Skip to content

Commit d86293f

Browse files
hvitvedhvitved
authored
Merge pull request #14690 from hvitved/csharp/gvn-unbound-type
2 parents 4b9430d + 602d16d commit d86293f

File tree

4 files changed

+56
-18
lines changed

4 files changed

+56
-18
lines changed

‎csharp/ql/test/TestUtilities/InlineFlowTest.qll‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,11 @@ private module FlowTestImpl implements InputSig<CsharpDataFlow> {
2626
}
2727

2828
string getArgString(DataFlow::Node src, DataFlow::Node sink) {
29-
(if exists(getSourceArgString(src)) then result = getSourceArgString(src) else result = "") and
29+
(
30+
result = getSourceArgString(src)
31+
or
32+
not exists(getSourceArgString(src)) and result = "line:" + src.getLocation().getStartLine()
33+
) and
3034
exists(sink)
3135
}
3236
}

‎csharp/ql/test/library-tests/dataflow/types/Types.cs‎

Lines changed: 35 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ class C : B<int> { }
1313

1414
class D : B<string>
1515
{
16-
public override void M() => Sink(this);
16+
public override void M() => Sink(this); // $ hasValueFlow=line:32 $ hasValueFlow=line:33 $ hasValueFlow=line:40
1717
}
1818

1919
static void M1()
@@ -41,32 +41,32 @@ static void M1()
4141
M9(new D()); // no flow
4242

4343
object o = null; // flow
44-
Sink(o);
44+
Sink(o); // $ hasValueFlow=line:43
4545
}
4646

4747
static void M2(A a)
4848
{
4949
if (a is C c)
50-
Sink(c);
50+
Sink(c); // $ hasValueFlow=line:23
5151
}
5252

5353
static void M3(A a)
5454
{
5555
switch (a)
5656
{
5757
case D d:
58-
Sink(d);
58+
Sink(d); // $ hasValueFlow=line:35
5959
break;
6060
}
6161
}
6262

63-
static void M4(A a) => Sink((C)a);
63+
static void M4(A a) => Sink((C)a); // $ hasValueFlow=line:25
6464

65-
static void M5<T>(T x) => Sink(x);
65+
static void M5<T>(T x) => Sink(x); // $ hasValueFlow=line:26 $ hasValueFlow=line:37
6666

67-
static void M6<T>(T x) where T : A => Sink(x);
67+
static void M6<T>(T x) where T : A => Sink(x); // $ hasValueFlow=line:27 $ hasValueFlow=line:38
6868

69-
static void M7<T>(T x) where T : class => Sink(x);
69+
static void M7<T>(T x) where T : class => Sink(x); // $ hasValueFlow=line:28 $ hasValueFlow=line:39
7070

7171
static void M8<T>(T x)
7272
{
@@ -77,7 +77,7 @@ static void M8<T>(T x)
7777
static void M9(A a)
7878
{
7979
if (a is B<int> b)
80-
Sink(b);
80+
Sink(b); // $ hasValueFlow=line:30
8181
}
8282

8383
static void Sink<T>(T x) { }
@@ -112,15 +112,15 @@ void M3()
112112

113113
public override void M()
114114
{
115-
Sink(this.Field);
115+
Sink(this.Field); // $ hasValueFlow=line:110
116116
}
117117

118118
void M10()
119119
{
120120
var a = new A();
121121
var e2 = new E2();
122-
Sink(Through(a)); // flow
123-
Sink(Through(e2)); // flow
122+
Sink(Through(a)); // $ hasValueFlow=line:120
123+
Sink(Through(e2)); // $ hasValueFlow=line:121
124124
Sink((E2)Through(a)); // no flow
125125
Sink((A)Through(e2)); // no flow
126126
}
@@ -150,6 +150,28 @@ class FieldB : FieldA { }
150150

151151
class FieldC : FieldA
152152
{
153-
public override void M() => Sink(this.Field);
153+
public override void M() => Sink(this.Field); // $ hasValueFlow=line:144
154+
}
155+
156+
class F
157+
{
158+
public virtual void M() { }
159+
160+
class F1<T> : F
161+
{
162+
public override void M() => Sink(this); // $ hasValueFlow=line:167
163+
}
164+
165+
class F2 : F { }
166+
167+
F GetF1() => new F1<int>();
168+
169+
F GetF2() => new F2();
170+
171+
private void M2()
172+
{
173+
GetF1().M();
174+
GetF2().M();
175+
}
154176
}
155177
}

‎csharp/ql/test/library-tests/dataflow/types/Types.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
testFailures
12
edges
23
| Types.cs:7:21:7:25 | this : D | Types.cs:7:32:7:35 | this access : D |
34
| Types.cs:7:32:7:35 | this access : D | Types.cs:16:30:16:30 | this : D |
@@ -54,6 +55,9 @@ edges
5455
| Types.cs:145:13:145:13 | access to parameter c : FieldC [field Field] : Object | Types.cs:138:21:138:25 | this : FieldC [field Field] : Object |
5556
| Types.cs:153:30:153:30 | this : FieldC [field Field] : Object | Types.cs:153:42:153:45 | this access : FieldC [field Field] : Object |
5657
| Types.cs:153:42:153:45 | this access : FieldC [field Field] : Object | Types.cs:153:42:153:51 | access to field Field |
58+
| Types.cs:162:34:162:34 | this : Types+F+F1<Int32> | Types.cs:162:46:162:49 | this access |
59+
| Types.cs:167:22:167:34 | object creation of type F1<Int32> : Types+F+F1<Int32> | Types.cs:173:13:173:19 | call to method GetF1 : Types+F+F1<Int32> |
60+
| Types.cs:173:13:173:19 | call to method GetF1 : Types+F+F1<Int32> | Types.cs:162:34:162:34 | this : Types+F+F1<Int32> |
5761
nodes
5862
| Types.cs:7:21:7:25 | this : D | semmle.label | this : D |
5963
| Types.cs:7:32:7:35 | this access : D | semmle.label | this access : D |
@@ -123,6 +127,10 @@ nodes
123127
| Types.cs:153:30:153:30 | this : FieldC [field Field] : Object | semmle.label | this : FieldC [field Field] : Object |
124128
| Types.cs:153:42:153:45 | this access : FieldC [field Field] : Object | semmle.label | this access : FieldC [field Field] : Object |
125129
| Types.cs:153:42:153:51 | access to field Field | semmle.label | access to field Field |
130+
| Types.cs:162:34:162:34 | this : Types+F+F1<Int32> | semmle.label | this : Types+F+F1<Int32> |
131+
| Types.cs:162:46:162:49 | this access | semmle.label | this access |
132+
| Types.cs:167:22:167:34 | object creation of type F1<Int32> : Types+F+F1<Int32> | semmle.label | object creation of type F1<Int32> : Types+F+F1<Int32> |
133+
| Types.cs:173:13:173:19 | call to method GetF1 : Types+F+F1<Int32> | semmle.label | call to method GetF1 : Types+F+F1<Int32> |
126134
subpaths
127135
| Types.cs:122:30:122:30 | access to local variable a : A | Types.cs:130:34:130:34 | x : A | Types.cs:130:40:130:40 | access to parameter x : A | Types.cs:122:22:122:31 | call to method Through |
128136
| Types.cs:123:30:123:31 | access to local variable e2 : Types+E<D>.E2 | Types.cs:130:34:130:34 | x : Types+E<D>.E2 | Types.cs:130:40:130:40 | access to parameter x : Types+E<D>.E2 | Types.cs:123:22:123:32 | call to method Through |
@@ -145,3 +153,4 @@ subpaths
145153
| Types.cs:120:25:120:31 | object creation of type A : A | Types.cs:120:25:120:31 | object creation of type A : A | Types.cs:122:22:122:31 | call to method Through | $@ | Types.cs:122:22:122:31 | call to method Through | call to method Through |
146154
| Types.cs:121:26:121:33 | object creation of type E2 : Types+E<D>.E2 | Types.cs:121:26:121:33 | object creation of type E2 : Types+E<D>.E2 | Types.cs:123:22:123:32 | call to method Through | $@ | Types.cs:123:22:123:32 | call to method Through | call to method Through |
147155
| Types.cs:144:23:144:34 | object creation of type Object : Object | Types.cs:144:23:144:34 | object creation of type Object : Object | Types.cs:153:42:153:51 | access to field Field | $@ | Types.cs:153:42:153:51 | access to field Field | access to field Field |
156+
| Types.cs:167:22:167:34 | object creation of type F1<Int32> : Types+F+F1<Int32> | Types.cs:167:22:167:34 | object creation of type F1<Int32> : Types+F+F1<Int32> | Types.cs:162:46:162:49 | this access | $@ | Types.cs:162:46:162:49 | this access | this access |

‎csharp/ql/test/library-tests/dataflow/types/Types.ql‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
*/
44

55
import csharp
6-
import Types::PathGraph
6+
import TestUtilities.InlineFlowTest
7+
import PathGraph
78

89
module TypesConfig implements DataFlow::ConfigSig {
910
predicate isSource(DataFlow::Node src) {
@@ -17,10 +18,12 @@ module TypesConfig implements DataFlow::ConfigSig {
1718
mc.getAnArgument() = sink.asExpr()
1819
)
1920
}
21+
22+
int fieldFlowBranchLimit() { result = 1000 }
2023
}
2124

22-
module Types = DataFlow::Global<TypesConfig>;
25+
import ValueFlowTest<TypesConfig>
2326

24-
from Types::PathNode source, Types::PathNode sink
25-
where Types::flowPath(source, sink)
27+
from PathNode source, PathNode sink
28+
where flowPath(source, sink)
2629
select source, source, sink, "$@", sink, sink.toString()

0 commit comments

Comments
 (0)