Skip to content

Commit 303b11e

Browse files
hvitvedhvitved
authored
Merge pull request #18298 from hvitved/rust/mad-source-sink
Rust: Add support for MaD sources and sinks with access paths
2 parents a35dc7e + 653d122 commit 303b11e

22 files changed

Lines changed: 948 additions & 58 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,14 @@ private import semmle.code.cpp.dataflow.ExternalFlow
1212
private import semmle.code.cpp.ir.IR
1313

1414
module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
15+
private import codeql.util.Void
16+
1517
class SummarizedCallableBase = Function;
1618

19+
class SourceBase = Void;
20+
21+
class SinkBase = Void;
22+
1723
ArgumentPosition callbackSelfParameterPosition() { result = TDirectPosition(-1) }
1824

1925
ReturnKind getStandardReturnValueKind() { result.(NormalReturnKind).getIndirectionIndex() = 0 }
@@ -93,6 +99,10 @@ private module StepsInput implements Impl::Private::StepsInputSig {
9399
DataFlowCall getACall(Public::SummarizedCallable sc) {
94100
result.getStaticCallTarget().getUnderlyingCallable() = sc
95101
}
102+
103+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
104+
105+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
96106
}
97107

98108
module SourceSinkInterpretationInput implements

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,14 @@ private import semmle.code.csharp.Unification
1414
private import semmle.code.csharp.dataflow.internal.ExternalFlow
1515

1616
module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow> {
17+
private import codeql.util.Void
18+
1719
class SummarizedCallableBase = UnboundCallable;
1820

21+
class SourceBase = Void;
22+
23+
class SinkBase = Void;
24+
1925
predicate neutralElement(SummarizedCallableBase c, string kind, string provenance, boolean isExact) {
2026
interpretNeutral(c, kind, provenance) and
2127
// isExact is not needed for C#.
@@ -176,12 +182,22 @@ private module TypesInput implements Impl::Private::TypesInputSig {
176182
result.asGvnType() = Gvn::getGlobalValueNumber(dt.getDelegateType().getReturnType())
177183
)
178184
}
185+
186+
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
187+
none()
188+
}
189+
190+
DataFlowType getSinkType(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
179191
}
180192

181193
private module StepsInput implements Impl::Private::StepsInputSig {
182194
DataFlowCall getACall(Public::SummarizedCallable sc) {
183195
sc = viableCallable(result).asSummarizedCallable()
184196
}
197+
198+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
199+
200+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
185201
}
186202

187203
module SourceSinkInterpretationInput implements

‎go/ql/lib/semmle/go/dataflow/ExternalFlow.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ import internal.ExternalFlowExtensions as FlowExtensions
9090
private import FlowSummary as FlowSummary
9191
private import internal.DataFlowPrivate
9292
private import internal.FlowSummaryImpl
93-
private import internal.FlowSummaryImpl::Public
93+
private import internal.FlowSummaryImpl::Public as Public
9494
private import internal.FlowSummaryImpl::Private
9595
private import internal.FlowSummaryImpl::Private::External
9696
private import codeql.mad.ModelValidation as SharedModelVal
@@ -583,13 +583,13 @@ predicate sourceNode(DataFlow::Node node, string kind) { sourceNode(node, kind,
583583
predicate sinkNode(DataFlow::Node node, string kind) { sinkNode(node, kind, _) }
584584

585585
// adapter class for converting Mad summaries to `SummarizedCallable`s
586-
private class SummarizedCallableAdapter extends SummarizedCallable {
586+
private class SummarizedCallableAdapter extends Public::SummarizedCallable {
587587
SummarizedCallableAdapter() { summaryElement(this, _, _, _, _, _) }
588588

589589
private predicate relevantSummaryElementManual(
590590
string input, string output, string kind, string model
591591
) {
592-
exists(Provenance provenance |
592+
exists(Public::Provenance provenance |
593593
summaryElement(this, input, output, kind, provenance, model) and
594594
provenance.isManual()
595595
)
@@ -598,11 +598,11 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
598598
private predicate relevantSummaryElementGenerated(
599599
string input, string output, string kind, string model
600600
) {
601-
exists(Provenance provenance |
601+
exists(Public::Provenance provenance |
602602
summaryElement(this, input, output, kind, provenance, model) and
603603
provenance.isGenerated()
604604
) and
605-
not exists(Provenance provenance |
605+
not exists(Public::Provenance provenance |
606606
neutralElement(this, "summary", provenance) and
607607
provenance.isManual()
608608
)
@@ -621,7 +621,7 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
621621
)
622622
}
623623

624-
override predicate hasProvenance(Provenance provenance) {
624+
override predicate hasProvenance(Public::Provenance provenance) {
625625
summaryElement(this, _, _, _, provenance, _)
626626
}
627627
}

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,14 @@ private string positionToString(int pos) {
2121
}
2222

2323
module Input implements InputSig<Location, DataFlowImplSpecific::GoDataFlow> {
24+
private import codeql.util.Void
25+
2426
class SummarizedCallableBase = Callable;
2527

28+
class SourceBase = Void;
29+
30+
class SinkBase = Void;
31+
2632
predicate neutralElement(
2733
Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
2834
) {
@@ -108,6 +114,10 @@ private module StepsInput implements Impl::Private::StepsInputSig {
108114
call.getACalleeIncludingExternals() = sc
109115
)
110116
}
117+
118+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
119+
120+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
111121
}
112122

113123
module SourceSinkInterpretationInput implements

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,14 @@ private string positionToString(int pos) {
2727
}
2828

2929
module Input implements InputSig<Location, DataFlowImplSpecific::JavaDataFlow> {
30+
private import codeql.util.Void
31+
3032
class SummarizedCallableBase = FlowSummary::SummarizedCallableBase;
3133

34+
class SourceBase = Void;
35+
36+
class SinkBase = Void;
37+
3238
predicate neutralElement(
3339
Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
3440
) {
@@ -123,12 +129,22 @@ private module TypesInput implements Impl::Private::TypesInputSig {
123129
result = getErasedRepr(t.(FunctionalInterface).getRunMethod().getReturnType()) and
124130
exists(rk)
125131
}
132+
133+
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
134+
none()
135+
}
136+
137+
DataFlowType getSinkType(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
126138
}
127139

128140
private module StepsInput implements Impl::Private::StepsInputSig {
129141
DataFlowCall getACall(Public::SummarizedCallable sc) {
130142
sc = viableCallable(result).asSummarizedCallable()
131143
}
144+
145+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
146+
147+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
132148
}
133149

134150
private predicate relatedArgSpec(Callable c, string spec) {

‎python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,14 @@ private import DataFlowImplSpecific::Private
1010
private import DataFlowImplSpecific::Public
1111

1212
module Input implements InputSig<Location, DataFlowImplSpecific::PythonDataFlow> {
13+
private import codeql.util.Void
14+
1315
class SummarizedCallableBase = string;
1416

17+
class SourceBase = Void;
18+
19+
class SinkBase = Void;
20+
1521
ArgumentPosition callbackSelfParameterPosition() { result.isLambdaSelf() }
1622

1723
ReturnKind getStandardReturnValueKind() { any() }
@@ -98,6 +104,10 @@ private module StepsInput implements Impl::Private::StepsInputSig {
98104
sc.(LibraryCallable).getACallSimple().asCfgNode()
99105
])
100106
}
107+
108+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
109+
110+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
101111
}
102112

103113
module Private {

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,14 @@ private import DataFlowImplSpecific::Private
1010
private import DataFlowImplSpecific::Public
1111

1212
module Input implements InputSig<Location, DataFlowImplSpecific::RubyDataFlow> {
13+
private import codeql.util.Void
14+
1315
class SummarizedCallableBase = string;
1416

17+
class SourceBase = Void;
18+
19+
class SinkBase = Void;
20+
1521
ArgumentPosition callbackSelfParameterPosition() { result.isLambdaSelf() }
1622

1723
ReturnKind getStandardReturnValueKind() { result instanceof NormalReturnKind }
@@ -154,6 +160,10 @@ private module StepsInput implements Impl::Private::StepsInputSig {
154160
or
155161
result.asCall().getAstNode() = sc.(LibraryCallable).getACallSimple()
156162
}
163+
164+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
165+
166+
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
157167
}
158168

159169
module Private {

‎rust/ql/lib/codeql/rust/dataflow/FlowSink.qll‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/** Provides classes and predicates for defining flow sinks. */
2+
3+
private import rust
4+
private import internal.FlowSummaryImpl as Impl
5+
private import internal.DataFlowImpl as DataFlowImpl
6+
7+
// import all instances below
8+
private module Sinks {
9+
private import codeql.rust.Frameworks
10+
private import codeql.rust.dataflow.internal.ModelsAsData
11+
}
12+
13+
/** Provides the `Range` class used to define the extent of `FlowSink`. */
14+
module FlowSink {
15+
/** A flow source. */
16+
abstract class Range extends Impl::Public::SinkElement {
17+
bindingset[this]
18+
Range() { any() }
19+
20+
override predicate isSink(
21+
string input, string kind, Impl::Public::Provenance provenance, string model
22+
) {
23+
this.isSink(input, kind) and provenance = "manual" and model = ""
24+
}
25+
26+
/**
27+
* Holds is this element is a flow sink of kind `kind`, where data
28+
* flows in as described by `input`.
29+
*/
30+
predicate isSink(string output, string kind) { none() }
31+
}
32+
}
33+
34+
final class FlowSink = FlowSink::Range;
35+
36+
predicate sinkNode = DataFlowImpl::sinkNode/2;

‎rust/ql/lib/codeql/rust/dataflow/FlowSource.qll‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/** Provides classes and predicates for defining flow sources. */
2+
3+
private import rust
4+
private import internal.FlowSummaryImpl as Impl
5+
private import internal.DataFlowImpl as DataFlowImpl
6+
7+
// import all instances below
8+
private module Sources {
9+
private import codeql.rust.Frameworks
10+
private import codeql.rust.dataflow.internal.ModelsAsData
11+
}
12+
13+
/** Provides the `Range` class used to define the extent of `FlowSource`. */
14+
module FlowSource {
15+
/** A flow source. */
16+
abstract class Range extends Impl::Public::SourceElement {
17+
bindingset[this]
18+
Range() { any() }
19+
20+
override predicate isSource(
21+
string output, string kind, Impl::Public::Provenance provenance, string model
22+
) {
23+
this.isSource(output, kind) and provenance = "manual" and model = ""
24+
}
25+
26+
/**
27+
* Holds is this element is a flow source of kind `kind`, where data
28+
* flows out as described by `output`.
29+
*/
30+
predicate isSource(string output, string kind) { none() }
31+
}
32+
}
33+
34+
final class FlowSource = FlowSource::Range;
35+
36+
predicate sourceNode = DataFlowImpl::sourceNode/2;

‎rust/ql/lib/codeql/rust/dataflow/FlowSummary.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,5 @@ module SummarizedCallable {
5757
}
5858

5959
final class SummarizedCallable = SummarizedCallable::Range;
60+
61+
final class Provenance = Impl::Public::Provenance;

0 commit comments

Comments
 (0)