C++: use in/out barriers with flow state

asgerf · asgerf · commit 53dbfcb3aa6d · 2023-09-28T11:08:30.000+02:00
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
@@ -134,8 +134,8 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {
 
   predicate isBarrier(DataFlow::Node node) { isBarrierImpl(node) }
 
-  predicate isBarrierOut(DataFlow::Node node) {
-    isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
+  predicate isBarrierOut(DataFlow::Node node, FlowState state) {
+    isSink(node, state) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
   }
 }
 
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql b/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
@@ -168,9 +168,9 @@ module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {
     )
   }
 
-  predicate isBarrierIn(DataFlow::Node node) { isSource(node, _) }
+  predicate isBarrierIn(DataFlow::Node node, FlowState state) { isSource(node, state) }
 
-  predicate isBarrierOut(DataFlow::Node node) { isSink(node, _) }
+  predicate isBarrierOut(DataFlow::Node node, FlowState state) { isSink(node, state) }
 
   predicate isAdditionalFlowStep(
     DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2

Original file line number	Diff line number	Diff line change
`@@ -134,8 +134,8 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {`
`134`	`134`
`135`	`135`	`predicate isBarrier(DataFlow::Node node) { isBarrierImpl(node) }`
`136`	`136`
`137`		`- predicate isBarrierOut(DataFlow::Node node) {`
`138`		- isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
	`137`	`+ predicate isBarrierOut(DataFlow::Node node, FlowState state) {`
	`138`	+ isSink(node, state) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
`139`	`139`	`}`
`140`	`140`	`}`
`141`	`141`
Original file line number	Diff line number	Diff line change
`@@ -168,9 +168,9 @@ module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {`
`168`	`168`	`)`
`169`	`169`	`}`
`170`	`170`
`171`		`- predicate isBarrierIn(DataFlow::Node node) { isSource(node, _) }`
	`171`	`+ predicate isBarrierIn(DataFlow::Node node, FlowState state) { isSource(node, state) }`
`172`	`172`
`173`		`- predicate isBarrierOut(DataFlow::Node node) { isSink(node, _) }`
	`173`	`+ predicate isBarrierOut(DataFlow::Node node, FlowState state) { isSink(node, state) }`
`174`	`174`
`175`	`175`	`predicate isAdditionalFlowStep(`
`176`	`176`	`DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2`