Skip to content

Commit 5a78f7d

Browse files
hvitvedhvitved
committed
debug
1 parent 33e3410 commit 5a78f7d

File tree

4 files changed

+81
-44
lines changed

4 files changed

+81
-44
lines changed

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ private module DispatchImpl {
3333
result.asSummarizedCallable().getACall() = c.asCall()
3434
}
3535

36+
private DataFlowCallable viableCallable(DataFlowCall c, int k) {
37+
result = viableCallable(c) and
38+
k = strictcount(viableCallable(c))
39+
}
40+
3641
/**
3742
* Holds if the set of viable implementations that can be called by `ma`
3843
* might be improved by knowing the call context. This is the case if the
@@ -122,6 +127,26 @@ private module DispatchImpl {
122127
mayBenefitFromCallContext(call.asCall(), _, _)
123128
}
124129

130+
private DataFlowCallable testviableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
131+
result = viableImplInCallContext(call, ctx) and
132+
call.toString() = "getClassName(...)"
133+
}
134+
135+
pragma[nomagic]
136+
private predicate foo(DataFlowCall call, DataFlowCall ctx1, DataFlowCall ctx2) {
137+
forex(DataFlowCallable c | c = viableImplInCallContext(call, ctx1) |
138+
c = viableImplInCallContext(call, ctx2)
139+
)
140+
}
141+
142+
private DataFlowCallable testviableImplInCallContext(
143+
DataFlowCall call, DataFlowCall ctx1, DataFlowCall ctx2
144+
) {
145+
result = viableImplInCallContext(call, ctx1) and
146+
foo(call, ctx1, ctx2) and
147+
foo(call, ctx2, ctx1)
148+
}
149+
125150
/**
126151
* Gets a viable dispatch target of `call` in the context `ctx`. This is
127152
* restricted to those `call`s for which a context might make a difference.

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -385,10 +385,10 @@ class DataFlowType extends SrcRefType {
385385
DataFlowType() { this = getErasedRepr(_) }
386386
}
387387

388-
pragma[nomagic]
389-
predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { t1.getASourceSupertype+() = t2 }
388+
// pragma[nomagic]
389+
// predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { t1.getASourceSupertype+() = t2 }
390+
predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { none() }
390391

391-
// predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { none() }
392392
pragma[noinline]
393393
DataFlowType getNodeType(Node n) {
394394
result = getErasedRepr(n.getTypeBound())

‎java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ module TaintedPathConfig implements DataFlow::ConfigSig {
5959

6060
predicate isBarrier(DataFlow::Node sanitizer) {
6161
sanitizer instanceof SimpleTypeSanitizer or
62-
sanitizer instanceof PathInjectionSanitizer
62+
sanitizer instanceof PathInjectionSanitizer or
63+
sanitizer.getLocation().getFile().getBaseName() = "BaseObject.java"
6364
}
6465

6566
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

Lines changed: 51 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1342,6 +1342,11 @@ module MakeImpl<InputSig Lang> {
13421342
fwdFlow1(node, state, cc, summaryCtx, argT, argAp, _, t, _, origT, ap, apa)
13431343
}
13441344

1345+
pragma[nomagic]
1346+
private ApOption blah(ApApprox apa) {
1347+
result = apSome(any(Ap argAp1 | apa = getApprox(argAp1)))
1348+
}
1349+
13451350
pragma[nomagic]
13461351
additional predicate fwdFlow1(
13471352
NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ArgTypOption argT,
@@ -1353,7 +1358,7 @@ module MakeImpl<InputSig Lang> {
13531358
(
13541359
exists(ParamNode p, ApApprox argApa |
13551360
summaryCtx = TParamNodeSome(p) and
1356-
argAp = apSome(any(Ap argAp1 | argApa = getApprox(argAp1))) and
1361+
argAp = blah(argApa) and //apSome(any(Ap argAp1 | argApa = getApprox(argAp1))) and
13571362
Param::nodeMayFlowThrough(p, argApa, node, apa) and
13581363
inSummaryCtx = true
13591364
)
@@ -3187,26 +3192,30 @@ module MakeImpl<InputSig Lang> {
31873192

31883193
private module Stage3 = MkStage<Stage2_5>::Stage<Stage3Param>;
31893194

3190-
// private predicate mostBusyNodeFwd3 = Stage3::mostBusyNodeFwd/9;
3191-
// private predicate mostBusyNodeFwd3_5 = Stage3_5::mostBusyNodeFwd/9;
3192-
// private predicate mostBusyNodeFwd4 = Stage4::mostBusyNodeFwd/9;
3193-
// private predicate mostBusyNodeFwd5 = Stage5::mostBusyNodeFwd/9;
3195+
// private predicate mostBusyNodeFwd3 = Stage3::mostBusyNodeFwd/10;
3196+
// private predicate mostBusyNodeFwd3_5 = Stage3_5::mostBusyNodeFwd/10;
3197+
// private predicate mostBusyNodeFwd4 = Stage4::mostBusyNodeFwd/10;
3198+
private predicate mostBusyNodeFwd5 = Stage5::mostBusyNodeFwd/10;
3199+
31943200
bindingset[node, t0, inSummaryCtx]
31953201
private predicate strengthenType(
31963202
NodeEx node, DataFlowType t0, DataFlowType t, boolean inSummaryCtx
31973203
) {
31983204
exists(inSummaryCtx) and
3199-
if castingNodeEx(node)
3200-
then
3201-
exists(DataFlowType nt | nt = node.getDataFlowType() |
3202-
if inSummaryCtx = false and typeStrongerThan(nt, t0)
3203-
then t = nt
3204-
else (
3205-
compatibleTypes(nt, t0) and
3206-
if inSummaryCtx = true and node instanceof ParamNodeEx then t = nt else t = t0
3205+
if node instanceof RetNodeEx and inSummaryCtx = true
3206+
then t = node.getDataFlowType() and compatibleTypes(t, t0)
3207+
else
3208+
if castingNodeEx(node)
3209+
then
3210+
exists(DataFlowType nt | nt = node.getDataFlowType() |
3211+
if inSummaryCtx = false and typeStrongerThan(nt, t0)
3212+
then t = nt
3213+
else (
3214+
compatibleTypes(nt, t0) and
3215+
if inSummaryCtx = true and node instanceof ParamNodeEx then t = nt else t = t0
3216+
)
32073217
)
3208-
)
3209-
else t = t0
3218+
else t = t0
32103219
}
32113220

32123221
private module Stage3_5Param implements MkStage<Stage3>::StageParam {
@@ -3630,11 +3639,12 @@ module MakeImpl<InputSig Lang> {
36303639

36313640
ApHeadContent projectToHeadContent(Content c) { result = c }
36323641

3633-
class ApOption = AccessPathApproxOption;
3642+
class ApOption = AccessPathFrontOption;
36343643

3635-
ApOption apNone() { result = TAccessPathApproxNone() }
3644+
// class ApOption = AccessPathApproxOption;
3645+
ApOption apNone() { result = TAccessPathFrontNone() }
36363646

3637-
ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
3647+
ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap.getFront()) }
36383648

36393649
import Level1CallContext
36403650
import LocalCallContext
@@ -3669,6 +3679,8 @@ module MakeImpl<InputSig Lang> {
36693679
predicate typecheckStore(Typ typ, DataFlowType contentType) {
36703680
compatibleTypes(typ, contentType)
36713681
}
3682+
3683+
predicate enableTypeFlow() { none() }
36723684
}
36733685

36743686
private module Stage5 = MkStage<Stage4>::Stage<Stage5Param>;
@@ -3681,7 +3693,7 @@ module MakeImpl<InputSig Lang> {
36813693
Stage5::parameterMayFlowThrough(p, _) and
36823694
Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0) and
36833695
Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()), _,
3684-
TAccessPathApproxSome(apa), _, _, apa0, _)
3696+
TAccessPathFrontSome(apa.getFront()), _, _, apa0, _)
36853697
)
36863698
}
36873699

@@ -4407,28 +4419,22 @@ module MakeImpl<InputSig Lang> {
44074419
PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, DataFlowType t,
44084420
AccessPath ap
44094421
) {
4410-
exists(DataFlowType t0, SummaryCtx sc0, Stage5::Ap apa, boolean inSummaryCtx |
4411-
pathStep0(mid, node, state, cc, sc0, t0, ap, apa) and
4422+
exists(DataFlowType t0, Stage5::Ap apa, boolean inSummaryCtx |
4423+
pathStep0(mid, node, state, cc, sc, t0, ap, apa) and
44124424
Stage5::revFlow(node, state, apa) and
44134425
strengthenType(node, t0, t, inSummaryCtx) and
44144426
not inBarrier(node, state)
44154427
|
44164428
exists(ParamNodeEx p, ParamNode param, AccessPath argAp, Stage5::Ap argApa |
4417-
sc0 = TSummaryCtxSome(p, _, _, argAp) and
4429+
sc = TSummaryCtxSome(p, _, _, argAp) and
44184430
param = p.asNode() and
44194431
argApa = argAp.getApprox() and
4420-
if Stage5::nodeMayFlowThrough(param, argApa, node, apa)
4421-
then
4422-
sc = sc0 and
4423-
inSummaryCtx = true
4424-
else (
4425-
sc = TSummaryCtxNone() and
4426-
inSummaryCtx = false
4427-
)
4432+
Stage5::nodeMayFlowThrough(param, argApa, node, apa) and
4433+
inSummaryCtx = true
44284434
)
44294435
or
4430-
sc0 = TSummaryCtxNone() and
4431-
sc = sc0 and
4436+
sc = TSummaryCtxNone() and
4437+
(cc instanceof CallContextNoCall or Stage5::nodeMayFlowNotThrough(node, apa)) and
44324438
inSummaryCtx = false
44334439
)
44344440
}
@@ -4581,14 +4587,15 @@ module MakeImpl<InputSig Lang> {
45814587
pragma[noinline]
45824588
private predicate pathIntoArg(
45834589
PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
4584-
DataFlowType t, AccessPath ap, AccessPathApprox apa
4590+
DataFlowType t, AccessPath ap, AccessPathApprox apa, boolean inSummaryCtx
45854591
) {
4586-
exists(ArgNodeEx arg, ArgumentPosition apos |
4587-
pathNode(mid, arg, state, cc, _, t, ap, _) and
4592+
exists(ArgNodeEx arg, SummaryCtx sc, ArgumentPosition apos |
4593+
pathNode(mid, arg, state, cc, sc, t, ap, _) and
45884594
not outBarrier(arg, state) and
45894595
arg.asNode().(ArgNode).argumentOf(call, apos) and
45904596
apa = ap.getApprox() and
4591-
parameterMatch(ppos, apos)
4597+
parameterMatch(ppos, apos) and
4598+
if sc = TSummaryCtxNone() then inSummaryCtx = false else inSummaryCtx = true
45924599
)
45934600
}
45944601

@@ -4607,11 +4614,11 @@ module MakeImpl<InputSig Lang> {
46074614
pragma[nomagic]
46084615
private predicate pathIntoCallable0(
46094616
PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
4610-
CallContext outercc, DataFlowCall call, DataFlowType t, AccessPath ap
4617+
CallContext outercc, DataFlowCall call, DataFlowType t, AccessPath ap, boolean inSummaryCtx
46114618
) {
46124619
exists(AccessPathApprox apa |
46134620
pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, t, ap,
4614-
pragma[only_bind_into](apa)) and
4621+
pragma[only_bind_into](apa), inSummaryCtx) and
46154622
callable = ResolveCall<parameterCandProj/1>::resolveCall(call, outercc) and
46164623
parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa))
46174624
)
@@ -4627,13 +4634,17 @@ module MakeImpl<InputSig Lang> {
46274634
PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
46284635
SummaryCtx sc, DataFlowCall call
46294636
) {
4630-
exists(ParameterPosition pos, DataFlowCallable callable, DataFlowType t, AccessPath ap |
4631-
pathIntoCallable0(mid, callable, pos, state, outercc, call, t, ap) and
4637+
exists(
4638+
ParameterPosition pos, DataFlowCallable callable, DataFlowType t, AccessPath ap,
4639+
boolean inSummaryCtx
4640+
|
4641+
pathIntoCallable0(mid, callable, pos, state, outercc, call, t, ap, inSummaryCtx) and
46324642
p.isParameterOf(callable, pos) and
46334643
not inBarrier(p, state) and
46344644
(
46354645
sc = TSummaryCtxSome(p, state, t, ap)
46364646
or
4647+
inSummaryCtx = false and
46374648
// not exists(TSummaryCtxSome(p, state, t, ap)) and
46384649
Stage5::nodeMayFlowNotThrough(p, ap.getApprox()) and
46394650
sc = TSummaryCtxNone() and

0 commit comments

Comments
 (0)