Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7317168

Browse files
geoffw0geoffw0
committed
C++: Switch to taint flow as suggested in the old PR.
1 parent b14b52d commit 7317168

5 files changed

Lines changed: 12 additions & 9 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strings.qll‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
1-
import semmle.code.cpp.models.interfaces.DataFlow
21
import semmle.code.cpp.models.interfaces.Taint
32

43
/**
54
* The `std::basic_string` constructor(s).
65
*/
7-
class StringConstructor extends DataFlowFunction {
6+
class StringConstructor extends TaintFunction {
87
StringConstructor() {
98
this.hasQualifiedName("std", "basic_string", "basic_string")
109
}
1110

12-
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
11+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
1312
// flow from any constructor argument to return value
1413
input.isInParameter(_) and
1514
output.isOutReturnValue()
@@ -19,12 +18,12 @@ class StringConstructor extends DataFlowFunction {
1918
/**
2019
* The standard function `std::string.c_str`.
2120
*/
22-
class StringCStr extends DataFlowFunction {
21+
class StringCStr extends TaintFunction {
2322
StringCStr() {
2423
this.hasQualifiedName("std", "basic_string", "c_str")
2524
}
2625

27-
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
26+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
2827
// flow from string itself (qualifier) to return value
2928
input.isInQualifier() and
3029
output.isOutReturnValue()

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,12 +106,14 @@
106106
| format.cpp:131:39:131:45 | ref arg & ... | format.cpp:132:8:132:13 | buffer | |
107107
| format.cpp:131:40:131:45 | buffer | format.cpp:131:39:131:45 | & ... | |
108108
| stl.cpp:67:12:67:17 | call to source | stl.cpp:71:7:71:7 | a | |
109-
| stl.cpp:68:16:68:20 | 123 | stl.cpp:68:16:68:21 | call to basic_string | |
109+
| stl.cpp:68:16:68:20 | 123 | stl.cpp:68:16:68:21 | call to basic_string | TAINT |
110110
| stl.cpp:68:16:68:21 | call to basic_string | stl.cpp:72:7:72:7 | b | |
111111
| stl.cpp:68:16:68:21 | call to basic_string | stl.cpp:74:7:74:7 | b | |
112-
| stl.cpp:69:16:69:21 | call to source | stl.cpp:69:16:69:24 | call to basic_string | |
112+
| stl.cpp:69:16:69:21 | call to source | stl.cpp:69:16:69:24 | call to basic_string | TAINT |
113113
| stl.cpp:69:16:69:24 | call to basic_string | stl.cpp:73:7:73:7 | c | |
114114
| stl.cpp:69:16:69:24 | call to basic_string | stl.cpp:75:7:75:7 | c | |
115+
| stl.cpp:74:7:74:7 | b | stl.cpp:74:9:74:13 | call to c_str | TAINT |
116+
| stl.cpp:75:7:75:7 | c | stl.cpp:75:9:75:13 | call to c_str | TAINT |
115117
| stl.cpp:80:20:80:22 | call to basic_stringstream | stl.cpp:83:2:83:4 | ss1 | |
116118
| stl.cpp:80:20:80:22 | call to basic_stringstream | stl.cpp:89:7:89:9 | ss1 | |
117119
| stl.cpp:80:20:80:22 | call to basic_stringstream | stl.cpp:94:7:94:9 | ss1 | |
@@ -127,7 +129,7 @@
127129
| stl.cpp:80:40:80:42 | call to basic_stringstream | stl.cpp:87:2:87:4 | ss5 | |
128130
| stl.cpp:80:40:80:42 | call to basic_stringstream | stl.cpp:93:7:93:9 | ss5 | |
129131
| stl.cpp:80:40:80:42 | call to basic_stringstream | stl.cpp:98:7:98:9 | ss5 | |
130-
| stl.cpp:81:16:81:21 | call to source | stl.cpp:81:16:81:24 | call to basic_string | |
132+
| stl.cpp:81:16:81:21 | call to source | stl.cpp:81:16:81:24 | call to basic_string | TAINT |
131133
| stl.cpp:81:16:81:24 | call to basic_string | stl.cpp:87:9:87:9 | t | |
132134
| stl.cpp:83:2:83:4 | ref arg ss1 | stl.cpp:89:7:89:9 | ss1 | |
133135
| stl.cpp:83:2:83:4 | ref arg ss1 | stl.cpp:94:7:94:9 | ss1 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ void test_string()
7272
sink(b);
7373
sink(c); // tainted
7474
sink(b.c_str());
75-
sink(c.c_str()); // tainted [NOT DETECTED]
75+
sink(c.c_str()); // tainted
7676
}
7777

7878
void test_stringstream()

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
| format.cpp:106:8:106:14 | wbuffer | format.cpp:105:38:105:52 | call to source |
1111
| stl.cpp:71:7:71:7 | a | stl.cpp:67:12:67:17 | call to source |
1212
| stl.cpp:73:7:73:7 | c | stl.cpp:69:16:69:21 | call to source |
13+
| stl.cpp:75:9:75:13 | call to c_str | stl.cpp:69:16:69:21 | call to source |
1314
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |
1415
| taint.cpp:16:8:16:14 | source1 | taint.cpp:12:22:12:27 | call to source |
1516
| taint.cpp:17:8:17:16 | ++ ... | taint.cpp:12:22:12:27 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
| format.cpp:101:8:101:13 | format.cpp:100:31:100:45 | AST only |
1010
| format.cpp:106:8:106:14 | format.cpp:105:38:105:52 | AST only |
1111
| stl.cpp:73:7:73:7 | stl.cpp:69:16:69:21 | AST only |
12+
| stl.cpp:75:9:75:13 | stl.cpp:69:16:69:21 | AST only |
1213
| taint.cpp:41:7:41:13 | taint.cpp:35:12:35:17 | AST only |
1314
| taint.cpp:42:7:42:13 | taint.cpp:35:12:35:17 | AST only |
1415
| taint.cpp:43:7:43:13 | taint.cpp:37:22:37:27 | AST only |

0 commit comments

Comments
 (0)