Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fc19bba

Browse files
geoffw0geoffw0
committed
C++: Model std::set::merge and correct test annotations.
1 parent 6ddda1f commit fc19bba

5 files changed

Lines changed: 25 additions & 4 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,19 @@ class StdSetSwap extends TaintFunction {
6565
}
6666
}
6767

68+
/**
69+
* The standard set `merge` function.
70+
*/
71+
class StdSetMerge extends TaintFunction {
72+
StdSetMerge() { this.hasQualifiedName("std", ["set", "unordered_set"], "merge") }
73+
74+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
75+
// container1.merge(container2)
76+
input.isParameterDeref(0) and
77+
output.isQualifierObject()
78+
}
79+
}
80+
6881
/**
6982
* The standard set `find` function.
7083
*/

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2224,10 +2224,12 @@
22242224
| set.cpp:99:2:99:4 | ref arg s16 | set.cpp:126:1:126:1 | s16 | |
22252225
| set.cpp:99:12:99:14 | ref arg s17 | set.cpp:102:7:102:9 | s17 | |
22262226
| set.cpp:99:12:99:14 | ref arg s17 | set.cpp:126:1:126:1 | s17 | |
2227+
| set.cpp:99:12:99:14 | s17 | set.cpp:99:2:99:4 | ref arg s16 | TAINT |
22272228
| set.cpp:100:2:100:4 | ref arg s18 | set.cpp:103:7:103:9 | s18 | |
22282229
| set.cpp:100:2:100:4 | ref arg s18 | set.cpp:126:1:126:1 | s18 | |
22292230
| set.cpp:100:12:100:14 | ref arg s19 | set.cpp:104:7:104:9 | s19 | |
22302231
| set.cpp:100:12:100:14 | ref arg s19 | set.cpp:126:1:126:1 | s19 | |
2232+
| set.cpp:100:12:100:14 | s19 | set.cpp:100:2:100:4 | ref arg s18 | TAINT |
22312233
| set.cpp:101:7:101:9 | s16 | set.cpp:101:7:101:9 | call to set | |
22322234
| set.cpp:102:7:102:9 | s17 | set.cpp:102:7:102:9 | call to set | |
22332235
| set.cpp:103:7:103:9 | s18 | set.cpp:103:7:103:9 | call to set | |
@@ -2685,10 +2687,12 @@
26852687
| set.cpp:211:2:211:4 | ref arg s16 | set.cpp:238:1:238:1 | s16 | |
26862688
| set.cpp:211:12:211:14 | ref arg s17 | set.cpp:214:7:214:9 | s17 | |
26872689
| set.cpp:211:12:211:14 | ref arg s17 | set.cpp:238:1:238:1 | s17 | |
2690+
| set.cpp:211:12:211:14 | s17 | set.cpp:211:2:211:4 | ref arg s16 | TAINT |
26882691
| set.cpp:212:2:212:4 | ref arg s18 | set.cpp:215:7:215:9 | s18 | |
26892692
| set.cpp:212:2:212:4 | ref arg s18 | set.cpp:238:1:238:1 | s18 | |
26902693
| set.cpp:212:12:212:14 | ref arg s19 | set.cpp:216:7:216:9 | s19 | |
26912694
| set.cpp:212:12:212:14 | ref arg s19 | set.cpp:238:1:238:1 | s19 | |
2695+
| set.cpp:212:12:212:14 | s19 | set.cpp:212:2:212:4 | ref arg s18 | TAINT |
26922696
| set.cpp:213:7:213:9 | s16 | set.cpp:213:7:213:9 | call to unordered_set | |
26932697
| set.cpp:214:7:214:9 | s17 | set.cpp:214:7:214:9 | call to unordered_set | |
26942698
| set.cpp:215:7:215:9 | s18 | set.cpp:215:7:215:9 | call to unordered_set | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,8 @@ void test_set()
9999
s16.merge(s17);
100100
s18.merge(s19);
101101
sink(s16); // tainted
102-
sink(s17); // tainted [NOT DETECTED]
103-
sink(s18); // tainted [NOT DETECTED]
102+
sink(s17);
103+
sink(s18); // tainted
104104
sink(s19); // tainted
105105

106106
// erase, clear
@@ -211,8 +211,8 @@ void test_unordered_set()
211211
s16.merge(s17);
212212
s18.merge(s19);
213213
sink(s16); // tainted
214-
sink(s17); // tainted [NOT DETECTED]
215-
sink(s18); // tainted [NOT DETECTED]
214+
sink(s17);
215+
sink(s18); // tainted
216216
sink(s19); // tainted
217217

218218
// erase, clear

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@
167167
| set.cpp:95:7:95:9 | call to set | set.cpp:91:13:91:18 | call to source |
168168
| set.cpp:98:7:98:9 | call to set | set.cpp:94:13:94:18 | call to source |
169169
| set.cpp:101:7:101:9 | call to set | set.cpp:91:13:91:18 | call to source |
170+
| set.cpp:103:7:103:9 | call to set | set.cpp:94:13:94:18 | call to source |
170171
| set.cpp:104:7:104:9 | call to set | set.cpp:94:13:94:18 | call to source |
171172
| set.cpp:110:7:110:9 | call to set | set.cpp:108:13:108:18 | call to source |
172173
| set.cpp:110:7:110:9 | call to set | set.cpp:109:13:109:18 | call to source |
@@ -201,6 +202,7 @@
201202
| set.cpp:207:7:207:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
202203
| set.cpp:210:7:210:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
203204
| set.cpp:213:7:213:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
205+
| set.cpp:215:7:215:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
204206
| set.cpp:216:7:216:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
205207
| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
206208
| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@
124124
| set.cpp:95:7:95:9 | set.cpp:91:13:91:18 | AST only |
125125
| set.cpp:98:7:98:9 | set.cpp:94:13:94:18 | AST only |
126126
| set.cpp:101:7:101:9 | set.cpp:91:13:91:18 | AST only |
127+
| set.cpp:103:7:103:9 | set.cpp:94:13:94:18 | AST only |
127128
| set.cpp:104:7:104:9 | set.cpp:94:13:94:18 | AST only |
128129
| set.cpp:110:7:110:9 | set.cpp:108:13:108:18 | AST only |
129130
| set.cpp:110:7:110:9 | set.cpp:109:13:109:18 | AST only |
@@ -151,6 +152,7 @@
151152
| set.cpp:207:7:207:9 | set.cpp:203:13:203:18 | AST only |
152153
| set.cpp:210:7:210:9 | set.cpp:206:13:206:18 | AST only |
153154
| set.cpp:213:7:213:9 | set.cpp:203:13:203:18 | AST only |
155+
| set.cpp:215:7:215:9 | set.cpp:206:13:206:18 | AST only |
154156
| set.cpp:216:7:216:9 | set.cpp:206:13:206:18 | AST only |
155157
| set.cpp:222:7:222:9 | set.cpp:220:13:220:18 | AST only |
156158
| set.cpp:222:7:222:9 | set.cpp:221:13:221:18 | AST only |

0 commit comments

Comments
 (0)