|
1 | 1 | /** |
2 | | - * Provides implementation classes modeling `std::string` and other |
3 | | - * instantiations of `std::basic_string`. See `semmle.code.cpp.models.Models` |
4 | | - * for usage information. |
| 2 | + * Provides implementation classes modeling `std::string` (and other |
| 3 | + * instantiations of `std::basic_string`) and `std::ostream`. See |
| 4 | + * `semmle.code.cpp.models.Models` for usage information. |
5 | 5 | */ |
6 | 6 |
|
7 | 7 | import semmle.code.cpp.models.interfaces.Taint |
@@ -287,3 +287,68 @@ class StdStringAt extends TaintFunction { |
287 | 287 | output.isQualifierObject() |
288 | 288 | } |
289 | 289 | } |
| 290 | + |
| 291 | +/** |
| 292 | + * The `std::basic_ostream` template class. |
| 293 | + */ |
| 294 | +class StdBasicOStream extends TemplateClass { |
| 295 | + StdBasicOStream() { this.hasQualifiedName("std", "basic_ostream") } |
| 296 | +} |
| 297 | + |
| 298 | +/** |
| 299 | + * The `std::ostream` function `operator<<` (defined as a member function). |
| 300 | + */ |
| 301 | +class StdOStreamOut extends DataFlowFunction, TaintFunction { |
| 302 | + StdOStreamOut() { this.hasQualifiedName("std", "basic_ostream", "operator<<") } |
| 303 | + |
| 304 | + override predicate hasDataFlow(FunctionInput input, FunctionOutput output) { |
| 305 | + // flow from qualifier to return value |
| 306 | + input.isQualifierAddress() and |
| 307 | + output.isReturnValue() |
| 308 | + } |
| 309 | + |
| 310 | + override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
| 311 | + // flow from parameter to qualifier |
| 312 | + input.isParameter(0) and |
| 313 | + output.isQualifierObject() |
| 314 | + or |
| 315 | + // flow from parameter to return value |
| 316 | + input.isParameter(0) and |
| 317 | + output.isReturnValueDeref() |
| 318 | + or |
| 319 | + // reverse flow from returned reference to the qualifier |
| 320 | + input.isReturnValueDeref() and |
| 321 | + output.isQualifierObject() |
| 322 | + } |
| 323 | +} |
| 324 | + |
| 325 | +/** |
| 326 | + * The `std::ostream` function `operator<<` (defined as a non-member function). |
| 327 | + */ |
| 328 | +class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction { |
| 329 | + StdOStreamOutNonMember() { |
| 330 | + this.hasQualifiedName("std", "operator<<") and |
| 331 | + this.getUnspecifiedType().(ReferenceType).getBaseType() = |
| 332 | + any(StdBasicOStream s).getAnInstantiation() |
| 333 | + } |
| 334 | + |
| 335 | + override predicate hasDataFlow(FunctionInput input, FunctionOutput output) { |
| 336 | + // flow from first parameter to return value |
| 337 | + input.isParameter(0) and |
| 338 | + output.isReturnValue() |
| 339 | + } |
| 340 | + |
| 341 | + override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
| 342 | + // flow from second parameter to first parameter |
| 343 | + input.isParameter(1) and |
| 344 | + output.isParameterDeref(0) |
| 345 | + or |
| 346 | + // flow from second parameter to return value |
| 347 | + input.isParameter(1) and |
| 348 | + output.isReturnValueDeref() |
| 349 | + or |
| 350 | + // reverse flow from returned reference to the first parameter |
| 351 | + input.isReturnValueDeref() and |
| 352 | + output.isParameterDeref(0) |
| 353 | + } |
| 354 | +} |
0 commit comments