C++: Also recognize iterators obtained via a function that doesn't receive the container as a qualiifer.

MathiasVP · MathiasVP · commit 559c7993092d · 2023-02-03T21:43:21.000Z
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
@@ -463,6 +463,7 @@ cached
 private module Cached {
   private import semmle.code.cpp.models.interfaces.Iterator as Interfaces
   private import semmle.code.cpp.models.implementations.Iterator as Iterator
+  private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs as IO
 
   /**
    * Holds if `next` is a instruction with a memory result that potentially
@@ -593,11 +594,16 @@ private module Cached {
   private predicate isChiAfterBegin(
     BaseSourceVariableInstruction containerBase, StoreInstruction iterator
   ) {
-    exists(CallInstruction getIterator |
+    exists(
+      CallInstruction getIterator, Iterator::GetIteratorFunction getIteratorFunction,
+      IO::FunctionInput input, int i
+    |
       getIterator = iterator.getSourceValue() and
-      getIterator.getStaticCallTarget() instanceof Iterator::GetIteratorFunction and
+      getIteratorFunction = getIterator.getStaticCallTarget() and
+      getIteratorFunction.getsIterator(input, _) and
       isDef(_, any(Node0Impl n | n.asInstruction() = iterator), _, _, 1, 0) and
-      isUse(_, getIterator.getThisArgumentOperand(), containerBase, 0, 0)
+      input.isParameterDerefOrQualifierObject(i) and
+      isUse(_, getIterator.getArgumentOperand(i), containerBase, 0, 0)
     )
   }
 
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
@@ -426,14 +426,14 @@ void test_vector_inserter(char *source_string) {
 		std::vector<std::string> out;
 		auto it = std::back_inserter(out);
 		*it++ = std::string(source_string);
-		sink(out); // $ ast MISSING: ir
+		sink(out); // $ ast,ir
 	}
 
 	{
 		std::vector<int> out;
 		auto it = std::back_inserter(out);
 		*it++ = source();
-		sink(out); // $ ast MISSING: ir
+		sink(out); // $ ast,ir
 	}
 
 	{

Original file line number	Diff line number	Diff line change
`@@ -426,14 +426,14 @@ void test_vector_inserter(char *source_string) {`
`426`	`426`	`std::vector<std::string> out;`
`427`	`427`	`auto it = std::back_inserter(out);`
`428`	`428`	`*it++ = std::string(source_string);`
`429`		`- sink(out); // $ ast MISSING: ir`
	`429`	`+ sink(out); // $ ast,ir`
`430`	`430`	`}`
`431`	`431`
`432`	`432`	`{`
`433`	`433`	`std::vector<int> out;`
`434`	`434`	`auto it = std::back_inserter(out);`
`435`	`435`	`*it++ = source();`
`436`		`- sink(out); // $ ast MISSING: ir`
	`436`	`+ sink(out); // $ ast,ir`
`437`	`437`	`}`
`438`	`438`
`439`	`439`	`{`