Fix modeling of std::set::emplace

Dave Bartolomeo · Dave Bartolomeo · commit eb9cea48b827 · 2020-10-17T17:00:29.000-04:00
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll
@@ -61,7 +61,7 @@ class StdSetEmplace extends TaintFunction {
     // flow from any parameter to qualifier and return value
     // (here we assume taint flow from any constructor parameter to the constructed object)
     // (where the return value is a pair, this should really flow just to the first part of it)
-    input.isParameter([0 .. getNumberOfParameters() - 1]) and
+    input.isParameterDeref([0 .. getNumberOfParameters() - 1]) and
     (
       output.isQualifierObject() or
       output.isReturnValue()

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ class StdSetEmplace extends TaintFunction {`
`61`	`61`	`// flow from any parameter to qualifier and return value`
`62`	`62`	`// (here we assume taint flow from any constructor parameter to the constructed object)`
`63`	`63`	`// (where the return value is a pair, this should really flow just to the first part of it)`
`64`		`- input.isParameter([0 .. getNumberOfParameters() - 1]) and`
	`64`	`+ input.isParameterDeref([0 .. getNumberOfParameters() - 1]) and`
`65`	`65`	`(`
`66`	`66`	`output.isQualifierObject() or`
`67`	`67`	`output.isReturnValue()`