Skip to content

Commit 6a11120

Browse files
hvitvedhvitved
committed
Address review comments
1 parent 1692535 commit 6a11120

File tree

4 files changed

+37
-46
lines changed

4 files changed

+37
-46
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-078/CommandInjectionRuntimeExecLocal.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ edges
1414
| RuntimeExecTest.java:25:66:25:71 | script : String | RuntimeExecTest.java:25:42:25:72 | {...} : String[] [[]] : String | provenance | |
1515
| RuntimeExecTest.java:31:17:31:29 | commandArray2 [post update] : String[] [[]] : String | RuntimeExecTest.java:32:43:32:55 | commandArray2 | provenance | Sink:MaD:1 |
1616
| RuntimeExecTest.java:31:36:31:41 | script : String | RuntimeExecTest.java:31:17:31:29 | commandArray2 [post update] : String[] [[]] : String | provenance | |
17-
| RuntimeExecTest.java:36:21:39:21 | concat(...) : Stream [<element>] : String | RuntimeExecTest.java:36:21:39:44 | toArray(...) | provenance | MaD:5 |
17+
| RuntimeExecTest.java:36:21:39:21 | concat(...) : Stream [<element>] : String | RuntimeExecTest.java:36:21:39:44 | toArray(...) | provenance | MaD:5 Sink:MaD:1 |
1818
| RuntimeExecTest.java:38:25:38:59 | stream(...) : Stream [<element>] : String | RuntimeExecTest.java:36:21:39:21 | concat(...) : Stream [<element>] : String | provenance | MaD:4 |
1919
| RuntimeExecTest.java:38:39:38:58 | new String[] : String[] [[]] : String | RuntimeExecTest.java:38:25:38:59 | stream(...) : Stream [<element>] : String | provenance | MaD:3 |
2020
| RuntimeExecTest.java:38:39:38:58 | {...} : String[] [[]] : String | RuntimeExecTest.java:38:39:38:58 | new String[] : String[] [[]] : String | provenance | |

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -292,8 +292,8 @@ edges
292292
| summaries.rb:128:1:128:1 | [post] x | summaries.rb:129:6:129:6 | x | provenance | |
293293
| summaries.rb:128:14:128:20 | tainted | summaries.rb:128:1:128:1 | [post] x | provenance | MaD:21 |
294294
| summaries.rb:131:16:131:22 | tainted | summaries.rb:131:1:131:23 | synthetic splat argument | provenance | Sink:MaD:4 |
295-
| summaries.rb:157:14:160:3 | do ... end [captured tainted] | summaries.rb:158:15:158:21 | tainted | provenance | heuristic-callback |
296-
| summaries.rb:157:14:160:3 | do ... end [captured tainted] | summaries.rb:158:15:158:21 | tainted | provenance | heuristic-callback |
295+
| summaries.rb:157:14:160:3 | do ... end [captured tainted] | summaries.rb:158:15:158:21 | tainted | provenance | heuristic-callback Sink:MaD:6 |
296+
| summaries.rb:157:14:160:3 | do ... end [captured tainted] | summaries.rb:158:15:158:21 | tainted | provenance | heuristic-callback Sink:MaD:6 |
297297
nodes
298298
| summaries.rb:1:11:1:36 | call to identity | semmle.label | call to identity |
299299
| summaries.rb:1:11:1:36 | call to identity | semmle.label | call to identity |

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 25 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -164,20 +164,6 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
164164
module Impl<FullStateConfigSig Config> {
165165
private class FlowState = Config::FlowState;
166166

167-
private class NodeEx extends NodeExImpl {
168-
NodeEx() {
169-
Config::allowImplicitRead(any(Node n | this.isImplicitReadNode(n)), _)
170-
or
171-
not this.isImplicitReadNode(_)
172-
}
173-
}
174-
175-
private class ArgNodeEx extends NodeEx, ArgNodeExImpl { }
176-
177-
private class ParamNodeEx extends NodeEx, ParamNodeExImpl { }
178-
179-
private class RetNodeEx extends NodeEx, RetNodeExImpl { }
180-
181167
private module SourceSinkFiltering {
182168
private import codeql.util.AlertFiltering
183169

@@ -1043,10 +1029,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
10431029
bindingset[label1, label2]
10441030
pragma[inline_late]
10451031
private string mergeLabels(string label1, string label2) {
1046-
// Big-step, hidden nodes, and summaries all may need to merge labels.
1047-
// These cases are expected to involve at most one non-empty label, so
1048-
// we'll just discard the 2nd+ label for now.
1049-
if label1 = "" then result = label2 else result = label1
1032+
if label2.matches("Sink:%")
1033+
then if label1 = "" then result = label2 else result = label1 + " " + label2
1034+
else
1035+
// Big-step, hidden nodes, and summaries all may need to merge labels.
1036+
// These cases are expected to involve at most one non-empty label, so
1037+
// we'll just discard the 2nd+ label for now.
1038+
if label1 = ""
1039+
then result = label2
1040+
else result = label1
10501041
}
10511042

10521043
pragma[nomagic]
@@ -2819,15 +2810,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
28192810
pragma[nomagic]
28202811
PathNodeImpl getAnImplicitReadSuccessorAtSink(string label) {
28212812
exists(PathNodeMid readTarget |
2822-
result = this.getASuccessorImpl(label) and
2813+
result = this.getASuccessorImpl(_) and
28232814
localStep(this, readTarget, _) and
28242815
readTarget.getNodeEx().isImplicitReadNode(_)
28252816
|
28262817
// last implicit read, leaving the access path empty
2827-
result = readTarget.projectToSink(_)
2818+
result = readTarget.projectToSink(label)
28282819
or
28292820
// implicit read, leaving the access path non-empty
2830-
exists(result.getAnImplicitReadSuccessorAtSink(_)) and
2821+
exists(result.getAnImplicitReadSuccessorAtSink(label)) and
28312822
result = readTarget
28322823
)
28332824
}
@@ -2859,7 +2850,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
28592850
// `x [Field]` -> `x`
28602851
//
28612852
// which the restriction below ensures.
2862-
not result = this.getAnImplicitReadSuccessorAtSink(label)
2853+
not result = this.getAnImplicitReadSuccessorAtSink(_)
28632854
or
28642855
exists(string l1, string l2 |
28652856
result = this.getASuccessorFromNonHidden(l1).getASuccessorIfHidden(l2) and
@@ -2980,18 +2971,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
29802971
)
29812972
or
29822973
// a final step to a sink
2983-
exists(string l2, string sinkmodel, string l2_ |
2984-
result = this.getSuccMid(l2).projectToSink(sinkmodel) and
2985-
if l2 = "" then l2_ = l2 else l2_ = l2 + " "
2974+
exists(string l2, string sinkLabel |
2975+
result = this.getSuccMid(l2).projectToSink(sinkLabel)
29862976
|
29872977
not this.isSourceWithLabel(_) and
2988-
if sinkmodel != "" then label = l2_ + "Sink:" + sinkmodel else label = l2
2978+
label = mergeLabels(l2, sinkLabel)
29892979
or
29902980
exists(string l1 |
29912981
this.isSourceWithLabel(l1) and
2992-
if sinkmodel != ""
2993-
then label = l1 + l2_ + "Sink:" + sinkmodel
2994-
else label = l1 + l2
2982+
label = l1 + mergeLabels(l2, sinkLabel)
29952983
)
29962984
)
29972985
}
@@ -3057,11 +3045,14 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
30573045
else any()
30583046
}
30593047

3060-
PathNodeSink projectToSink(string model) {
3061-
this.isAtSink() and
3062-
sinkModel(node, model) and
3063-
result.getNodeEx() = this.toNormalSinkNodeEx() and
3064-
result.getState() = state
3048+
PathNodeSink projectToSink(string label) {
3049+
exists(string model |
3050+
this.isAtSink() and
3051+
sinkModel(node, model) and
3052+
result.getNodeEx() = this.toNormalSinkNodeEx() and
3053+
result.getState() = state and
3054+
if model != "" then label = "Sink:" + model else label = ""
3055+
)
30653056
}
30663057
}
30673058

‎shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
850850

851851
class SndLevelScopeOption = SndLevelScopeOption::Option;
852852

853-
final class NodeExImpl extends TNodeEx {
853+
final class NodeEx extends TNodeEx {
854854
string toString() {
855855
result = this.asNode().toString()
856856
or
@@ -899,14 +899,14 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
899899
Location getLocation() { result = this.projectToNode().getLocation() }
900900
}
901901

902-
final class ArgNodeExImpl extends NodeExImpl {
903-
ArgNodeExImpl() { this.asNode() instanceof ArgNode }
902+
final class ArgNodeEx extends NodeEx {
903+
ArgNodeEx() { this.asNode() instanceof ArgNode }
904904

905905
DataFlowCall getCall() { this.asNode().(ArgNode).argumentOf(result, _) }
906906
}
907907

908-
final class ParamNodeExImpl extends NodeExImpl {
909-
ParamNodeExImpl() { this.asNode() instanceof ParamNode }
908+
final class ParamNodeEx extends NodeEx {
909+
ParamNodeEx() { this.asNode() instanceof ParamNode }
910910

911911
predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
912912
this.asNode().(ParamNode).isParameterOf(c, pos)
@@ -919,10 +919,10 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
919919
* A node from which flow can return to the caller. This is either a regular
920920
* `ReturnNode` or a synthesized node for flow out via a parameter.
921921
*/
922-
final class RetNodeExImpl extends NodeExImpl {
922+
final class RetNodeEx extends NodeEx {
923923
private ReturnPosition pos;
924924

925-
RetNodeExImpl() { pos = getReturnPositionEx(this) }
925+
RetNodeEx() { pos = getReturnPositionEx(this) }
926926

927927
ReturnPosition getReturnPosition() { result = pos }
928928

@@ -1713,7 +1713,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
17131713
* Holds if data can flow in one local step from `node1` to `node2`.
17141714
*/
17151715
cached
1716-
predicate localFlowStepExImpl(NodeExImpl node1, NodeExImpl node2, string model) {
1716+
predicate localFlowStepExImpl(NodeEx node1, NodeEx node2, string model) {
17171717
exists(Node n1, Node n2 |
17181718
node1.asNode() = n1 and
17191719
node2.asNode() = n2 and
@@ -1730,7 +1730,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
17301730
}
17311731

17321732
cached
1733-
ReturnPosition getReturnPositionEx(NodeExImpl ret) {
1733+
ReturnPosition getReturnPositionEx(NodeEx ret) {
17341734
result = getValueReturnPosition(ret.asNode())
17351735
or
17361736
exists(ParamNode p |

0 commit comments

Comments
 (0)