Skip to content

Commit 5fc1b35

Browse files
hvitvedhvitved
committed
Data flow: Take conjunctive With(out)Contents into account in prohibitsUseUseFlow 
1 parent 9d23742 commit 5fc1b35

File tree

2 files changed

+23
-46
lines changed

2 files changed

+23
-46
lines changed

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -750,6 +750,27 @@ module Private {
750750
)
751751
}
752752

753+
/**
754+
* Holds if `p` can reach `n` in a summarized callable, using only value-preserving
755+
* local steps. `clearsOrExcepts` records whether any node on the path from `p` to
756+
* `n` either clears or expects contents.
757+
*/
758+
private predicate paramReachesLocal(ParamNode p, Node n, boolean clearsOrExcepts) {
759+
viableParam(_, _, _, p) and
760+
n = p and
761+
clearsOrExcepts = false
762+
or
763+
exists(Node mid, boolean clearsOrExceptsMid |
764+
paramReachesLocal(p, mid, clearsOrExceptsMid) and
765+
summaryLocalStep(mid, n, true) and
766+
if
767+
summaryClearsContent(n, _) or
768+
summaryExpectsContent(n, _)
769+
then clearsOrExcepts = true
770+
else clearsOrExcepts = clearsOrExceptsMid
771+
)
772+
}
773+
753774
/**
754775
* Holds if use-use flow starting from `arg` should be prohibited.
755776
*
@@ -759,15 +780,11 @@ module Private {
759780
*/
760781
pragma[nomagic]
761782
predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
762-
exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
783+
exists(ParamNode p, ParameterPosition ppos, Node ret |
784+
paramReachesLocal(p, ret, true) and
763785
p = summaryArgParam0(_, arg, sc) and
764786
p.isParameterOf(_, pragma[only_bind_into](ppos)) and
765-
summaryLocalStep(p, mid, true) and
766-
summaryLocalStep(mid, ret, true) and
767787
isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
768-
|
769-
summaryClearsContent(mid, _) or
770-
summaryExpectsContent(mid, _)
771788
)
772789
}
773790

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
failures
2-
| summaries.rb:106:6:106:9 | ...[...] | Unexpected result: hasValueFlow=elem1 |
3-
| summaries.rb:107:6:107:9 | ...[...] | Unexpected result: hasValueFlow=elem2 |
42
edges
53
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
64
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
@@ -99,14 +97,10 @@ edges
9997
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:87:5:87:5 | a [element 1] : |
10098
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:91:5:91:5 | a [element 1] : |
10199
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:91:5:91:5 | a [element 1] : |
102-
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:103:1:103:1 | d [element 1] : |
103-
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:103:1:103:1 | d [element 1] : |
104100
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:86:6:86:6 | a [element 2] : |
105101
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:86:6:86:6 | a [element 2] : |
106102
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:95:1:95:1 | a [element 2] : |
107103
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:95:1:95:1 | a [element 2] : |
108-
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:103:1:103:1 | d [element 2] : |
109-
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:103:1:103:1 | d [element 2] : |
110104
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:82:6:82:6 | a [element] : |
111105
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:82:6:82:6 | a [element] : |
112106
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:84:6:84:6 | a [element] : |
@@ -191,28 +185,14 @@ edges
191185
| summaries.rb:99:1:99:1 | a [element 2] : | summaries.rb:99:1:99:1 | [post] a [element 2] : |
192186
| summaries.rb:102:6:102:6 | a [element 2] : | summaries.rb:102:6:102:9 | ...[...] |
193187
| summaries.rb:102:6:102:6 | a [element 2] : | summaries.rb:102:6:102:9 | ...[...] |
194-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | summaries.rb:106:6:106:6 | d [element 1] : |
195-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | summaries.rb:106:6:106:6 | d [element 1] : |
196-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | summaries.rb:107:6:107:6 | d [element 2] : |
197-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | summaries.rb:107:6:107:6 | d [element 2] : |
198188
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:104:1:104:1 | d [element 3] : |
199189
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:104:1:104:1 | d [element 3] : |
200-
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
201-
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
202-
| summaries.rb:103:1:103:1 | d [element 1] : | summaries.rb:103:1:103:1 | [post] d [element 1] : |
203-
| summaries.rb:103:1:103:1 | d [element 1] : | summaries.rb:103:1:103:1 | [post] d [element 1] : |
204-
| summaries.rb:103:1:103:1 | d [element 2] : | summaries.rb:103:1:103:1 | [post] d [element 2] : |
205-
| summaries.rb:103:1:103:1 | d [element 2] : | summaries.rb:103:1:103:1 | [post] d [element 2] : |
206190
| summaries.rb:103:8:103:22 | call to source : | summaries.rb:103:1:103:1 | [post] d [element 3] : |
207191
| summaries.rb:103:8:103:22 | call to source : | summaries.rb:103:1:103:1 | [post] d [element 3] : |
208192
| summaries.rb:104:1:104:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
209193
| summaries.rb:104:1:104:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
210194
| summaries.rb:104:1:104:1 | d [element 3] : | summaries.rb:104:1:104:1 | [post] d [element 3] : |
211195
| summaries.rb:104:1:104:1 | d [element 3] : | summaries.rb:104:1:104:1 | [post] d [element 3] : |
212-
| summaries.rb:106:6:106:6 | d [element 1] : | summaries.rb:106:6:106:9 | ...[...] |
213-
| summaries.rb:106:6:106:6 | d [element 1] : | summaries.rb:106:6:106:9 | ...[...] |
214-
| summaries.rb:107:6:107:6 | d [element 2] : | summaries.rb:107:6:107:9 | ...[...] |
215-
| summaries.rb:107:6:107:6 | d [element 2] : | summaries.rb:107:6:107:9 | ...[...] |
216196
| summaries.rb:108:6:108:6 | d [element 3] : | summaries.rb:108:6:108:9 | ...[...] |
217197
| summaries.rb:108:6:108:6 | d [element 3] : | summaries.rb:108:6:108:9 | ...[...] |
218198
| summaries.rb:111:1:111:1 | [post] x [@value] : | summaries.rb:112:6:112:6 | x [@value] : |
@@ -407,30 +387,14 @@ nodes
407387
| summaries.rb:102:6:102:6 | a [element 2] : | semmle.label | a [element 2] : |
408388
| summaries.rb:102:6:102:9 | ...[...] | semmle.label | ...[...] |
409389
| summaries.rb:102:6:102:9 | ...[...] | semmle.label | ...[...] |
410-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | semmle.label | [post] d [element 1] : |
411-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | semmle.label | [post] d [element 1] : |
412-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | semmle.label | [post] d [element 2] : |
413-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | semmle.label | [post] d [element 2] : |
414390
| summaries.rb:103:1:103:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
415391
| summaries.rb:103:1:103:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
416-
| summaries.rb:103:1:103:1 | d [element 1] : | semmle.label | d [element 1] : |
417-
| summaries.rb:103:1:103:1 | d [element 1] : | semmle.label | d [element 1] : |
418-
| summaries.rb:103:1:103:1 | d [element 2] : | semmle.label | d [element 2] : |
419-
| summaries.rb:103:1:103:1 | d [element 2] : | semmle.label | d [element 2] : |
420392
| summaries.rb:103:8:103:22 | call to source : | semmle.label | call to source : |
421393
| summaries.rb:103:8:103:22 | call to source : | semmle.label | call to source : |
422394
| summaries.rb:104:1:104:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
423395
| summaries.rb:104:1:104:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
424396
| summaries.rb:104:1:104:1 | d [element 3] : | semmle.label | d [element 3] : |
425397
| summaries.rb:104:1:104:1 | d [element 3] : | semmle.label | d [element 3] : |
426-
| summaries.rb:106:6:106:6 | d [element 1] : | semmle.label | d [element 1] : |
427-
| summaries.rb:106:6:106:6 | d [element 1] : | semmle.label | d [element 1] : |
428-
| summaries.rb:106:6:106:9 | ...[...] | semmle.label | ...[...] |
429-
| summaries.rb:106:6:106:9 | ...[...] | semmle.label | ...[...] |
430-
| summaries.rb:107:6:107:6 | d [element 2] : | semmle.label | d [element 2] : |
431-
| summaries.rb:107:6:107:6 | d [element 2] : | semmle.label | d [element 2] : |
432-
| summaries.rb:107:6:107:9 | ...[...] | semmle.label | ...[...] |
433-
| summaries.rb:107:6:107:9 | ...[...] | semmle.label | ...[...] |
434398
| summaries.rb:108:6:108:6 | d [element 3] : | semmle.label | d [element 3] : |
435399
| summaries.rb:108:6:108:6 | d [element 3] : | semmle.label | d [element 3] : |
436400
| summaries.rb:108:6:108:9 | ...[...] | semmle.label | ...[...] |
@@ -544,10 +508,6 @@ invalidSpecComponent
544508
| summaries.rb:98:6:98:9 | ...[...] | summaries.rb:81:13:81:27 | call to source : | summaries.rb:98:6:98:9 | ...[...] | $@ | summaries.rb:81:13:81:27 | call to source : | call to source : |
545509
| summaries.rb:102:6:102:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:102:6:102:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
546510
| summaries.rb:102:6:102:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:102:6:102:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
547-
| summaries.rb:106:6:106:9 | ...[...] | summaries.rb:79:15:79:29 | call to source : | summaries.rb:106:6:106:9 | ...[...] | $@ | summaries.rb:79:15:79:29 | call to source : | call to source : |
548-
| summaries.rb:106:6:106:9 | ...[...] | summaries.rb:79:15:79:29 | call to source : | summaries.rb:106:6:106:9 | ...[...] | $@ | summaries.rb:79:15:79:29 | call to source : | call to source : |
549-
| summaries.rb:107:6:107:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:107:6:107:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
550-
| summaries.rb:107:6:107:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:107:6:107:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
551511
| summaries.rb:108:6:108:9 | ...[...] | summaries.rb:103:8:103:22 | call to source : | summaries.rb:108:6:108:9 | ...[...] | $@ | summaries.rb:103:8:103:22 | call to source : | call to source : |
552512
| summaries.rb:108:6:108:9 | ...[...] | summaries.rb:103:8:103:22 | call to source : | summaries.rb:108:6:108:9 | ...[...] | $@ | summaries.rb:103:8:103:22 | call to source : | call to source : |
553513
| summaries.rb:112:6:112:16 | call to get_value | summaries.rb:111:13:111:26 | call to source : | summaries.rb:112:6:112:16 | call to get_value | $@ | summaries.rb:111:13:111:26 | call to source : | call to source : |

0 commit comments

Comments
 (0)