Skip to content

Commit 5408824

Browse files
hvitvedTom Hvitved
hvitved
authored and
Tom Hvitved
committed
C#: Use source declarations in field flow
1 parent a344707 commit 5408824

3 files changed

Lines changed: 42 additions & 6 deletions

File tree

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ private class Argument extends Expr {
298298
private predicate instanceFieldLikeAssign(Expr e, FieldLike f, Expr src, Expr q) {
299299
exists(FieldLikeAccess fa, AssignableDefinition def |
300300
def.getTargetAccess() = fa and
301-
f = fa.getTarget() and
301+
f = fa.getTarget().getSourceDeclaration() and
302302
not f.isStatic() and
303303
src = def.getSource() and
304304
q = fa.getQualifier() and
@@ -313,7 +313,7 @@ private predicate instanceFieldLikeAssign(Expr e, FieldLike f, Expr src, Expr q)
313313
private predicate instanceFieldLikeInit(ObjectCreation oc, FieldLike f, Expr src) {
314314
exists(MemberInitializer mi |
315315
mi = oc.getInitializer().(ObjectInitializer).getAMemberInitializer() and
316-
f = mi.getInitializedMember() and
316+
f = mi.getInitializedMember().getSourceDeclaration() and
317317
not f.isStatic() and
318318
src = mi.getRValue()
319319
)
@@ -421,7 +421,8 @@ private module Cached {
421421
}
422422

423423
cached
424-
newtype TContent = TFieldLikeContent(FieldLike f) { not f.isStatic() }
424+
newtype TContent =
425+
TFieldLikeContent(FieldLike f) { not f.isStatic() and f.getSourceDeclaration() = f }
425426

426427
/**
427428
* Holds if data can flow from `node1` to `node2` via an assignment to
@@ -449,7 +450,11 @@ private module Cached {
449450
predicate readStepImpl(Node node1, Content c, Node node2) {
450451
exists(ReadStepConfiguration x |
451452
x.hasNodePath(node1, node2) and
452-
c.(FieldLikeContent).getField() = node2.asExpr().(FieldLikeRead).getTarget()
453+
c.(FieldLikeContent).getField() = node2
454+
.asExpr()
455+
.(FieldLikeRead)
456+
.getTarget()
457+
.getSourceDeclaration()
453458
)
454459
}
455460

‎csharp/ql/test/library-tests/dataflow/types/Types.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ class E1 : E<C>
9797
{
9898
void M3()
9999
{
100-
this.M2(new E1()); // no flow
100+
this.M2(new E1()); // no flow (FALSE POSITIVE)
101101
}
102102

103103
public override void M() { }
@@ -107,7 +107,7 @@ class E2 : E<D>
107107
{
108108
void M3()
109109
{
110-
this.M2(new E2()); // flow (FALSE NEGATIVE)
110+
this.M2(new E2()); // flow
111111
}
112112

113113
public override void M()

‎csharp/ql/test/library-tests/dataflow/types/Types.expected‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,20 @@ edges
4545
| Types.cs:74:9:74:9 | access to local variable d : D | Types.cs:16:30:16:30 | this : D |
4646
| Types.cs:77:22:77:22 | a : C | Types.cs:80:18:80:18 | access to local variable b |
4747
| Types.cs:77:22:77:22 | a : D | Types.cs:80:18:80:18 | access to local variable b |
48+
| Types.cs:90:22:90:22 | e : E1 | Types.cs:92:26:92:26 | access to parameter e : E1 |
49+
| Types.cs:90:22:90:22 | e : E2 | Types.cs:92:26:92:26 | access to parameter e : E2 |
50+
| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | Types.cs:93:13:93:16 | this access [Field] : E1 |
51+
| Types.cs:92:13:92:16 | [post] this access [Field] : E2 | Types.cs:93:13:93:16 | this access [Field] : E2 |
52+
| Types.cs:92:26:92:26 | access to parameter e : E1 | Types.cs:92:13:92:16 | [post] this access [Field] : E1 |
53+
| Types.cs:92:26:92:26 | access to parameter e : E2 | Types.cs:92:13:92:16 | [post] this access [Field] : E2 |
54+
| Types.cs:93:13:93:16 | this access [Field] : E1 | Types.cs:113:34:113:34 | this [Field] : E1 |
55+
| Types.cs:93:13:93:16 | this access [Field] : E2 | Types.cs:113:34:113:34 | this [Field] : E2 |
56+
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:90:22:90:22 | e : E1 |
57+
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:90:22:90:22 | e : E2 |
58+
| Types.cs:113:34:113:34 | this [Field] : E1 | Types.cs:115:22:115:25 | this access [Field] : E1 |
59+
| Types.cs:113:34:113:34 | this [Field] : E2 | Types.cs:115:22:115:25 | this access [Field] : E2 |
60+
| Types.cs:115:22:115:25 | this access [Field] : E1 | Types.cs:115:22:115:31 | access to field Field |
61+
| Types.cs:115:22:115:25 | this access [Field] : E2 | Types.cs:115:22:115:31 | access to field Field |
4862
nodes
4963
| Types.cs:7:21:7:25 | this : C | semmle.label | this : C |
5064
| Types.cs:7:21:7:25 | this : D | semmle.label | this : D |
@@ -101,6 +115,21 @@ nodes
101115
| Types.cs:77:22:77:22 | a : C | semmle.label | a : C |
102116
| Types.cs:77:22:77:22 | a : D | semmle.label | a : D |
103117
| Types.cs:80:18:80:18 | access to local variable b | semmle.label | access to local variable b |
118+
| Types.cs:90:22:90:22 | e : E1 | semmle.label | e : E1 |
119+
| Types.cs:90:22:90:22 | e : E2 | semmle.label | e : E2 |
120+
| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | semmle.label | [post] this access [Field] : E1 |
121+
| Types.cs:92:13:92:16 | [post] this access [Field] : E2 | semmle.label | [post] this access [Field] : E2 |
122+
| Types.cs:92:26:92:26 | access to parameter e : E1 | semmle.label | access to parameter e : E1 |
123+
| Types.cs:92:26:92:26 | access to parameter e : E2 | semmle.label | access to parameter e : E2 |
124+
| Types.cs:93:13:93:16 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
125+
| Types.cs:93:13:93:16 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
126+
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | semmle.label | object creation of type E1 : E1 |
127+
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | semmle.label | object creation of type E2 : E2 |
128+
| Types.cs:113:34:113:34 | this [Field] : E1 | semmle.label | this [Field] : E1 |
129+
| Types.cs:113:34:113:34 | this [Field] : E2 | semmle.label | this [Field] : E2 |
130+
| Types.cs:115:22:115:25 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
131+
| Types.cs:115:22:115:25 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
132+
| Types.cs:115:22:115:31 | access to field Field | semmle.label | access to field Field |
104133
#select
105134
| Types.cs:22:9:22:15 | object creation of type C : C | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
106135
| Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:50:18:50:18 | access to local variable c | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
@@ -122,3 +151,5 @@ nodes
122151
| Types.cs:40:12:40:18 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
123152
| Types.cs:41:12:41:18 | object creation of type D : D | Types.cs:80:18:80:18 | access to local variable b | Types.cs:80:18:80:18 | access to local variable b | $@ | Types.cs:80:18:80:18 | access to local variable b | access to local variable b |
124153
| Types.cs:43:20:43:23 | null : null | Types.cs:44:14:44:14 | access to local variable o | Types.cs:44:14:44:14 | access to local variable o | $@ | Types.cs:44:14:44:14 | access to local variable o | access to local variable o |
154+
| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |
155+
| Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |

0 commit comments

Comments
 (0)