Skip to content

Commit 7766b70

Browse files
hvitvedhvitved
committed
temp
1 parent 705243b commit 7766b70

File tree

1 file changed

+84
-49
lines changed

1 file changed

+84
-49
lines changed

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

Lines changed: 84 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1310,7 +1310,7 @@ module MakeImpl<InputSig Lang> {
13101310
PrevStage::revFlow(node) and result = getTyp(node.getDataFlowType())
13111311
}
13121312

1313-
pragma[inline]
1313+
pragma[nomagic]
13141314
private predicate flowThroughOutOfCall(
13151315
DataFlowCall call, CcCall ccc, RetNodeEx ret, ReturnKindExt kind, NodeEx out,
13161316
boolean allowsFieldFlow, ApApprox argApa, ApApprox apa
@@ -1321,14 +1321,13 @@ module MakeImpl<InputSig Lang> {
13211321
matchesCall(ccc, call)
13221322
}
13231323

1324-
pragma[nomagic]
1325-
private predicate flowThroughOutOfCall(
1326-
DataFlowCall call, CcCall ccc, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
1327-
ApApprox argApa, ApApprox apa
1328-
) {
1329-
flowThroughOutOfCall(call, ccc, _, kind, out, allowsFieldFlow, argApa, apa)
1330-
}
1331-
1324+
// pragma[nomagic]
1325+
// private predicate flowThroughOutOfCall(
1326+
// DataFlowCall call, CcCall ccc, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
1327+
// ApApprox argApa, ApApprox apa
1328+
// ) {
1329+
// flowThroughOutOfCall(call, ccc, _, kind, out, allowsFieldFlow, argApa, apa)
1330+
// }
13321331
/**
13331332
* Holds if `node` is reachable with access path `ap` from a source.
13341333
*
@@ -1441,10 +1440,10 @@ module MakeImpl<InputSig Lang> {
14411440
)
14421441
or
14431442
// flow into a callable
1444-
exists(boolean inSummaryCtx |
1445-
fwdFlowIn(node, apa, state, cc, t, origT, ap, inSummaryCtx)
1443+
exists(boolean inSummaryCtx, boolean allowsFlowThrough |
1444+
fwdFlowIn(node, apa, state, cc, t, origT, ap, inSummaryCtx, allowsFlowThrough)
14461445
|
1447-
PrevStage::parameterMayFlowThrough(node, apa) and
1446+
allowsFlowThrough = true and
14481447
summaryCtx = TParamNodeSome(node.asNode()) and
14491448
argT = ArgTypOption::some(toArgTyp(t)) and
14501449
argAp = apSome(ap)
@@ -1468,9 +1467,8 @@ module MakeImpl<InputSig Lang> {
14681467
ApApprox innerArgApa
14691468
|
14701469
fwdFlowThrough(call, cc, state, ccc, summaryCtx, argT, argAp, t, origT, ap, apa, ret,
1471-
innerArgApa) and
1472-
flowThroughOutOfCall(call, ccc, ret, _, node, allowsFieldFlow, innerArgApa, apa) and
1473-
if allowsFieldFlow = false then ap instanceof ApNil else any()
1470+
innerArgApa, allowsFieldFlow) and
1471+
flowThroughOutOfCall(call, ccc, ret, _, node, allowsFieldFlow, innerArgApa, apa)
14741472
)
14751473
}
14761474

@@ -1606,10 +1604,14 @@ module MakeImpl<InputSig Lang> {
16061604
}
16071605

16081606
private signature module FwdFlowInInputSig {
1609-
default predicate callRestriction(DataFlowCall call) { any() }
1610-
1611-
bindingset[p, apa]
1612-
default predicate parameterRestriction(ParamNodeEx p, ApApprox apa) { any() }
1607+
// default predicate callRestriction(DataFlowCall call) { any() }
1608+
// bindingset[p, apa]
1609+
// default predicate parameterRestriction(ParamNodeEx p, ApApprox apa) { any() }
1610+
default predicate restriction(
1611+
DataFlowCall call, ParamNodeEx p, ApApprox apa, boolean allowsFieldFlow
1612+
) {
1613+
PrevStage::callEdgeArgParam(call, _, _, p, allowsFieldFlow, apa)
1614+
}
16131615
}
16141616

16151617
/**
@@ -1630,9 +1632,13 @@ module MakeImpl<InputSig Lang> {
16301632
DataFlowCall call, DataFlowCallable c, ArgNodeEx arg, ParamNodeEx p,
16311633
boolean allowsFieldFlow, ApApprox apa
16321634
) {
1633-
PrevStage::callEdgeArgParam(call, c, arg, p, allowsFieldFlow, apa) and
1634-
I::callRestriction(call) and
1635-
I::parameterRestriction(p, apa)
1635+
exists(boolean allowsFieldFlow1, boolean allowsFieldFlow2 |
1636+
PrevStage::callEdgeArgParam(call, c, arg, p, allowsFieldFlow1, apa) and
1637+
I::restriction(call, p, apa, allowsFieldFlow2) and
1638+
allowsFieldFlow = allowsFieldFlow1.booleanAnd(allowsFieldFlow2)
1639+
)
1640+
// I::callRestriction(call) and
1641+
// I::parameterRestriction(p, apa)
16361642
}
16371643

16381644
pragma[nomagic]
@@ -1767,15 +1773,40 @@ module MakeImpl<InputSig Lang> {
17671773

17681774
private module FwdFlowInNoRestriction implements FwdFlowInInputSig { }
17691775

1776+
pragma[nomagic]
1777+
private predicate flowThroughOutOfCall(
1778+
DataFlowCall call, ParamNodeEx p, ApApprox apa, boolean allowsFieldFlow
1779+
) {
1780+
PrevStage::parameterMayFlowThrough(p, apa) and
1781+
flowThroughOutOfCall(call, _, _, _, _, allowsFieldFlow, apa, _) and
1782+
PrevStage::callEdgeArgParam(call, _, _, p, _, apa)
1783+
}
1784+
1785+
bindingset[call, p, ap, apa]
1786+
pragma[inline_late]
1787+
private predicate fwdFlowInFlowThroughAllowed(
1788+
DataFlowCall call, ParamNodeEx p, Ap ap, ApApprox apa
1789+
) {
1790+
exists(boolean allowsFieldFlow |
1791+
flowThroughOutOfCall(call, p, apa, allowsFieldFlow) and
1792+
if allowsFieldFlow = false then ap instanceof ApNil else any()
1793+
)
1794+
}
1795+
17701796
pragma[nomagic]
17711797
private predicate fwdFlowIn(
17721798
ParamNodeEx p, ApApprox apa, FlowState state, CcCall innercc, Typ t, TypOption origT,
1773-
Ap ap, boolean inSummaryCtx
1799+
Ap ap, boolean inSummaryCtx, boolean allowsFlowThrough
17741800
) {
1775-
exists(ParamNodeOption summaryCtx |
1776-
FwdFlowIn<FwdFlowInNoRestriction>::fwdFlowIn(_, _, p, state, _, innercc, summaryCtx, _,
1777-
_, t, origT, ap, apa, _) and
1801+
exists(DataFlowCall call, ParamNodeOption summaryCtx |
1802+
FwdFlowIn<FwdFlowInNoRestriction>::fwdFlowIn(call, _, p, state, _, innercc, summaryCtx,
1803+
_, _, t, origT, ap, apa, _) and
17781804
if summaryCtx = TParamNodeNone() then inSummaryCtx = false else inSummaryCtx = true
1805+
|
1806+
allowsFlowThrough = false
1807+
or
1808+
allowsFlowThrough = true and
1809+
fwdFlowInFlowThroughAllowed(call, p, ap, apa)
17791810
)
17801811
}
17811812

@@ -1947,16 +1978,18 @@ module MakeImpl<InputSig Lang> {
19471978
pragma[nomagic]
19481979
private predicate fwdFlowRetFromArg(
19491980
RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, ArgTyp argT, Ap argAp,
1950-
ApApprox argApa, Typ t, TypOption origT, Ap ap, ApApprox apa
1981+
ApApprox argApa, Typ t, TypOption origT, Ap ap, ApApprox apa, boolean allowsFieldFlow
19511982
) {
1952-
exists(DataFlowCall call, ReturnKindExt kind, boolean allowsFieldFlow |
1983+
exists(DataFlowCall call, ReturnKindExt kind |
19531984
fwdFlow(pragma[only_bind_into](ret), state, ccc,
19541985
TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())), ArgTypOption::some(argT),
19551986
pragma[only_bind_into](apSome(argAp)), t, origT, ap, pragma[only_bind_into](apa)) and
19561987
parameterFlowThroughAllowed(summaryCtx, kind) and
19571988
argApa = getApprox(argAp) and
19581989
flowThroughOutOfCall(call, ccc, ret, kind, _, allowsFieldFlow, argApa, apa) and
1959-
if allowsFieldFlow = false then ap instanceof ApNil else any()
1990+
if allowsFieldFlow = false
1991+
then ap instanceof ApNil and argAp instanceof ApNil
1992+
else any()
19601993
)
19611994
}
19621995

@@ -1965,10 +1998,10 @@ module MakeImpl<InputSig Lang> {
19651998
DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
19661999
ArgTypOption argT, ApOption argAp, Typ t, TypOption origT, Ap ap, ApApprox apa,
19672000
RetNodeEx ret, ParamNodeEx innerSummaryCtx, ArgTyp innerArgT, Ap innerArgAp,
1968-
ApApprox innerArgApa
2001+
ApApprox innerArgApa, boolean allowsFieldFlow
19692002
) {
19702003
fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgT, innerArgAp, innerArgApa, t,
1971-
origT, ap, apa) and
2004+
origT, ap, apa, allowsFieldFlow) and
19722005
fwdFlowIsEntered(call, cc, ccc, summaryCtx, argT, argAp, innerSummaryCtx, innerArgT,
19732006
innerArgAp)
19742007
}
@@ -1977,16 +2010,14 @@ module MakeImpl<InputSig Lang> {
19772010
private predicate fwdFlowThrough(
19782011
DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
19792012
ArgTypOption argT, ApOption argAp, Typ t, TypOption origT, Ap ap, ApApprox apa,
1980-
RetNodeEx ret, ApApprox innerArgApa
2013+
RetNodeEx ret, ApApprox innerArgApa, boolean allowsFieldFlow
19812014
) {
19822015
fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argT, argAp, t, origT, ap, apa, ret, _,
1983-
_, _, innerArgApa)
2016+
_, _, innerArgApa, allowsFieldFlow)
19842017
}
19852018

19862019
private module FwdFlowThroughRestriction implements FwdFlowInInputSig {
1987-
predicate callRestriction = PrevStage::callMayFlowThroughRev/1;
1988-
1989-
predicate parameterRestriction = PrevStage::parameterMayFlowThrough/2;
2020+
predicate restriction = flowThroughOutOfCall/4;
19902021
}
19912022

19922023
/**
@@ -2000,7 +2031,8 @@ module MakeImpl<InputSig Lang> {
20002031
) {
20012032
exists(ApApprox apa |
20022033
FwdFlowIn<FwdFlowThroughRestriction>::fwdFlowIn(call, _, p, _, cc, innerCc, summaryCtx,
2003-
argT, argAp, any(Typ t0 | t = toArgTyp(t0)), _, ap, apa, _)
2034+
argT, argAp, any(Typ t0 | t = toArgTyp(t0)), _, ap, apa, _) and
2035+
fwdFlowInFlowThroughAllowed(call, p, ap, apa)
20042036
)
20052037
}
20062038

@@ -2024,10 +2056,11 @@ module MakeImpl<InputSig Lang> {
20242056
pragma[nomagic]
20252057
private predicate returnFlowsThrough0(
20262058
DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
2027-
ParamNodeEx innerSummaryCtx, ArgTyp innerArgT, Ap innerArgAp, ApApprox innerArgApa
2059+
ParamNodeEx innerSummaryCtx, ArgTyp innerArgT, Ap innerArgAp, ApApprox innerArgApa,
2060+
boolean allowsFieldFlow
20282061
) {
20292062
fwdFlowThrough0(call, _, state, ccc, _, _, _, _, _, ap, apa, ret, innerSummaryCtx,
2030-
innerArgT, innerArgAp, innerArgApa)
2063+
innerArgT, innerArgAp, innerArgApa, allowsFieldFlow)
20312064
}
20322065

20332066
pragma[nomagic]
@@ -2036,10 +2069,10 @@ module MakeImpl<InputSig Lang> {
20362069
ArgTyp argT, Ap argAp, Ap ap
20372070
) {
20382071
exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
2039-
returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argT, argAp, innerArgApa) and
2072+
returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argT, argAp, innerArgApa,
2073+
allowsFieldFlow) and
20402074
flowThroughOutOfCall(call, ccc, ret, _, _, allowsFieldFlow, innerArgApa, apa) and
2041-
pos = ret.getReturnPosition() and
2042-
if allowsFieldFlow = false then ap instanceof ApNil else any()
2075+
pos = ret.getReturnPosition()
20432076
)
20442077
}
20452078

@@ -2053,7 +2086,9 @@ module MakeImpl<InputSig Lang> {
20532086
flowIntoCallApaTaken(call, _, pragma[only_bind_into](arg), p, allowsFieldFlow, argApa) and
20542087
fwdFlow(arg, _, _, _, _, _, pragma[only_bind_into](argT), _,
20552088
pragma[only_bind_into](argAp), argApa) and
2056-
if allowsFieldFlow = false then argAp instanceof ApNil else any()
2089+
if allowsFieldFlow = false
2090+
then argAp instanceof ApNil and ap instanceof ApNil
2091+
else any()
20572092
)
20582093
}
20592094

@@ -3255,12 +3290,12 @@ module MakeImpl<InputSig Lang> {
32553290
then t = nt
32563291
else (
32573292
compatibleTypes(nt, t0) and
3258-
// t = t0
3259-
if inSummaryCtx = true and node instanceof ParamNodeEx
3260-
then
3261-
t = nt and
3262-
compatibleTypes(origT, t)
3263-
else t = t0
3293+
t = t0
3294+
// if inSummaryCtx = true and node instanceof ParamNodeEx
3295+
// then
3296+
// t = nt and
3297+
// compatibleTypes(origT, t)
3298+
// else t = t0
32643299
)
32653300
)
32663301
else t = t0

0 commit comments

Comments
 (0)