Skip to content

Commit e51c20b

Browse files
hvitvedhvitved
committed
Data flow: Take conjunctive With(out)Contents into account in prohibitsUseUseFlow 
1 parent 9d23742 commit e51c20b

File tree

4 files changed

+23
-54
lines changed

4 files changed

+23
-54
lines changed

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -750,6 +750,27 @@ module Private {
750750
)
751751
}
752752

753+
/**
754+
* Holds if `p` can reach `n` in a summarized callable, using only value-preserving
755+
* local steps. `clearsOrExcepts` records whether any node on the path from `p` to
756+
* `n` either clears or expects contents.
757+
*/
758+
private predicate paramReachesLocal(ParamNode p, Node n, boolean clearsOrExcepts) {
759+
viableParam(_, _, _, p) and
760+
n = p and
761+
clearsOrExcepts = false
762+
or
763+
exists(Node mid, boolean clearsOrExceptsMid |
764+
paramReachesLocal(p, mid, clearsOrExceptsMid) and
765+
summaryLocalStep(mid, n, true) and
766+
if
767+
summaryClearsContent(n, _) or
768+
summaryExpectsContent(n, _)
769+
then clearsOrExcepts = true
770+
else clearsOrExcepts = clearsOrExceptsMid
771+
)
772+
}
773+
753774
/**
754775
* Holds if use-use flow starting from `arg` should be prohibited.
755776
*
@@ -759,15 +780,11 @@ module Private {
759780
*/
760781
pragma[nomagic]
761782
predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
762-
exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
783+
exists(ParamNode p, ParameterPosition ppos, Node ret |
784+
paramReachesLocal(p, ret, true) and
763785
p = summaryArgParam0(_, arg, sc) and
764786
p.isParameterOf(_, pragma[only_bind_into](ppos)) and
765-
summaryLocalStep(p, mid, true) and
766-
summaryLocalStep(mid, ret, true) and
767787
isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
768-
|
769-
summaryClearsContent(mid, _) or
770-
summaryExpectsContent(mid, _)
771788
)
772789
}
773790

‎ruby/ql/test/library-tests/dataflow/array-flow/array-flow.expected‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -564,8 +564,6 @@ edges
564564
| array_flow.rb:334:10:334:10 | a [element] : | array_flow.rb:334:10:334:13 | ...[...] |
565565
| array_flow.rb:338:16:338:25 | call to source : | array_flow.rb:339:9:339:9 | a [element 2] : |
566566
| array_flow.rb:338:16:338:25 | call to source : | array_flow.rb:339:9:339:9 | a [element 2] : |
567-
| array_flow.rb:338:16:338:25 | call to source : | array_flow.rb:345:10:345:10 | a [element 2] : |
568-
| array_flow.rb:338:16:338:25 | call to source : | array_flow.rb:345:10:345:10 | a [element 2] : |
569567
| array_flow.rb:339:9:339:9 | [post] a [element] : | array_flow.rb:343:10:343:10 | a [element] : |
570568
| array_flow.rb:339:9:339:9 | [post] a [element] : | array_flow.rb:343:10:343:10 | a [element] : |
571569
| array_flow.rb:339:9:339:9 | [post] a [element] : | array_flow.rb:344:10:344:10 | a [element] : |
@@ -588,8 +586,6 @@ edges
588586
| array_flow.rb:343:10:343:10 | a [element] : | array_flow.rb:343:10:343:13 | ...[...] |
589587
| array_flow.rb:344:10:344:10 | a [element] : | array_flow.rb:344:10:344:13 | ...[...] |
590588
| array_flow.rb:344:10:344:10 | a [element] : | array_flow.rb:344:10:344:13 | ...[...] |
591-
| array_flow.rb:345:10:345:10 | a [element 2] : | array_flow.rb:345:10:345:13 | ...[...] |
592-
| array_flow.rb:345:10:345:10 | a [element 2] : | array_flow.rb:345:10:345:13 | ...[...] |
593589
| array_flow.rb:345:10:345:10 | a [element] : | array_flow.rb:345:10:345:13 | ...[...] |
594590
| array_flow.rb:345:10:345:10 | a [element] : | array_flow.rb:345:10:345:13 | ...[...] |
595591
| array_flow.rb:349:16:349:25 | call to source : | array_flow.rb:350:9:350:9 | a [element 2] : |
@@ -4098,8 +4094,6 @@ nodes
40984094
| array_flow.rb:344:10:344:10 | a [element] : | semmle.label | a [element] : |
40994095
| array_flow.rb:344:10:344:13 | ...[...] | semmle.label | ...[...] |
41004096
| array_flow.rb:344:10:344:13 | ...[...] | semmle.label | ...[...] |
4101-
| array_flow.rb:345:10:345:10 | a [element 2] : | semmle.label | a [element 2] : |
4102-
| array_flow.rb:345:10:345:10 | a [element 2] : | semmle.label | a [element 2] : |
41034097
| array_flow.rb:345:10:345:10 | a [element] : | semmle.label | a [element] : |
41044098
| array_flow.rb:345:10:345:10 | a [element] : | semmle.label | a [element] : |
41054099
| array_flow.rb:345:10:345:13 | ...[...] | semmle.label | ...[...] |

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash-flow.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@ edges
102102
| hash_flow.rb:185:9:185:12 | hash [element :a] : | hash_flow.rb:185:9:185:23 | call to delete : |
103103
| hash_flow.rb:185:9:185:23 | call to delete : | hash_flow.rb:186:10:186:10 | a |
104104
| hash_flow.rb:194:15:194:25 | call to taint : | hash_flow.rb:197:9:197:12 | hash [element :a] : |
105-
| hash_flow.rb:194:15:194:25 | call to taint : | hash_flow.rb:202:10:202:13 | hash [element :a] : |
106105
| hash_flow.rb:197:9:197:12 | [post] hash [element :a] : | hash_flow.rb:202:10:202:13 | hash [element :a] : |
107106
| hash_flow.rb:197:9:197:12 | hash [element :a] : | hash_flow.rb:197:9:197:12 | [post] hash [element :a] : |
108107
| hash_flow.rb:197:9:197:12 | hash [element :a] : | hash_flow.rb:197:9:200:7 | call to delete_if [element :a] : |
@@ -307,7 +306,6 @@ edges
307306
| hash_flow.rb:477:29:477:33 | value : | hash_flow.rb:479:14:479:18 | value |
308307
| hash_flow.rb:482:10:482:10 | b [element :a] : | hash_flow.rb:482:10:482:14 | ...[...] |
309308
| hash_flow.rb:489:15:489:25 | call to taint : | hash_flow.rb:492:9:492:12 | hash [element :a] : |
310-
| hash_flow.rb:489:15:489:25 | call to taint : | hash_flow.rb:498:10:498:13 | hash [element :a] : |
311309
| hash_flow.rb:492:9:492:12 | [post] hash [element :a] : | hash_flow.rb:498:10:498:13 | hash [element :a] : |
312310
| hash_flow.rb:492:9:492:12 | hash [element :a] : | hash_flow.rb:492:9:492:12 | [post] hash [element :a] : |
313311
| hash_flow.rb:492:9:492:12 | hash [element :a] : | hash_flow.rb:492:9:496:7 | call to reject! [element :a] : |

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
failures
2-
| summaries.rb:106:6:106:9 | ...[...] | Unexpected result: hasValueFlow=elem1 |
3-
| summaries.rb:107:6:107:9 | ...[...] | Unexpected result: hasValueFlow=elem2 |
42
edges
53
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
64
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
@@ -99,14 +97,10 @@ edges
9997
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:87:5:87:5 | a [element 1] : |
10098
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:91:5:91:5 | a [element 1] : |
10199
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:91:5:91:5 | a [element 1] : |
102-
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:103:1:103:1 | d [element 1] : |
103-
| summaries.rb:79:15:79:29 | call to source : | summaries.rb:103:1:103:1 | d [element 1] : |
104100
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:86:6:86:6 | a [element 2] : |
105101
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:86:6:86:6 | a [element 2] : |
106102
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:95:1:95:1 | a [element 2] : |
107103
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:95:1:95:1 | a [element 2] : |
108-
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:103:1:103:1 | d [element 2] : |
109-
| summaries.rb:79:32:79:46 | call to source : | summaries.rb:103:1:103:1 | d [element 2] : |
110104
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:82:6:82:6 | a [element] : |
111105
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:82:6:82:6 | a [element] : |
112106
| summaries.rb:81:1:81:1 | [post] a [element] : | summaries.rb:84:6:84:6 | a [element] : |
@@ -191,28 +185,14 @@ edges
191185
| summaries.rb:99:1:99:1 | a [element 2] : | summaries.rb:99:1:99:1 | [post] a [element 2] : |
192186
| summaries.rb:102:6:102:6 | a [element 2] : | summaries.rb:102:6:102:9 | ...[...] |
193187
| summaries.rb:102:6:102:6 | a [element 2] : | summaries.rb:102:6:102:9 | ...[...] |
194-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | summaries.rb:106:6:106:6 | d [element 1] : |
195-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | summaries.rb:106:6:106:6 | d [element 1] : |
196-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | summaries.rb:107:6:107:6 | d [element 2] : |
197-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | summaries.rb:107:6:107:6 | d [element 2] : |
198188
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:104:1:104:1 | d [element 3] : |
199189
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:104:1:104:1 | d [element 3] : |
200-
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
201-
| summaries.rb:103:1:103:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
202-
| summaries.rb:103:1:103:1 | d [element 1] : | summaries.rb:103:1:103:1 | [post] d [element 1] : |
203-
| summaries.rb:103:1:103:1 | d [element 1] : | summaries.rb:103:1:103:1 | [post] d [element 1] : |
204-
| summaries.rb:103:1:103:1 | d [element 2] : | summaries.rb:103:1:103:1 | [post] d [element 2] : |
205-
| summaries.rb:103:1:103:1 | d [element 2] : | summaries.rb:103:1:103:1 | [post] d [element 2] : |
206190
| summaries.rb:103:8:103:22 | call to source : | summaries.rb:103:1:103:1 | [post] d [element 3] : |
207191
| summaries.rb:103:8:103:22 | call to source : | summaries.rb:103:1:103:1 | [post] d [element 3] : |
208192
| summaries.rb:104:1:104:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
209193
| summaries.rb:104:1:104:1 | [post] d [element 3] : | summaries.rb:108:6:108:6 | d [element 3] : |
210194
| summaries.rb:104:1:104:1 | d [element 3] : | summaries.rb:104:1:104:1 | [post] d [element 3] : |
211195
| summaries.rb:104:1:104:1 | d [element 3] : | summaries.rb:104:1:104:1 | [post] d [element 3] : |
212-
| summaries.rb:106:6:106:6 | d [element 1] : | summaries.rb:106:6:106:9 | ...[...] |
213-
| summaries.rb:106:6:106:6 | d [element 1] : | summaries.rb:106:6:106:9 | ...[...] |
214-
| summaries.rb:107:6:107:6 | d [element 2] : | summaries.rb:107:6:107:9 | ...[...] |
215-
| summaries.rb:107:6:107:6 | d [element 2] : | summaries.rb:107:6:107:9 | ...[...] |
216196
| summaries.rb:108:6:108:6 | d [element 3] : | summaries.rb:108:6:108:9 | ...[...] |
217197
| summaries.rb:108:6:108:6 | d [element 3] : | summaries.rb:108:6:108:9 | ...[...] |
218198
| summaries.rb:111:1:111:1 | [post] x [@value] : | summaries.rb:112:6:112:6 | x [@value] : |
@@ -407,30 +387,14 @@ nodes
407387
| summaries.rb:102:6:102:6 | a [element 2] : | semmle.label | a [element 2] : |
408388
| summaries.rb:102:6:102:9 | ...[...] | semmle.label | ...[...] |
409389
| summaries.rb:102:6:102:9 | ...[...] | semmle.label | ...[...] |
410-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | semmle.label | [post] d [element 1] : |
411-
| summaries.rb:103:1:103:1 | [post] d [element 1] : | semmle.label | [post] d [element 1] : |
412-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | semmle.label | [post] d [element 2] : |
413-
| summaries.rb:103:1:103:1 | [post] d [element 2] : | semmle.label | [post] d [element 2] : |
414390
| summaries.rb:103:1:103:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
415391
| summaries.rb:103:1:103:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
416-
| summaries.rb:103:1:103:1 | d [element 1] : | semmle.label | d [element 1] : |
417-
| summaries.rb:103:1:103:1 | d [element 1] : | semmle.label | d [element 1] : |
418-
| summaries.rb:103:1:103:1 | d [element 2] : | semmle.label | d [element 2] : |
419-
| summaries.rb:103:1:103:1 | d [element 2] : | semmle.label | d [element 2] : |
420392
| summaries.rb:103:8:103:22 | call to source : | semmle.label | call to source : |
421393
| summaries.rb:103:8:103:22 | call to source : | semmle.label | call to source : |
422394
| summaries.rb:104:1:104:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
423395
| summaries.rb:104:1:104:1 | [post] d [element 3] : | semmle.label | [post] d [element 3] : |
424396
| summaries.rb:104:1:104:1 | d [element 3] : | semmle.label | d [element 3] : |
425397
| summaries.rb:104:1:104:1 | d [element 3] : | semmle.label | d [element 3] : |
426-
| summaries.rb:106:6:106:6 | d [element 1] : | semmle.label | d [element 1] : |
427-
| summaries.rb:106:6:106:6 | d [element 1] : | semmle.label | d [element 1] : |
428-
| summaries.rb:106:6:106:9 | ...[...] | semmle.label | ...[...] |
429-
| summaries.rb:106:6:106:9 | ...[...] | semmle.label | ...[...] |
430-
| summaries.rb:107:6:107:6 | d [element 2] : | semmle.label | d [element 2] : |
431-
| summaries.rb:107:6:107:6 | d [element 2] : | semmle.label | d [element 2] : |
432-
| summaries.rb:107:6:107:9 | ...[...] | semmle.label | ...[...] |
433-
| summaries.rb:107:6:107:9 | ...[...] | semmle.label | ...[...] |
434398
| summaries.rb:108:6:108:6 | d [element 3] : | semmle.label | d [element 3] : |
435399
| summaries.rb:108:6:108:6 | d [element 3] : | semmle.label | d [element 3] : |
436400
| summaries.rb:108:6:108:9 | ...[...] | semmle.label | ...[...] |
@@ -544,10 +508,6 @@ invalidSpecComponent
544508
| summaries.rb:98:6:98:9 | ...[...] | summaries.rb:81:13:81:27 | call to source : | summaries.rb:98:6:98:9 | ...[...] | $@ | summaries.rb:81:13:81:27 | call to source : | call to source : |
545509
| summaries.rb:102:6:102:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:102:6:102:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
546510
| summaries.rb:102:6:102:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:102:6:102:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
547-
| summaries.rb:106:6:106:9 | ...[...] | summaries.rb:79:15:79:29 | call to source : | summaries.rb:106:6:106:9 | ...[...] | $@ | summaries.rb:79:15:79:29 | call to source : | call to source : |
548-
| summaries.rb:106:6:106:9 | ...[...] | summaries.rb:79:15:79:29 | call to source : | summaries.rb:106:6:106:9 | ...[...] | $@ | summaries.rb:79:15:79:29 | call to source : | call to source : |
549-
| summaries.rb:107:6:107:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:107:6:107:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
550-
| summaries.rb:107:6:107:9 | ...[...] | summaries.rb:79:32:79:46 | call to source : | summaries.rb:107:6:107:9 | ...[...] | $@ | summaries.rb:79:32:79:46 | call to source : | call to source : |
551511
| summaries.rb:108:6:108:9 | ...[...] | summaries.rb:103:8:103:22 | call to source : | summaries.rb:108:6:108:9 | ...[...] | $@ | summaries.rb:103:8:103:22 | call to source : | call to source : |
552512
| summaries.rb:108:6:108:9 | ...[...] | summaries.rb:103:8:103:22 | call to source : | summaries.rb:108:6:108:9 | ...[...] | $@ | summaries.rb:103:8:103:22 | call to source : | call to source : |
553513
| summaries.rb:112:6:112:16 | call to get_value | summaries.rb:111:13:111:26 | call to source : | summaries.rb:112:6:112:16 | call to get_value | $@ | summaries.rb:111:13:111:26 | call to source : | call to source : |

0 commit comments

Comments
 (0)