Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9dbea53

Browse files
MathiasVPMathiasVP
committed
Merge branch 'mathiasvp/replace-ast-with-ir-use-usedataflow' into refactor-param-out-nodes-2
2 parents da6bbbb + 3f9deb6 commit 9dbea53

22 files changed

Lines changed: 1528 additions & 1430 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,8 @@ class InstructionNode extends Node0 {
363363

364364
/** Gets the instruction corresponding to this node. */
365365
Instruction getInstruction() { result = instr }
366+
367+
override string toStringImpl() { result = instr.getAst().toString() }
366368
}
367369

368370
/**
@@ -376,6 +378,8 @@ class OperandNode extends Node, Node0 {
376378

377379
/** Gets the operand corresponding to this node. */
378380
Operand getOperand() { result = node.getOperand() }
381+
382+
override string toStringImpl() { result = op.getDef().getAst().toString() }
379383
}
380384

381385
/**

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
uniqueEnclosingCallable
2-
| globals.cpp:9:5:9:19 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
3-
| globals.cpp:9:5:9:19 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
4-
| globals.cpp:16:12:16:26 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
5-
| globals.cpp:16:12:16:26 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
2+
| globals.cpp:9:5:9:19 | flowTestGlobal1 indirection | Node should have one enclosing callable but has 0. |
3+
| globals.cpp:9:5:9:19 | flowTestGlobal1 indirection | Node should have one enclosing callable but has 0. |
4+
| globals.cpp:16:12:16:26 | flowTestGlobal2 indirection | Node should have one enclosing callable but has 0. |
5+
| globals.cpp:16:12:16:26 | flowTestGlobal2 indirection | Node should have one enclosing callable but has 0. |
66
uniqueType
77
uniqueNodeLocation
88
| BarrierGuard.cpp:2:11:2:13 | (unnamed parameter 0) | Node should have one location but has 6. |

‎cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ postIsNotPre
3333
| D.cpp:56:15:56:24 | new indirection | PostUpdateNode should not equal its pre-update node. |
3434
postHasUniquePre
3535
uniquePostUpdate
36-
| aliasing.cpp:70:11:70:11 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
37-
| aliasing.cpp:77:11:77:11 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
38-
| aliasing.cpp:84:11:84:11 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
39-
| aliasing.cpp:91:11:91:11 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
36+
| aliasing.cpp:70:11:70:11 | definition of w indirection | Node has multiple PostUpdateNodes. |
37+
| aliasing.cpp:77:11:77:11 | definition of w indirection | Node has multiple PostUpdateNodes. |
38+
| aliasing.cpp:84:11:84:11 | definition of w indirection | Node has multiple PostUpdateNodes. |
39+
| aliasing.cpp:91:11:91:11 | definition of w indirection | Node has multiple PostUpdateNodes. |
4040
| complex.cpp:22:3:22:5 | this indirection | Node has multiple PostUpdateNodes. |
4141
| complex.cpp:25:7:25:7 | this indirection | Node has multiple PostUpdateNodes. |
4242
| complex.cpp:42:10:42:14 | inner indirection | Node has multiple PostUpdateNodes. |
@@ -45,8 +45,8 @@ uniquePostUpdate
4545
| complex.cpp:54:6:54:10 | inner indirection | Node has multiple PostUpdateNodes. |
4646
| complex.cpp:55:6:55:10 | inner indirection | Node has multiple PostUpdateNodes. |
4747
| complex.cpp:56:6:56:10 | inner indirection | Node has multiple PostUpdateNodes. |
48-
| struct_init.c:26:16:26:20 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
49-
| struct_init.c:41:16:41:20 | VariableAddress indirection | Node has multiple PostUpdateNodes. |
48+
| struct_init.c:26:16:26:20 | definition of outer indirection | Node has multiple PostUpdateNodes. |
49+
| struct_init.c:41:16:41:20 | definition of outer indirection | Node has multiple PostUpdateNodes. |
5050
postIsInSameCallable
5151
reverseRead
5252
argHasPostUpdate

‎cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected‎

Lines changed: 944 additions & 944 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected‎

Lines changed: 167 additions & 73 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
2-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | Convert indirection |
2+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection |
33
nodes
44
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | semmle.label | fgets output argument |
5-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | Convert indirection | semmle.label | Convert indirection |
5+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection | semmle.label | (const char *)... indirection |
66
subpaths
77
#select
8-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | user input (string read by fgets) |
8+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | user input (string read by fgets) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,32 @@
11
edges
2-
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | Convert indirection |
3-
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection |
4-
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection |
5-
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection |
6-
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection |
2+
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | (const char *)... indirection |
3+
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection |
4+
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection |
5+
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection |
6+
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection |
77
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
88
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
9-
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | Convert indirection |
10-
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | Convert indirection |
9+
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | (const char *)... indirection |
10+
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | (const char *)... indirection |
1111
nodes
1212
| test.c:8:27:8:30 | argv | semmle.label | argv |
1313
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
1414
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
15-
| test.c:17:11:17:18 | Convert indirection | semmle.label | Convert indirection |
16-
| test.c:32:11:32:18 | Convert indirection | semmle.label | Convert indirection |
15+
| test.c:17:11:17:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
16+
| test.c:32:11:32:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
1717
| test.c:37:17:37:24 | scanf output argument | semmle.label | scanf output argument |
18-
| test.c:38:11:38:18 | Convert indirection | semmle.label | Convert indirection |
18+
| test.c:38:11:38:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
1919
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
20-
| test.c:44:11:44:18 | Convert indirection | semmle.label | Convert indirection |
20+
| test.c:44:11:44:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
2121
| test.c:57:10:57:16 | access to array indirection | semmle.label | access to array indirection |
2222
subpaths
2323
#select
24-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
25-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
26-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
27-
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
28-
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
29-
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
30-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
24+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
25+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
26+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
27+
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
28+
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
29+
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
30+
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
3131
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
3232
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.expected‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
edges
2-
| tests.cpp:26:15:26:23 | VariableAddress indirection | tests.cpp:51:12:51:20 | call to badSource indirection |
3-
| tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:38:39:38:49 | Convert indirection |
4-
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | VariableAddress indirection |
5-
| tests.cpp:38:39:38:49 | Convert indirection | tests.cpp:38:25:38:36 | strncat output argument |
6-
| tests.cpp:51:12:51:20 | call to badSource indirection | tests.cpp:53:16:53:19 | Convert indirection |
2+
| tests.cpp:26:15:26:23 | badSource indirection | tests.cpp:51:12:51:20 | call to badSource indirection |
3+
| tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:38:39:38:49 | (const char *)... indirection |
4+
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | badSource indirection |
5+
| tests.cpp:38:39:38:49 | (const char *)... indirection | tests.cpp:38:25:38:36 | strncat output argument |
6+
| tests.cpp:51:12:51:20 | call to badSource indirection | tests.cpp:53:16:53:19 | (const char *)... indirection |
77
nodes
8-
| tests.cpp:26:15:26:23 | VariableAddress indirection | semmle.label | VariableAddress indirection |
8+
| tests.cpp:26:15:26:23 | badSource indirection | semmle.label | badSource indirection |
99
| tests.cpp:33:34:33:39 | call to getenv indirection | semmle.label | call to getenv indirection |
1010
| tests.cpp:38:25:38:36 | strncat output argument | semmle.label | strncat output argument |
11-
| tests.cpp:38:39:38:49 | Convert indirection | semmle.label | Convert indirection |
11+
| tests.cpp:38:39:38:49 | (const char *)... indirection | semmle.label | (const char *)... indirection |
1212
| tests.cpp:51:12:51:20 | call to badSource indirection | semmle.label | call to badSource indirection |
13-
| tests.cpp:53:16:53:19 | Convert indirection | semmle.label | Convert indirection |
13+
| tests.cpp:53:16:53:19 | (const char *)... indirection | semmle.label | (const char *)... indirection |
1414
subpaths
1515
#select
16-
| tests.cpp:53:16:53:19 | data | tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:53:16:53:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | tests.cpp:33:34:33:39 | call to getenv indirection | user input (an environment variable) | tests.cpp:38:25:38:36 | strncat output argument | strncat output argument |
16+
| tests.cpp:53:16:53:19 | data | tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:53:16:53:19 | (const char *)... indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | tests.cpp:33:34:33:39 | call to getenv indirection | user input (an environment variable) | tests.cpp:38:25:38:36 | strncat output argument | strncat output argument |

0 commit comments

Comments
 (0)