Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3bef0e5

Browse files
geoffw0geoffw0
committed
C++: Implement a general model.
1 parent d08efb4 commit 3bef0e5

2 files changed

Lines changed: 30 additions & 8 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,13 @@ private class Swap extends DataFlowFunction {
2525
* obj1.swap(obj2)
2626
* ```
2727
*/
28-
private class MemberSwap extends TaintFunction {
28+
private class MemberSwap extends TaintFunction, MemberFunction {
2929
MemberSwap() {
30-
this.hasQualifiedName("std", "basic_string", "swap") or
31-
this.hasQualifiedName("std", "basic_stringstream", "swap") or
32-
this.hasQualifiedName("std", ["array", "vector", "deque", "list", "forward_list"], "swap") or
33-
this.hasQualifiedName("std", ["set", "unordered_set"], "swap") or
34-
this.hasQualifiedName("std", "pair", "swap") or
35-
this.hasQualifiedName("std", ["map", "unordered_map"], "swap") or
36-
this.hasQualifiedName("std", ["map", "unordered_map"], "swap")
30+
this.hasName("swap") and
31+
this.getNumberOfParameters() = 1 and
32+
this.getParameter(0).getType() instanceof ReferenceType and
33+
this.getParameter(0).getType().(ReferenceType).getBaseType().getUnspecifiedType() =
34+
getDeclaringType()
3735
}
3836

3937
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5004,7 +5004,9 @@
50045004
| swap1.cpp:24:9:24:13 | this | swap1.cpp:24:31:24:34 | this | |
50055005
| swap1.cpp:24:23:24:26 | that | swap1.cpp:24:23:24:26 | that | |
50065006
| swap1.cpp:24:23:24:26 | that | swap1.cpp:24:36:24:39 | that | |
5007+
| swap1.cpp:24:31:24:34 | this | swap1.cpp:24:36:24:39 | ref arg that | TAINT |
50075008
| swap1.cpp:24:36:24:39 | ref arg that | swap1.cpp:24:23:24:26 | that | |
5009+
| swap1.cpp:24:36:24:39 | that | swap1.cpp:24:31:24:34 | ref arg this | TAINT |
50085010
| swap1.cpp:25:9:25:13 | this | swap1.cpp:25:36:25:52 | constructor init of field data1 [pre-this] | |
50095011
| swap1.cpp:25:28:25:31 | that | swap1.cpp:25:42:25:45 | that | |
50105012
| swap1.cpp:25:47:25:51 | data1 | swap1.cpp:25:36:25:52 | constructor init of field data1 | TAINT |
@@ -5014,28 +5016,36 @@
50145016
| swap1.cpp:29:23:29:27 | call to Class | swap1.cpp:30:18:30:20 | tmp | |
50155017
| swap1.cpp:29:24:29:27 | that | swap1.cpp:29:23:29:27 | call to Class | |
50165018
| swap1.cpp:30:13:30:16 | ref arg this | swap1.cpp:31:21:31:24 | this | |
5019+
| swap1.cpp:30:13:30:16 | this | swap1.cpp:30:18:30:20 | ref arg tmp | TAINT |
50175020
| swap1.cpp:30:13:30:16 | this | swap1.cpp:31:21:31:24 | this | |
5021+
| swap1.cpp:30:18:30:20 | tmp | swap1.cpp:30:13:30:16 | ref arg this | TAINT |
50185022
| swap1.cpp:31:21:31:24 | this | swap1.cpp:31:20:31:24 | * ... | TAINT |
50195023
| swap1.cpp:34:16:34:24 | this | swap1.cpp:36:13:36:16 | this | |
50205024
| swap1.cpp:34:34:34:37 | that | swap1.cpp:34:34:34:37 | that | |
50215025
| swap1.cpp:34:34:34:37 | that | swap1.cpp:36:18:36:21 | that | |
50225026
| swap1.cpp:36:13:36:16 | ref arg this | swap1.cpp:37:21:37:24 | this | |
5027+
| swap1.cpp:36:13:36:16 | this | swap1.cpp:36:18:36:21 | ref arg that | TAINT |
50235028
| swap1.cpp:36:13:36:16 | this | swap1.cpp:37:21:37:24 | this | |
50245029
| swap1.cpp:36:18:36:21 | ref arg that | swap1.cpp:34:34:34:37 | that | |
5030+
| swap1.cpp:36:18:36:21 | that | swap1.cpp:36:13:36:16 | ref arg this | TAINT |
50255031
| swap1.cpp:37:21:37:24 | this | swap1.cpp:37:20:37:24 | * ... | TAINT |
50265032
| swap1.cpp:40:16:40:26 | this | swap1.cpp:43:13:43:16 | this | |
50275033
| swap1.cpp:40:41:40:44 | that | swap1.cpp:42:24:42:27 | that | |
50285034
| swap1.cpp:42:23:42:27 | call to Class | swap1.cpp:43:18:43:20 | tmp | |
50295035
| swap1.cpp:42:24:42:27 | that | swap1.cpp:42:23:42:27 | call to Class | |
50305036
| swap1.cpp:43:13:43:16 | ref arg this | swap1.cpp:44:21:44:24 | this | |
5037+
| swap1.cpp:43:13:43:16 | this | swap1.cpp:43:18:43:20 | ref arg tmp | TAINT |
50315038
| swap1.cpp:43:13:43:16 | this | swap1.cpp:44:21:44:24 | this | |
5039+
| swap1.cpp:43:18:43:20 | tmp | swap1.cpp:43:13:43:16 | ref arg this | TAINT |
50325040
| swap1.cpp:44:21:44:24 | this | swap1.cpp:44:20:44:24 | * ... | TAINT |
50335041
| swap1.cpp:47:16:47:26 | this | swap1.cpp:49:13:49:16 | this | |
50345042
| swap1.cpp:47:36:47:39 | that | swap1.cpp:47:36:47:39 | that | |
50355043
| swap1.cpp:47:36:47:39 | that | swap1.cpp:49:18:49:21 | that | |
50365044
| swap1.cpp:49:13:49:16 | ref arg this | swap1.cpp:50:21:50:24 | this | |
5045+
| swap1.cpp:49:13:49:16 | this | swap1.cpp:49:18:49:21 | ref arg that | TAINT |
50375046
| swap1.cpp:49:13:49:16 | this | swap1.cpp:50:21:50:24 | this | |
50385047
| swap1.cpp:49:18:49:21 | ref arg that | swap1.cpp:47:36:47:39 | that | |
5048+
| swap1.cpp:49:18:49:21 | that | swap1.cpp:49:13:49:16 | ref arg this | TAINT |
50395049
| swap1.cpp:50:21:50:24 | this | swap1.cpp:50:20:50:24 | * ... | TAINT |
50405050
| swap1.cpp:53:14:53:17 | this | swap1.cpp:56:18:56:22 | this | |
50415051
| swap1.cpp:53:26:53:29 | that | swap1.cpp:53:26:53:29 | that | |
@@ -5049,7 +5059,9 @@
50495059
| swap1.cpp:61:32:61:32 | y | swap1.cpp:61:32:61:32 | y | |
50505060
| swap1.cpp:61:32:61:32 | y | swap1.cpp:63:16:63:16 | y | |
50515061
| swap1.cpp:63:9:63:9 | ref arg x | swap1.cpp:61:22:61:22 | x | |
5062+
| swap1.cpp:63:9:63:9 | x | swap1.cpp:63:16:63:16 | ref arg y | TAINT |
50525063
| swap1.cpp:63:16:63:16 | ref arg y | swap1.cpp:61:32:61:32 | y | |
5064+
| swap1.cpp:63:16:63:16 | y | swap1.cpp:63:9:63:9 | ref arg x | TAINT |
50535065
| swap1.cpp:69:23:69:23 | x | swap1.cpp:71:5:71:5 | x | |
50545066
| swap1.cpp:69:23:69:23 | x | swap1.cpp:73:10:73:10 | x | |
50555067
| swap1.cpp:69:23:69:23 | x | swap1.cpp:76:9:76:9 | x | |
@@ -5158,7 +5170,9 @@
51585170
| swap2.cpp:24:9:24:13 | this | swap2.cpp:24:31:24:34 | this | |
51595171
| swap2.cpp:24:23:24:26 | that | swap2.cpp:24:23:24:26 | that | |
51605172
| swap2.cpp:24:23:24:26 | that | swap2.cpp:24:36:24:39 | that | |
5173+
| swap2.cpp:24:31:24:34 | this | swap2.cpp:24:36:24:39 | ref arg that | TAINT |
51615174
| swap2.cpp:24:36:24:39 | ref arg that | swap2.cpp:24:23:24:26 | that | |
5175+
| swap2.cpp:24:36:24:39 | that | swap2.cpp:24:31:24:34 | ref arg this | TAINT |
51625176
| swap2.cpp:25:9:25:13 | this | swap2.cpp:25:36:25:52 | constructor init of field data1 [pre-this] | |
51635177
| swap2.cpp:25:28:25:31 | that | swap2.cpp:25:42:25:45 | that | |
51645178
| swap2.cpp:25:28:25:31 | that | swap2.cpp:25:61:25:64 | that | |
@@ -5173,28 +5187,36 @@
51735187
| swap2.cpp:29:23:29:27 | call to Class | swap2.cpp:30:18:30:20 | tmp | |
51745188
| swap2.cpp:29:24:29:27 | that | swap2.cpp:29:23:29:27 | call to Class | |
51755189
| swap2.cpp:30:13:30:16 | ref arg this | swap2.cpp:31:21:31:24 | this | |
5190+
| swap2.cpp:30:13:30:16 | this | swap2.cpp:30:18:30:20 | ref arg tmp | TAINT |
51765191
| swap2.cpp:30:13:30:16 | this | swap2.cpp:31:21:31:24 | this | |
5192+
| swap2.cpp:30:18:30:20 | tmp | swap2.cpp:30:13:30:16 | ref arg this | TAINT |
51775193
| swap2.cpp:31:21:31:24 | this | swap2.cpp:31:20:31:24 | * ... | TAINT |
51785194
| swap2.cpp:34:16:34:24 | this | swap2.cpp:36:13:36:16 | this | |
51795195
| swap2.cpp:34:34:34:37 | that | swap2.cpp:34:34:34:37 | that | |
51805196
| swap2.cpp:34:34:34:37 | that | swap2.cpp:36:18:36:21 | that | |
51815197
| swap2.cpp:36:13:36:16 | ref arg this | swap2.cpp:37:21:37:24 | this | |
5198+
| swap2.cpp:36:13:36:16 | this | swap2.cpp:36:18:36:21 | ref arg that | TAINT |
51825199
| swap2.cpp:36:13:36:16 | this | swap2.cpp:37:21:37:24 | this | |
51835200
| swap2.cpp:36:18:36:21 | ref arg that | swap2.cpp:34:34:34:37 | that | |
5201+
| swap2.cpp:36:18:36:21 | that | swap2.cpp:36:13:36:16 | ref arg this | TAINT |
51845202
| swap2.cpp:37:21:37:24 | this | swap2.cpp:37:20:37:24 | * ... | TAINT |
51855203
| swap2.cpp:40:16:40:26 | this | swap2.cpp:43:13:43:16 | this | |
51865204
| swap2.cpp:40:41:40:44 | that | swap2.cpp:42:24:42:27 | that | |
51875205
| swap2.cpp:42:23:42:27 | call to Class | swap2.cpp:43:18:43:20 | tmp | |
51885206
| swap2.cpp:42:24:42:27 | that | swap2.cpp:42:23:42:27 | call to Class | |
51895207
| swap2.cpp:43:13:43:16 | ref arg this | swap2.cpp:44:21:44:24 | this | |
5208+
| swap2.cpp:43:13:43:16 | this | swap2.cpp:43:18:43:20 | ref arg tmp | TAINT |
51905209
| swap2.cpp:43:13:43:16 | this | swap2.cpp:44:21:44:24 | this | |
5210+
| swap2.cpp:43:18:43:20 | tmp | swap2.cpp:43:13:43:16 | ref arg this | TAINT |
51915211
| swap2.cpp:44:21:44:24 | this | swap2.cpp:44:20:44:24 | * ... | TAINT |
51925212
| swap2.cpp:47:16:47:26 | this | swap2.cpp:49:13:49:16 | this | |
51935213
| swap2.cpp:47:36:47:39 | that | swap2.cpp:47:36:47:39 | that | |
51945214
| swap2.cpp:47:36:47:39 | that | swap2.cpp:49:18:49:21 | that | |
51955215
| swap2.cpp:49:13:49:16 | ref arg this | swap2.cpp:50:21:50:24 | this | |
5216+
| swap2.cpp:49:13:49:16 | this | swap2.cpp:49:18:49:21 | ref arg that | TAINT |
51965217
| swap2.cpp:49:13:49:16 | this | swap2.cpp:50:21:50:24 | this | |
51975218
| swap2.cpp:49:18:49:21 | ref arg that | swap2.cpp:47:36:47:39 | that | |
5219+
| swap2.cpp:49:18:49:21 | that | swap2.cpp:49:13:49:16 | ref arg this | TAINT |
51985220
| swap2.cpp:50:21:50:24 | this | swap2.cpp:50:20:50:24 | * ... | TAINT |
51995221
| swap2.cpp:53:14:53:17 | this | swap2.cpp:56:18:56:22 | this | |
52005222
| swap2.cpp:53:26:53:29 | that | swap2.cpp:53:26:53:29 | that | |
@@ -5216,7 +5238,9 @@
52165238
| swap2.cpp:61:32:61:32 | y | swap2.cpp:61:32:61:32 | y | |
52175239
| swap2.cpp:61:32:61:32 | y | swap2.cpp:63:16:63:16 | y | |
52185240
| swap2.cpp:63:9:63:9 | ref arg x | swap2.cpp:61:22:61:22 | x | |
5241+
| swap2.cpp:63:9:63:9 | x | swap2.cpp:63:16:63:16 | ref arg y | TAINT |
52195242
| swap2.cpp:63:16:63:16 | ref arg y | swap2.cpp:61:32:61:32 | y | |
5243+
| swap2.cpp:63:16:63:16 | y | swap2.cpp:63:9:63:9 | ref arg x | TAINT |
52205244
| swap2.cpp:69:23:69:23 | x | swap2.cpp:71:5:71:5 | x | |
52215245
| swap2.cpp:69:23:69:23 | x | swap2.cpp:73:10:73:10 | x | |
52225246
| swap2.cpp:69:23:69:23 | x | swap2.cpp:76:9:76:9 | x | |

0 commit comments

Comments
 (0)