1
1
#include " taint_rules.h"
2
2
#include < json/json_parser.h>
3
3
#include < util/file_util.h>
4
- #include < util/string2int.h>
5
4
#include < util/msgstream.h>
6
- #include < fstream>
7
5
#include < util/prefix.h>
8
6
9
7
10
- std::unique_ptr<taintable_locationt> taintable_locationt::load (
11
- const std::string &location_string,
12
- bool dereference,
13
- message_handlert &message_handler)
14
- {
15
- messaget msg (message_handler);
16
-
17
- std::unique_ptr<taintable_locationt> taintable_argument =
18
- taintable_location_argumentt::load (location_string, dereference, message_handler);
19
- if (taintable_argument != nullptr )
20
- return taintable_argument;
21
- // Prefer returns but allow return_value
22
- else if (location_string == " returns" || location_string == " return_value" )
23
- return std::unique_ptr<taintable_locationt>(
24
- new taintable_location_return_valuet (dereference));
25
- else
26
- return nullptr ;
27
- }
28
-
29
- std::unique_ptr<taintable_location_argumentt> taintable_location_argumentt::load (
30
- const std::string &location_string,
31
- bool dereference,
32
- message_handlert &message_handler)
33
- {
34
- messaget msg (message_handler);
35
-
36
- if (location_string == " this" )
37
- return std::unique_ptr<taintable_location_argumentt>(
38
- new taintable_location_argumentt ());
39
- else if (has_prefix (location_string, " arg" ))
40
- {
41
- // Parse string and handle invalid input/out of range
42
- const char *arg_no_string = location_string.c_str () + 3 ;
43
- char *arg_no_string_end;
44
- long arg_no;
45
- arg_no = strtol (arg_no_string, &arg_no_string_end, 0 );
46
- if (arg_no > 100 || arg_no < 1 )
47
- {
48
- msg.error ()
49
- << " JSON tainted location specification location was to an invalid argument index."
50
- << messaget::eom;
51
- return nullptr ;
52
- }
53
- if (*arg_no_string == ' \0 ' || *arg_no_string_end != ' \0 ' )
54
- {
55
- msg.error ()
56
- << " JSON tainted location specification location was to an argument without an index."
57
- << messaget::eom;
58
- return nullptr ;
59
- }
60
- return std::unique_ptr<taintable_location_argumentt>(
61
- new taintable_location_argumentt (arg_no, dereference));
62
- }
63
- else
64
- return nullptr ;
65
- }
66
-
67
- template <typename taintable_locationt>
68
- boost::optional<tainted_locationt<taintable_locationt>> tainted_locationt<taintable_locationt>::load(
69
- const jsont &json,
70
- taint_tokent::named_tokenst &tokens,
71
- message_handlert &message_handler)
72
- {
73
- messaget msg (message_handler);
74
-
75
- if (json.is_null ())
76
- return boost::none;
77
- if (!json.is_object ())
78
- {
79
- msg.error ()
80
- << " JSON tainted location specification was not an object, ignoring it."
81
- << messaget::eom;
82
- return boost::none;
83
- }
84
- // Read the location
85
- const jsont &dereference_json = json[" dereference" ];
86
- bool dereference = dereference_json.is_true (); // Null == false
87
- if (!(dereference_json.is_null ()
88
- || dereference_json.is_true () || dereference_json.is_false ()))
89
- {
90
- msg.error ()
91
- << " JSON tainted location included an invalid value for dereference, assuming true was intended."
92
- << messaget::eom;
93
- dereference = true ;
94
- }
95
- std::unique_ptr<taintable_locationt> location =
96
- taintable_locationt::load (json[" location" ].value , dereference, message_handler);
97
- if (location == nullptr )
98
- {
99
- msg.error ()
100
- << " JSON tainted location specification did not have valid location, ignoring it."
101
- << messaget::eom;
102
- return boost::none;
103
- }
104
- // Read the taint
105
- std::string taint_string = json[" taint" ].value ;
106
- if (taint_string.empty ())
107
- taint_string = json[" vulnerability" ].value ;
108
- if (taint_string.empty ())
109
- {
110
- msg.error ()
111
- << " JSON tainted location specification did not specify taint symbol, ignoring it."
112
- << messaget::eom;
113
- return boost::none;
114
- }
115
- // Try to add a new token, get the token added or already in the set
116
- taint_tokent token =
117
- tokens.left .insert ({ taint_string, taint_tokent::fresh () }).first ->second ;
118
- return tainted_locationt<taintable_locationt>(std::move (location), token);
119
- }
120
-
121
-
122
- std::unique_ptr<taintable_locationt> taintable_location_return_valuet::applied (
123
- bool has_this, size_t arg_count_including_this) const
124
- {
125
- return std::unique_ptr<taintable_locationt>(
126
- new taintable_location_return_valuet (*this ));
127
- }
128
-
129
- std::unique_ptr<taintable_locationt> taintable_location_argumentt::applied (
130
- bool has_this, size_t arg_count_including_this) const
131
- {
132
- return applied_argument (has_this, arg_count_including_this);
133
- }
134
-
135
- std::unique_ptr<taintable_location_argumentt> taintable_location_argumentt::applied_argument (
136
- bool has_this, size_t arg_count_including_this) const
137
- {
138
- if (has_this)
139
- {
140
- if (arg_index >= arg_count_including_this)
141
- return nullptr ;
142
- return std::unique_ptr<taintable_location_argumentt>(
143
- new taintable_location_argumentt (*this ));
144
- }
145
- if (arg_index == 0 || arg_index - 1 >= arg_count_including_this)
146
- return nullptr ;
147
- return std::unique_ptr<taintable_location_argumentt>(
148
- new taintable_location_argumentt (arg_index - 1 , dereference));
149
- }
150
-
151
-
152
- taint_sett taint_propogation_rulet::apply ()
8
+ taint_sett taint_propogation_rulet::apply () const
153
9
{
154
10
assert (!has_input_condition ());
155
11
return taint_sett::from_token (result.taint );
156
12
}
157
13
158
- taint_sett taint_propogation_rulet::apply (const taint_sett &input_taint)
14
+ taint_sett taint_propogation_rulet::apply (const taint_sett &input_taint) const
159
15
{
160
16
assert (has_input_condition ());
161
17
return input_taint.map_conditional (input->taint , result.taint );
@@ -334,7 +190,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
334
190
if (failure)
335
191
continue ; // Doesn't match this function overload
336
192
rules->add (fn_detail_it->second .id ,
337
- std::make_shared< taint_sink_rulet> (
193
+ taint_sink_rulet (
338
194
std::move (input), std::move (*sink_target), comment, message));
339
195
overload_found = true ;
340
196
}
@@ -354,7 +210,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
354
210
if (failure)
355
211
continue ; // Doesn't match this function overload
356
212
rules->add (fn_detail_it->second .id ,
357
- std::make_shared< taint_sanitizer_rulet> (std::move (*sanitizes), comment));
213
+ taint_sanitizer_rulet (std::move (*sanitizes), comment));
358
214
overload_found = true ;
359
215
}
360
216
}
@@ -369,7 +225,7 @@ std::unique_ptr<taint_rulest> taint_rulest::load(
369
225
if (failure)
370
226
continue ; // Doesn't match this function overload
371
227
rules->add (fn_detail_it->second .id ,
372
- std::make_shared< taint_propogation_rulet> (
228
+ taint_propogation_rulet (
373
229
std::move (input), std::move (*result), comment));
374
230
overload_found = true ;
375
231
}
0 commit comments