Skip to content

Commit 5edbe52

Browse files
hvitvedhvitved
committed
temp
1 parent 51aff2d commit 5edbe52

File tree

2 files changed

+83
-38
lines changed

2 files changed

+83
-38
lines changed

‎csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected

+6-6
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,17 @@ edges
3131
| CollectionFlow.cs:26:58:26:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:26:67:26:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
3232
| CollectionFlow.cs:26:67:26:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:26:67:26:73 | access to indexer : A |
3333
| CollectionFlow.cs:28:59:28:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:28:68:28:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
34-
| CollectionFlow.cs:28:68:28:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A |
35-
| CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | CollectionFlow.cs:28:68:28:85 | access to property Value : A |
34+
| CollectionFlow.cs:28:68:28:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A |
35+
| CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A | CollectionFlow.cs:28:68:28:85 | access to property Value : A |
3636
| CollectionFlow.cs:30:60:30:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:69:30:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
3737
| CollectionFlow.cs:30:69:30:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:30:69:30:79 | access to property Values : ICollection<T> [element] : A |
3838
| CollectionFlow.cs:30:69:30:79 | access to property Values : ICollection<T> [element] : A | CollectionFlow.cs:30:69:30:87 | call to method First<T> : A |
3939
| CollectionFlow.cs:32:58:32:61 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:32:67:32:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
4040
| CollectionFlow.cs:32:67:32:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:32:67:32:75 | access to property Keys : ICollection<T> [element] : A |
4141
| CollectionFlow.cs:32:67:32:75 | access to property Keys : ICollection<T> [element] : A | CollectionFlow.cs:32:67:32:83 | call to method First<T> : A |
4242
| CollectionFlow.cs:34:57:34:60 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:34:66:34:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
43-
| CollectionFlow.cs:34:66:34:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A |
44-
| CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | CollectionFlow.cs:34:66:34:81 | access to property Key : A |
43+
| CollectionFlow.cs:34:66:34:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A |
44+
| CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A | CollectionFlow.cs:34:66:34:81 | access to property Key : A |
4545
| CollectionFlow.cs:36:49:36:52 | args : A[] [element] : A | CollectionFlow.cs:36:63:36:66 | access to parameter args : A[] [element] : A |
4646
| CollectionFlow.cs:36:49:36:52 | args : null [element] : A | CollectionFlow.cs:36:63:36:66 | access to parameter args : null [element] : A |
4747
| CollectionFlow.cs:36:63:36:66 | access to parameter args : A[] [element] : A | CollectionFlow.cs:36:63:36:69 | access to array element |
@@ -291,7 +291,7 @@ nodes
291291
| CollectionFlow.cs:26:67:26:73 | access to indexer : A | semmle.label | access to indexer : A |
292292
| CollectionFlow.cs:28:59:28:62 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
293293
| CollectionFlow.cs:28:68:28:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
294-
| CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | semmle.label | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A |
294+
| CollectionFlow.cs:28:68:28:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A | semmle.label | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A |
295295
| CollectionFlow.cs:28:68:28:85 | access to property Value : A | semmle.label | access to property Value : A |
296296
| CollectionFlow.cs:30:60:30:63 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
297297
| CollectionFlow.cs:30:69:30:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
@@ -303,7 +303,7 @@ nodes
303303
| CollectionFlow.cs:32:67:32:83 | call to method First<T> : A | semmle.label | call to method First<T> : A |
304304
| CollectionFlow.cs:34:57:34:60 | dict : Dictionary<T,T> [element, property Key] : A | semmle.label | dict : Dictionary<T,T> [element, property Key] : A |
305305
| CollectionFlow.cs:34:66:34:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
306-
| CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | semmle.label | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A |
306+
| CollectionFlow.cs:34:66:34:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A | semmle.label | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A |
307307
| CollectionFlow.cs:34:66:34:81 | access to property Key : A | semmle.label | access to property Key : A |
308308
| CollectionFlow.cs:36:49:36:52 | args : A[] [element] : A | semmle.label | args : A[] [element] : A |
309309
| CollectionFlow.cs:36:49:36:52 | args : null [element] : A | semmle.label | args : null [element] : A |

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

+77-32
Original file line numberDiff line numberDiff line change
@@ -961,6 +961,16 @@ module MakeImpl<InputSig Lang> {
961961
exists(ap)
962962
}
963963

964+
pragma[nomagic]
965+
additional predicate nodeMayFlowNotThrough(NodeEx node, Ap ap) {
966+
revFlow(node, false) and
967+
exists(ap)
968+
or
969+
revFlow(node, true) and
970+
exists(ap) and
971+
hasSinkCallCtx()
972+
}
973+
964974
pragma[nomagic]
965975
predicate callMayFlowThroughRev(DataFlowCall call) {
966976
exists(ArgNodeEx arg, boolean toReturn |
@@ -1265,6 +1275,9 @@ module MakeImpl<InputSig Lang> {
12651275
bindingset[p, argAp, node, ap]
12661276
predicate nodeMayFlowThrough(ParamNode p, ApApprox argAp, NodeEx node, ApApprox ap);
12671277

1278+
bindingset[node, ap]
1279+
predicate nodeMayFlowNotThrough(NodeEx node, ApApprox ap);
1280+
12681281
bindingset[node, state, t0, ap, inSummaryCtx]
12691282
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx);
12701283

@@ -1333,29 +1346,19 @@ module MakeImpl<InputSig Lang> {
13331346
NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ArgTypOption argT,
13341347
ApOption argAp, Typ t0, Typ t, Ap ap, ApApprox apa
13351348
) {
1336-
exists(ParamNodeOption summaryCtx0, ApOption argAp0, boolean inSummaryCtx |
1337-
fwdFlow0(node, state, cc, summaryCtx0, argT, argAp0, t0, ap, apa) and
1349+
exists(boolean inSummaryCtx |
1350+
fwdFlow0(node, state, cc, summaryCtx, argT, argAp, t0, ap, apa) and
13381351
PrevStage::revFlow(node, state, apa) and
13391352
(
13401353
exists(ParamNode p, ApApprox argApa |
1341-
summaryCtx0 = TParamNodeSome(p) and
1342-
argAp0 = apSome(any(Ap argAp1 | argApa = getApprox(argAp1)))
1343-
|
1344-
if Param::nodeMayFlowThrough(p, argApa, node, apa)
1345-
then
1346-
summaryCtx = summaryCtx0 and
1347-
argAp = argAp0 and
1348-
inSummaryCtx = true
1349-
else (
1350-
summaryCtx = TParamNodeNone() and
1351-
argAp = apNone() and
1352-
inSummaryCtx = false
1353-
)
1354+
summaryCtx = TParamNodeSome(p) and
1355+
argAp = apSome(any(Ap argAp1 | argApa = getApprox(argAp1))) and
1356+
Param::nodeMayFlowThrough(p, argApa, node, apa) and
1357+
inSummaryCtx = true
13541358
)
13551359
or
1356-
summaryCtx0 = TParamNodeNone() and
1357-
summaryCtx = summaryCtx0 and
1358-
argAp = argAp0 and
1360+
summaryCtx = TParamNodeNone() and
1361+
(cc instanceof CcNoCall or Param::nodeMayFlowNotThrough(node, apa)) and
13591362
inSummaryCtx = false
13601363
) and
13611364
filter(node, state, t0, ap, t, inSummaryCtx)
@@ -1414,22 +1417,24 @@ module MakeImpl<InputSig Lang> {
14141417
or
14151418
// flow into a callable
14161419
exists(Typ t0 | fwdFlowIn(node, apa, state, cc, t0, ap) |
1417-
if PrevStage::parameterMayFlowThrough(node, apa)
1418-
then
1419-
summaryCtx = TParamNodeSome(node.asNode()) and
1420-
argT = ArgTypOption::some(toArgTyp(t)) and
1421-
argAp = apSome(ap) and
1422-
t = t0 // getNodeTyp(node)
1423-
else (
1424-
summaryCtx = TParamNodeNone() and
1425-
argT instanceof ArgTypOption::None and
1426-
argAp = apNone() and
1427-
t = t0
1428-
)
1420+
PrevStage::parameterMayFlowThrough(node, apa) and
1421+
summaryCtx = TParamNodeSome(node.asNode()) and
1422+
argT = ArgTypOption::some(toArgTyp(t)) and
1423+
argAp = apSome(ap) and
1424+
t = t0 // getNodeTyp(node)
1425+
or
1426+
Param::nodeMayFlowNotThrough(node, apa) and
1427+
summaryCtx = TParamNodeNone() and
1428+
argT instanceof ArgTypOption::None and
1429+
argAp = apNone() and
1430+
t = t0
14291431
)
14301432
or
14311433
// flow out of a callable
1432-
fwdFlowOut(_, _, node, state, cc, summaryCtx, argT, argAp, t, ap, apa)
1434+
fwdFlowOut(_, _, node, state, cc, _, _, _, t, ap, apa) and
1435+
argT instanceof ArgTypOption::None and
1436+
argAp = apNone() and
1437+
summaryCtx = TParamNodeNone()
14331438
or
14341439
// flow through a callable
14351440
exists(
@@ -2373,6 +2378,14 @@ module MakeImpl<InputSig Lang> {
23732378
)
23742379
}
23752380

2381+
pragma[nomagic]
2382+
additional predicate nodeMayFlowNotThrough(NodeEx node, Ap ap) {
2383+
revFlow(node, _, TReturnCtxNone(), _, ap)
2384+
or
2385+
revFlow(node, _, TReturnCtxNoFlowThrough(), _, ap) and
2386+
hasSinkCallCtx()
2387+
}
2388+
23762389
pragma[nomagic]
23772390
private predicate revFlowThroughArg(
23782391
DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
@@ -2682,6 +2695,11 @@ module MakeImpl<InputSig Lang> {
26822695
exists(argAp)
26832696
}
26842697

2698+
bindingset[node, ap]
2699+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
2700+
PrevStage::nodeMayFlowNotThrough(node, ap)
2701+
}
2702+
26852703
pragma[nomagic]
26862704
private predicate expectsContentCand(NodeEx node) {
26872705
exists(Content c |
@@ -3009,6 +3027,11 @@ module MakeImpl<InputSig Lang> {
30093027
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
30103028
}
30113029

3030+
bindingset[node, ap]
3031+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3032+
PrevStage::nodeMayFlowNotThrough(node, ap)
3033+
}
3034+
30123035
pragma[nomagic]
30133036
private predicate expectsContentCand(NodeEx node, Ap ap) {
30143037
exists(Content c |
@@ -3090,6 +3113,11 @@ module MakeImpl<InputSig Lang> {
30903113
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
30913114
}
30923115

3116+
bindingset[node, ap]
3117+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3118+
PrevStage::nodeMayFlowNotThrough(node, ap)
3119+
}
3120+
30933121
pragma[nomagic]
30943122
private predicate expectsContentCand(NodeEx node, Ap ap) {
30953123
exists(Content c |
@@ -3136,6 +3164,7 @@ module MakeImpl<InputSig Lang> {
31363164
private predicate strengthenType(
31373165
NodeEx node, DataFlowType t0, DataFlowType t, boolean inSummaryCtx
31383166
) {
3167+
exists(inSummaryCtx) and
31393168
if castingNodeEx(node)
31403169
then
31413170
exists(DataFlowType nt | nt = node.getDataFlowType() |
@@ -3196,6 +3225,11 @@ module MakeImpl<InputSig Lang> {
31963225
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
31973226
}
31983227

3228+
bindingset[node, ap]
3229+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3230+
PrevStage::nodeMayFlowNotThrough(node, ap)
3231+
}
3232+
31993233
pragma[nomagic]
32003234
private predicate clearSet(NodeEx node, ContentSet c) {
32013235
PrevStage::revFlow(node) and
@@ -3295,6 +3329,11 @@ module MakeImpl<InputSig Lang> {
32953329
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
32963330
}
32973331

3332+
bindingset[node, ap]
3333+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3334+
PrevStage::nodeMayFlowNotThrough(node, ap)
3335+
}
3336+
32983337
pragma[nomagic]
32993338
private predicate clearSet(NodeEx node, ContentSet c) {
33003339
PrevStage::revFlow(node) and
@@ -3582,6 +3621,11 @@ module MakeImpl<InputSig Lang> {
35823621
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
35833622
}
35843623

3624+
bindingset[node, ap]
3625+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3626+
PrevStage::nodeMayFlowNotThrough(node, ap)
3627+
}
3628+
35853629
bindingset[node, state, t0, ap, inSummaryCtx]
35863630
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
35873631
strengthenType(node, t0, t, inSummaryCtx) and
@@ -4557,7 +4601,8 @@ module MakeImpl<InputSig Lang> {
45574601
(
45584602
sc = TSummaryCtxSome(p, state, t, ap)
45594603
or
4560-
not exists(TSummaryCtxSome(p, state, t, ap)) and
4604+
// not exists(TSummaryCtxSome(p, state, t, ap)) and
4605+
Stage5::nodeMayFlowNotThrough(p, ap.getApprox()) and
45614606
sc = TSummaryCtxNone() and
45624607
// When the call contexts of source and sink needs to match then there's
45634608
// never any reason to enter a callable except to find a summary. See also

0 commit comments

Comments
 (0)