Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 597757d

Browse files
geoffw0geoffw0
committed
C++: Model std::stringstream put and write.
1 parent 66a5c38 commit 597757d

5 files changed

Lines changed: 52 additions & 11 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -296,10 +296,11 @@ class StdBasicOStream extends TemplateClass {
296296
}
297297

298298
/**
299-
* The `std::ostream` function `operator<<` (defined as a member function).
299+
* The `std::ostream` functions `operator<<` (defined as a member function),
300+
* `put` and `write`.
300301
*/
301302
class StdOStreamOut extends DataFlowFunction, TaintFunction {
302-
StdOStreamOut() { this.hasQualifiedName("std", "basic_ostream", "operator<<") }
303+
StdOStreamOut() { this.hasQualifiedName("std", "basic_ostream", ["operator<<", "put", "write"]) }
303304

304305
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
305306
// flow from qualifier to return value
@@ -308,11 +309,11 @@ class StdOStreamOut extends DataFlowFunction, TaintFunction {
308309
}
309310

310311
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
311-
// flow from parameter to qualifier
312+
// flow from first parameter to qualifier
312313
input.isParameter(0) and
313314
output.isQualifierObject()
314315
or
315-
// flow from parameter to return value
316+
// flow from first parameter to return value
316317
input.isParameter(0) and
317318
output.isReturnValueDeref()
318319
or
@@ -358,7 +359,9 @@ class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
358359
* input parameter.
359360
*/
360361
class StdStringStreamConstructor extends Constructor, TaintFunction {
361-
StdStringStreamConstructor() { this.getDeclaringType().hasQualifiedName("std", "basic_stringstream") }
362+
StdStringStreamConstructor() {
363+
this.getDeclaringType().hasQualifiedName("std", "basic_stringstream")
364+
}
362365

363366
/**
364367
* Gets the index of a parameter to this function that is a string.

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1449,11 +1449,35 @@
14491449
| stringstream.cpp:51:10:51:14 | abc | stringstream.cpp:51:10:51:14 | call to basic_string | TAINT |
14501450
| stringstream.cpp:51:10:51:14 | call to basic_string | stringstream.cpp:51:2:51:4 | ref arg ss7 | TAINT |
14511451
| stringstream.cpp:55:7:55:9 | ref arg ss8 | stringstream.cpp:58:7:58:9 | ss8 | |
1452+
| stringstream.cpp:55:15:55:17 | 97 | stringstream.cpp:55:7:55:9 | ref arg ss8 | TAINT |
1453+
| stringstream.cpp:55:15:55:17 | 97 | stringstream.cpp:55:11:55:13 | call to put | TAINT |
14521454
| stringstream.cpp:56:7:56:9 | ref arg ss9 | stringstream.cpp:59:7:59:9 | ss9 | |
1455+
| stringstream.cpp:56:15:56:29 | call to source | stringstream.cpp:56:7:56:9 | ref arg ss9 | TAINT |
1456+
| stringstream.cpp:56:15:56:29 | call to source | stringstream.cpp:56:11:56:13 | call to put | TAINT |
14531457
| stringstream.cpp:57:7:57:10 | ref arg ss10 | stringstream.cpp:60:7:60:10 | ss10 | |
1458+
| stringstream.cpp:57:12:57:14 | ref arg call to put | stringstream.cpp:57:7:57:10 | ref arg ss10 | TAINT |
1459+
| stringstream.cpp:57:16:57:18 | 97 | stringstream.cpp:57:7:57:10 | ref arg ss10 | TAINT |
1460+
| stringstream.cpp:57:16:57:18 | 97 | stringstream.cpp:57:12:57:14 | call to put | TAINT |
1461+
| stringstream.cpp:57:21:57:23 | ref arg call to put | stringstream.cpp:57:12:57:14 | ref arg call to put | TAINT |
1462+
| stringstream.cpp:57:25:57:39 | call to source | stringstream.cpp:57:12:57:14 | ref arg call to put | TAINT |
1463+
| stringstream.cpp:57:25:57:39 | call to source | stringstream.cpp:57:21:57:23 | call to put | TAINT |
1464+
| stringstream.cpp:57:48:57:50 | 122 | stringstream.cpp:57:21:57:23 | ref arg call to put | TAINT |
1465+
| stringstream.cpp:57:48:57:50 | 122 | stringstream.cpp:57:44:57:46 | call to put | TAINT |
14541466
| stringstream.cpp:62:7:62:10 | ref arg ss11 | stringstream.cpp:65:7:65:10 | ss11 | |
1467+
| stringstream.cpp:62:18:62:24 | begin | stringstream.cpp:62:7:62:10 | ref arg ss11 | TAINT |
1468+
| stringstream.cpp:62:18:62:24 | begin | stringstream.cpp:62:12:62:16 | call to write | TAINT |
14551469
| stringstream.cpp:63:7:63:10 | ref arg ss12 | stringstream.cpp:66:7:66:10 | ss12 | |
1470+
| stringstream.cpp:63:18:63:23 | call to source | stringstream.cpp:63:7:63:10 | ref arg ss12 | TAINT |
1471+
| stringstream.cpp:63:18:63:23 | call to source | stringstream.cpp:63:12:63:16 | call to write | TAINT |
14561472
| stringstream.cpp:64:7:64:10 | ref arg ss13 | stringstream.cpp:67:7:67:10 | ss13 | |
1473+
| stringstream.cpp:64:12:64:16 | ref arg call to write | stringstream.cpp:64:7:64:10 | ref arg ss13 | TAINT |
1474+
| stringstream.cpp:64:18:64:24 | begin | stringstream.cpp:64:7:64:10 | ref arg ss13 | TAINT |
1475+
| stringstream.cpp:64:18:64:24 | begin | stringstream.cpp:64:12:64:16 | call to write | TAINT |
1476+
| stringstream.cpp:64:30:64:34 | ref arg call to write | stringstream.cpp:64:12:64:16 | ref arg call to write | TAINT |
1477+
| stringstream.cpp:64:36:64:41 | call to source | stringstream.cpp:64:12:64:16 | ref arg call to write | TAINT |
1478+
| stringstream.cpp:64:36:64:41 | call to source | stringstream.cpp:64:30:64:34 | call to write | TAINT |
1479+
| stringstream.cpp:64:60:64:64 | end | stringstream.cpp:64:30:64:34 | ref arg call to write | TAINT |
1480+
| stringstream.cpp:64:60:64:64 | end | stringstream.cpp:64:54:64:58 | call to write | TAINT |
14571481
| stringstream.cpp:70:32:70:37 | source | stringstream.cpp:76:14:76:19 | source | |
14581482
| stringstream.cpp:72:20:72:22 | call to basic_stringstream | stringstream.cpp:75:7:75:9 | ss1 | |
14591483
| stringstream.cpp:72:20:72:22 | call to basic_stringstream | stringstream.cpp:77:7:77:9 | ss1 | |
@@ -1737,6 +1761,8 @@
17371761
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:195:7:195:8 | ss | |
17381762
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:196:7:196:8 | ss | |
17391763
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:197:7:197:8 | ss | |
1764+
| stringstream.cpp:192:14:192:16 | 97 | stringstream.cpp:192:7:192:8 | ref arg ss | TAINT |
1765+
| stringstream.cpp:192:14:192:16 | 97 | stringstream.cpp:192:10:192:12 | call to put | TAINT |
17401766
| stringstream.cpp:193:7:193:8 | ref arg ss | stringstream.cpp:194:7:194:8 | ss | |
17411767
| stringstream.cpp:193:7:193:8 | ref arg ss | stringstream.cpp:195:7:195:8 | ss | |
17421768
| stringstream.cpp:193:7:193:8 | ref arg ss | stringstream.cpp:196:7:196:8 | ss | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,18 +53,18 @@ void test_stringstream_string(int amount)
5353
sink(ss7); // [FALSE POSITIVE]
5454

5555
sink(ss8.put('a'));
56-
sink(ss9.put(ns_char::source())); // tainted [NOT DETECTED]
56+
sink(ss9.put(ns_char::source())); // tainted
5757
sink(ss10.put('a').put(ns_char::source()).put('z')); // tainted [NOT DETECTED]
5858
sink(ss8);
59-
sink(ss9); // tainted [NOT DETECTED]
60-
sink(ss10); // tainted [NOT DETECTED]
59+
sink(ss9); // tainted
60+
sink(ss10); // tainted
6161

6262
sink(ss11.write("begin", 5));
63-
sink(ss12.write(source(), 5)); // tainted [NOT DETECTED]
63+
sink(ss12.write(source(), 5)); // tainted
6464
sink(ss13.write("begin", 5).write(source(), amount).write("end", 3)); // tainted [NOT DETECTED]
6565
sink(ss11);
66-
sink(ss12); // tainted [NOT DETECTED]
67-
sink(ss13); // tainted [NOT DETECTED]
66+
sink(ss12); // tainted
67+
sink(ss13); // tainted
6868
}
6969

7070
void test_stringstream_int(int source)

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,12 @@
170170
| stringstream.cpp:46:11:46:13 | call to str | stringstream.cpp:29:16:29:21 | call to source |
171171
| stringstream.cpp:52:7:52:9 | ss6 | stringstream.cpp:49:10:49:15 | call to source |
172172
| stringstream.cpp:53:7:53:9 | ss7 | stringstream.cpp:50:10:50:15 | call to source |
173+
| stringstream.cpp:56:11:56:13 | call to put | stringstream.cpp:56:15:56:29 | call to source |
174+
| stringstream.cpp:59:7:59:9 | ss9 | stringstream.cpp:56:15:56:29 | call to source |
175+
| stringstream.cpp:60:7:60:10 | ss10 | stringstream.cpp:57:25:57:39 | call to source |
176+
| stringstream.cpp:63:12:63:16 | call to write | stringstream.cpp:63:18:63:23 | call to source |
177+
| stringstream.cpp:66:7:66:10 | ss12 | stringstream.cpp:63:18:63:23 | call to source |
178+
| stringstream.cpp:67:7:67:10 | ss13 | stringstream.cpp:64:36:64:41 | call to source |
173179
| stringstream.cpp:76:11:76:11 | call to operator<< | stringstream.cpp:70:32:70:37 | source |
174180
| stringstream.cpp:81:7:81:9 | ss2 | stringstream.cpp:70:32:70:37 | source |
175181
| stringstream.cpp:83:11:83:13 | call to str | stringstream.cpp:70:32:70:37 | source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,12 @@
186186
| stringstream.cpp:46:11:46:13 | stringstream.cpp:29:16:29:21 | AST only |
187187
| stringstream.cpp:52:7:52:9 | stringstream.cpp:49:10:49:15 | AST only |
188188
| stringstream.cpp:53:7:53:9 | stringstream.cpp:50:10:50:15 | AST only |
189+
| stringstream.cpp:56:11:56:13 | stringstream.cpp:56:15:56:29 | AST only |
190+
| stringstream.cpp:59:7:59:9 | stringstream.cpp:56:15:56:29 | AST only |
191+
| stringstream.cpp:60:7:60:10 | stringstream.cpp:57:25:57:39 | AST only |
192+
| stringstream.cpp:63:12:63:16 | stringstream.cpp:63:18:63:23 | AST only |
193+
| stringstream.cpp:66:7:66:10 | stringstream.cpp:63:18:63:23 | AST only |
194+
| stringstream.cpp:67:7:67:10 | stringstream.cpp:64:36:64:41 | AST only |
189195
| stringstream.cpp:76:11:76:11 | stringstream.cpp:70:32:70:37 | AST only |
190196
| stringstream.cpp:81:7:81:9 | stringstream.cpp:70:32:70:37 | AST only |
191197
| stringstream.cpp:83:11:83:13 | stringstream.cpp:70:32:70:37 | AST only |

0 commit comments

Comments
 (0)