C++: We *could* support .Argument with no index, but I'm not convinced we can do so efficiently, so lets not.

geoffw0 · geoffw0 · commit 58737b1d7ec7 · 2024-03-25T17:08:15.000Z
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -39,8 +39,6 @@
  *      - `n1..n2` syntax can be used to indicate a range of arguments, inclusive
  *        at both ends. One or more "*" can be added in front of the range to
  *        indicate indirection on all arguments in the range, for example `*n1..n2`.
- *      - "Argument" can be specified without any "[]". In this case, any argument
- *        is accepted.
  *    - "ReturnValue": Selects a value being returned by the selected element.
  *      One or more "*" can be added as an argument to indicate indirection, for
  *      example, "ReturnValue[*]" indicates the first indirection of the return
@@ -58,8 +56,6 @@
  *      - `n1..n2` syntax can be used to indicate a range of arguments, inclusive
  *        at both ends. One or more "*" can be added in front of the range to
  *        indicate indirection on all arguments in the range, for example `*n1..n2`.
- *      - "Argument" can be specified without any "[]". In this case, any argument
- *        is accepted.
  *    - "Parameter[n]": Selects the value of a parameter of the selected element.
  *      The syntax is the same as for "Argument", for example "Parameter[0]",
  *      "Parameter[*0]", "Parameter[0..2]" etc.
diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll
@@ -78,7 +78,7 @@ private class TestSummaries extends SummaryModelCsv {
         ";;false;madArg0ToArg1Indirect;;;Argument[0];Argument[*1];taint",
         ";;false;madArg0IndirectToArg1Indirect;;;Argument[*0];Argument[*1];taint",
         ";;false;madArgsComplex;;;Argument[*0..1,2];ReturnValue;taint",
-        ";;false;madArgsAny;;;Argument;ReturnValue;taint",
+        ";;false;madArgsAny;;;Argument;ReturnValue;taint", // (syntax not supported)
         ";;false;madArg0FieldToReturn;;;Argument[0].value;ReturnValue;taint",
         ";;false;madArg0IndirectFieldToReturn;;;Argument[*0].value;ReturnValue;taint",
         ";;false;madArg0FieldIndirectToReturn;;;Argument[0].ptr[*];ReturnValue;taint",
diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp b/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp
@@ -186,9 +186,9 @@ void test_summaries() {
 	sink(madArgsComplex(0, 0, 0, source()));
 
 	sink(madArgsAny(0, 0));
-	sink(madArgsAny(source(), 0)); // $ MISSING: ir
-	sink(madArgsAny(0, sourcePtr())); // $ MISSING: ir
-	sink(madArgsAny(0, sourceIndirect())); // $ MISSING: ir
+	sink(madArgsAny(source(), 0)); // (syntax not supported)
+	sink(madArgsAny(0, sourcePtr())); // (syntax not supported)
+	sink(madArgsAny(0, sourceIndirect())); // (syntax not supported)
 
 	// test summaries involving structs / fields
 
