Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 66a5c38

Browse files
geoffw0geoffw0
committed
C++: Model std::stringstream constructor.
1 parent 46a07fa commit 66a5c38

5 files changed

Lines changed: 49 additions & 6 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,27 @@ class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
353353
}
354354
}
355355

356+
/**
357+
* Additional model for `std::stringstream` constructors that take a string
358+
* input parameter.
359+
*/
360+
class StdStringStreamConstructor extends Constructor, TaintFunction {
361+
StdStringStreamConstructor() { this.getDeclaringType().hasQualifiedName("std", "basic_stringstream") }
362+
363+
/**
364+
* Gets the index of a parameter to this function that is a string.
365+
*/
366+
int getAStringParameterIndex() {
367+
getParameter(result).getType() instanceof ReferenceType // `const std::basic_string &`
368+
}
369+
370+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
371+
// taint flow from any parameter of string type to the returned object
372+
input.isParameterDeref(getAStringParameterIndex()) and
373+
output.isReturnValue() // TODO: this should be `isQualifierObject` by our current definitions, but that flow is not yet supported.
374+
}
375+
}
376+
356377
/**
357378
* The `std::stringstream` function `str`.
358379
*/

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1489,12 +1489,16 @@
14891489
| stringstream.cpp:90:19:90:23 | abc | stringstream.cpp:90:18:90:23 | call to basic_string | TAINT |
14901490
| stringstream.cpp:91:18:91:26 | call to basic_string | stringstream.cpp:93:24:93:25 | s2 | |
14911491
| stringstream.cpp:91:19:91:24 | call to source | stringstream.cpp:91:18:91:26 | call to basic_string | TAINT |
1492+
| stringstream.cpp:92:24:92:25 | s1 | stringstream.cpp:92:24:92:26 | call to basic_stringstream | TAINT |
14921493
| stringstream.cpp:92:24:92:26 | call to basic_stringstream | stringstream.cpp:102:7:102:9 | ss1 | |
1494+
| stringstream.cpp:93:24:93:25 | s2 | stringstream.cpp:93:24:93:26 | call to basic_stringstream | TAINT |
14931495
| stringstream.cpp:93:24:93:26 | call to basic_stringstream | stringstream.cpp:103:7:103:9 | ss2 | |
14941496
| stringstream.cpp:94:25:94:49 | call to basic_stringstream | stringstream.cpp:104:7:104:9 | ss3 | |
14951497
| stringstream.cpp:94:44:94:48 | abc | stringstream.cpp:94:44:94:48 | call to basic_string | TAINT |
1498+
| stringstream.cpp:94:44:94:48 | call to basic_string | stringstream.cpp:94:25:94:49 | call to basic_stringstream | TAINT |
14961499
| stringstream.cpp:95:25:95:52 | call to basic_stringstream | stringstream.cpp:105:7:105:9 | ss4 | |
14971500
| stringstream.cpp:95:44:95:49 | call to source | stringstream.cpp:95:44:95:51 | call to basic_string | TAINT |
1501+
| stringstream.cpp:95:44:95:51 | call to basic_string | stringstream.cpp:95:25:95:52 | call to basic_stringstream | TAINT |
14981502
| stringstream.cpp:96:20:96:22 | call to basic_stringstream | stringstream.cpp:99:7:99:9 | ss5 | |
14991503
| stringstream.cpp:96:20:96:22 | call to basic_stringstream | stringstream.cpp:106:7:106:9 | ss5 | |
15001504
| stringstream.cpp:97:20:97:22 | call to basic_stringstream | stringstream.cpp:100:7:100:9 | ss6 | |
@@ -1503,20 +1507,26 @@
15031507
| stringstream.cpp:99:13:99:36 | call to basic_stringstream | stringstream.cpp:99:7:99:9 | ref arg ss5 | TAINT |
15041508
| stringstream.cpp:99:13:99:36 | call to basic_stringstream | stringstream.cpp:99:11:99:11 | call to operator= | TAINT |
15051509
| stringstream.cpp:99:31:99:35 | abc | stringstream.cpp:99:31:99:35 | call to basic_string | TAINT |
1510+
| stringstream.cpp:99:31:99:35 | call to basic_string | stringstream.cpp:99:13:99:36 | call to basic_stringstream | TAINT |
15061511
| stringstream.cpp:100:7:100:9 | ref arg ss6 | stringstream.cpp:107:7:107:9 | ss6 | |
15071512
| stringstream.cpp:100:13:100:39 | call to basic_stringstream | stringstream.cpp:100:7:100:9 | ref arg ss6 | TAINT |
15081513
| stringstream.cpp:100:13:100:39 | call to basic_stringstream | stringstream.cpp:100:11:100:11 | call to operator= | TAINT |
15091514
| stringstream.cpp:100:31:100:36 | call to source | stringstream.cpp:100:31:100:38 | call to basic_string | TAINT |
1515+
| stringstream.cpp:100:31:100:38 | call to basic_string | stringstream.cpp:100:13:100:39 | call to basic_stringstream | TAINT |
15101516
| stringstream.cpp:112:24:112:28 | abc | stringstream.cpp:112:24:112:28 | call to basic_string | TAINT |
1517+
| stringstream.cpp:112:24:112:28 | call to basic_string | stringstream.cpp:112:24:112:29 | call to basic_stringstream | TAINT |
15111518
| stringstream.cpp:112:24:112:29 | call to basic_stringstream | stringstream.cpp:117:2:117:4 | ss1 | |
15121519
| stringstream.cpp:112:24:112:29 | call to basic_stringstream | stringstream.cpp:120:7:120:9 | ss1 | |
15131520
| stringstream.cpp:113:24:113:29 | call to source | stringstream.cpp:113:24:113:31 | call to basic_string | TAINT |
1521+
| stringstream.cpp:113:24:113:31 | call to basic_string | stringstream.cpp:113:24:113:32 | call to basic_stringstream | TAINT |
15141522
| stringstream.cpp:113:24:113:32 | call to basic_stringstream | stringstream.cpp:117:11:117:13 | ss2 | |
15151523
| stringstream.cpp:113:24:113:32 | call to basic_stringstream | stringstream.cpp:121:7:121:9 | ss2 | |
15161524
| stringstream.cpp:114:24:114:28 | abc | stringstream.cpp:114:24:114:28 | call to basic_string | TAINT |
1525+
| stringstream.cpp:114:24:114:28 | call to basic_string | stringstream.cpp:114:24:114:29 | call to basic_stringstream | TAINT |
15171526
| stringstream.cpp:114:24:114:29 | call to basic_stringstream | stringstream.cpp:118:11:118:13 | ss3 | |
15181527
| stringstream.cpp:114:24:114:29 | call to basic_stringstream | stringstream.cpp:122:7:122:9 | ss3 | |
15191528
| stringstream.cpp:115:24:115:29 | call to source | stringstream.cpp:115:24:115:31 | call to basic_string | TAINT |
1529+
| stringstream.cpp:115:24:115:31 | call to basic_string | stringstream.cpp:115:24:115:32 | call to basic_stringstream | TAINT |
15201530
| stringstream.cpp:115:24:115:32 | call to basic_stringstream | stringstream.cpp:118:2:118:4 | ss4 | |
15211531
| stringstream.cpp:115:24:115:32 | call to basic_stringstream | stringstream.cpp:123:7:123:9 | ss4 | |
15221532
| stringstream.cpp:117:2:117:4 | ref arg ss1 | stringstream.cpp:120:7:120:9 | ss1 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -97,14 +97,14 @@ void test_stringstream_constructors()
9797
std::stringstream ss6;
9898

9999
sink(ss5 = std::stringstream("abc"));
100-
sink(ss6 = std::stringstream(source())); // tainted [NOT DETECTED]
100+
sink(ss6 = std::stringstream(source())); // tainted
101101

102102
sink(ss1);
103-
sink(ss2); // tainted [NOT DETECTED]
103+
sink(ss2); // tainted
104104
sink(ss3);
105-
sink(ss4); // tainted [NOT DETECTED]
105+
sink(ss4); // tainted
106106
sink(ss5);
107-
sink(ss6); // tainted [NOT DETECTED]
107+
sink(ss6); // tainted
108108
}
109109

110110
void test_stringstream_swap()
@@ -118,9 +118,9 @@ void test_stringstream_swap()
118118
ss4.swap(ss3);
119119

120120
sink(ss1); // tainted [NOT DETECTED]
121-
sink(ss2);
121+
sink(ss2); // [FALSE POSITIVE]
122122
sink(ss3); // tainted [NOT DETECTED]
123-
sink(ss4);
123+
sink(ss4); // [FALSE POSITIVE]
124124
}
125125

126126
void test_stringstream_in()

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,12 @@
173173
| stringstream.cpp:76:11:76:11 | call to operator<< | stringstream.cpp:70:32:70:37 | source |
174174
| stringstream.cpp:81:7:81:9 | ss2 | stringstream.cpp:70:32:70:37 | source |
175175
| stringstream.cpp:83:11:83:13 | call to str | stringstream.cpp:70:32:70:37 | source |
176+
| stringstream.cpp:100:11:100:11 | call to operator= | stringstream.cpp:100:31:100:36 | call to source |
177+
| stringstream.cpp:103:7:103:9 | ss2 | stringstream.cpp:91:19:91:24 | call to source |
178+
| stringstream.cpp:105:7:105:9 | ss4 | stringstream.cpp:95:44:95:49 | call to source |
179+
| stringstream.cpp:107:7:107:9 | ss6 | stringstream.cpp:100:31:100:36 | call to source |
180+
| stringstream.cpp:121:7:121:9 | ss2 | stringstream.cpp:113:24:113:29 | call to source |
181+
| stringstream.cpp:123:7:123:9 | ss4 | stringstream.cpp:115:24:115:29 | call to source |
176182
| stringstream.cpp:143:11:143:11 | call to operator<< | stringstream.cpp:143:14:143:19 | call to source |
177183
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
178184
| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,12 @@
189189
| stringstream.cpp:76:11:76:11 | stringstream.cpp:70:32:70:37 | AST only |
190190
| stringstream.cpp:81:7:81:9 | stringstream.cpp:70:32:70:37 | AST only |
191191
| stringstream.cpp:83:11:83:13 | stringstream.cpp:70:32:70:37 | AST only |
192+
| stringstream.cpp:100:11:100:11 | stringstream.cpp:100:31:100:36 | AST only |
193+
| stringstream.cpp:103:7:103:9 | stringstream.cpp:91:19:91:24 | AST only |
194+
| stringstream.cpp:105:7:105:9 | stringstream.cpp:95:44:95:49 | AST only |
195+
| stringstream.cpp:107:7:107:9 | stringstream.cpp:100:31:100:36 | AST only |
196+
| stringstream.cpp:121:7:121:9 | stringstream.cpp:113:24:113:29 | AST only |
197+
| stringstream.cpp:123:7:123:9 | stringstream.cpp:115:24:115:29 | AST only |
192198
| stringstream.cpp:143:11:143:11 | stringstream.cpp:143:14:143:21 | IR only |
193199
| stringstream.cpp:143:11:143:22 | stringstream.cpp:143:14:143:19 | IR only |
194200
| stringstream.cpp:143:11:143:22 | stringstream.cpp:143:14:143:21 | IR only |

0 commit comments

Comments
 (0)