Skip to content

Commit f6627cc

Browse files
MathiasVPMathiasVP
authored
Merge pull request #16969 from MathiasVP/add-missing-underlying-type
C++: Strip specifiers and typedefs when finding iterator parameter for string taint function
2 parents 1a2b4a3 + 7a2b170 commit f6627cc

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

‎cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ abstract private class StdStringTaintFunction extends TaintFunction {
6666
* Gets the index of a parameter to this function that is an iterator.
6767
*/
6868
final int getAnIteratorParameterIndex() {
69-
this.getParameter(result).getType() instanceof Iterator
69+
this.getParameter(result).getUnspecifiedType() instanceof Iterator
7070
}
7171
}
7272

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4361,6 +4361,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
43614361
| string.cpp:446:17:446:17 | a | string.cpp:446:19:446:23 | call to begin | TAINT |
43624362
| string.cpp:446:17:446:17 | ref arg a | string.cpp:446:8:446:8 | a | |
43634363
| string.cpp:446:17:446:17 | ref arg a | string.cpp:447:8:447:8 | a | |
4364+
| string.cpp:446:17:446:25 | call to iterator | string.cpp:446:8:446:8 | ref arg a | TAINT |
4365+
| string.cpp:446:17:446:25 | call to iterator | string.cpp:446:10:446:15 | call to insert | TAINT |
43644366
| string.cpp:446:19:446:23 | call to begin | string.cpp:446:17:446:25 | call to iterator | TAINT |
43654367
| string.cpp:446:32:446:34 | 120 | string.cpp:446:8:446:8 | ref arg a | TAINT |
43664368
| string.cpp:446:32:446:34 | 120 | string.cpp:446:10:446:15 | call to insert | TAINT |
@@ -4369,6 +4371,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
43694371
| string.cpp:449:17:449:17 | b | string.cpp:449:19:449:23 | call to begin | TAINT |
43704372
| string.cpp:449:17:449:17 | ref arg b | string.cpp:449:8:449:8 | b | |
43714373
| string.cpp:449:17:449:17 | ref arg b | string.cpp:450:8:450:8 | b | |
4374+
| string.cpp:449:17:449:25 | call to iterator | string.cpp:449:8:449:8 | ref arg b | TAINT |
4375+
| string.cpp:449:17:449:25 | call to iterator | string.cpp:449:10:449:15 | call to insert | TAINT |
43724376
| string.cpp:449:19:449:23 | call to begin | string.cpp:449:17:449:25 | call to iterator | TAINT |
43734377
| string.cpp:449:32:449:46 | call to source | string.cpp:449:8:449:8 | ref arg b | TAINT |
43744378
| string.cpp:449:32:449:46 | call to source | string.cpp:449:10:449:15 | call to insert | TAINT |
@@ -4396,6 +4400,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
43964400
| string.cpp:459:17:459:17 | c | string.cpp:459:19:459:21 | call to end | TAINT |
43974401
| string.cpp:459:17:459:17 | ref arg c | string.cpp:459:8:459:8 | c | |
43984402
| string.cpp:459:17:459:17 | ref arg c | string.cpp:460:8:460:8 | c | |
4403+
| string.cpp:459:17:459:23 | call to iterator | string.cpp:459:8:459:8 | ref arg c | TAINT |
4404+
| string.cpp:459:17:459:23 | call to iterator | string.cpp:459:10:459:15 | call to insert | TAINT |
43994405
| string.cpp:459:19:459:21 | call to end | string.cpp:459:17:459:23 | call to iterator | TAINT |
44004406
| string.cpp:459:26:459:27 | ref arg s1 | string.cpp:459:38:459:39 | s1 | |
44014407
| string.cpp:459:26:459:27 | ref arg s1 | string.cpp:465:28:465:29 | s1 | |
@@ -4413,6 +4419,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
44134419
| string.cpp:462:17:462:17 | d | string.cpp:462:19:462:21 | call to end | TAINT |
44144420
| string.cpp:462:17:462:17 | ref arg d | string.cpp:462:8:462:8 | d | |
44154421
| string.cpp:462:17:462:17 | ref arg d | string.cpp:463:8:463:8 | d | |
4422+
| string.cpp:462:17:462:23 | call to iterator | string.cpp:462:8:462:8 | ref arg d | TAINT |
4423+
| string.cpp:462:17:462:23 | call to iterator | string.cpp:462:10:462:15 | call to insert | TAINT |
44164424
| string.cpp:462:19:462:21 | call to end | string.cpp:462:17:462:23 | call to iterator | TAINT |
44174425
| string.cpp:462:26:462:27 | ref arg s2 | string.cpp:462:38:462:39 | s2 | |
44184426
| string.cpp:462:26:462:27 | ref arg s2 | string.cpp:465:8:465:9 | s2 | |
@@ -4432,6 +4440,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
44324440
| string.cpp:465:18:465:19 | ref arg s2 | string.cpp:465:8:465:9 | s2 | |
44334441
| string.cpp:465:18:465:19 | ref arg s2 | string.cpp:466:8:466:9 | s2 | |
44344442
| string.cpp:465:18:465:19 | s2 | string.cpp:465:21:465:23 | call to end | TAINT |
4443+
| string.cpp:465:18:465:25 | call to iterator | string.cpp:465:8:465:9 | ref arg s2 | TAINT |
4444+
| string.cpp:465:18:465:25 | call to iterator | string.cpp:465:11:465:16 | call to insert | TAINT |
44354445
| string.cpp:465:21:465:23 | call to end | string.cpp:465:18:465:25 | call to iterator | TAINT |
44364446
| string.cpp:465:28:465:29 | ref arg s1 | string.cpp:465:40:465:41 | s1 | |
44374447
| string.cpp:465:28:465:29 | s1 | string.cpp:465:31:465:35 | call to begin | TAINT |

0 commit comments

Comments
 (0)