Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5e3bb82

Browse files
michaelnebelmichaelnebel
committed
C#: Make the model predicates emmit the provenance directly to enable testing.
1 parent cf3cb29 commit 5e3bb82

2 files changed

Lines changed: 37 additions & 31 deletions

File tree

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll‎

Lines changed: 18 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@
6969
* sources "remote" indicates a default remote flow source, and for summaries
7070
* "taint" indicates a default additional taint step and "value" indicates a
7171
* globally applicable value-preserving step.
72+
* 9. The `provenance` column is tag to indicate the origin of the summary.
73+
* There are two supported values: "generated" and "manual". "generated" means that
74+
* the model has been emitted by the model generator tool and "manual" means
75+
* that the model has been written by hand. This information is used in a heuristic
76+
* for dataflow analysis to determine, if a model or source code should be used for
77+
* determining flow.
7278
*/
7379

7480
import csharp
@@ -163,17 +169,10 @@ private predicate sinkModel(string row) { any(SinkModelCsv s).row(row) }
163169

164170
private predicate summaryModel(string row) { any(SummaryModelCsv s).row(row) }
165171

166-
bindingset[provenance]
167-
private boolean isGenerated(string provenance) {
168-
provenance = "generated" and result = true
169-
or
170-
provenance != "generated" and result = false
171-
}
172-
173172
/** Holds if a source model exists for the given parameters. */
174173
predicate sourceModel(
175174
string namespace, string type, boolean subtypes, string name, string signature, string ext,
176-
string output, string kind, boolean generated
175+
string output, string kind, string provenance
177176
) {
178177
exists(string row |
179178
sourceModel(row) and
@@ -186,16 +185,14 @@ predicate sourceModel(
186185
row.splitAt(";", 5) = ext and
187186
row.splitAt(";", 6) = output and
188187
row.splitAt(";", 7) = kind and
189-
exists(string provenance |
190-
row.splitAt(";", 8) = provenance and generated = isGenerated(provenance)
191-
)
188+
row.splitAt(";", 8) = provenance
192189
)
193190
}
194191

195192
/** Holds if a sink model exists for the given parameters. */
196193
predicate sinkModel(
197194
string namespace, string type, boolean subtypes, string name, string signature, string ext,
198-
string input, string kind, boolean generated
195+
string input, string kind, string provenance
199196
) {
200197
exists(string row |
201198
sinkModel(row) and
@@ -208,16 +205,14 @@ predicate sinkModel(
208205
row.splitAt(";", 5) = ext and
209206
row.splitAt(";", 6) = input and
210207
row.splitAt(";", 7) = kind and
211-
exists(string provenance |
212-
row.splitAt(";", 8) = provenance and generated = isGenerated(provenance)
213-
)
208+
row.splitAt(";", 8) = provenance
214209
)
215210
}
216211

217212
/** Holds if a summary model exists for the given parameters. */
218213
predicate summaryModel(
219214
string namespace, string type, boolean subtypes, string name, string signature, string ext,
220-
string input, string output, string kind, boolean generated
215+
string input, string output, string kind, string provenance
221216
) {
222217
exists(string row |
223218
summaryModel(row) and
@@ -231,9 +226,7 @@ predicate summaryModel(
231226
row.splitAt(";", 6) = input and
232227
row.splitAt(";", 7) = output and
233228
row.splitAt(";", 8) = kind and
234-
exists(string provenance |
235-
row.splitAt(";", 9) = provenance and generated = isGenerated(provenance)
236-
)
229+
row.splitAt(";", 9) = provenance
237230
)
238231
}
239232

@@ -268,25 +261,25 @@ predicate modelCoverage(string namespace, int namespaces, string kind, string pa
268261
part = "source" and
269262
n =
270263
strictcount(string subns, string type, boolean subtypes, string name, string signature,
271-
string ext, string output, boolean generated |
264+
string ext, string output, string provenance |
272265
canonicalNamespaceLink(namespace, subns) and
273-
sourceModel(subns, type, subtypes, name, signature, ext, output, kind, generated)
266+
sourceModel(subns, type, subtypes, name, signature, ext, output, kind, provenance)
274267
)
275268
or
276269
part = "sink" and
277270
n =
278271
strictcount(string subns, string type, boolean subtypes, string name, string signature,
279-
string ext, string input, boolean generated |
272+
string ext, string input, string provenance |
280273
canonicalNamespaceLink(namespace, subns) and
281-
sinkModel(subns, type, subtypes, name, signature, ext, input, kind, generated)
274+
sinkModel(subns, type, subtypes, name, signature, ext, input, kind, provenance)
282275
)
283276
or
284277
part = "summary" and
285278
n =
286279
strictcount(string subns, string type, boolean subtypes, string name, string signature,
287-
string ext, string input, string output, boolean generated |
280+
string ext, string input, string output, string provenance |
288281
canonicalNamespaceLink(namespace, subns) and
289-
summaryModel(subns, type, subtypes, name, signature, ext, input, output, kind, generated)
282+
summaryModel(subns, type, subtypes, name, signature, ext, input, output, kind, provenance)
290283
)
291284
)
292285
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,16 +91,25 @@ DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) {
9191
)
9292
}
9393

94+
bindingset[provenance]
95+
private boolean isGenerated(string provenance) {
96+
provenance = "generated" and result = true
97+
or
98+
provenance != "generated" and result = false
99+
}
100+
94101
/**
95102
* Holds if an external flow summary exists for `c` with input specification
96103
* `input`, output specification `output`, kind `kind`, and a flag `generated`
97104
* stating whether the summary is autogenerated.
98105
*/
99106
predicate summaryElement(Callable c, string input, string output, string kind, boolean generated) {
100107
exists(
101-
string namespace, string type, boolean subtypes, string name, string signature, string ext
108+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
109+
string provenance
102110
|
103-
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, generated) and
111+
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) and
112+
generated = isGenerated(provenance) and
104113
c = interpretElement(namespace, type, subtypes, name, signature, ext)
105114
)
106115
}
@@ -112,9 +121,11 @@ predicate summaryElement(Callable c, string input, string output, string kind, b
112121
*/
113122
predicate sourceElement(Element e, string output, string kind, boolean generated) {
114123
exists(
115-
string namespace, string type, boolean subtypes, string name, string signature, string ext
124+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
125+
string provenance
116126
|
117-
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, generated) and
127+
sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance) and
128+
generated = isGenerated(provenance) and
118129
e = interpretElement(namespace, type, subtypes, name, signature, ext)
119130
)
120131
}
@@ -126,9 +137,11 @@ predicate sourceElement(Element e, string output, string kind, boolean generated
126137
*/
127138
predicate sinkElement(Element e, string input, string kind, boolean generated) {
128139
exists(
129-
string namespace, string type, boolean subtypes, string name, string signature, string ext
140+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
141+
string provenance
130142
|
131-
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, generated) and
143+
sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance) and
144+
generated = isGenerated(provenance) and
132145
e = interpretElement(namespace, type, subtypes, name, signature, ext)
133146
)
134147
}

0 commit comments

Comments
 (0)