Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4ae59b5

Browse files
aschackmullaschackmull
committed
Dataflow: Revert flow-state versions of in-/out-barriers.
1 parent 82463c9 commit 4ae59b5

2 files changed

Lines changed: 10 additions & 70 deletions

File tree

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -87,21 +87,9 @@ abstract class Configuration extends string {
8787
/** Holds if data flow into `node` is prohibited. */
8888
predicate isBarrierIn(Node node) { none() }
8989

90-
/**
91-
* Holds if data flow into `node` is prohibited when the flow state is
92-
* `state`
93-
*/
94-
predicate isBarrierIn(Node node, FlowState state) { none() }
95-
9690
/** Holds if data flow out of `node` is prohibited. */
9791
predicate isBarrierOut(Node node) { none() }
9892

99-
/**
100-
* Holds if data flow out of `node` is prohibited when the flow state is
101-
* `state`
102-
*/
103-
predicate isBarrierOut(Node node, FlowState state) { none() }
104-
10593
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
10694
predicate isBarrierGuard(BarrierGuard guard) { none() }
10795

@@ -321,7 +309,7 @@ private class RetNodeEx extends NodeEx {
321309
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
322310
}
323311

324-
private predicate fullInBarrier(NodeEx node, Configuration config) {
312+
private predicate inBarrier(NodeEx node, Configuration config) {
325313
exists(Node n |
326314
node.asNode() = n and
327315
config.isBarrierIn(n)
@@ -330,16 +318,7 @@ private predicate fullInBarrier(NodeEx node, Configuration config) {
330318
)
331319
}
332320

333-
private predicate stateInBarrier(NodeEx node, FlowState state, Configuration config) {
334-
exists(Node n |
335-
node.asNode() = n and
336-
config.isBarrierIn(n, state)
337-
|
338-
config.isSource(n, state)
339-
)
340-
}
341-
342-
private predicate fullOutBarrier(NodeEx node, Configuration config) {
321+
private predicate outBarrier(NodeEx node, Configuration config) {
343322
exists(Node n |
344323
node.asNode() = n and
345324
config.isBarrierOut(n)
@@ -348,15 +327,6 @@ private predicate fullOutBarrier(NodeEx node, Configuration config) {
348327
)
349328
}
350329

351-
private predicate stateOutBarrier(NodeEx node, FlowState state, Configuration config) {
352-
exists(Node n |
353-
node.asNode() = n and
354-
config.isBarrierOut(n, state)
355-
|
356-
config.isSink(n, state)
357-
)
358-
}
359-
360330
pragma[nomagic]
361331
private predicate fullBarrier(NodeEx node, Configuration config) {
362332
exists(Node n | node.asNode() = n |
@@ -382,12 +352,6 @@ private predicate stateBarrier(NodeEx node, FlowState state, Configuration confi
382352
exists(Node n | node.asNode() = n |
383353
config.isBarrier(n, state)
384354
or
385-
config.isBarrierIn(n, state) and
386-
not config.isSource(n, state)
387-
or
388-
config.isBarrierOut(n, state) and
389-
not config.isSink(n, state)
390-
or
391355
exists(BarrierGuard g |
392356
config.isBarrierGuard(g, state) and
393357
n = g.getAGuardedNode()
@@ -420,8 +384,8 @@ private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
420384
/** Provides the relevant barriers for a step from `node1` to `node2`. */
421385
pragma[inline]
422386
private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
423-
not fullOutBarrier(node1, config) and
424-
not fullInBarrier(node2, config) and
387+
not outBarrier(node1, config) and
388+
not inBarrier(node2, config) and
425389
not fullBarrier(node1, config) and
426390
not fullBarrier(node2, config)
427391
}
@@ -474,8 +438,6 @@ private predicate additionalLocalStateStep(
474438
config.isAdditionalFlowStep(n1, s1, n2, s2) and
475439
getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
476440
stepFilter(node1, node2, config) and
477-
not stateOutBarrier(node1, s1, config) and
478-
not stateInBarrier(node2, s2, config) and
479441
not stateBarrier(node1, s1, config) and
480442
not stateBarrier(node2, s2, config)
481443
)
@@ -517,8 +479,6 @@ private predicate additionalJumpStateStep(
517479
config.isAdditionalFlowStep(n1, s1, n2, s2) and
518480
getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
519481
stepFilter(node1, node2, config) and
520-
not stateOutBarrier(node1, s1, config) and
521-
not stateInBarrier(node2, s2, config) and
522482
not stateBarrier(node1, s1, config) and
523483
not stateBarrier(node2, s2, config) and
524484
not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
@@ -918,8 +878,8 @@ private module Stage1 {
918878
private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
919879
revFlow(node, true, config) and
920880
fwdFlow(node, true, config) and
921-
not fullInBarrier(node, config) and
922-
not fullOutBarrier(node, config)
881+
not inBarrier(node, config) and
882+
not outBarrier(node, config)
923883
}
924884

925885
/** Holds if flow may return from `callable`. */
@@ -1014,8 +974,8 @@ private predicate flowOutOfCallNodeCand1(
1014974
) {
1015975
viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
1016976
Stage1::revFlow(ret, config) and
1017-
not fullOutBarrier(ret, config) and
1018-
not fullInBarrier(out, config)
977+
not outBarrier(ret, config) and
978+
not inBarrier(out, config)
1019979
}
1020980

1021981
pragma[nomagic]
@@ -1036,8 +996,8 @@ private predicate flowIntoCallNodeCand1(
1036996
) {
1037997
viableParamArgNodeCand1(call, p, arg, config) and
1038998
Stage1::revFlow(p, config) and
1039-
not fullOutBarrier(arg, config) and
1040-
not fullInBarrier(p, config)
999+
not outBarrier(arg, config) and
1000+
not inBarrier(p, config)
10411001
}
10421002

10431003
/**

‎java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -109,33 +109,13 @@ abstract class Configuration extends DataFlow::Configuration {
109109
/** Holds if taint propagation into `node` is prohibited. */
110110
predicate isSanitizerIn(DataFlow::Node node) { none() }
111111

112-
/**
113-
* Holds if taint propagation into `node` is prohibited when the flow state is
114-
* `state`.
115-
*/
116-
predicate isSanitizerIn(DataFlow::Node node, DataFlow::FlowState state) { none() }
117-
118-
final override predicate isBarrierIn(DataFlow::Node node, DataFlow::FlowState state) {
119-
this.isSanitizerIn(node, state)
120-
}
121-
122112
final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
123113

124114
/** Holds if taint propagation out of `node` is prohibited. */
125115
predicate isSanitizerOut(DataFlow::Node node) { none() }
126116

127117
final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
128118

129-
/**
130-
* Holds if taint propagation out of `node` is prohibited when the flow state is
131-
* `state`.
132-
*/
133-
predicate isSanitizerOut(DataFlow::Node node, DataFlow::FlowState state) { none() }
134-
135-
final override predicate isBarrierOut(DataFlow::Node node, DataFlow::FlowState state) {
136-
this.isSanitizerOut(node, state)
137-
}
138-
139119
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
140120
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
141121

0 commit comments

Comments
 (0)