@@ -33,33 +33,31 @@ class MySanitizerHandlingNot extends Sanitizer {
3333 /** The test `if is_safe(arg):` sanitizes `arg` on its `true` edge. */
3434 override predicate sanitizingEdge ( TaintKind taint , PyEdgeRefinement test ) {
3535 taint instanceof ExternalStringKind and
36- clears_taint_on_true ( _ , test .getTest ( ) , test .getSense ( ) , test )
36+ clears_taint_on_true ( test .getTest ( ) , test .getSense ( ) , test )
3737 }
3838
3939 /**
4040 * Helper predicate that recurses into any nesting of `not`
4141 *
4242 * To reduce the number of tuples this predicate holds for, we include the `PyEdgeRefinement` and
43- * ensure that `test` is a part of this `PyEdgeRefinement`. Without including `PyEdgeRefinement` as an argument
44- * *any* `CallNode c` to `test.is_safe` would be a result of this predicate, since (c, c, true) would hold.
43+ * ensure that `test` is a part of this `PyEdgeRefinement` (instead of just taking the
44+ * `edge_refinement.getInput().getAUse()` part as a part of the predicate). Without including
45+ * `PyEdgeRefinement` as an argument *any* `CallNode c` to `test.is_safe` would be a result of
46+ * this predicate, since the tuple where `test = c` and `sense = true` would hold.
4547 */
4648 private predicate clears_taint_on_true (
47- CallNode final_test , ControlFlowNode test , boolean sense , PyEdgeRefinement edge_refinement
49+ ControlFlowNode test , boolean sense , PyEdgeRefinement edge_refinement
4850 ) {
51+ edge_refinement .getTest ( ) .getNode ( ) .( Expr ) .getASubExpression * ( ) = test .getNode ( ) and
4952 (
50- edge_refinement .getTest ( ) .getNode ( ) .( Expr ) .getASubExpression * ( ) = test .getNode ( ) and
51- test .getNode ( ) .( Expr ) .getASubExpression * ( ) = final_test .getNode ( )
52- ) and
53- (
54- final_test = test and
55- final_test = Value:: named ( "test.is_safe" ) .getACall ( ) and
56- edge_refinement .getInput ( ) .getAUse ( ) = final_test .getAnArg ( ) and
53+ test = Value:: named ( "test.is_safe" ) .getACall ( ) and
54+ edge_refinement .getInput ( ) .getAUse ( ) = test .( CallNode ) .getAnArg ( ) and
5755 sense = true
5856 or
5957 test .( UnaryExprNode ) .getNode ( ) .getOp ( ) instanceof Not and
6058 exists ( ControlFlowNode nested_test |
6159 nested_test = test .( UnaryExprNode ) .getOperand ( ) and
62- clears_taint_on_true ( final_test , nested_test , sense .booleanNot ( ) , edge_refinement )
60+ clears_taint_on_true ( nested_test , sense .booleanNot ( ) , edge_refinement )
6361 )
6462 )
6563 }
0 commit comments