[CPP-370] First attempt at isAdditionalFlowStep().

zlaski-semmle · zlaski-semmle · commit d8b8dda43925 · 2019-05-21T06:45:52.000-07:00
diff --git a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
@@ -42,8 +42,16 @@ predicate whitelistFunction(Function f, int arg) {
   (arg = 1 or arg = 2)
 }
 
+<<<<<<< HEAD
 predicate whitelisted(FunctionCall fc) {
   exists(Function f, int arg | f = fc.getTarget() | whitelistFunction(f, arg))
+=======
+predicate underscoreMacro(Expr e) {
+  exists(MacroInvocation mi |
+    mi.getMacroName() = "_" and
+    mi.getExpr() = e
+  )
+>>>>>>> [CPP-370] First attempt at isAdditionalFlowStep().
 }
 
 predicate isNonConst(DataFlow::Node node) {
@@ -88,11 +96,26 @@ predicate isNonConst(DataFlow::Node node) {
     )
   )
   or
+<<<<<<< HEAD
   node instanceof DataFlow::DefinitionByReferenceNode
 }
 
 class NonConstFlow extends TaintTracking::Configuration {
   NonConstFlow() { this = "NonConstFlow" }
+=======
+  // we let the '_' macro through regardless of what it points at
+  underscoreMacro(e)
+}
+
+predicate isConst(Expr e) {
+  e instanceof StringLiteral
+  or
+  whitelisted(e)
+}
+
+class ConstFlow extends DataFlow::Configuration {
+  ConstFlow() { this = "ConstFlow" }
+>>>>>>> [CPP-370] First attempt at isAdditionalFlowStep().
 
   override predicate isSource(DataFlow::Node source) { isNonConst(source) }
 
@@ -101,6 +124,20 @@ class NonConstFlow extends TaintTracking::Configuration {
       sink.asExpr() = fc.getArgument(fc.getFormatParameterIndex())
     )
   }
+
+  override predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
+  	none()
+  	or
+    // an element picked from an array of string literals is a string literal
+    exists(Variable v, int a |
+      a = sink.asExpr().(ArrayExpr).getArrayOffset().getValue().toInt() and
+      v = sink.asExpr().(ArrayExpr).getArrayBase().(VariableAccess).getTarget()
+    |
+    // we disallow parameters, since they may be bound to unsafe arguments
+    // at various call sites.
+      not v instanceof Parameter and source.asExpr() instanceof StringLiteral
+      )
+  }
 }
 
 from FormattingFunctionCall call, Expr formatString
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
@@ -94,14 +94,14 @@ int main(int argc, char **argv) {
     const char *hello = "Hello, World\n";
     const char **p = &hello;
     (*p)++;
-    printf(hello); // NOT OK
+    printf(hello); // NOT OK [NOT DETECTED]
   }
   {
     // Same as above block but through a C++ reference
     const char *hello = "Hello, World\n";
     const char *&p = hello;
     p++;
-    printf(hello); // NOT OK
+    printf(hello); // NOT OK [NOT DETECTED]
   }
   if (gettext_debug) {
     printf(new char[100]); // NOT OK
@@ -132,4 +132,4 @@ void another_func(void) {
   printf(message); // OK
   printf("Hello, World\n"); // OK
   printf(gettext("Hello, World\n")); // OK
-}
+}
