Skip to content

Commit 147f854

Browse files
hvitvedhvitved
committed
works
1 parent a5722e9 commit 147f854

File tree

2 files changed

+72
-31
lines changed

2 files changed

+72
-31
lines changed

Diff for: ‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll

+3-3
Original file line numberDiff line numberDiff line change
@@ -385,10 +385,10 @@ class DataFlowType extends SrcRefType {
385385
DataFlowType() { this = getErasedRepr(_) }
386386
}
387387

388-
// pragma[nomagic]
389-
// predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { t1.getASourceSupertype+() = t2 }
390-
predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { none() }
388+
pragma[nomagic]
389+
predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { t1.getASourceSupertype+() = t2 }
391390

391+
// predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) { none() }
392392
pragma[noinline]
393393
DataFlowType getNodeType(Node n) {
394394
result = getErasedRepr(n.getTypeBound())

Diff for: ‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

+69-28
Original file line numberDiff line numberDiff line change
@@ -1278,8 +1278,10 @@ module MakeImpl<InputSig Lang> {
12781278
bindingset[node, ap]
12791279
predicate nodeMayFlowNotThrough(NodeEx node, ApApprox ap);
12801280

1281-
bindingset[node, state, t0, ap, inSummaryCtx]
1282-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx);
1281+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
1282+
predicate filter(
1283+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
1284+
);
12831285

12841286
bindingset[typ, contentType]
12851287
predicate typecheckStore(Typ typ, DataFlowType contentType);
@@ -1367,7 +1369,13 @@ module MakeImpl<InputSig Lang> {
13671369
(cc instanceof CcNoCall or Param::nodeMayFlowNotThrough(node, apa)) and
13681370
inSummaryCtx = false
13691371
) and
1370-
filter(node, state, t0, ap, t, inSummaryCtx) and
1372+
exists(Typ origT1 |
1373+
origT1 = origT0.asSome()
1374+
or
1375+
origT0.isNone() and origT1 = t0
1376+
|
1377+
filter(node, state, origT1, t0, ap, t, inSummaryCtx)
1378+
) and
13711379
// origT.asSome() = t
13721380
if t != t0 and origT0.isNone() and not ap instanceof ApNil
13731381
then origT.asSome() = t0
@@ -2395,20 +2403,33 @@ module MakeImpl<InputSig Lang> {
23952403
)
23962404
}
23972405

2406+
pragma[nomagic]
2407+
private predicate nodeMayFlowThrough0(
2408+
ParamNode p, Ap argAp, ApOption argApO, ReturnPosition pos, Ap returnAp,
2409+
ApOption returnApO
2410+
) {
2411+
// revFlow(node, _, TReturnCtxMaybeFlowThrough(_), _, ap)
2412+
exists(ParamNodeEx param |
2413+
p = param.asNode() and
2414+
returnFlowsThrough(_, pos, _, _, param, _, argAp, returnAp) and
2415+
parameterFlowsThroughRev(param, argAp, pos, returnAp) and
2416+
argApO = apSome(argAp) and
2417+
returnApO = apSome(returnAp)
2418+
)
2419+
}
2420+
23982421
// pragma[nomagic]
23992422
// predicate nodeMayFlowThrough(NodeEx node, Ap ap) {
24002423
// revFlow(node, _, TReturnCtxMaybeFlowThrough(_), _, ap)
24012424
// }
24022425
pragma[nomagic]
24032426
additional predicate nodeMayFlowThrough(ParamNode p, Ap argAp, NodeEx node, Ap ap) {
24042427
// revFlow(node, _, TReturnCtxMaybeFlowThrough(_), _, ap)
2405-
exists(ReturnPosition pos, Ap returnAp, ParamNodeEx param |
2406-
p = param.asNode() and
2407-
returnFlowsThrough(_, pos, _, _, param, _, argAp, returnAp) and
2408-
parameterFlowsThroughRev(param, argAp, pos, returnAp) and
2409-
revFlow(pragma[only_bind_into](node), _, TReturnCtxMaybeFlowThrough(pos),
2410-
apSome(returnAp), pragma[only_bind_into](ap)) and
2411-
fwdFlow(pragma[only_bind_into](node), _, _, TParamNodeSome(p), _, apSome(argAp), _, _,
2428+
exists(ApOption argApO, ReturnPosition pos, Ap returnAp, ApOption returnApO |
2429+
nodeMayFlowThrough0(p, argAp, argApO, pos, returnAp, returnApO) and
2430+
revFlow(pragma[only_bind_into](node), _, TReturnCtxMaybeFlowThrough(pos), returnApO,
2431+
pragma[only_bind_into](ap)) and
2432+
fwdFlow(pragma[only_bind_into](node), _, _, TParamNodeSome(p), _, argApO, _, _,
24122433
pragma[only_bind_into](ap), _)
24132434
)
24142435
}
@@ -2745,9 +2766,12 @@ module MakeImpl<InputSig Lang> {
27452766
)
27462767
}
27472768

2748-
bindingset[node, state, t0, ap, inSummaryCtx]
2749-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
2769+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
2770+
predicate filter(
2771+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
2772+
) {
27502773
PrevStage::revFlowState(state) and
2774+
exists(origT) and
27512775
t0 = t and
27522776
exists(ap) and
27532777
not stateBarrier(node, state) and
@@ -3078,9 +3102,12 @@ module MakeImpl<InputSig Lang> {
30783102
)
30793103
}
30803104

3081-
bindingset[node, state, t0, ap, inSummaryCtx]
3082-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
3105+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
3106+
predicate filter(
3107+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
3108+
) {
30833109
exists(state) and
3110+
exists(origT) and
30843111
t0 = t and
30853112
exists(ap) and
30863113
not stateBarrier(node, state) and
@@ -3164,9 +3191,12 @@ module MakeImpl<InputSig Lang> {
31643191
)
31653192
}
31663193

3167-
bindingset[node, state, t0, ap, inSummaryCtx]
3168-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
3194+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
3195+
predicate filter(
3196+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
3197+
) {
31693198
exists(state) and
3199+
exists(origT) and
31703200
// We can get away with not using type strengthening here, since we aren't
31713201
// going to use the tracked types in the construction of Stage 4 access
31723202
// paths. For Stage 4 and onwards, the tracked types must be consistent as
@@ -3199,7 +3229,7 @@ module MakeImpl<InputSig Lang> {
31993229

32003230
bindingset[node, t0, inSummaryCtx]
32013231
private predicate strengthenType(
3202-
NodeEx node, DataFlowType t0, DataFlowType t, boolean inSummaryCtx
3232+
NodeEx node, DataFlowType origT, DataFlowType t0, DataFlowType t, boolean inSummaryCtx
32033233
) {
32043234
exists(inSummaryCtx) and
32053235
// if node instanceof RetNodeEx and inSummaryCtx = true
@@ -3224,7 +3254,11 @@ module MakeImpl<InputSig Lang> {
32243254
else (
32253255
compatibleTypes(nt, t0) and
32263256
// t = t0
3227-
if inSummaryCtx = true and node instanceof ParamNodeEx then t = nt else t = t0
3257+
if inSummaryCtx = true and node instanceof ParamNodeEx
3258+
then
3259+
t = nt and
3260+
compatibleTypes(origT, t)
3261+
else t = t0
32283262
)
32293263
)
32303264
else t = t0
@@ -3311,9 +3345,12 @@ module MakeImpl<InputSig Lang> {
33113345
)
33123346
}
33133347

3314-
bindingset[node, state, t0, ap, inSummaryCtx]
3315-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
3348+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
3349+
predicate filter(
3350+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
3351+
) {
33163352
exists(state) and
3353+
exists(origT) and
33173354
not clear(node, ap) and
33183355
t0 = t and
33193356
(if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), t0) else any()) and
@@ -3415,11 +3452,13 @@ module MakeImpl<InputSig Lang> {
34153452
)
34163453
}
34173454

3418-
bindingset[node, state, t0, ap, inSummaryCtx]
3419-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
3455+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
3456+
predicate filter(
3457+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
3458+
) {
34203459
exists(state) and
34213460
not clear(node, ap) and
3422-
strengthenType(node, t0, t, inSummaryCtx) and
3461+
strengthenType(node, origT, t0, t, inSummaryCtx) and
34233462
(
34243463
notExpectsContent(node)
34253464
or
@@ -3680,9 +3719,11 @@ module MakeImpl<InputSig Lang> {
36803719
PrevStage::nodeMayFlowNotThrough(node, ap)
36813720
}
36823721

3683-
bindingset[node, state, t0, ap, inSummaryCtx]
3684-
predicate filter(NodeEx node, FlowState state, Typ t0, Ap ap, Typ t, boolean inSummaryCtx) {
3685-
strengthenType(node, t0, t, inSummaryCtx) and
3722+
bindingset[node, state, origT, t0, ap, inSummaryCtx]
3723+
predicate filter(
3724+
NodeEx node, FlowState state, Typ origT, Typ t0, Ap ap, Typ t, boolean inSummaryCtx
3725+
) {
3726+
strengthenType(node, origT, t0, t, inSummaryCtx) and
36863727
exists(state) and
36873728
exists(ap)
36883729
}
@@ -4434,7 +4475,7 @@ module MakeImpl<InputSig Lang> {
44344475
exists(DataFlowType t0, Stage5::Ap apa, boolean inSummaryCtx |
44354476
pathStep0(mid, node, state, cc, sc, t0, ap, apa) and
44364477
Stage5::revFlow(node, state, apa) and
4437-
strengthenType(node, t0, t, inSummaryCtx) and
4478+
strengthenType(node, t0, t0, t, inSummaryCtx) and
44384479
not inBarrier(node, state)
44394480
|
44404481
exists(ParamNodeEx p, ParamNode param, AccessPath argAp, Stage5::Ap argApa |
@@ -5197,7 +5238,7 @@ module MakeImpl<InputSig Lang> {
51975238
) and
51985239
exists(boolean inSummaryCtx |
51995240
(if sc1 = TSummaryCtx1None() then inSummaryCtx = false else inSummaryCtx = true) and
5200-
strengthenType(node, t0, t, inSummaryCtx)
5241+
strengthenType(node, t0, t0, t, inSummaryCtx)
52015242
)
52025243
}
52035244

0 commit comments

Comments
 (0)