@@ -16,21 +16,23 @@ private class StdBasicString extends ClassTemplateInstantiation {
1616}
1717
1818/**
19- * Additional model for `std::string` constructors that reference the character
20- * type of the container, or an iterator. For example construction from
21- * iterators:
22- * ```
23- * std::string b(a.begin(), a.end());
24- * ```
19+ * The `std::basic_string::iterator` declaration.
2520 */
26- private class StdStringConstructor extends Constructor , TaintFunction {
27- StdStringConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicString }
21+ private class StdBasicStringIterator extends Iterator , Type {
22+ StdBasicStringIterator ( ) {
23+ this .getEnclosingElement ( ) instanceof StdBasicString and this .hasName ( "iterator" )
24+ }
25+ }
2826
27+ /**
28+ * A `std::string` function for which taint should be propagated.
29+ */
30+ abstract private class StdStringTaintFunction extends TaintFunction {
2931 /**
3032 * Gets the index of a parameter to this function that is a string (or
3133 * character).
3234 */
33- int getAStringParameterIndex ( ) {
35+ final int getAStringParameterIndex ( ) {
3436 exists ( Type paramType | paramType = this .getParameter ( result ) .getUnspecifiedType ( ) |
3537 // e.g. `std::basic_string::CharT *`
3638 paramType instanceof PointerType
@@ -41,15 +43,28 @@ private class StdStringConstructor extends Constructor, TaintFunction {
4143 this .getDeclaringType ( ) .getTemplateArgument ( 2 ) .( Type ) .getUnspecifiedType ( )
4244 or
4345 // i.e. `std::basic_string::CharT`
44- this .getParameter ( result ) .getUnspecifiedType ( ) =
45- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( )
46+ paramType = this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( )
4647 )
4748 }
4849
4950 /**
5051 * Gets the index of a parameter to this function that is an iterator.
5152 */
52- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
53+ final int getAnIteratorParameterIndex ( ) {
54+ this .getParameter ( result ) .getType ( ) instanceof Iterator
55+ }
56+ }
57+
58+ /**
59+ * Additional model for `std::string` constructors that reference the character
60+ * type of the container, or an iterator. For example construction from
61+ * iterators:
62+ * ```
63+ * std::string b(a.begin(), a.end());
64+ * ```
65+ */
66+ private class StdStringConstructor extends Constructor , StdStringTaintFunction {
67+ StdStringConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicString }
5368
5469 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
5570 // taint flow from any parameter of the value type to the returned object
@@ -68,7 +83,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
6883/**
6984 * The `std::string` function `c_str`.
7085 */
71- private class StdStringCStr extends TaintFunction {
86+ private class StdStringCStr extends StdStringTaintFunction {
7287 StdStringCStr ( ) { this .getClassAndName ( "c_str" ) instanceof StdBasicString }
7388
7489 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -81,7 +96,7 @@ private class StdStringCStr extends TaintFunction {
8196/**
8297 * The `std::string` function `data`.
8398 */
84- private class StdStringData extends TaintFunction {
99+ private class StdStringData extends StdStringTaintFunction {
85100 StdStringData ( ) { this .getClassAndName ( "data" ) instanceof StdBasicString }
86101
87102 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -99,7 +114,7 @@ private class StdStringData extends TaintFunction {
99114/**
100115 * The `std::string` function `push_back`.
101116 */
102- private class StdStringPush extends TaintFunction {
117+ private class StdStringPush extends StdStringTaintFunction {
103118 StdStringPush ( ) { this .getClassAndName ( "push_back" ) instanceof StdBasicString }
104119
105120 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -112,7 +127,7 @@ private class StdStringPush extends TaintFunction {
112127/**
113128 * The `std::string` functions `front` and `back`.
114129 */
115- private class StdStringFrontBack extends TaintFunction {
130+ private class StdStringFrontBack extends StdStringTaintFunction {
116131 StdStringFrontBack ( ) { this .getClassAndName ( [ "front" , "back" ] ) instanceof StdBasicString }
117132
118133 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -125,7 +140,7 @@ private class StdStringFrontBack extends TaintFunction {
125140/**
126141 * The (non-member) `std::string` function `operator+`.
127142 */
128- private class StdStringPlus extends TaintFunction {
143+ private class StdStringPlus extends StdStringTaintFunction {
129144 StdStringPlus ( ) {
130145 this .hasQualifiedName ( [ "std" , "bsl" ] , "operator+" ) and
131146 this .getUnspecifiedType ( ) instanceof StdBasicString
@@ -142,31 +157,15 @@ private class StdStringPlus extends TaintFunction {
142157}
143158
144159/**
145- * The `std::string` functions `operator+=`, `append`, `insert` and
146- * `replace`. All of these functions combine the existing string
147- * with a new string (or character) from one of the arguments.
160+ * The `std::string` functions `operator+=`, `append` and `replace`.
161+ * All of these functions combine the existing string with a new
162+ * string (or character) from one of the arguments.
148163 */
149- private class StdStringAppend extends TaintFunction {
164+ private class StdStringAppend extends StdStringTaintFunction {
150165 StdStringAppend ( ) {
151- this .getClassAndName ( [ "operator+=" , "append" , "insert" , "replace" ] ) instanceof StdBasicString
152- }
153-
154- /**
155- * Gets the index of a parameter to this function that is a string (or
156- * character).
157- */
158- int getAStringParameterIndex ( ) {
159- this .getParameter ( result ) .getType ( ) instanceof PointerType or // e.g. `std::basic_string::CharT *`
160- this .getParameter ( result ) .getType ( ) instanceof ReferenceType or // e.g. `std::basic_string &`
161- this .getParameter ( result ) .getUnspecifiedType ( ) =
162- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( ) // i.e. `std::basic_string::CharT`
166+ this .getClassAndName ( [ "operator+=" , "append" , "replace" ] ) instanceof StdBasicString
163167 }
164168
165- /**
166- * Gets the index of a parameter to this function that is an iterator.
167- */
168- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
169-
170169 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
171170 // flow from string and parameter to string (qualifier) and return value
172171 (
@@ -187,26 +186,42 @@ private class StdStringAppend extends TaintFunction {
187186}
188187
189188/**
190- * The standard function `std::string.assign `.
189+ * The `std::string` function `insert `.
191190 */
192- private class StdStringAssign extends TaintFunction {
193- StdStringAssign ( ) { this .getClassAndName ( "assign " ) instanceof StdBasicString }
191+ private class StdStringInsert extends StdStringTaintFunction {
192+ StdStringInsert ( ) { this .getClassAndName ( "insert " ) instanceof StdBasicString }
194193
195194 /**
196- * Gets the index of a parameter to this function that is a string (or
197- * character).
195+ * Holds if the return type is an iterator.
198196 */
199- int getAStringParameterIndex ( ) {
200- this .getParameter ( result ) .getType ( ) instanceof PointerType or // e.g. `std::basic_string::CharT *`
201- this .getParameter ( result ) .getType ( ) instanceof ReferenceType or // e.g. `std::basic_string &`
202- this .getParameter ( result ) .getUnspecifiedType ( ) =
203- this .getDeclaringType ( ) .getTemplateArgument ( 0 ) .( Type ) .getUnspecifiedType ( ) // i.e. `std::basic_string::CharT`
197+ predicate hasIteratorReturnValue ( ) { this .getType ( ) instanceof Iterator }
198+
199+ override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
200+ // flow from string and parameter to string (qualifier) and return value
201+ (
202+ input .isQualifierObject ( ) or
203+ input .isParameterDeref ( this .getAStringParameterIndex ( ) ) or
204+ input .isParameter ( this .getAnIteratorParameterIndex ( ) )
205+ ) and
206+ (
207+ output .isQualifierObject ( )
208+ or
209+ if this .hasIteratorReturnValue ( ) then output .isReturnValue ( ) else output .isReturnValueDeref ( )
210+ )
211+ or
212+ // reverse flow from returned reference to the qualifier (for writes to
213+ // the result)
214+ not this .hasIteratorReturnValue ( ) and
215+ input .isReturnValueDeref ( ) and
216+ output .isQualifierObject ( )
204217 }
218+ }
205219
206- /**
207- * Gets the index of a parameter to this function that is an iterator.
208- */
209- int getAnIteratorParameterIndex ( ) { this .getParameter ( result ) .getType ( ) instanceof Iterator }
220+ /**
221+ * The standard function `std::string.assign`.
222+ */
223+ private class StdStringAssign extends StdStringTaintFunction {
224+ StdStringAssign ( ) { this .getClassAndName ( "assign" ) instanceof StdBasicString }
210225
211226 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
212227 // flow from parameter to string itself (qualifier) and return value
@@ -229,7 +244,7 @@ private class StdStringAssign extends TaintFunction {
229244/**
230245 * The standard function `std::string.copy`.
231246 */
232- private class StdStringCopy extends TaintFunction {
247+ private class StdStringCopy extends StdStringTaintFunction {
233248 StdStringCopy ( ) { this .getClassAndName ( "copy" ) instanceof StdBasicString }
234249
235250 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -242,7 +257,7 @@ private class StdStringCopy extends TaintFunction {
242257/**
243258 * The standard function `std::string.substr`.
244259 */
245- private class StdStringSubstr extends TaintFunction {
260+ private class StdStringSubstr extends StdStringTaintFunction {
246261 StdStringSubstr ( ) { this .getClassAndName ( "substr" ) instanceof StdBasicString }
247262
248263 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -255,7 +270,7 @@ private class StdStringSubstr extends TaintFunction {
255270/**
256271 * The `std::string` functions `at` and `operator[]`.
257272 */
258- private class StdStringAt extends TaintFunction {
273+ private class StdStringAt extends StdStringTaintFunction {
259274 StdStringAt ( ) { this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof StdBasicString }
260275
261276 override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
0 commit comments