:561:22 | // $ ast,ir | Missing result:ir= |
9872
| string.cpp:562:12:562:22 | // $ ast,ir | Missing result:ir= |
9973
| string.cpp:563:12:563:22 | // $ ast,ir | Missing result:ir= |
@@ -104,18 +78,11 @@
10478
| stringstream.cpp:41:13:41:23 | // $ ast,ir | Missing result:ir= |
10579
| stringstream.cpp:52:13:52:23 | // $ ast,ir | Missing result:ir= |
10680
| stringstream.cpp:53:13:53:33 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
107-
| stringstream.cpp:56:36:56:46 | // $ ast,ir | Missing result:ir= |
108-
| stringstream.cpp:57:55:57:65 | // $ ast,ir | Missing result:ir= |
10981
| stringstream.cpp:59:13:59:23 | // $ ast,ir | Missing result:ir= |
11082
| stringstream.cpp:60:14:60:24 | // $ ast,ir | Missing result:ir= |
111-
| stringstream.cpp:63:33:63:43 | // $ ast,ir | Missing result:ir= |
112-
| stringstream.cpp:64:72:64:82 | // $ ast,ir | Missing result:ir= |
11383
| stringstream.cpp:66:14:66:24 | // $ ast,ir | Missing result:ir= |
11484
| stringstream.cpp:67:14:67:24 | // $ ast,ir | Missing result:ir= |
115-
| stringstream.cpp:76:23:76:33 | // $ ast,ir | Missing result:ir= |
116-
| stringstream.cpp:78:19:78:29 | // $ ast,ir | Missing result:ir= |
11785
| stringstream.cpp:81:13:81:23 | // $ ast,ir | Missing result:ir= |
118-
| stringstream.cpp:100:43:100:53 | // $ ast,ir | Missing result:ir= |
11986
| stringstream.cpp:103:13:103:23 | // $ ast,ir | Missing result:ir= |
12087
| stringstream.cpp:105:13:105:23 | // $ ast,ir | Missing result:ir= |
12188
| stringstream.cpp:107:13:107:23 | // $ ast,ir | Missing result:ir= |
@@ -126,41 +93,15 @@
12693
| stringstream.cpp:149:12:149:22 | // $ ast,ir | Missing result:ir= |
12794
| stringstream.cpp:150:12:150:22 | // $ ast,ir | Missing result:ir= |
12895
| stringstream.cpp:151:12:151:22 | // $ ast,ir | Missing result:ir= |
129-
| stringstream.cpp:162:27:162:37 | // $ ast,ir | Missing result:ir= |
130-
| stringstream.cpp:166:27:166:37 | // $ ast,ir | Missing result:ir= |
131-
| stringstream.cpp:179:21:179:31 | // $ ast,ir | Missing result:ir= |
132-
| stringstream.cpp:196:39:196:49 | // $ ast,ir | Missing result:ir= |
133-
| stringstream.cpp:215:31:215:41 | // $ ast,ir | Missing result:ir= |
134-
| stringstream.cpp:216:31:216:41 | // $ ast,ir | Missing result:ir= |
135-
| stringstream.cpp:223:36:223:46 | // $ ast,ir | Missing result:ir= |
136-
| stringstream.cpp:224:36:224:46 | // $ ast,ir | Missing result:ir= |
137-
| stringstream.cpp:230:49:230:59 | // $ ast,ir | Missing result:ir= |
13896
| stringstream.cpp:239:12:239:22 | // $ ast,ir | Missing result:ir= |
13997
| stringstream.cpp:240:12:240:32 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
14098
| stringstream.cpp:247:12:247:22 | // $ ast,ir | Missing result:ir= |
14199
| stringstream.cpp:248:12:248:32 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
142100
| stringstream.cpp:251:12:251:22 | // $ ast,ir | Missing result:ir= |
143101
| stringstream.cpp:252:12:252:22 | // $ ast,ir | Missing result:ir= |
144-
| stringstream.cpp:262:47:262:57 | // $ ast,ir | Missing result:ir= |
145-
| stringstream.cpp:266:80:266:90 | // $ ast,ir | Missing result:ir= |
146102
| stringstream.cpp:267:13:267:23 | // $ ast,ir | Missing result:ir= |
147103
| taint.cpp:173:17:173:27 | // $ ast,ir | Missing result:ir= |
148-
| taint.cpp:374:11:374:21 | // $ ast,ir | Missing result:ir= |
149-
| taint.cpp:376:11:376:21 | // $ ast,ir | Missing result:ir= |
150-
| taint.cpp:384:11:384:21 | // $ ast,ir | Missing result:ir= |
151-
| taint.cpp:393:11:393:21 | // $ ast,ir | Missing result:ir= |
152-
| taint.cpp:404:11:404:21 | // $ ast,ir | Missing result:ir= |
153-
| taint.cpp:406:11:406:21 | // $ ast,ir | Missing result:ir= |
154-
| taint.cpp:414:11:414:21 | // $ ast,ir | Missing result:ir= |
155-
| taint.cpp:460:11:460:21 | // $ ast,ir | Missing result:ir= |
156-
| taint.cpp:469:23:469:33 | // $ ast,ir | Missing result:ir= |
157-
| taint.cpp:527:13:527:33 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
158104
| taint.cpp:553:14:553:51 | // $ ast=550:24 ir SPURIOUS: ast=551:6 | Missing result:ir= |
159-
| taint.cpp:562:15:562:25 | // $ ast,ir | Missing result:ir= |
160-
| taint.cpp:575:15:575:35 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
161-
| taint.cpp:668:19:668:29 | // $ ast,ir | Missing result:ir= |
162-
| taint.cpp:680:19:680:29 | // $ ast,ir | Missing result:ir= |
163-
| taint.cpp:694:13:694:23 | // $ ast,ir | Missing result:ir= |
164105
| vector.cpp:52:12:52:22 | // $ ast,ir | Missing result:ir= |
165106
| vector.cpp:58:12:58:22 | // $ ast,ir | Missing result:ir= |
166107
| vector.cpp:64:12:64:22 | // $ ast,ir | Missing result:ir= |
@@ -190,9 +131,7 @@
190131
| vector.cpp:274:13:274:23 | // $ ast,ir | Missing result:ir= |
191132
| vector.cpp:275:13:275:23 | // $ ast,ir | Missing result:ir= |
192133
| vector.cpp:285:12:285:22 | // $ ast,ir | Missing result:ir= |
193-
| vector.cpp:286:19:286:29 | // $ ast,ir | Missing result:ir= |
194134
| vector.cpp:290:12:290:22 | // $ ast,ir | Missing result:ir= |
195-
| vector.cpp:291:19:291:29 | // $ ast,ir | Missing result:ir= |
196135
| vector.cpp:309:11:309:21 | // $ ast,ir | Missing result:ir= |
197136
| vector.cpp:312:11:312:21 | // $ ast,ir | Missing result:ir= |
198137
| vector.cpp:324:12:324:22 | // $ ast,ir | Missing result:ir= |
@@ -203,7 +142,6 @@
203142
| vector.cpp:392:12:392:65 | // $ ast=330:10 ir=330:10 SPURIOUS: ast=389:8 ir=389:8 | Missing result:ir=330:10 |
204143
| vector.cpp:400:13:400:23 | // $ ast,ir | Missing result:ir= |
205144
| vector.cpp:429:14:429:24 | // $ ast,ir | Missing result:ir= |
206-
| vector.cpp:436:14:436:24 | // $ ast,ir | Missing result:ir= |
207145
| vector.cpp:473:12:473:22 | // $ ast,ir | Missing result:ir= |
208146
| vector.cpp:482:14:482:24 | // $ ast,ir | Missing result:ir= |
209147
| vector.cpp:485:14:485:24 | // $ ast,ir | Missing result:ir= |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,9 @@ module IRTest {
8282
TestAllocationConfig() { this = "TestAllocationConfig" }
8383

8484
override predicate isSource(DataFlow::Node source) {
85-
source.asConvertedExpr().(FunctionCall).getTarget().getName() = "source"
85+
source.asExpr().(FunctionCall).getTarget().getName() = "source"
86+
or
87+
source.asIndirectExpr().(FunctionCall).getTarget().getName() = "source"
8688
or
8789
source.asParameter().getName().matches("source%")
8890
or
@@ -95,7 +97,7 @@ module IRTest {
9597
override predicate isSink(DataFlow::Node sink) {
9698
exists(FunctionCall call |
9799
call.getTarget().getName() = "sink" and
98-
sink.asExpr() = call.getAnArgument()
100+
[sink.asExpr(), sink.asIndirectExpr()] = call.getAnArgument()
99101
)
100102
}
101103

0 commit comments

Comments
 (0)