Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 43c8efd

Browse files
geoffw0geoffw0
committed
C++: Repair the range based for test.
1 parent 8afa92d commit 43c8efd

7 files changed

Lines changed: 95 additions & 61 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ private import implementations.Strcat
1313
private import implementations.Strcpy
1414
private import implementations.Strdup
1515
private import implementations.Strftime
16+
private import implementations.StdContainer
1617
private import implementations.StdString
1718
private import implementations.Swap
1819
private import implementations.GetDelim

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* Provides models for C++ containers such as `std::vector` and `std::list`.
3+
*/
4+
5+
import semmle.code.cpp.models.interfaces.Taint
6+
7+
/**
8+
* Model standard container constructors.
9+
*/
10+
class StdContainerConstructor extends Constructor, TaintFunction {
11+
StdContainerConstructor() { this.getDeclaringType().hasQualifiedName("std", "vector") }
12+
13+
/**
14+
* Gets the index of a parameter to this function that is a reference to the
15+
* type of thing contained.
16+
*/
17+
int getAnElementParameter() {
18+
getParameter(result).getType().getUnspecifiedType().(ReferenceType).getBaseType() =
19+
getDeclaringType().getTemplateArgument(0) // i.e. the `T` of this `std::vector<T>`
20+
}
21+
22+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
23+
// taint flow from any parameter of type `T` to the returned object
24+
input.isParameterDeref(getAnElementParameter()) and
25+
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
26+
}
27+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 58 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1330,59 +1330,61 @@
13301330
| taint.cpp:483:18:483:19 | ref arg & ... | taint.cpp:483:19:483:19 | n [inner post update] | |
13311331
| taint.cpp:483:19:483:19 | n | taint.cpp:483:18:483:19 | & ... | |
13321332
| taint.cpp:483:28:483:34 | source1 | taint.cpp:483:11:483:15 | ref arg & ... | TAINT |
1333-
| vector.cpp:8:43:8:49 | source1 | vector.cpp:12:21:12:27 | source1 | |
1334-
| vector.cpp:8:43:8:49 | source1 | vector.cpp:26:33:26:39 | source1 | |
1335-
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:14:14:14:14 | v | |
1336-
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:18:38:18:38 | v | |
1337-
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:18:55:18:55 | v | |
1338-
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:22:15:22:15 | v | |
1339-
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:30:1:30:1 | v | |
1340-
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
1341-
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
1342-
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
1343-
| vector.cpp:14:14:14:14 | call to end | vector.cpp:14:14:14:14 | (__end) | |
1344-
| vector.cpp:14:14:14:14 | call to operator* | vector.cpp:15:8:15:8 | x | |
1345-
| vector.cpp:14:14:14:14 | ref arg (__begin) | vector.cpp:14:14:14:14 | (__begin) | |
1346-
| vector.cpp:14:14:14:14 | ref arg (__begin) | vector.cpp:14:14:14:14 | (__begin) | |
1347-
| vector.cpp:14:14:14:14 | ref arg (__begin) | vector.cpp:14:14:14:14 | (__begin) | |
1348-
| vector.cpp:14:14:14:14 | ref arg (__range) | vector.cpp:14:14:14:14 | (__range) | |
1349-
| vector.cpp:14:14:14:14 | v | vector.cpp:14:14:14:14 | (__range) | |
1350-
| vector.cpp:14:14:14:14 | v | vector.cpp:14:14:14:14 | (__range) | |
1351-
| vector.cpp:14:14:14:14 | v | vector.cpp:14:14:14:14 | call to operator* | TAINT |
1352-
| vector.cpp:18:38:18:38 | ref arg v | vector.cpp:18:55:18:55 | v | |
1353-
| vector.cpp:18:38:18:38 | ref arg v | vector.cpp:22:15:22:15 | v | |
1354-
| vector.cpp:18:38:18:38 | ref arg v | vector.cpp:30:1:30:1 | v | |
1355-
| vector.cpp:18:40:18:44 | call to begin | vector.cpp:18:49:18:50 | it | |
1356-
| vector.cpp:18:40:18:44 | call to begin | vector.cpp:18:66:18:67 | it | |
1357-
| vector.cpp:18:40:18:44 | call to begin | vector.cpp:19:9:19:10 | it | |
1358-
| vector.cpp:18:55:18:55 | ref arg v | vector.cpp:18:55:18:55 | v | |
1359-
| vector.cpp:18:55:18:55 | ref arg v | vector.cpp:22:15:22:15 | v | |
1360-
| vector.cpp:18:55:18:55 | ref arg v | vector.cpp:30:1:30:1 | v | |
1361-
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:18:49:18:50 | it | |
1362-
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:18:66:18:67 | it | |
1363-
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:19:9:19:10 | it | |
1364-
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
1365-
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
1366-
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
1367-
| vector.cpp:22:15:22:15 | call to end | vector.cpp:22:15:22:15 | (__end) | |
1368-
| vector.cpp:22:15:22:15 | call to operator* | vector.cpp:23:8:23:8 | x | |
1369-
| vector.cpp:22:15:22:15 | ref arg (__begin) | vector.cpp:22:15:22:15 | (__begin) | |
1370-
| vector.cpp:22:15:22:15 | ref arg (__begin) | vector.cpp:22:15:22:15 | (__begin) | |
1371-
| vector.cpp:22:15:22:15 | ref arg (__begin) | vector.cpp:22:15:22:15 | (__begin) | |
1372-
| vector.cpp:22:15:22:15 | ref arg (__range) | vector.cpp:22:15:22:15 | (__range) | |
1373-
| vector.cpp:22:15:22:15 | v | vector.cpp:22:15:22:15 | (__range) | |
1374-
| vector.cpp:22:15:22:15 | v | vector.cpp:22:15:22:15 | (__range) | |
1375-
| vector.cpp:22:15:22:15 | v | vector.cpp:22:15:22:15 | call to operator* | TAINT |
1376-
| vector.cpp:26:33:26:40 | call to vector | vector.cpp:27:21:27:27 | const_v | |
1377-
| vector.cpp:26:33:26:40 | call to vector | vector.cpp:30:1:30:1 | const_v | |
1378-
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |
1379-
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |
1380-
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |
1381-
| vector.cpp:27:21:27:21 | call to end | vector.cpp:27:21:27:21 | (__end) | |
1382-
| vector.cpp:27:21:27:21 | call to operator* | vector.cpp:28:8:28:8 | x | |
1383-
| vector.cpp:27:21:27:21 | ref arg (__begin) | vector.cpp:27:21:27:21 | (__begin) | |
1384-
| vector.cpp:27:21:27:21 | ref arg (__begin) | vector.cpp:27:21:27:21 | (__begin) | |
1385-
| vector.cpp:27:21:27:21 | ref arg (__begin) | vector.cpp:27:21:27:21 | (__begin) | |
1386-
| vector.cpp:27:21:27:27 | const_v | vector.cpp:27:21:27:21 | (__range) | |
1387-
| vector.cpp:27:21:27:27 | const_v | vector.cpp:27:21:27:21 | (__range) | |
1388-
| vector.cpp:27:21:27:27 | const_v | vector.cpp:27:21:27:21 | call to operator* | TAINT |
1333+
| vector.cpp:8:43:8:49 | source1 | vector.cpp:9:26:9:32 | source1 | |
1334+
| vector.cpp:8:43:8:49 | source1 | vector.cpp:23:38:23:44 | source1 | |
1335+
| vector.cpp:9:21:9:33 | call to vector | vector.cpp:11:14:11:14 | v | |
1336+
| vector.cpp:9:21:9:33 | call to vector | vector.cpp:15:38:15:38 | v | |
1337+
| vector.cpp:9:21:9:33 | call to vector | vector.cpp:15:55:15:55 | v | |
1338+
| vector.cpp:9:21:9:33 | call to vector | vector.cpp:19:15:19:15 | v | |
1339+
| vector.cpp:9:21:9:33 | call to vector | vector.cpp:27:1:27:1 | v | |
1340+
| vector.cpp:9:26:9:32 | source1 | vector.cpp:9:21:9:33 | call to vector | TAINT |
1341+
| vector.cpp:11:14:11:14 | call to begin | vector.cpp:11:14:11:14 | (__begin) | |
1342+
| vector.cpp:11:14:11:14 | call to begin | vector.cpp:11:14:11:14 | (__begin) | |
1343+
| vector.cpp:11:14:11:14 | call to begin | vector.cpp:11:14:11:14 | (__begin) | |
1344+
| vector.cpp:11:14:11:14 | call to end | vector.cpp:11:14:11:14 | (__end) | |
1345+
| vector.cpp:11:14:11:14 | call to operator* | vector.cpp:12:8:12:8 | x | |
1346+
| vector.cpp:11:14:11:14 | ref arg (__begin) | vector.cpp:11:14:11:14 | (__begin) | |
1347+
| vector.cpp:11:14:11:14 | ref arg (__begin) | vector.cpp:11:14:11:14 | (__begin) | |
1348+
| vector.cpp:11:14:11:14 | ref arg (__begin) | vector.cpp:11:14:11:14 | (__begin) | |
1349+
| vector.cpp:11:14:11:14 | ref arg (__range) | vector.cpp:11:14:11:14 | (__range) | |
1350+
| vector.cpp:11:14:11:14 | v | vector.cpp:11:14:11:14 | (__range) | |
1351+
| vector.cpp:11:14:11:14 | v | vector.cpp:11:14:11:14 | (__range) | |
1352+
| vector.cpp:11:14:11:14 | v | vector.cpp:11:14:11:14 | call to operator* | TAINT |
1353+
| vector.cpp:15:38:15:38 | ref arg v | vector.cpp:15:55:15:55 | v | |
1354+
| vector.cpp:15:38:15:38 | ref arg v | vector.cpp:19:15:19:15 | v | |
1355+
| vector.cpp:15:38:15:38 | ref arg v | vector.cpp:27:1:27:1 | v | |
1356+
| vector.cpp:15:40:15:44 | call to begin | vector.cpp:15:49:15:50 | it | |
1357+
| vector.cpp:15:40:15:44 | call to begin | vector.cpp:15:66:15:67 | it | |
1358+
| vector.cpp:15:40:15:44 | call to begin | vector.cpp:16:9:16:10 | it | |
1359+
| vector.cpp:15:55:15:55 | ref arg v | vector.cpp:15:55:15:55 | v | |
1360+
| vector.cpp:15:55:15:55 | ref arg v | vector.cpp:19:15:19:15 | v | |
1361+
| vector.cpp:15:55:15:55 | ref arg v | vector.cpp:27:1:27:1 | v | |
1362+
| vector.cpp:15:66:15:67 | ref arg it | vector.cpp:15:49:15:50 | it | |
1363+
| vector.cpp:15:66:15:67 | ref arg it | vector.cpp:15:66:15:67 | it | |
1364+
| vector.cpp:15:66:15:67 | ref arg it | vector.cpp:16:9:16:10 | it | |
1365+
| vector.cpp:19:15:19:15 | call to begin | vector.cpp:19:15:19:15 | (__begin) | |
1366+
| vector.cpp:19:15:19:15 | call to begin | vector.cpp:19:15:19:15 | (__begin) | |
1367+
| vector.cpp:19:15:19:15 | call to begin | vector.cpp:19:15:19:15 | (__begin) | |
1368+
| vector.cpp:19:15:19:15 | call to end | vector.cpp:19:15:19:15 | (__end) | |
1369+
| vector.cpp:19:15:19:15 | call to operator* | vector.cpp:20:8:20:8 | x | |
1370+
| vector.cpp:19:15:19:15 | ref arg (__begin) | vector.cpp:19:15:19:15 | (__begin) | |
1371+
| vector.cpp:19:15:19:15 | ref arg (__begin) | vector.cpp:19:15:19:15 | (__begin) | |
1372+
| vector.cpp:19:15:19:15 | ref arg (__begin) | vector.cpp:19:15:19:15 | (__begin) | |
1373+
| vector.cpp:19:15:19:15 | ref arg (__range) | vector.cpp:19:15:19:15 | (__range) | |
1374+
| vector.cpp:19:15:19:15 | v | vector.cpp:19:15:19:15 | (__range) | |
1375+
| vector.cpp:19:15:19:15 | v | vector.cpp:19:15:19:15 | (__range) | |
1376+
| vector.cpp:19:15:19:15 | v | vector.cpp:19:15:19:15 | call to operator* | TAINT |
1377+
| vector.cpp:23:33:23:45 | call to vector | vector.cpp:24:21:24:27 | const_v | |
1378+
| vector.cpp:23:33:23:45 | call to vector | vector.cpp:27:1:27:1 | const_v | |
1379+
| vector.cpp:23:38:23:44 | source1 | vector.cpp:23:33:23:45 | call to vector | TAINT |
1380+
| vector.cpp:24:21:24:21 | call to begin | vector.cpp:24:21:24:21 | (__begin) | |
1381+
| vector.cpp:24:21:24:21 | call to begin | vector.cpp:24:21:24:21 | (__begin) | |
1382+
| vector.cpp:24:21:24:21 | call to begin | vector.cpp:24:21:24:21 | (__begin) | |
1383+
| vector.cpp:24:21:24:21 | call to end | vector.cpp:24:21:24:21 | (__end) | |
1384+
| vector.cpp:24:21:24:21 | call to operator* | vector.cpp:25:8:25:8 | x | |
1385+
| vector.cpp:24:21:24:21 | ref arg (__begin) | vector.cpp:24:21:24:21 | (__begin) | |
1386+
| vector.cpp:24:21:24:21 | ref arg (__begin) | vector.cpp:24:21:24:21 | (__begin) | |
1387+
| vector.cpp:24:21:24:21 | ref arg (__begin) | vector.cpp:24:21:24:21 | (__begin) | |
1388+
| vector.cpp:24:21:24:27 | const_v | vector.cpp:24:21:24:21 | (__range) | |
1389+
| vector.cpp:24:21:24:27 | const_v | vector.cpp:24:21:24:21 | (__range) | |
1390+
| vector.cpp:24:21:24:27 | const_v | vector.cpp:24:21:24:21 | call to operator* | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ namespace std {
117117
vector() noexcept(noexcept(Allocator())) : vector(Allocator()) { }
118118
explicit vector(const Allocator&) noexcept;
119119
explicit vector(size_type n, const Allocator& = Allocator());
120+
vector(size_type n, const T& value, const Allocator& = Allocator());
120121
~vector();
121122

122123
vector& operator=(const vector& x);

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,3 +166,6 @@
166166
| taint.cpp:470:7:470:7 | x | taint.cpp:462:6:462:11 | call to source |
167167
| taint.cpp:471:7:471:7 | y | taint.cpp:462:6:462:11 | call to source |
168168
| taint.cpp:485:7:485:10 | line | taint.cpp:480:26:480:32 | source1 |
169+
| vector.cpp:12:8:12:8 | x | vector.cpp:8:43:8:49 | source1 |
170+
| vector.cpp:20:8:20:8 | x | vector.cpp:8:43:8:49 | source1 |
171+
| vector.cpp:25:8:25:8 | x | vector.cpp:8:43:8:49 | source1 |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,6 @@
101101
| taint.cpp:446:7:446:7 | taint.cpp:445:14:445:28 | AST only |
102102
| taint.cpp:447:9:447:17 | taint.cpp:445:14:445:28 | AST only |
103103
| taint.cpp:471:7:471:7 | taint.cpp:462:6:462:11 | AST only |
104+
| vector.cpp:12:8:12:8 | vector.cpp:8:43:8:49 | AST only |
105+
| vector.cpp:20:8:20:8 | vector.cpp:8:43:8:49 | AST only |
106+
| vector.cpp:25:8:25:8 | vector.cpp:8:43:8:49 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,7 @@ using namespace std;
66
void sink(int);
77

88
void test_range_based_for_loop_vector(int source1) {
9-
// Tainting the vector by allocating a tainted length. This doesn't represent
10-
// how a vector would typically get tainted, but it allows this test to avoid
11-
// being concerned with std::vector modeling.
12-
std::vector<int> v(source1);
9+
std::vector<int> v(100, source1);
1310

1411
for(int x : v) {
1512
sink(x); // tainted [NOT DETECTED by IR]
@@ -23,7 +20,7 @@ void test_range_based_for_loop_vector(int source1) {
2320
sink(x); // tainted [NOT DETECTED by IR]
2421
}
2522

26-
const std::vector<int> const_v(source1);
23+
const std::vector<int> const_v(100, source1);
2724
for(const int& x : const_v) {
2825
sink(x); // tainted [NOT DETECTED by IR]
2926
}

0 commit comments

Comments
 (0)