Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0ca4bf4

Browse files
tamasvajktamasvajk
committed
C#: WIP: Add tuple data flow
1 parent 4709442 commit 0ca4bf4

12 files changed

Lines changed: 321 additions & 1 deletion

File tree

‎csharp/ql/src/semmle/code/csharp/Assignable.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,9 @@ module AssignableDefinitions {
537537
/** Gets the underlying assignment. */
538538
AssignExpr getAssignment() { result = ae }
539539

540+
/** Gets the leaf expression. */
541+
Expr getLeaf() { result = leaf }
542+
540543
/**
541544
* Gets the evaluation order of this definition among the other definitions
542545
* in the compound tuple assignment. For example, in `(x, (y, z)) = ...` the

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,9 @@ module LocalFlow {
220220
e1 = we.getInitializer() and
221221
e2 = we
222222
)
223+
or
224+
scope = any(AssignExpr ae | ae.getLValue().(TupleExpr) = e2 and ae.getRValue() = e1) and
225+
isSuccessor = false
223226
)
224227
}
225228

@@ -483,6 +486,15 @@ private predicate fieldOrPropertyStore(Expr e, Content c, Expr src, Expr q, bool
483486
src = mi.getRValue() and
484487
postUpdate = false
485488
)
489+
or
490+
// Tuple element, `(..., src, ...)` `f` is `ItemX` of tuple `q`
491+
exists(int i |
492+
not (src instanceof LocalVariableDeclExpr or src instanceof VariableWrite) and
493+
e = q and
494+
src = q.(TupleExpr).getArgument(i) and
495+
f = q.getType().(TupleType).getElement(i) and
496+
postUpdate = false
497+
)
486498
)
487499
}
488500

@@ -495,7 +507,7 @@ private predicate overridesOrImplementsSourceDecl(Property p1, Property p2) {
495507

496508
/**
497509
* Holds if `e2` is an expression that reads field or property `c` from
498-
* expresion `e1`. This takes overriding into account for properties written
510+
* expression `e1`. This takes overriding into account for properties written
499511
* from library code.
500512
*/
501513
private predicate fieldOrPropertyRead(Expr e1, Content c, FieldOrPropertyRead e2) {
@@ -794,6 +806,27 @@ private module Cached {
794806
c = getResultContent()
795807
)
796808
or
809+
// node1 = (..., node2, ...)
810+
// node1.ItemX flows to node2
811+
exists(
812+
int i, Ssa::ExplicitDefinition def, AssignableDefinitions::TupleAssignmentDefinition tad,
813+
Expr item
814+
|
815+
// node1 = (..., item, ...)
816+
node1.asExpr().(TupleExpr).getArgument(i) = item and
817+
(
818+
// item = (..., ..., ...) in node1 = (..., (..., ..., ...), ...)
819+
node2.asExpr() instanceof TupleExpr and node2.asExpr() = item
820+
or
821+
// item = variable in node1 = (..., variable, ...)
822+
node2.(SsaDefinitionNode).getDefinition() = def and
823+
def.getADefinition() = tad and
824+
tad.getLeaf() = item
825+
) and
826+
c.(FieldContent).getField() =
827+
node1.asExpr().getType().(TupleType).getElement(i).getUnboundDeclaration()
828+
)
829+
or
797830
FlowSummaryImpl::Private::readStep(node1, c, node2)
798831
}
799832

‎csharp/ql/test/library-tests/csharp7/GlobalFlow.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| CSharp7.cs:41:13:41:21 | "tainted" | CSharp7.cs:53:18:53:19 | access to local variable t1 |
22
| CSharp7.cs:57:11:57:19 | "tainted" | CSharp7.cs:58:18:58:19 | access to local variable t4 |
3+
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:92:18:92:28 | call to method I |
34
| CSharp7.cs:177:22:177:30 | "tainted" | CSharp7.cs:177:22:177:30 | "tainted" |
45
| CSharp7.cs:177:22:177:30 | "tainted" | CSharp7.cs:183:21:183:26 | call to local function g |
56
| CSharp7.cs:177:22:177:30 | "tainted" | CSharp7.cs:184:21:184:26 | call to local function h |

‎csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,33 +34,41 @@
3434
| CSharp7.cs:66:26:66:26 | 2 | CSharp7.cs:66:16:66:27 | (..., ...) |
3535
| CSharp7.cs:69:10:69:20 | this | CSharp7.cs:71:26:71:28 | this access |
3636
| CSharp7.cs:71:26:71:28 | [post] this access | CSharp7.cs:72:17:72:19 | this access |
37+
| CSharp7.cs:71:26:71:28 | call to method F | CSharp7.cs:71:9:71:22 | (..., ...) |
3738
| CSharp7.cs:71:26:71:28 | this access | CSharp7.cs:72:17:72:19 | this access |
3839
| CSharp7.cs:72:13:72:19 | SSA def(z) | CSharp7.cs:75:16:75:16 | access to local variable z |
3940
| CSharp7.cs:72:17:72:19 | [post] this access | CSharp7.cs:73:18:73:20 | this access |
4041
| CSharp7.cs:72:17:72:19 | call to method F | CSharp7.cs:72:13:72:19 | SSA def(z) |
4142
| CSharp7.cs:72:17:72:19 | this access | CSharp7.cs:73:18:73:20 | this access |
4243
| CSharp7.cs:73:18:73:20 | [post] this access | CSharp7.cs:74:13:74:15 | this access |
44+
| CSharp7.cs:73:18:73:20 | call to method F | CSharp7.cs:73:9:73:14 | (..., ...) |
4345
| CSharp7.cs:73:18:73:20 | this access | CSharp7.cs:74:13:74:15 | this access |
4446
| CSharp7.cs:74:13:74:15 | call to method F | CSharp7.cs:74:13:74:17 | access to field Item1 |
4547
| CSharp7.cs:75:16:75:16 | [post] access to local variable z | CSharp7.cs:77:39:77:39 | access to local variable z |
4648
| CSharp7.cs:75:16:75:16 | access to local variable z | CSharp7.cs:77:39:77:39 | access to local variable z |
49+
| CSharp7.cs:75:27:75:35 | (..., ...) | CSharp7.cs:75:9:75:23 | (..., ...) |
4750
| CSharp7.cs:75:28:75:28 | 1 | CSharp7.cs:75:27:75:35 | (..., ...) |
4851
| CSharp7.cs:75:31:75:31 | 2 | CSharp7.cs:75:27:75:35 | (..., ...) |
4952
| CSharp7.cs:75:34:75:34 | 3 | CSharp7.cs:75:27:75:35 | (..., ...) |
5053
| CSharp7.cs:76:9:76:32 | SSA def(x) | CSharp7.cs:79:27:79:27 | access to local variable x |
54+
| CSharp7.cs:76:18:76:32 | ... = ... | CSharp7.cs:76:9:76:14 | (..., ...) |
55+
| CSharp7.cs:76:27:76:32 | (..., ...) | CSharp7.cs:76:18:76:23 | (..., ...) |
5156
| CSharp7.cs:76:27:76:32 | (..., ...) | CSharp7.cs:76:18:76:32 | ... = ... |
5257
| CSharp7.cs:76:28:76:28 | 1 | CSharp7.cs:76:27:76:32 | (..., ...) |
5358
| CSharp7.cs:76:31:76:31 | 2 | CSharp7.cs:76:27:76:32 | (..., ...) |
5459
| CSharp7.cs:77:9:77:40 | SSA def(a) | CSharp7.cs:78:31:78:31 | access to local variable a |
5560
| CSharp7.cs:77:9:77:40 | SSA def(b) | CSharp7.cs:78:24:78:24 | access to local variable b |
5661
| CSharp7.cs:77:9:77:40 | SSA def(c) | CSharp7.cs:78:28:78:28 | access to local variable c |
62+
| CSharp7.cs:77:35:77:40 | (..., ...) | CSharp7.cs:77:9:77:31 | (..., ...) |
5763
| CSharp7.cs:77:36:77:36 | 1 | CSharp7.cs:77:9:77:40 | SSA def(a) |
5864
| CSharp7.cs:77:36:77:36 | 1 | CSharp7.cs:77:35:77:40 | (..., ...) |
5965
| CSharp7.cs:77:39:77:39 | access to local variable z | CSharp7.cs:77:35:77:40 | (..., ...) |
66+
| CSharp7.cs:78:23:78:33 | (..., ...) | CSharp7.cs:78:9:78:19 | (..., ...) |
6067
| CSharp7.cs:78:24:78:24 | access to local variable b | CSharp7.cs:78:23:78:33 | (..., ...) |
6168
| CSharp7.cs:78:27:78:32 | (..., ...) | CSharp7.cs:78:23:78:33 | (..., ...) |
6269
| CSharp7.cs:78:28:78:28 | access to local variable c | CSharp7.cs:78:27:78:32 | (..., ...) |
6370
| CSharp7.cs:78:31:78:31 | access to local variable a | CSharp7.cs:78:27:78:32 | (..., ...) |
71+
| CSharp7.cs:79:22:79:28 | (..., ...) | CSharp7.cs:79:9:79:18 | (..., ...) |
6472
| CSharp7.cs:79:23:79:24 | "" | CSharp7.cs:79:22:79:28 | (..., ...) |
6573
| CSharp7.cs:79:27:79:27 | access to local variable x | CSharp7.cs:79:22:79:28 | (..., ...) |
6674
| CSharp7.cs:82:21:82:21 | x | CSharp7.cs:84:20:84:20 | access to parameter x |
@@ -74,6 +82,7 @@
7482
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:89:18:89:34 | (..., ...) |
7583
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:89:18:89:34 | (..., ...) |
7684
| CSharp7.cs:90:9:90:29 | SSA def(t3) | CSharp7.cs:91:18:91:19 | access to local variable t3 |
85+
| CSharp7.cs:90:28:90:29 | access to local variable t1 | CSharp7.cs:90:9:90:24 | (..., ...) |
7786
| CSharp7.cs:90:28:90:29 | access to local variable t1 | CSharp7.cs:92:20:92:21 | access to local variable t1 |
7887
| CSharp7.cs:92:20:92:21 | access to local variable t1 | CSharp7.cs:92:20:92:27 | access to field Item1 |
7988
| CSharp7.cs:97:19:97:19 | 1 | CSharp7.cs:97:18:97:38 | (..., ...) |
@@ -92,18 +101,22 @@
92101
| CSharp7.cs:104:45:104:45 | 1 | CSharp7.cs:104:22:104:46 | (..., ...) |
93102
| CSharp7.cs:109:9:109:46 | SSA def(m1) | CSharp7.cs:112:27:112:28 | access to local variable m1 |
94103
| CSharp7.cs:109:9:109:46 | SSA def(m2) | CSharp7.cs:112:31:112:32 | access to local variable m2 |
104+
| CSharp7.cs:109:28:109:46 | (..., ...) | CSharp7.cs:109:9:109:24 | (..., ...) |
95105
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:109:9:109:46 | SSA def(m1) |
96106
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:109:28:109:46 | (..., ...) |
97107
| CSharp7.cs:109:40:109:45 | (..., ...) | CSharp7.cs:109:9:109:46 | SSA def(m2) |
98108
| CSharp7.cs:109:40:109:45 | (..., ...) | CSharp7.cs:109:28:109:46 | (..., ...) |
99109
| CSharp7.cs:109:41:109:41 | 0 | CSharp7.cs:109:40:109:45 | (..., ...) |
100110
| CSharp7.cs:109:44:109:44 | 1 | CSharp7.cs:109:40:109:45 | (..., ...) |
101111
| CSharp7.cs:112:9:112:33 | SSA def(m4) | CSharp7.cs:113:18:113:19 | access to local variable m4 |
112+
| CSharp7.cs:112:26:112:33 | (..., ...) | CSharp7.cs:112:9:112:22 | (..., ...) |
102113
| CSharp7.cs:112:27:112:28 | access to local variable m1 | CSharp7.cs:112:26:112:33 | (..., ...) |
103114
| CSharp7.cs:112:31:112:32 | access to local variable m2 | CSharp7.cs:112:26:112:33 | (..., ...) |
104115
| CSharp7.cs:114:9:114:67 | SSA def(m9) | CSharp7.cs:115:19:115:20 | access to local variable m9 |
116+
| CSharp7.cs:114:38:114:67 | ... = ... | CSharp7.cs:114:9:114:34 | (..., ...) |
105117
| CSharp7.cs:114:38:114:67 | SSA def(m2) | CSharp7.cs:118:9:118:10 | access to local variable m2 |
106118
| CSharp7.cs:114:38:114:67 | SSA qualifier def(m2.Item1) | CSharp7.cs:119:19:119:26 | access to field Item1 |
119+
| CSharp7.cs:114:49:114:67 | (..., ...) | CSharp7.cs:114:38:114:45 | (..., ...) |
107120
| CSharp7.cs:114:49:114:67 | (..., ...) | CSharp7.cs:114:38:114:67 | ... = ... |
108121
| CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:49:114:67 | (..., ...) |
109122
| CSharp7.cs:114:61:114:66 | (..., ...) | CSharp7.cs:114:38:114:67 | SSA def(m2) |
@@ -186,9 +199,12 @@
186199
| CSharp7.cs:223:13:223:20 | [post] this access | CSharp7.cs:224:18:224:25 | this access |
187200
| CSharp7.cs:223:13:223:20 | this access | CSharp7.cs:224:18:224:25 | this access |
188201
| CSharp7.cs:224:18:224:25 | [post] this access | CSharp7.cs:225:22:225:29 | this access |
202+
| CSharp7.cs:224:18:224:25 | call to method f | CSharp7.cs:224:9:224:14 | (..., ...) |
189203
| CSharp7.cs:224:18:224:25 | this access | CSharp7.cs:225:22:225:29 | this access |
190204
| CSharp7.cs:225:22:225:29 | [post] this access | CSharp7.cs:226:22:226:33 | this access |
205+
| CSharp7.cs:225:22:225:29 | call to method f | CSharp7.cs:225:9:225:18 | (..., ...) |
191206
| CSharp7.cs:225:22:225:29 | this access | CSharp7.cs:226:22:226:33 | this access |
207+
| CSharp7.cs:226:22:226:33 | call to method f | CSharp7.cs:226:9:226:18 | (..., ...) |
192208
| CSharp7.cs:234:16:234:23 | SSA def(o) | CSharp7.cs:235:13:235:13 | access to local variable o |
193209
| CSharp7.cs:234:20:234:23 | null | CSharp7.cs:234:16:234:23 | SSA def(o) |
194210
| CSharp7.cs:235:13:235:13 | access to local variable o | CSharp7.cs:235:18:235:23 | SSA def(i1) |

‎csharp/ql/test/library-tests/csharp7/TaintReaches.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
| CSharp7.cs:41:13:41:21 | "tainted" | CSharp7.cs:41:9:41:21 | SSA def(x) |
2+
| CSharp7.cs:79:23:79:24 | "" | CSharp7.cs:79:9:79:18 | (..., ...) |
23
| CSharp7.cs:79:23:79:24 | "" | CSharp7.cs:79:22:79:28 | (..., ...) |
34
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:89:13:89:34 | SSA def(t1) |
45
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:89:18:89:34 | (..., ...) |
6+
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:90:9:90:24 | (..., ...) |
57
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:90:28:90:29 | access to local variable t1 |
68
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:92:20:92:21 | access to local variable t1 |
79
| CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:92:20:92:27 | access to field Item1 |
810
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:89:13:89:34 | SSA def(t1) |
911
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:89:18:89:34 | (..., ...) |
12+
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:90:9:90:24 | (..., ...) |
1013
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:90:28:90:29 | access to local variable t1 |
1114
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:92:20:92:21 | access to local variable t1 |
1215
| CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:92:20:92:27 | access to field Item1 |
@@ -18,10 +21,14 @@
1821
| CSharp7.cs:104:23:104:42 | "TupleMemberAccess2" | CSharp7.cs:104:18:104:47 | (..., ...) |
1922
| CSharp7.cs:104:23:104:42 | "TupleMemberAccess2" | CSharp7.cs:104:18:104:53 | access to field Item2 |
2023
| CSharp7.cs:104:23:104:42 | "TupleMemberAccess2" | CSharp7.cs:104:22:104:46 | (..., ...) |
24+
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:109:9:109:24 | (..., ...) |
2125
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:109:9:109:46 | SSA def(m1) |
2226
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:109:28:109:46 | (..., ...) |
27+
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:112:9:112:22 | (..., ...) |
2328
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:112:26:112:33 | (..., ...) |
2429
| CSharp7.cs:109:29:109:37 | "DefUse1" | CSharp7.cs:112:27:112:28 | access to local variable m1 |
30+
| CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:9:114:34 | (..., ...) |
31+
| CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:38:114:45 | (..., ...) |
2532
| CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:38:114:67 | ... = ... |
2633
| CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:49:114:67 | (..., ...) |
2734
| CSharp7.cs:123:28:123:36 | "DefUse3" | CSharp7.cs:123:22:123:36 | ... = ... |

‎csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
| Tuples.cs:5:13:5:56 | SSA def(x) | Tuples.cs:6:27:6:27 | access to local variable x |
2+
| Tuples.cs:5:13:5:56 | SSA qualifier def(x.Item1) | Tuples.cs:21:14:21:20 | access to field Item1 |
3+
| Tuples.cs:5:13:5:56 | SSA qualifier def(x.Item2) | Tuples.cs:23:14:23:20 | access to field Item2 |
4+
| Tuples.cs:5:13:5:56 | SSA qualifier def(x.Item2.Item1) | Tuples.cs:23:14:23:26 | access to field Item1 |
5+
| Tuples.cs:5:13:5:56 | SSA qualifier def(x.Item2.Item2) | Tuples.cs:24:14:24:26 | access to field Item2 |
6+
| Tuples.cs:5:17:5:56 | (..., ...) | Tuples.cs:5:13:5:56 | SSA def(x) |
7+
| Tuples.cs:6:9:6:27 | SSA def(a) | Tuples.cs:7:14:7:14 | access to local variable a |
8+
| Tuples.cs:6:9:6:27 | SSA def(b) | Tuples.cs:8:14:8:14 | access to local variable b |
9+
| Tuples.cs:6:9:6:27 | SSA def(c) | Tuples.cs:9:14:9:14 | access to local variable c |
10+
| Tuples.cs:6:27:6:27 | access to local variable x | Tuples.cs:6:9:6:23 | (..., ...) |
11+
| Tuples.cs:6:27:6:27 | access to local variable x | Tuples.cs:11:23:11:23 | access to local variable x |
12+
| Tuples.cs:11:9:11:23 | SSA def(a) | Tuples.cs:12:14:12:14 | access to local variable a |
13+
| Tuples.cs:11:9:11:23 | SSA def(b) | Tuples.cs:13:14:13:14 | access to local variable b |
14+
| Tuples.cs:11:9:11:23 | SSA def(c) | Tuples.cs:14:14:14:14 | access to local variable c |
15+
| Tuples.cs:11:23:11:23 | access to local variable x | Tuples.cs:11:9:11:19 | (..., ...) |
16+
| Tuples.cs:11:23:11:23 | access to local variable x | Tuples.cs:16:26:16:26 | access to local variable x |
17+
| Tuples.cs:16:9:16:26 | SSA def(p) | Tuples.cs:17:14:17:14 | access to local variable p |
18+
| Tuples.cs:16:9:16:26 | SSA def(q) | Tuples.cs:18:14:18:14 | access to local variable q |
19+
| Tuples.cs:16:9:16:26 | SSA qualifier def(q.Item1) | Tuples.cs:18:14:18:20 | access to field Item1 |
20+
| Tuples.cs:16:9:16:26 | SSA qualifier def(q.Item2) | Tuples.cs:19:14:19:20 | access to field Item2 |
21+
| Tuples.cs:16:26:16:26 | access to local variable x | Tuples.cs:16:9:16:22 | (..., ...) |
22+
| Tuples.cs:16:26:16:26 | access to local variable x | Tuples.cs:21:14:21:14 | access to local variable x |
23+
| Tuples.cs:18:14:18:14 | access to local variable q | Tuples.cs:19:14:19:14 | access to local variable q |
24+
| Tuples.cs:21:14:21:14 | [post] access to local variable x | Tuples.cs:22:14:22:14 | access to local variable x |
25+
| Tuples.cs:21:14:21:14 | access to local variable x | Tuples.cs:22:14:22:14 | access to local variable x |
26+
| Tuples.cs:21:14:21:20 | [post] access to field Item1 | Tuples.cs:22:14:22:16 | access to field Item1 |
27+
| Tuples.cs:21:14:21:20 | access to field Item1 | Tuples.cs:22:14:22:16 | access to field Item1 |
28+
| Tuples.cs:22:14:22:14 | [post] access to local variable x | Tuples.cs:23:14:23:14 | access to local variable x |
29+
| Tuples.cs:22:14:22:14 | access to local variable x | Tuples.cs:23:14:23:14 | access to local variable x |
30+
| Tuples.cs:23:14:23:14 | access to local variable x | Tuples.cs:24:14:24:14 | access to local variable x |
31+
| Tuples.cs:23:14:23:20 | access to field Item2 | Tuples.cs:24:14:24:20 | access to field Item2 |

‎csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.ql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import csharp
2+
3+
from DataFlow::Node pred, DataFlow::Node succ
4+
where DataFlow::localFlowStep(pred, succ)
5+
select pred, succ

0 commit comments

Comments
 (0)