44 * The extensible relations have the following columns:
55 *
66 * - Sources:
7- * `crate; path; output; kind; provenance`
7+ * `path; output; kind; provenance`
88 * - Sinks:
9- * `crate; path; input; kind; provenance`
9+ * `path; input; kind; provenance`
1010 * - Summaries:
11- * `crate; path; input; output; kind; provenance`
11+ * `path; input; output; kind; provenance`
1212 *
1313 * The interpretation of a row is similar to API-graphs with a left-to-right
1414 * reading.
1515 *
16- * 1. The `crate` column selects a crate.
17- * 2. The `path` column selects a function with the given canonical path within
18- * the crate.
19- * 3. The `input` column specifies how data enters the element selected by the
20- * first 2 columns, and the `output` column specifies how data leaves the
21- * element selected by the first 2 columns. Both `input` and `output` are
16+ * 1. The `path` column selects a function with the given canonical path.
17+ * 2. The `input` column specifies how data enters the element selected by the
18+ * first column, and the `output` column specifies how data leaves the
19+ * element selected by the first column. Both `input` and `output` are
2220 * `.`-separated lists of "access path tokens" to resolve, starting at the
2321 * selected function.
2422 *
3432 * - `Field[t(i)]`: position `i` inside the variant/struct with canonical path `v`, for example
3533 * `Field[core::option::Option::Some(0)]`.
3634 * - `Field[i]`: the `i`th element of a tuple.
37- * 4 . The `kind` column is a tag that can be referenced from QL to determine to
35+ * 3 . The `kind` column is a tag that can be referenced from QL to determine to
3836 * which classes the interpreted elements should be added. For example, for
3937 * sources `"remote"` indicates a default remote flow source, and for summaries
4038 * `"taint"` indicates a default additional taint step and `"value"` indicates a
4139 * globally applicable value-preserving step.
42- * 5 . The `provenance` column is mainly used internally, and should be set to `"manual"` for
40+ * 4 . The `provenance` column is mainly used internally, and should be set to `"manual"` for
4341 * all custom models.
4442 */
4543
@@ -66,6 +64,19 @@ extensible predicate sourceModelDeprecated(
6664 QlBuiltins:: ExtensionId madId
6765) ;
6866
67+ /**
68+ * Holds if in a call to the function with canonical path `path`, the value referred
69+ * to by `output` is a flow source of the given `kind`.
70+ *
71+ * `output = "ReturnValue"` simply means the result of the call itself.
72+ *
73+ * For more information on the `kind` parameter, see
74+ * https://github.com/github/codeql/blob/main/docs/codeql/reusables/threat-model-description.rst.
75+ */
76+ extensible predicate sourceModel (
77+ string path , string output , string kind , string provenance , QlBuiltins:: ExtensionId madId
78+ ) ;
79+
6980/**
7081 * DEPRECATED: Do not use.
7182 *
@@ -84,6 +95,20 @@ extensible predicate sinkModelDeprecated(
8495 QlBuiltins:: ExtensionId madId
8596) ;
8697
98+ /**
99+ * Holds if in a call to the function with canonical path `path`, the value referred
100+ * to by `input` is a flow sink of the given `kind`.
101+ *
102+ * For example, `input = Argument[0]` means the first argument of the call.
103+ *
104+ * The following kinds are supported:
105+ *
106+ * - `sql-injection`: a flow sink for SQL injection.
107+ */
108+ extensible predicate sinkModel (
109+ string path , string input , string kind , string provenance , QlBuiltins:: ExtensionId madId
110+ ) ;
111+
87112/**
88113 * DEPRECATED: Do not use.
89114 *
@@ -99,6 +124,18 @@ extensible predicate summaryModelDeprecated(
99124 QlBuiltins:: ExtensionId madId
100125) ;
101126
127+ /**
128+ * Holds if in a call to the function with canonical path `path`, the value referred
129+ * to by `input` can flow to the value referred to by `output`.
130+ *
131+ * `kind` should be either `value` or `taint`, for value-preserving or taint-preserving
132+ * steps, respectively.
133+ */
134+ extensible predicate summaryModel (
135+ string path , string input , string output , string kind , string provenance ,
136+ QlBuiltins:: ExtensionId madId
137+ ) ;
138+
102139/**
103140 * Holds if the given extension tuple `madId` should pretty-print as `model`.
104141 *
@@ -110,15 +147,30 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
110147 model = "Source: " + crate + "; " + path + "; " + output + "; " + kind
111148 )
112149 or
150+ exists ( string path , string output , string kind |
151+ sourceModel ( path , kind , output , _, madId ) and
152+ model = "Source: " + path + "; " + output + "; " + kind
153+ )
154+ or
113155 exists ( string crate , string path , string input , string kind |
114156 sinkModelDeprecated ( crate , path , kind , input , _, madId ) and
115157 model = "Sink: " + crate + "; " + path + "; " + input + "; " + kind
116158 )
117159 or
160+ exists ( string path , string input , string kind |
161+ sinkModel ( path , kind , input , _, madId ) and
162+ model = "Sink: " + path + "; " + input + "; " + kind
163+ )
164+ or
118165 exists ( string type , string path , string input , string output , string kind |
119166 summaryModelDeprecated ( type , path , input , output , kind , _, madId ) and
120167 model = "Summary: " + type + "; " + path + "; " + input + "; " + output + "; " + kind
121168 )
169+ or
170+ exists ( string path , string input , string output , string kind |
171+ summaryModel ( path , input , output , kind , _, madId ) and
172+ model = "Summary: " + path + "; " + input + "; " + output + "; " + kind
173+ )
122174}
123175
124176private class SummarizedCallableFromModelDeprecated extends SummarizedCallable:: Range {
@@ -151,6 +203,30 @@ private class SummarizedCallableFromModelDeprecated extends SummarizedCallable::
151203 }
152204}
153205
206+ private class SummarizedCallableFromModel extends SummarizedCallable:: Range {
207+ private string path ;
208+
209+ SummarizedCallableFromModel ( ) {
210+ summaryModel ( path , _, _, _, _, _) and
211+ this .getCanonicalPath ( ) = path
212+ }
213+
214+ override predicate propagatesFlow (
215+ string input , string output , boolean preservesValue , string model
216+ ) {
217+ exists ( string kind , QlBuiltins:: ExtensionId madId |
218+ summaryModel ( path , input , output , kind , _, madId ) and
219+ model = "MaD:" + madId .toString ( )
220+ |
221+ kind = "value" and
222+ preservesValue = true
223+ or
224+ kind = "taint" and
225+ preservesValue = false
226+ )
227+ }
228+ }
229+
154230private class FlowSourceFromModelDeprecated extends FlowSource:: Range {
155231 private string crate ;
156232 private string path ;
@@ -168,6 +244,22 @@ private class FlowSourceFromModelDeprecated extends FlowSource::Range {
168244 }
169245}
170246
247+ private class FlowSourceFromModel extends FlowSource:: Range {
248+ private string path ;
249+
250+ FlowSourceFromModel ( ) {
251+ sourceModel ( path , _, _, _, _) and
252+ this .callResolvesTo ( path )
253+ }
254+
255+ override predicate isSource ( string output , string kind , Provenance provenance , string model ) {
256+ exists ( QlBuiltins:: ExtensionId madId |
257+ sourceModel ( path , output , kind , provenance , madId ) and
258+ model = "MaD:" + madId .toString ( )
259+ )
260+ }
261+ }
262+
171263private class FlowSinkFromModelDeprecated extends FlowSink:: Range {
172264 private string crate ;
173265 private string path ;
@@ -184,3 +276,19 @@ private class FlowSinkFromModelDeprecated extends FlowSink::Range {
184276 )
185277 }
186278}
279+
280+ private class FlowSinkFromModel extends FlowSink:: Range {
281+ private string path ;
282+
283+ FlowSinkFromModel ( ) {
284+ sinkModel ( path , _, _, _, _) and
285+ this .callResolvesTo ( path )
286+ }
287+
288+ override predicate isSink ( string input , string kind , Provenance provenance , string model ) {
289+ exists ( QlBuiltins:: ExtensionId madId |
290+ sinkModel ( path , input , kind , provenance , madId ) and
291+ model = "MaD:" + madId .toString ( )
292+ )
293+ }
294+ }
0 commit comments