Skip to content

Commit b4b45d6

Browse files
hvitvedhvitved
committed
temp
1 parent dd8ab95 commit b4b45d6

File tree

2 files changed

+74
-37
lines changed

2 files changed

+74
-37
lines changed

‎csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected

+6-6
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,17 @@ edges
3131
| CollectionFlow.cs:25:58:25:61 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:25:67:25:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
3232
| CollectionFlow.cs:25:67:25:70 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:25:67:25:73 | access to indexer : A |
3333
| CollectionFlow.cs:27:59:27:62 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:27:68:27:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
34-
| CollectionFlow.cs:27:68:27:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A |
35-
| CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | CollectionFlow.cs:27:68:27:85 | access to property Value : A |
34+
| CollectionFlow.cs:27:68:27:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A |
35+
| CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A | CollectionFlow.cs:27:68:27:85 | access to property Value : A |
3636
| CollectionFlow.cs:29:60:29:63 | dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:29:69:29:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
3737
| CollectionFlow.cs:29:69:29:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | CollectionFlow.cs:29:69:29:79 | access to property Values : ICollection<T> [element] : A |
3838
| CollectionFlow.cs:29:69:29:79 | access to property Values : ICollection<T> [element] : A | CollectionFlow.cs:29:69:29:87 | call to method First<T> : A |
3939
| CollectionFlow.cs:31:58:31:61 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:31:67:31:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
4040
| CollectionFlow.cs:31:67:31:70 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:31:67:31:75 | access to property Keys : ICollection<T> [element] : A |
4141
| CollectionFlow.cs:31:67:31:75 | access to property Keys : ICollection<T> [element] : A | CollectionFlow.cs:31:67:31:83 | call to method First<T> : A |
4242
| CollectionFlow.cs:33:57:33:60 | dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:33:66:33:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
43-
| CollectionFlow.cs:33:66:33:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A |
44-
| CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | CollectionFlow.cs:33:66:33:81 | access to property Key : A |
43+
| CollectionFlow.cs:33:66:33:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A |
44+
| CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A | CollectionFlow.cs:33:66:33:81 | access to property Key : A |
4545
| CollectionFlow.cs:35:49:35:52 | args : A[] [element] : A | CollectionFlow.cs:35:63:35:66 | access to parameter args : A[] [element] : A |
4646
| CollectionFlow.cs:35:49:35:52 | args : null [element] : A | CollectionFlow.cs:35:63:35:66 | access to parameter args : null [element] : A |
4747
| CollectionFlow.cs:35:63:35:66 | access to parameter args : A[] [element] : A | CollectionFlow.cs:35:63:35:69 | access to array element |
@@ -278,7 +278,7 @@ nodes
278278
| CollectionFlow.cs:25:67:25:73 | access to indexer : A | semmle.label | access to indexer : A |
279279
| CollectionFlow.cs:27:59:27:62 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
280280
| CollectionFlow.cs:27:68:27:71 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
281-
| CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A | semmle.label | call to method First<KeyValuePair<Int32,T>> : KeyValuePair<Int32,T> [property Value] : A |
281+
| CollectionFlow.cs:27:68:27:79 | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A | semmle.label | call to method First<KeyValuePair<Int32,T>> : Object [property Value] : A |
282282
| CollectionFlow.cs:27:68:27:85 | access to property Value : A | semmle.label | access to property Value : A |
283283
| CollectionFlow.cs:29:60:29:63 | dict : Dictionary<T,T> [element, property Value] : A | semmle.label | dict : Dictionary<T,T> [element, property Value] : A |
284284
| CollectionFlow.cs:29:69:29:72 | access to parameter dict : Dictionary<T,T> [element, property Value] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Value] : A |
@@ -290,7 +290,7 @@ nodes
290290
| CollectionFlow.cs:31:67:31:83 | call to method First<T> : A | semmle.label | call to method First<T> : A |
291291
| CollectionFlow.cs:33:57:33:60 | dict : Dictionary<T,T> [element, property Key] : A | semmle.label | dict : Dictionary<T,T> [element, property Key] : A |
292292
| CollectionFlow.cs:33:66:33:69 | access to parameter dict : Dictionary<T,T> [element, property Key] : A | semmle.label | access to parameter dict : Dictionary<T,T> [element, property Key] : A |
293-
| CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A | semmle.label | call to method First<KeyValuePair<T,Int32>> : KeyValuePair<T,Int32> [property Key] : A |
293+
| CollectionFlow.cs:33:66:33:77 | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A | semmle.label | call to method First<KeyValuePair<T,Int32>> : Object [property Key] : A |
294294
| CollectionFlow.cs:33:66:33:81 | access to property Key : A | semmle.label | access to property Key : A |
295295
| CollectionFlow.cs:35:49:35:52 | args : A[] [element] : A | semmle.label | args : A[] [element] : A |
296296
| CollectionFlow.cs:35:49:35:52 | args : null [element] : A | semmle.label | args : null [element] : A |

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

+68-31
Original file line numberDiff line numberDiff line change
@@ -961,6 +961,12 @@ module MakeImpl<InputSig Lang> {
961961
exists(ap)
962962
}
963963

964+
pragma[nomagic]
965+
additional predicate nodeMayFlowNotThrough(NodeEx node, Ap ap) {
966+
revFlow(node, false) and
967+
exists(ap)
968+
}
969+
964970
pragma[nomagic]
965971
predicate callMayFlowThroughRev(DataFlowCall call) {
966972
exists(ArgNodeEx arg, boolean toReturn |
@@ -1265,6 +1271,9 @@ module MakeImpl<InputSig Lang> {
12651271
bindingset[p, argAp, node, ap]
12661272
predicate nodeMayFlowThrough(ParamNode p, ApApprox argAp, NodeEx node, ApApprox ap);
12671273

1274+
bindingset[node, ap]
1275+
predicate nodeMayFlowNotThrough(NodeEx node, ApApprox ap);
1276+
12681277
bindingset[node, state, t0, ap, inSummaryCtx]
12691278
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx);
12701279

@@ -1333,29 +1342,19 @@ module MakeImpl<InputSig Lang> {
13331342
NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ArgTypOption argT,
13341343
ApOption argAp, Typ t0, Typ t, Ap ap, ApApprox apa
13351344
) {
1336-
exists(ParamNodeOption summaryCtx0, ApOption argAp0, boolean inSummaryCtx |
1337-
fwdFlow0(node, state, cc, summaryCtx0, argT, argAp0, t0, ap, apa) and
1345+
exists(boolean inSummaryCtx |
1346+
fwdFlow0(node, state, cc, summaryCtx, argT, argAp, t0, ap, apa) and
13381347
PrevStage::revFlow(node, state, apa) and
13391348
(
13401349
exists(ParamNode p, ApApprox argApa |
1341-
summaryCtx0 = TParamNodeSome(p) and
1342-
argAp0 = apSome(any(Ap argAp1 | argApa = getApprox(argAp1)))
1343-
|
1344-
if Param::nodeMayFlowThrough(p, argApa, node, apa)
1345-
then
1346-
summaryCtx = summaryCtx0 and
1347-
argAp = argAp0 and
1348-
inSummaryCtx = true
1349-
else (
1350-
summaryCtx = TParamNodeNone() and
1351-
argAp = apNone() and
1352-
inSummaryCtx = false
1353-
)
1350+
summaryCtx = TParamNodeSome(p) and
1351+
argAp = apSome(any(Ap argAp1 | argApa = getApprox(argAp1))) and
1352+
Param::nodeMayFlowThrough(p, argApa, node, apa) and
1353+
inSummaryCtx = true
13541354
)
13551355
or
1356-
summaryCtx0 = TParamNodeNone() and
1357-
summaryCtx = summaryCtx0 and
1358-
argAp = argAp0 and
1356+
summaryCtx = TParamNodeNone() and
1357+
Param::nodeMayFlowNotThrough(node, apa) and
13591358
inSummaryCtx = false
13601359
) and
13611360
filter(node, state, t0, ap, t, inSummaryCtx)
@@ -1414,18 +1413,17 @@ module MakeImpl<InputSig Lang> {
14141413
or
14151414
// flow into a callable
14161415
exists(Typ t0 | fwdFlowIn(node, apa, state, cc, t0, ap) |
1417-
if PrevStage::parameterMayFlowThrough(node, apa)
1418-
then
1419-
summaryCtx = TParamNodeSome(node.asNode()) and
1420-
argT = ArgTypOption::some(toArgTyp(t)) and
1421-
argAp = apSome(ap) and
1422-
t = t0 // getNodeTyp(node)
1423-
else (
1424-
summaryCtx = TParamNodeNone() and
1425-
argT instanceof ArgTypOption::None and
1426-
argAp = apNone() and
1427-
t = t0
1428-
)
1416+
PrevStage::parameterMayFlowThrough(node, apa) and
1417+
summaryCtx = TParamNodeSome(node.asNode()) and
1418+
argT = ArgTypOption::some(toArgTyp(t)) and
1419+
argAp = apSome(ap) and
1420+
t = t0 // getNodeTyp(node)
1421+
or
1422+
Param::nodeMayFlowNotThrough(node, apa) and
1423+
summaryCtx = TParamNodeNone() and
1424+
argT instanceof ArgTypOption::None and
1425+
argAp = apNone() and
1426+
t = t0
14291427
)
14301428
or
14311429
// flow out of a callable
@@ -2373,6 +2371,13 @@ module MakeImpl<InputSig Lang> {
23732371
)
23742372
}
23752373

2374+
pragma[nomagic]
2375+
additional predicate nodeMayFlowNotThrough(NodeEx node, Ap ap) {
2376+
revFlow(pragma[only_bind_into](node), _,
2377+
[TReturnCtxNone().(TReturnCtx), TReturnCtxNoFlowThrough()], _,
2378+
pragma[only_bind_into](ap))
2379+
}
2380+
23762381
pragma[nomagic]
23772382
private predicate revFlowThroughArg(
23782383
DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
@@ -2682,6 +2687,11 @@ module MakeImpl<InputSig Lang> {
26822687
exists(argAp)
26832688
}
26842689

2690+
bindingset[node, ap]
2691+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
2692+
PrevStage::nodeMayFlowNotThrough(node, ap)
2693+
}
2694+
26852695
pragma[nomagic]
26862696
private predicate expectsContentCand(NodeEx node) {
26872697
exists(Content c |
@@ -3009,6 +3019,11 @@ module MakeImpl<InputSig Lang> {
30093019
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
30103020
}
30113021

3022+
bindingset[node, ap]
3023+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3024+
PrevStage::nodeMayFlowNotThrough(node, ap)
3025+
}
3026+
30123027
pragma[nomagic]
30133028
private predicate expectsContentCand(NodeEx node, Ap ap) {
30143029
exists(Content c |
@@ -3090,6 +3105,11 @@ module MakeImpl<InputSig Lang> {
30903105
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
30913106
}
30923107

3108+
bindingset[node, ap]
3109+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3110+
PrevStage::nodeMayFlowNotThrough(node, ap)
3111+
}
3112+
30933113
pragma[nomagic]
30943114
private predicate expectsContentCand(NodeEx node, Ap ap) {
30953115
exists(Content c |
@@ -3136,6 +3156,7 @@ module MakeImpl<InputSig Lang> {
31363156
private predicate strengthenType(
31373157
NodeEx node, DataFlowType t0, DataFlowType t, boolean inSummaryCtx
31383158
) {
3159+
exists(inSummaryCtx) and
31393160
if castingNodeEx(node)
31403161
then
31413162
exists(DataFlowType nt | nt = node.getDataFlowType() |
@@ -3196,6 +3217,11 @@ module MakeImpl<InputSig Lang> {
31963217
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
31973218
}
31983219

3220+
bindingset[node, ap]
3221+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3222+
PrevStage::nodeMayFlowNotThrough(node, ap)
3223+
}
3224+
31993225
pragma[nomagic]
32003226
private predicate clearSet(NodeEx node, ContentSet c) {
32013227
PrevStage::revFlow(node) and
@@ -3295,6 +3321,11 @@ module MakeImpl<InputSig Lang> {
32953321
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
32963322
}
32973323

3324+
bindingset[node, ap]
3325+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3326+
PrevStage::nodeMayFlowNotThrough(node, ap)
3327+
}
3328+
32983329
pragma[nomagic]
32993330
private predicate clearSet(NodeEx node, ContentSet c) {
33003331
PrevStage::revFlow(node) and
@@ -3582,6 +3613,11 @@ module MakeImpl<InputSig Lang> {
35823613
PrevStage::nodeMayFlowThrough(p, argAp, node, ap)
35833614
}
35843615

3616+
bindingset[node, ap]
3617+
predicate nodeMayFlowNotThrough(NodeEx node, PrevStage::Ap ap) {
3618+
PrevStage::nodeMayFlowNotThrough(node, ap)
3619+
}
3620+
35853621
bindingset[node, state, t0, ap, inSummaryCtx]
35863622
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
35873623
strengthenType(node, t0, t, inSummaryCtx) and
@@ -4557,7 +4593,8 @@ module MakeImpl<InputSig Lang> {
45574593
(
45584594
sc = TSummaryCtxSome(p, state, t, ap)
45594595
or
4560-
not exists(TSummaryCtxSome(p, state, t, ap)) and
4596+
// not exists(TSummaryCtxSome(p, state, t, ap)) and
4597+
Stage5::nodeMayFlowNotThrough(p, ap.getApprox()) and
45614598
sc = TSummaryCtxNone() and
45624599
// When the call contexts of source and sink needs to match then there's
45634600
// never any reason to enter a callable except to find a summary. See also

0 commit comments

Comments
 (0)