Skip to content

Commit b556590

Browse files
aschackmullaschackmull
authored
Merge pull request #17663 from aschackmull/dataflow/speculative-flow
Dataflow: Add support for speculative taint flow.
2 parents 7e8a09a + 570b042 commit b556590

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+656
-121
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,3 +281,9 @@ private predicate exprToPartialDefinitionStep(Expr exprIn, Expr exprOut) {
281281
}
282282

283283
private predicate iteratorDereference(Call c) { c.getTarget() instanceof IteratorReferenceFunction }
284+
285+
/**
286+
* Holds if the additional step from `src` to `sink` should be considered in
287+
* speculative taint flow exploration.
288+
*/
289+
predicate speculativeTaintStep(DataFlow::Node src, DataFlow::Node sink) { none() }

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,17 @@ deprecated private module Config implements FullStateConfigSig {
261261
model = ""
262262
}
263263

264-
predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
264+
predicate isAdditionalFlowStep(
265+
Node node1, FlowState state1, Node node2, FlowState state2, string model
266+
) {
265267
getConfig(state1).isAdditionalFlowStep(node1, getState(state1), node2, getState(state2)) and
266-
getConfig(state2) = getConfig(state1)
268+
getConfig(state2) = getConfig(state1) and
269+
model = ""
267270
or
268271
not singleConfiguration() and
269272
getConfig(state1).isAdditionalFlowStep(node1, node2) and
270-
state2 = state1
273+
state2 = state1 and
274+
model = ""
271275
}
272276

273277
predicate allowImplicitRead(Node node, ContentSet c) {

0 commit comments

Comments
 (0)