Skip to content

Commit 7b23339

Browse files
NathanJPhillipssmowton
authored andcommitted
Merge pull request diffblue#146 from NathanJPhillips/cleanup/store-rules-in-map
Cleanup/store rules in map
1 parent 05a7a13 commit 7b23339

File tree

5 files changed

+351
-276
lines changed

5 files changed

+351
-276
lines changed

src/goto-analyzer/taint_rules.cpp

Lines changed: 5 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -1,161 +1,17 @@
11
#include "taint_rules.h"
22
#include <json/json_parser.h>
33
#include <util/file_util.h>
4-
#include <util/string2int.h>
54
#include <util/msgstream.h>
6-
#include <fstream>
75
#include <util/prefix.h>
86

97

10-
std::unique_ptr<taintable_locationt> taintable_locationt::load(
11-
const std::string &location_string,
12-
bool dereference,
13-
message_handlert &message_handler)
14-
{
15-
messaget msg(message_handler);
16-
17-
std::unique_ptr<taintable_locationt> taintable_argument =
18-
taintable_location_argumentt::load(location_string, dereference, message_handler);
19-
if(taintable_argument != nullptr)
20-
return taintable_argument;
21-
// Prefer returns but allow return_value
22-
else if(location_string == "returns" || location_string == "return_value")
23-
return std::unique_ptr<taintable_locationt>(
24-
new taintable_location_return_valuet(dereference));
25-
else
26-
return nullptr;
27-
}
28-
29-
std::unique_ptr<taintable_location_argumentt> taintable_location_argumentt::load(
30-
const std::string &location_string,
31-
bool dereference,
32-
message_handlert &message_handler)
33-
{
34-
messaget msg(message_handler);
35-
36-
if(location_string == "this")
37-
return std::unique_ptr<taintable_location_argumentt>(
38-
new taintable_location_argumentt());
39-
else if(has_prefix(location_string, "arg"))
40-
{
41-
// Parse string and handle invalid input/out of range
42-
const char *arg_no_string = location_string.c_str() + 3;
43-
char *arg_no_string_end;
44-
long arg_no;
45-
arg_no = strtol(arg_no_string, &arg_no_string_end, 0);
46-
if(arg_no > 100 || arg_no < 1)
47-
{
48-
msg.error()
49-
<< "JSON tainted location specification location was to an invalid argument index."
50-
<< messaget::eom;
51-
return nullptr;
52-
}
53-
if(*arg_no_string == '\0' || *arg_no_string_end != '\0')
54-
{
55-
msg.error()
56-
<< "JSON tainted location specification location was to an argument without an index."
57-
<< messaget::eom;
58-
return nullptr;
59-
}
60-
return std::unique_ptr<taintable_location_argumentt>(
61-
new taintable_location_argumentt(arg_no, dereference));
62-
}
63-
else
64-
return nullptr;
65-
}
66-
67-
template<typename taintable_locationt>
68-
boost::optional<tainted_locationt<taintable_locationt>> tainted_locationt<taintable_locationt>::load(
69-
const jsont &json,
70-
taint_tokent::named_tokenst &tokens,
71-
message_handlert &message_handler)
72-
{
73-
messaget msg(message_handler);
74-
75-
if(json.is_null())
76-
return boost::none;
77-
if(!json.is_object())
78-
{
79-
msg.error()
80-
<< "JSON tainted location specification was not an object, ignoring it."
81-
<< messaget::eom;
82-
return boost::none;
83-
}
84-
// Read the location
85-
const jsont &dereference_json = json["dereference"];
86-
bool dereference = dereference_json.is_true(); // Null == false
87-
if(!(dereference_json.is_null()
88-
|| dereference_json.is_true() || dereference_json.is_false()))
89-
{
90-
msg.error()
91-
<< "JSON tainted location included an invalid value for dereference, assuming true was intended."
92-
<< messaget::eom;
93-
dereference = true;
94-
}
95-
std::unique_ptr<taintable_locationt> location =
96-
taintable_locationt::load(json["location"].value, dereference, message_handler);
97-
if(location == nullptr)
98-
{
99-
msg.error()
100-
<< "JSON tainted location specification did not have valid location, ignoring it."
101-
<< messaget::eom;
102-
return boost::none;
103-
}
104-
// Read the taint
105-
std::string taint_string = json["taint"].value;
106-
if(taint_string.empty())
107-
taint_string = json["vulnerability"].value;
108-
if(taint_string.empty())
109-
{
110-
msg.error()
111-
<< "JSON tainted location specification did not specify taint symbol, ignoring it."
112-
<< messaget::eom;
113-
return boost::none;
114-
}
115-
// Try to add a new token, get the token added or already in the set
116-
taint_tokent token =
117-
tokens.left.insert({ taint_string, taint_tokent::fresh() }).first->second;
118-
return tainted_locationt<taintable_locationt>(std::move(location), token);
119-
}
120-
121-
122-
std::unique_ptr<taintable_locationt> taintable_location_return_valuet::applied(
123-
bool has_this, size_t arg_count_including_this) const
124-
{
125-
return std::unique_ptr<taintable_locationt>(
126-
new taintable_location_return_valuet(*this));
127-
}
128-
129-
std::unique_ptr<taintable_locationt> taintable_location_argumentt::applied(
130-
bool has_this, size_t arg_count_including_this) const
131-
{
132-
return applied_argument(has_this, arg_count_including_this);
133-
}
134-
135-
std::unique_ptr<taintable_location_argumentt> taintable_location_argumentt::applied_argument(
136-
bool has_this, size_t arg_count_including_this) const
137-
{
138-
if(has_this)
139-
{
140-
if(arg_index >= arg_count_including_this)
141-
return nullptr;
142-
return std::unique_ptr<taintable_location_argumentt>(
143-
new taintable_location_argumentt(*this));
144-
}
145-
if(arg_index == 0 || arg_index - 1 >= arg_count_including_this)
146-
return nullptr;
147-
return std::unique_ptr<taintable_location_argumentt>(
148-
new taintable_location_argumentt(arg_index - 1, dereference));
149-
}
150-
151-
152-
taint_sett taint_propogation_rulet::apply()
8+
taint_sett taint_propogation_rulet::apply() const
1539
{
15410
assert(!has_input_condition());
15511
return taint_sett::from_token(result.taint);
15612
}
15713

158-
taint_sett taint_propogation_rulet::apply(const taint_sett &input_taint)
14+
taint_sett taint_propogation_rulet::apply(const taint_sett &input_taint) const
15915
{
16016
assert(has_input_condition());
16117
return input_taint.map_conditional(input->taint, result.taint);
@@ -334,7 +190,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
334190
if(failure)
335191
continue; // Doesn't match this function overload
336192
rules->add(fn_detail_it->second.id,
337-
std::make_shared<taint_sink_rulet>(
193+
taint_sink_rulet(
338194
std::move(input), std::move(*sink_target), comment, message));
339195
overload_found = true;
340196
}
@@ -354,7 +210,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
354210
if(failure)
355211
continue; // Doesn't match this function overload
356212
rules->add(fn_detail_it->second.id,
357-
std::make_shared<taint_sanitizer_rulet>(std::move(*sanitizes), comment));
213+
taint_sanitizer_rulet(std::move(*sanitizes), comment));
358214
overload_found = true;
359215
}
360216
}
@@ -369,7 +225,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
369225
if(failure)
370226
continue; // Doesn't match this function overload
371227
rules->add(fn_detail_it->second.id,
372-
std::make_shared<taint_propogation_rulet>(
228+
taint_propogation_rulet(
373229
std::move(input), std::move(*result), comment));
374230
overload_found = true;
375231
}

0 commit comments

Comments
 (0)