Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f417640

Browse files
jbjjbj
authored
Merge pull request #1938 from dave-bartolomeo/dave/InNOut
C++: Rename predicates in `FunctionInputsAndOutputs.qll` and add QLDoc
2 parents 9a8b622 + c1e5db0 commit f417640

12 files changed

Lines changed: 319 additions & 119 deletions

File tree

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3838
* There is now a `DataFlow::localExprFlow` predicate and a
3939
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4040
common case of local data flow and taint: from one `Expr` to another.
41+
* The member predicates of the `FunctionInput` and `FunctionOutput` classes have been renamed for
42+
clarity (e.g. `isOutReturnPointer()` to `isReturnValueDeref()`). The existing member predicates
43+
have been deprecated, and will be removed in a future release. Code that uses the old member
44+
predicates should be updated to use the corresponding new member predicate.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -578,8 +578,8 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
578578
exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel, int iIn |
579579
call.getTarget() = f and
580580
f.hasDataFlow(inModel, outModel) and
581-
outModel.isOutReturnValue() and
582-
inModel.isInParameter(iIn) and
581+
outModel.isReturnValue() and
582+
inModel.isParameter(iIn) and
583583
fromExpr = call.getArgument(iIn)
584584
)
585585
)
@@ -589,12 +589,12 @@ private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
589589
exists(DataFlowFunction f, Call call, FunctionOutput outModel, int argOutIndex |
590590
call.getTarget() = f and
591591
argOut = call.getArgument(argOutIndex) and
592-
outModel.isOutParameterPointer(argOutIndex) and
592+
outModel.isParameterDeref(argOutIndex) and
593593
exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
594-
inModel.isInParameterPointer(argInIndex) and
594+
inModel.isParameterDeref(argInIndex) and
595595
call.passesByReference(argInIndex, exprIn)
596596
or
597-
inModel.isInParameter(argInIndex) and
597+
inModel.isParameter(argInIndex) and
598598
exprIn = call.getArgument(argInIndex)
599599
)
600600
)

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -122,27 +122,27 @@ private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
122122
exists(DataFlowFunction f, Call call, FunctionOutput outModel, int argOutIndex |
123123
call.getTarget() = f and
124124
argOut = call.getArgument(argOutIndex) and
125-
outModel.isOutParameterPointer(argOutIndex) and
125+
outModel.isParameterDeref(argOutIndex) and
126126
exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
127127
// Taint flows from a pointer to a dereference, which DataFlow does not handle
128128
// memcpy(&dest_var, tainted_ptr, len)
129-
inModel.isInParameterPointer(argInIndex) and
129+
inModel.isParameterDeref(argInIndex) and
130130
exprIn = call.getArgument(argInIndex)
131131
)
132132
)
133133
or
134134
exists(TaintFunction f, Call call, FunctionOutput outModel, int argOutIndex |
135135
call.getTarget() = f and
136136
argOut = call.getArgument(argOutIndex) and
137-
outModel.isOutParameterPointer(argOutIndex) and
137+
outModel.isParameterDeref(argOutIndex) and
138138
exists(int argInIndex, FunctionInput inModel | f.hasTaintFlow(inModel, outModel) |
139-
inModel.isInParameterPointer(argInIndex) and
139+
inModel.isParameterDeref(argInIndex) and
140140
exprIn = call.getArgument(argInIndex)
141141
or
142-
inModel.isInParameterPointer(argInIndex) and
142+
inModel.isParameterDeref(argInIndex) and
143143
call.passesByReference(argInIndex, exprIn)
144144
or
145-
inModel.isInParameter(argInIndex) and
145+
inModel.isParameter(argInIndex) and
146146
exprIn = call.getArgument(argInIndex)
147147
)
148148
)

‎cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,6 @@ class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFuncti
3434

3535
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
3636
// These functions simply return the argument value.
37-
input.isInParameter(0) and output.isOutReturnValue()
37+
input.isParameter(0) and output.isReturnValue()
3838
}
3939
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Inet.qll‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,17 @@ class InetNtoa extends TaintFunction {
55
InetNtoa() { hasGlobalName("inet_ntoa") }
66

77
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
8-
input.isInParameter(0) and
9-
output.isOutReturnPointer()
8+
input.isParameter(0) and
9+
output.isReturnValueDeref()
1010
}
1111
}
1212

1313
class InetAton extends TaintFunction, ArrayFunction {
1414
InetAton() { hasGlobalName("inet_aton") }
1515

1616
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
17-
input.isInParameterPointer(0) and
18-
output.isOutParameterPointer(1)
17+
input.isParameterDeref(0) and
18+
output.isParameterDeref(1)
1919
}
2020

2121
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
@@ -34,8 +34,8 @@ class InetAddr extends TaintFunction, ArrayFunction {
3434
InetAddr() { hasGlobalName("inet_addr") }
3535

3636
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
37-
input.isInParameterPointer(0) and
38-
output.isOutReturnValue()
37+
input.isParameterDeref(0) and
38+
output.isReturnValue()
3939
}
4040

4141
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
@@ -47,8 +47,8 @@ class InetNetwork extends TaintFunction, ArrayFunction {
4747
InetNetwork() { hasGlobalName("inet_network") }
4848

4949
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
50-
input.isInParameterPointer(1) and
51-
output.isOutReturnValue()
50+
input.isParameterDeref(1) and
51+
output.isReturnValue()
5252
}
5353

5454
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
@@ -61,28 +61,28 @@ class InetMakeaddr extends TaintFunction {
6161

6262
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
6363
(
64-
input.isInParameter(0) or
65-
input.isInParameter(1)
64+
input.isParameter(0) or
65+
input.isParameter(1)
6666
) and
67-
output.isOutReturnValue()
67+
output.isReturnValue()
6868
}
6969
}
7070

7171
class InetLnaof extends TaintFunction {
7272
InetLnaof() { hasGlobalName("inet_lnaof") }
7373

7474
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
75-
input.isInParameter(0) and
76-
output.isOutReturnValue()
75+
input.isParameter(0) and
76+
output.isReturnValue()
7777
}
7878
}
7979

8080
class InetNetof extends TaintFunction {
8181
InetNetof() { hasGlobalName("inet_netof") }
8282

8383
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
84-
input.isInParameter(0) and
85-
output.isOutReturnValue()
84+
input.isParameter(0) and
85+
output.isReturnValue()
8686
}
8787
}
8888

@@ -91,10 +91,10 @@ class InetPton extends TaintFunction, ArrayFunction {
9191

9292
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
9393
(
94-
input.isInParameter(0) or
95-
input.isInParameterPointer(1)
94+
input.isParameter(0) or
95+
input.isParameterDeref(1)
9696
) and
97-
output.isOutParameterPointer(2)
97+
output.isParameterDeref(2)
9898
}
9999

100100
override predicate hasArrayInput(int bufParam) { bufParam = 1 }
@@ -110,8 +110,8 @@ class Gethostbyname extends TaintFunction, ArrayFunction {
110110
Gethostbyname() { hasGlobalName("gethostbyname") }
111111

112112
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
113-
input.isInParameterPointer(0) and
114-
output.isOutReturnPointer()
113+
input.isParameterDeref(0) and
114+
output.isReturnValueDeref()
115115
}
116116

117117
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
@@ -124,11 +124,11 @@ class Gethostbyaddr extends TaintFunction, ArrayFunction {
124124

125125
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
126126
(
127-
input.isInParameterPointer(0) or
128-
input.isInParameter(1) or
129-
input.isInParameter(2)
127+
input.isParameterDeref(0) or
128+
input.isParameter(1) or
129+
input.isParameter(2)
130130
) and
131-
output.isOutReturnPointer()
131+
output.isReturnValueDeref()
132132
}
133133

134134
override predicate hasArrayInput(int bufParam) { bufParam = 0 }

‎cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,22 @@ class MemcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
1919
override predicate hasArrayOutput(int bufParam) { bufParam = 0 }
2020

2121
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
22-
input.isInParameterPointer(1) and
23-
output.isOutParameterPointer(0)
22+
input.isParameterDeref(1) and
23+
output.isParameterDeref(0)
2424
or
25-
input.isInParameterPointer(1) and
26-
output.isOutReturnPointer()
25+
input.isParameterDeref(1) and
26+
output.isReturnValueDeref()
2727
or
28-
input.isInParameter(0) and
29-
output.isOutReturnValue()
28+
input.isParameter(0) and
29+
output.isReturnValue()
3030
}
3131

3232
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
33-
input.isInParameter(2) and
34-
output.isOutParameterPointer(0)
33+
input.isParameter(2) and
34+
output.isParameterDeref(0)
3535
or
36-
input.isInParameter(2) and
37-
output.isOutReturnPointer()
36+
input.isParameter(2) and
37+
output.isReturnValueDeref()
3838
}
3939

4040
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,17 @@ class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideE
4141

4242
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
4343
exists(ParameterIndex i |
44-
input.isInParameter(i) and
44+
input.isParameter(i) and
4545
exists(getParameter(i))
4646
or
47-
input.isInParameterPointer(i) and
47+
input.isParameterDeref(i) and
4848
getParameter(i).getUnspecifiedType() instanceof PointerType
4949
) and
5050
(
51-
output.isOutReturnPointer() and
51+
output.isReturnValueDeref() and
5252
getUnspecifiedType() instanceof PointerType
5353
or
54-
output.isOutReturnValue()
54+
output.isReturnValue()
5555
)
5656
}
5757

@@ -85,10 +85,10 @@ class PureFunction extends TaintFunction, SideEffectFunction {
8585

8686
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
8787
exists(ParameterIndex i |
88-
input.isInParameter(i) and
88+
input.isParameter(i) and
8989
exists(getParameter(i))
9090
) and
91-
output.isOutReturnValue()
91+
output.isReturnValue()
9292
}
9393

9494
override predicate neverReadsMemory() { any() }

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction {
1919
}
2020

2121
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
22-
input.isInParameter(0) and
23-
output.isOutReturnValue()
22+
input.isParameter(0) and
23+
output.isReturnValue()
2424
}
2525

2626
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -31,19 +31,19 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction {
3131
name = "_mbsncat" or
3232
name = "_mbsncat_l"
3333
) and
34-
input.isInParameter(2) and
35-
output.isOutParameterPointer(0)
34+
input.isParameter(2) and
35+
output.isParameterDeref(0)
3636
or
3737
name = "_mbsncat_l" and
38-
input.isInParameter(3) and
39-
output.isOutParameterPointer(0)
38+
input.isParameter(3) and
39+
output.isParameterDeref(0)
4040
)
4141
or
42-
input.isInParameterPointer(0) and
43-
output.isOutParameterPointer(0)
42+
input.isParameterDeref(0) and
43+
output.isParameterDeref(0)
4444
or
45-
input.isInParameter(1) and
46-
output.isOutParameterPointer(0)
45+
input.isParameter(1) and
46+
output.isParameterDeref(0)
4747
}
4848

4949
override predicate hasArrayInput(int param) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -55,15 +55,15 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
5555
this.hasName("wcscpy")
5656
) and
5757
(
58-
input.isInParameterPointer(1) and
59-
output.isOutParameterPointer(0)
58+
input.isParameterDeref(1) and
59+
output.isParameterDeref(0)
6060
or
61-
input.isInParameterPointer(1) and
62-
output.isOutReturnPointer()
61+
input.isParameterDeref(1) and
62+
output.isReturnValueDeref()
6363
)
6464
or
65-
input.isInParameter(0) and
66-
output.isOutReturnValue()
65+
input.isParameter(0) and
66+
output.isReturnValue()
6767
}
6868

6969
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -78,12 +78,12 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
7878
this.hasName("_wcsncpy_l")
7979
) and
8080
(
81-
input.isInParameter(2) or
82-
input.isInParameterPointer(1)
81+
input.isParameter(2) or
82+
input.isParameterDeref(1)
8383
) and
8484
(
85-
output.isOutParameterPointer(0) or
86-
output.isOutReturnPointer()
85+
output.isParameterDeref(0) or
86+
output.isReturnValueDeref()
8787
)
8888
}
8989
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strftime.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ class Strftime extends TaintFunction, ArrayFunction {
66

77
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
88
(
9-
input.isInParameter(1) or
10-
input.isInParameterPointer(2) or
11-
input.isInParameterPointer(3)
9+
input.isParameter(1) or
10+
input.isParameterDeref(2) or
11+
input.isParameterDeref(3)
1212
) and
1313
(
14-
output.isOutParameterPointer(0) or
15-
output.isOutReturnValue()
14+
output.isParameterDeref(0) or
15+
output.isReturnValue()
1616
)
1717
}
1818

0 commit comments

Comments
 (0)