Skip to content

Commit 7f6b400

Browse files
authored
Merge pull request #10366 from MathiasVP/use-use-flow-in-experimental
C++: Use-use flow in `experimental`
2 parents e07e6c9 + d2b150e commit 7f6b400

37 files changed

+24095
-17
lines changed
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Provides a library for local (intra-procedural) and global (inter-procedural)
3+
* data flow analysis: deciding whether data can flow from a _source_ to a
4+
* _sink_. This library differs from the one in `semmle.code.cpp.dataflow` in that
5+
* this library uses the IR (Intermediate Representation) library, which provides
6+
* a more precise semantic representation of the program, whereas the other dataflow
7+
* library uses the more syntax-oriented ASTs. This library should provide more accurate
8+
* results than the AST-based library in most scenarios.
9+
*
10+
* Unless configured otherwise, _flow_ means that the exact value of
11+
* the source may reach the sink. We do not track flow across pointer
12+
* dereferences or array indexing.
13+
*
14+
* To use global (interprocedural) data flow, extend the class
15+
* `DataFlow::Configuration` as documented on that class. To use local
16+
* (intraprocedural) data flow between expressions, call
17+
* `DataFlow::localExprFlow`. For more general cases of local data flow, call
18+
* `DataFlow::localFlow` or `DataFlow::localFlowStep` with arguments of type
19+
* `DataFlow::Node`.
20+
*/
21+
22+
import cpp
23+
24+
module DataFlow {
25+
import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl
26+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
10+
*/
11+
12+
import cpp
13+
14+
module DataFlow2 {
15+
import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl2
16+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* Provides a `DataFlow3` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
10+
*/
11+
12+
import cpp
13+
14+
module DataFlow3 {
15+
import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl3
16+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* Provides a `DataFlow4` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
10+
*/
11+
12+
import cpp
13+
14+
module DataFlow4 {
15+
import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl4
16+
}
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Provides a predicate for non-contextual virtual dispatch and function
3+
* pointer resolution.
4+
*/
5+
6+
import cpp
7+
private import semmle.code.cpp.ir.ValueNumbering
8+
private import internal.DataFlowDispatch
9+
private import semmle.code.cpp.ir.IR
10+
11+
/**
12+
* Resolve potential target function(s) for `call`.
13+
*
14+
* If `call` is a call through a function pointer (`ExprCall`) or its target is
15+
* a virtual member function, simple data flow analysis is performed in order
16+
* to identify the possible target(s).
17+
*/
18+
Function resolveCall(Call call) {
19+
exists(CallInstruction callInstruction |
20+
callInstruction.getAst() = call and
21+
result = viableCallable(callInstruction)
22+
)
23+
}
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Provides classes for performing local (intra-procedural) and
3+
* global (inter-procedural) taint-tracking analyses.
4+
*
5+
* We define _taint propagation_ informally to mean that a substantial part of
6+
* the information from the source is preserved at the sink. For example, taint
7+
* propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
8+
* 100` since we consider a single bit of information to be too little.
9+
*
10+
* To use global (interprocedural) taint tracking, extend the class
11+
* `TaintTracking::Configuration` as documented on that class. To use local
12+
* (intraprocedural) taint tracking between expressions, call
13+
* `TaintTracking::localExprTaint`. For more general cases of local taint
14+
* tracking, call `TaintTracking::localTaint` or
15+
* `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
16+
*/
17+
18+
import semmle.code.cpp.ir.dataflow.DataFlow
19+
import semmle.code.cpp.ir.dataflow.DataFlow2
20+
21+
module TaintTracking {
22+
import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
23+
}
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/**
2+
* Provides a `TaintTracking2` module, which is a copy of the `TaintTracking`
3+
* module. Use this class when data-flow configurations or taint-tracking
4+
* configurations must depend on each other. Two classes extending
5+
* `DataFlow::Configuration` should never depend on each other, but one of them
6+
* should instead depend on a `DataFlow2::Configuration`, a
7+
* `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
8+
* `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
9+
* `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
10+
*
11+
* See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
12+
*/
13+
module TaintTracking2 {
14+
import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking2.TaintTrackingImpl
15+
}
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/**
2+
* Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
3+
* module. Use this class when data-flow configurations or taint-tracking
4+
* configurations must depend on each other. Two classes extending
5+
* `DataFlow::Configuration` should never depend on each other, but one of them
6+
* should instead depend on a `DataFlow2::Configuration`, a
7+
* `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
8+
* `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
9+
* `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
10+
*
11+
* See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
12+
*/
13+
module TaintTracking3 {
14+
import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking3.TaintTrackingImpl
15+
}

0 commit comments

Comments
 (0)