@@ -30,9 +30,7 @@ private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
3030 instructionTaintStep ( n1 .asInstruction ( ) , n2 .asInstruction ( ) )
3131 }
3232
33- override predicate isBarrier ( DataFlow:: Node node ) {
34- nodeIsBarrier ( node )
35- }
33+ override predicate isBarrier ( DataFlow:: Node node ) { nodeIsBarrier ( node ) }
3634}
3735
3836private class ToGlobalVarTaintTrackingCfg extends DataFlow:: Configuration {
@@ -41,9 +39,7 @@ private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
4139 override predicate isSource ( DataFlow:: Node source ) { isUserInput ( source .asExpr ( ) , _) }
4240
4341 override predicate isSink ( DataFlow:: Node sink ) {
44- exists ( GlobalOrNamespaceVariable gv |
45- writesVariable ( sink .asInstruction ( ) , gv )
46- )
42+ exists ( GlobalOrNamespaceVariable gv | writesVariable ( sink .asInstruction ( ) , gv ) )
4743 }
4844
4945 override predicate isAdditionalFlowStep ( DataFlow:: Node n1 , DataFlow:: Node n2 ) {
@@ -57,16 +53,16 @@ private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
5753 )
5854 }
5955
60- override predicate isBarrier ( DataFlow:: Node node ) {
61- nodeIsBarrier ( node )
62- }
56+ override predicate isBarrier ( DataFlow:: Node node ) { nodeIsBarrier ( node ) }
6357}
6458
6559private class FromGlobalVarTaintTrackingCfg extends DataFlow2:: Configuration {
6660 FromGlobalVarTaintTrackingCfg ( ) { this = "FromGlobalVarTaintTrackingCfg" }
6761
6862 override predicate isSource ( DataFlow:: Node source ) {
69- exists ( ToGlobalVarTaintTrackingCfg other , DataFlow:: Node prevSink , GlobalOrNamespaceVariable gv |
63+ exists (
64+ ToGlobalVarTaintTrackingCfg other , DataFlow:: Node prevSink , GlobalOrNamespaceVariable gv
65+ |
7066 other .hasFlowTo ( prevSink ) and
7167 writesVariable ( prevSink .asInstruction ( ) , gv ) and
7268 readsVariable ( source .asInstruction ( ) , gv )
@@ -79,9 +75,7 @@ private class FromGlobalVarTaintTrackingCfg extends DataFlow2::Configuration {
7975 instructionTaintStep ( n1 .asInstruction ( ) , n2 .asInstruction ( ) )
8076 }
8177
82- override predicate isBarrier ( DataFlow:: Node node ) {
83- nodeIsBarrier ( node )
84- }
78+ override predicate isBarrier ( DataFlow:: Node node ) { nodeIsBarrier ( node ) }
8579}
8680
8781private predicate readsVariable ( LoadInstruction load , Variable var ) {
@@ -110,10 +104,10 @@ private predicate hasUpperBoundsCheck(Variable var) {
110104}
111105
112106private predicate nodeIsBarrier ( DataFlow:: Node node ) {
113- exists ( Variable checkedVar |
114- readsVariable ( node .asInstruction ( ) , checkedVar ) and
115- hasUpperBoundsCheck ( checkedVar )
116- )
107+ exists ( Variable checkedVar |
108+ readsVariable ( node .asInstruction ( ) , checkedVar ) and
109+ hasUpperBoundsCheck ( checkedVar )
110+ )
117111}
118112
119113private predicate instructionTaintStep ( Instruction i1 , Instruction i2 ) {
@@ -201,17 +195,25 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
201195 GlobalOrNamespaceVariable global , DataFlow:: Node load , DataFlow:: Node sink
202196 |
203197 toCfg .hasFlow ( DataFlow:: exprNode ( source ) , store ) and
204- store .asInstruction ( ) .( StoreInstruction ) .getDestinationAddress ( ) .( VariableAddressInstruction ) .getASTVariable ( ) = global and
205- load .asInstruction ( ) .( LoadInstruction ) .getSourceAddress ( ) .( VariableAddressInstruction ) .getASTVariable ( ) = global and
198+ store
199+ .asInstruction ( )
200+ .( StoreInstruction )
201+ .getDestinationAddress ( )
202+ .( VariableAddressInstruction )
203+ .getASTVariable ( ) = global and
204+ load
205+ .asInstruction ( )
206+ .( LoadInstruction )
207+ .getSourceAddress ( )
208+ .( VariableAddressInstruction )
209+ .getASTVariable ( ) = global and
206210 fromCfg .hasFlow ( load , sink ) and
207211 tainted = adjustedSink ( sink ) and
208212 global = globalVarFromId ( globalVar )
209213 )
210214}
211215
212- GlobalOrNamespaceVariable globalVarFromId ( string id ) {
213- id = result .getQualifiedName ( )
214- }
216+ GlobalOrNamespaceVariable globalVarFromId ( string id ) { id = result .getQualifiedName ( ) }
215217
216218Function resolveCall ( Call call ) {
217219 exists ( CallInstruction callInstruction |
0 commit comments