github · erik-krogh · Mar 15, 2022 · Mar 11, 2022 · Mar 14, 2022 · Mar 12, 2022
@@ -447,26 +447,6 @@ private predicate skipInitializer(Initializer init) {
   )
 }
 
-/**
- * Holds if `e` is an expression in a static initializer that must be evaluated
- * at run time. This predicate computes "is non-const" instead of "is const" in
- * order to avoid recursion through forall.
- */
-private predicate runtimeExprInStaticInitializer(Expr e) {
-  inStaticInitializer(e) and
-  if e instanceof AggregateLiteral
-  then runtimeExprInStaticInitializer(e.getAChild())
-  else not e.getFullyConverted().isConstant()
-}
-
-/** Holds if `e` is part of the initializer of a local static variable. */
-private predicate inStaticInitializer(Expr e) {
-  exists(LocalVariable local |
-    local.isStatic() and
-    e.getParent+() = local.getInitializer()
-  )
-}
-
 /**
  * Gets the `i`th child of `n` in control-flow order, where the `i`-indexes are
  * contiguous, and the first index is 0.

@@ -287,20 +287,6 @@ private module SsaDefReaches {
     )
   }
 
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
   /**
    * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
    */

@@ -1,7 +1,5 @@
 private import ReachableBlock as Reachability
 
-private module ReachabilityGraph = Reachability::Graph;
-
 module Graph {
   import Reachability::Graph
 

@@ -1,7 +1,5 @@
 private import ReachableBlock as Reachability
 
-private module ReachabilityGraph = Reachability::Graph;
-
 module Graph {
   import Reachability::Graph
 

@@ -287,20 +287,6 @@ private module SsaDefReaches {
     )
   }
 
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
   /**
    * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
    */

@@ -511,13 +511,6 @@ module FinallySplitting {
     predicate isEntryNode() { first(try.getFinally(), this) }
   }
 
-  /** A control flow element that does not belong to a `finally` block. */
-  private class NonFinallyControlFlowElement extends ControlFlowElement {
-    NonFinallyControlFlowElement() {
-      not this = any(Statements::TryStmtTree t).getAFinallyDescendant()
-    }
-  }
-
   /**
    * A split for elements belonging to a `finally` block, which determines how to
    * continue execution after leaving the `finally` block. For example, in

@@ -287,20 +287,6 @@ private module SsaDefReaches {
     )
   }
 
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
   /**
    * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
    */

@@ -287,20 +287,6 @@ private module SsaDefReaches {
     )
   }
 
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
   /**
    * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
    */

@@ -287,20 +287,6 @@ private module SsaDefReaches {
     )
   }
 
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
   /**
    * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
    */

@@ -24,13 +24,6 @@ private class ServiceClass extends Class {
   }
 }
 
-/** Top-level Request DTO types */
-private class RequestDTO extends Class {
-  RequestDTO() {
-    this.getABaseType*().getABaseInterface().hasQualifiedName("ServiceStack", "IReturn")
-  }
-}
-
 /** Flow sources for the ServiceStack framework */
 module Sources {
   private import semmle.code.csharp.security.dataflow.flowsources.Remote

@@ -11,13 +11,6 @@
 
 import csharp
 
-class ZeroFloatLiteral extends FloatLiteral {
-  ZeroFloatLiteral() {
-    this.getValue() = "0" or
-    this.getValue() = "0.0"
-  }
-}
-
 from EqualityOperation e
 where
   e.getAnOperand().getType() instanceof FloatingPointType and

@@ -1,7 +1,5 @@
 private import ReachableBlock as Reachability
 
-private module ReachabilityGraph = Reachability::Graph;
-
 module Graph {
   import Reachability::Graph
 

@@ -1,7 +1,5 @@
 private import ReachableBlock as Reachability
 
-private module ReachabilityGraph = Reachability::Graph;
-
 module Graph {
   import Reachability::Graph
 

@@ -88,15 +88,6 @@ predicate hasAddressType(int byteSize) {
  */
 predicate hasFunctionAddressType(int byteSize) { byteSize = getTypeSize(any(NullType type)) }
 
-private int getBaseClassSize(ValueOrRefType type) {
-  if exists(type.getBaseClass()) then result = getContentSize(type.getBaseClass()) else result = 0
-}
-
-private int getContentSize(ValueOrRefType type) {
-  result =
-    getBaseClassSize(type) + sum(Field field | not field.isStatic() | getTypeSize(field.getType()))
-}
-
 private predicate isOpaqueType(ValueOrRefType type) {
   type instanceof Struct or
   type instanceof NullableType or

@@ -9,26 +9,6 @@ import EJB
 /** A method or constructor that may not be called from an EJB. */
 abstract class ForbiddenCallable extends Callable { }
 
-/**
- * Specialized version of the `polyCalls(..)` predicate for the use
- * case of finding "shortest" call chains from EJBs to forbidden
- * methods. This is the same as `polyCalls(..)`, with two exceptions:
- *
- * - It does not consider calls into an EJB method.
- * - It does not consider calls from "forbidden callables".
- */
-private predicate ejbPolyCalls(Callable origin, Callable target) {
-  origin.polyCalls(target) and
-  not exists(EJB ejb | target = ejb.getACallable()) and
-  not origin instanceof ForbiddenCallable
-}
-
-private predicate ejbPolyCallsPlus(Callable origin, Callable target) {
-  exists(EJB ejb | origin = ejb.getACallable() | ejbPolyCalls(origin, target))
-  or
-  exists(Callable mid | ejbPolyCallsPlus(origin, mid) and ejbPolyCalls(mid, target))
-}
-
 /**
  * Holds if there exists a call chain from an EJB-`Callable` `origin` to a `ForbiddenCallable` `target`
  * that does not contain any intermediate EJB-`Callable` or `ForbiddenCallable`,

@@ -16,13 +16,6 @@
 
 import java
 
-class ReachFromStmt extends Stmt {
-  ReachFromStmt() {
-    exists(Method m | m.getBody() = this) or
-    exists(WhileStmt w | w.getStmt() = this)
-  }
-}
-
 class SleepMethod extends Method {
   SleepMethod() {
     this.getName() = "sleep" and

@@ -15,11 +15,6 @@ import semmle.code.java.Expr
 import semmle.code.java.Statement
 import semmle.code.java.JDK
 
-/** A use of `+` that has type `String`. */
-class StringCat extends AddExpr {
-  StringCat() { this.getType() instanceof TypeString }
-}
-
 /**
  * An assignment of the form
  *

@@ -36,16 +36,6 @@ class MessageDigest extends RefType {
   MessageDigest() { this.hasQualifiedName("java.security", "MessageDigest") }
 }
 
-/** The method call `MessageDigest.getInstance(...)` */
-class MDConstructor extends StaticMethodAccess {
-  MDConstructor() {
-    exists(Method m | m = this.getMethod() |
-      m.getDeclaringType() instanceof MessageDigest and
-      m.hasName("getInstance")
-    )
-  }
-}
-
 /** The method `digest()` declared in `java.security.MessageDigest`. */
 class MDDigestMethod extends Method {
   MDDigestMethod() {

@@ -9,15 +9,6 @@
 import javascript
 import InsecureDownloadCustomizations::InsecureDownload
 
-// Materialize flow labels
-private class ConcreteSensitiveInsecureUrl extends Label::SensitiveInsecureUrl {
-  ConcreteSensitiveInsecureUrl() { this = this }
-}
-
-private class ConcreteInsecureUrl extends Label::InsecureUrl {
-  ConcreteInsecureUrl() { this = this }
-}
-
 /**
  * A taint tracking configuration for download of sensitive file through insecure connection.
  */

@@ -969,12 +969,6 @@ private module Scopes {
     scope = n.getEnclosingModule()
   }
 
-  private predicate maybe_defined(SsaVariable var) {
-    exists(var.getDefinition()) and not py_ssa_phi(var, _) and not var.getDefinition().isDelete()
-    or
-    exists(SsaVariable input | input = var.getAPhiInput() | maybe_defined(input))
-  }
-
   private predicate maybe_undefined(SsaVariable var) {
     not exists(var.getDefinition()) and not py_ssa_phi(var, _)
     or

@@ -900,22 +900,6 @@ private class EssaTaintTracking extends string {
     or
     result = this.testEvaluates(defn, not_operand(test), use, src).booleanNot()
   }
-
-  /**
-   * Holds if `test` is the test in a branch and `use` is that test
-   * with all the `not` prefixes removed.
-   */
-  private predicate boolean_filter(ControlFlowNode test, ControlFlowNode use) {
-    any(PyEdgeRefinement ref).getTest() = test and
-    (
-      use = test
-      or
-      exists(ControlFlowNode notuse |
-        this.boolean_filter(test, notuse) and
-        use = not_operand(notuse)
-      )
-    )
-  }
 }
 
 private predicate testEvaluatesMaybe(ControlFlowNode test, ControlFlowNode use) {

@@ -21,9 +21,6 @@ private module Invoke {
 
   /** Provides models for the `invoke` module. */
   module InvokeModule {
-    /** Gets a reference to the `invoke.context` module. */
-    API::Node context() { result = invoke().getMember("context") }
-
     /** Provides models for the `invoke.context` module */
     module Context {
       /** Provides models for the `invoke.context.Context` class */

@@ -295,17 +295,6 @@ private module RestFramework {
       result = API::moduleImport("rest_framework").getMember("response").getMember("Response")
     }
 
-    /**
-     * A source of instances of `rest_framework.response.Response`, extend this class to model new instances.
-     *
-     * This can include instantiations of the class, return values from function
-     * calls, or a special parameter that will be set when functions are called by an external
-     * library.
-     *
-     * Use the predicate `Response::instance()` to get references to instances of `rest_framework.response.Response`.
-     */
-    abstract class InstanceSource extends DataFlow::LocalSourceNode { }
-
     /** A direct instantiation of `rest_framework.response.Response`. */
     private class ClassInstantiation extends PrivateDjango::DjangoImpl::Http::Response::HttpResponse::InstanceSource,
       DataFlow::CallCfgNode {

@@ -185,11 +185,6 @@ predicate function_can_never_return(FunctionObject func) {
   func = ModuleObject::named("sys").attr("exit")
 }
 
-private newtype TIterationDefinition =
-  TIterationDefinition_(SsaSourceVariable var, ControlFlowNode def, ControlFlowNode sequence) {
-    SsaSource::iteration_defined_variable(var, def, sequence)
-  }
-
 /** Hold if outer contains inner, both are contained within a test and inner is a use is a plain use or an attribute lookup */
 pragma[noinline]
 predicate contains_interesting_expression_within_test(ControlFlowNode outer, ControlFlowNode inner) {