Skip to content

Commit 854dfb3

Browse files
aschackmullaschackmull
authored
Merge pull request #15501 from aschackmull/dataflow/alert-provenance
Dataflow: Support alert provenance
2 parents 1015ee9 + b4e23d9 commit 854dfb3

File tree

345 files changed

+6772
-5033
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

345 files changed

+6772
-5033
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,10 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { no
286286
/** Extra data-flow steps needed for lambda flow analysis. */
287287
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
288288

289+
predicate knownSourceModel(Node source, string model) { none() }
290+
291+
predicate knownSinkModel(Node sink, string model) { none() }
292+
289293
/**
290294
* Holds if flow is allowed to pass from parameter `p` and back to itself as a
291295
* side-effect, resulting in a summary from `p` to itself.

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

Lines changed: 62 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -516,7 +516,7 @@ private module ThisFlow {
516516
*/
517517
cached
518518
predicate localFlowStep(Node nodeFrom, Node nodeTo) {
519-
simpleLocalFlowStep(nodeFrom, nodeTo)
519+
simpleLocalFlowStep(nodeFrom, nodeTo, _)
520520
or
521521
// Field flow is not strictly a "step" but covers the whole function
522522
// transitively. There's no way to get a step-like relation out of the global
@@ -530,64 +530,67 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
530530
* This is the local flow predicate that's used as a building block in global
531531
* data flow. It may have less flow than the `localFlowStep` predicate.
532532
*/
533-
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
534-
// Expr -> Expr
535-
exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
536-
or
537-
// Assignment -> LValue post-update node
538-
//
539-
// This is used for assignments whose left-hand side is not a variable
540-
// assignment or a storeStep but is still modeled by other means. It could be
541-
// a call to `operator*` or `operator[]` where taint should flow to the
542-
// post-update node of the qualifier.
543-
exists(AssignExpr assign |
544-
nodeFrom.asExpr() = assign and
545-
nodeTo.(PostUpdateNode).getPreUpdateNode().asExpr() = assign.getLValue()
546-
)
547-
or
548-
// Node -> FlowVar -> VariableAccess
549-
exists(FlowVar var |
550-
(
551-
exprToVarStep(nodeFrom.asExpr(), var)
552-
or
553-
varSourceBaseCase(var, nodeFrom.asParameter())
554-
or
555-
varSourceBaseCase(var, nodeFrom.asUninitialized())
556-
or
557-
var.definedPartiallyAt(nodeFrom.asPartialDefinition())
558-
) and
559-
varToNodeStep(var, nodeTo)
560-
)
561-
or
562-
// Expr -> DefinitionByReferenceNode
563-
exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
564-
or
565-
// `this` -> adjacent-`this`
566-
ThisFlow::adjacentThisRefs(nodeFrom, nodeTo)
567-
or
568-
// post-update-`this` -> following-`this`-ref
569-
ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
570-
or
571-
// In `f(&x->a)`, this step provides the flow from post-`&` to post-`x->a`,
572-
// from which there is field flow to `x` via reverse read.
573-
exists(PartialDefinition def, Expr inner, Expr outer |
574-
def.definesExpressions(inner, outer) and
575-
inner = nodeTo.(InnerPartialDefinitionNode).getPreUpdateNode().asExpr() and
576-
outer = nodeFrom.(PartialDefinitionNode).getPreUpdateNode().asExpr()
577-
)
578-
or
579-
// Reverse flow: data that flows from the post-update node of a reference
580-
// returned by a function call, back into the qualifier of that function.
581-
// This allows data to flow 'in' through references returned by a modeled
582-
// function such as `operator[]`.
583-
exists(DataFlowFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
584-
call.getTarget() = f and
585-
inModel.isReturnValueDeref() and
586-
outModel.isQualifierObject() and
587-
f.hasDataFlow(inModel, outModel) and
588-
nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr() = call and
589-
nodeTo.asDefiningArgument() = call.getQualifier()
590-
)
533+
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
534+
(
535+
// Expr -> Expr
536+
exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
537+
or
538+
// Assignment -> LValue post-update node
539+
//
540+
// This is used for assignments whose left-hand side is not a variable
541+
// assignment or a storeStep but is still modeled by other means. It could be
542+
// a call to `operator*` or `operator[]` where taint should flow to the
543+
// post-update node of the qualifier.
544+
exists(AssignExpr assign |
545+
nodeFrom.asExpr() = assign and
546+
nodeTo.(PostUpdateNode).getPreUpdateNode().asExpr() = assign.getLValue()
547+
)
548+
or
549+
// Node -> FlowVar -> VariableAccess
550+
exists(FlowVar var |
551+
(
552+
exprToVarStep(nodeFrom.asExpr(), var)
553+
or
554+
varSourceBaseCase(var, nodeFrom.asParameter())
555+
or
556+
varSourceBaseCase(var, nodeFrom.asUninitialized())
557+
or
558+
var.definedPartiallyAt(nodeFrom.asPartialDefinition())
559+
) and
560+
varToNodeStep(var, nodeTo)
561+
)
562+
or
563+
// Expr -> DefinitionByReferenceNode
564+
exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
565+
or
566+
// `this` -> adjacent-`this`
567+
ThisFlow::adjacentThisRefs(nodeFrom, nodeTo)
568+
or
569+
// post-update-`this` -> following-`this`-ref
570+
ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
571+
or
572+
// In `f(&x->a)`, this step provides the flow from post-`&` to post-`x->a`,
573+
// from which there is field flow to `x` via reverse read.
574+
exists(PartialDefinition def, Expr inner, Expr outer |
575+
def.definesExpressions(inner, outer) and
576+
inner = nodeTo.(InnerPartialDefinitionNode).getPreUpdateNode().asExpr() and
577+
outer = nodeFrom.(PartialDefinitionNode).getPreUpdateNode().asExpr()
578+
)
579+
or
580+
// Reverse flow: data that flows from the post-update node of a reference
581+
// returned by a function call, back into the qualifier of that function.
582+
// This allows data to flow 'in' through references returned by a modeled
583+
// function such as `operator[]`.
584+
exists(DataFlowFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
585+
call.getTarget() = f and
586+
inModel.isReturnValueDeref() and
587+
outModel.isQualifierObject() and
588+
f.hasDataFlow(inModel, outModel) and
589+
nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr() = call and
590+
nodeTo.asDefiningArgument() = call.getQualifier()
591+
)
592+
) and
593+
model = ""
591594
}
592595

593596
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
3232
* Holds if the additional step from `src` to `sink` should be included in all
3333
* global taint flow configurations.
3434
*/
35-
predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
36-
localAdditionalTaintStep(src, sink)
35+
predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink, string model) {
36+
localAdditionalTaintStep(src, sink) and model = ""
3737
}
3838

3939
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ abstract deprecated class Configuration extends DataFlow::Configuration {
127127

128128
final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
129129
this.isAdditionalTaintStep(node1, node2) or
130-
defaultAdditionalTaintStep(node1, node2)
130+
defaultAdditionalTaintStep(node1, node2, _)
131131
}
132132

133133
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ abstract deprecated class Configuration extends DataFlow::Configuration {
127127

128128
final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
129129
this.isAdditionalTaintStep(node1, node2) or
130-
defaultAdditionalTaintStep(node1, node2)
130+
defaultAdditionalTaintStep(node1, node2, _)
131131
}
132132

133133
/**

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ deprecated private module Config implements FullStateConfigSig {
263263

264264
predicate isBarrierOut(Node node, FlowState state) { none() }
265265

266-
predicate isAdditionalFlowStep(Node node1, Node node2) {
266+
predicate isAdditionalFlowStep(Node node1, Node node2, string model) {
267267
singleConfiguration() and
268-
any(Configuration config).isAdditionalFlowStep(node1, node2)
268+
any(Configuration config).isAdditionalFlowStep(node1, node2) and
269+
model = ""
269270
}
270271

271272
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1020,6 +1020,10 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { no
10201020
/** Extra data-flow steps needed for lambda flow analysis. */
10211021
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
10221022

1023+
predicate knownSourceModel(Node source, string model) { none() }
1024+
1025+
predicate knownSinkModel(Node sink, string model) { none() }
1026+
10231027
/**
10241028
* Holds if flow is allowed to pass from parameter `p` and back to itself as a
10251029
* side-effect, resulting in a summary from `p` to itself.
@@ -1096,7 +1100,7 @@ private predicate localFlowStepWithSummaries(Node node1, Node node2) {
10961100
or
10971101
readStep(node1, _, node2)
10981102
or
1099-
DataFlowImplCommon::argumentValueFlowsThrough(node1, _, node2)
1103+
DataFlowImplCommon::argumentValueFlowsThrough(node1, _, node2, _)
11001104
}
11011105

11021106
/** Holds if `node` flows to a node that is used in a `SwitchInstruction`. */

0 commit comments

Comments
 (0)