Skip to content

Commit 473a1d3

Browse files
asgerfasgerf
committed
C++: mass enable diff-informed data flow
1 parent 772b972 commit 473a1d3

File tree

53 files changed

+382
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+382
-0
lines changed

Diff for: ‎cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll

+30
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,12 @@ module LiteralAlgorithmTracerConfig implements DataFlow::ConfigSig {
127127
c.(DataFlow::FieldContent).getField().getName() in ["nid", "sn", "ln"]
128128
)
129129
}
130+
131+
predicate observeDiffInformedIncrementalMode() {
132+
// TODO(diff-informed): Manually verify if config can be diff-informed.
133+
// ql/lib/experimental/cryptography/modules/OpenSSL.qll:141: Flow call outside 'select' clause
134+
none()
135+
}
130136
}
131137

132138
module LiteralAlgorithmTracer = DataFlow::Global<LiteralAlgorithmTracerConfig>;
@@ -535,6 +541,12 @@ module KeyGeneration {
535541
c.getArgument(sizeInd) = node.asExpr()
536542
)
537543
}
544+
545+
predicate observeDiffInformedIncrementalMode() {
546+
// TODO(diff-informed): Manually verify if config can be diff-informed.
547+
// ql/lib/experimental/cryptography/modules/OpenSSL.qll:557: Flow call outside 'select' clause
548+
none()
549+
}
538550
}
539551

540552
module AsymExplicitAlgKeyLengthFlow = DataFlow::Global<AsymExplicitAlgKeyLengthFlowConfig>;
@@ -574,6 +586,12 @@ module KeyGeneration {
574586
c.getArgument(3) = node.asExpr()
575587
)
576588
}
589+
590+
predicate observeDiffInformedIncrementalMode() {
591+
// TODO(diff-informed): Manually verify if config can be diff-informed.
592+
// ql/lib/experimental/cryptography/modules/OpenSSL.qll:598: Flow call outside 'select' clause
593+
none()
594+
}
577595
}
578596

579597
module Length_to_RSA_EVP_PKEY_Q_keygen_Flow =
@@ -622,6 +640,12 @@ module KeyGeneration {
622640
isKeyGenOperationWithNoSize(c.getTarget()) and c.getAnArgument() = node.asExpr()
623641
)
624642
}
643+
644+
predicate observeDiffInformedIncrementalMode() {
645+
// TODO(diff-informed): Manually verify if config can be diff-informed.
646+
// ql/lib/experimental/cryptography/modules/OpenSSL.qll:689: Flow call outside 'select' clause
647+
none()
648+
}
625649
}
626650

627651
module KeyGenKeySizeInitToKeyGenFlow = DataFlow::Global<KeyGenKeySizeInitToKeyGenConfig>;
@@ -656,6 +680,12 @@ module KeyGeneration {
656680
predicate isSource(DataFlow::Node source) { isEVP_PKEY_CTX_Source(source, _) }
657681

658682
predicate isSink(DataFlow::Node sink) { isKeyGen_EVP_PKEY_CTX_Sink(sink, _) }
683+
684+
predicate observeDiffInformedIncrementalMode() {
685+
// TODO(diff-informed): Manually verify if config can be diff-informed.
686+
// ql/lib/experimental/cryptography/modules/OpenSSL.qll:706: Flow call outside 'select' clause
687+
none()
688+
}
659689
}
660690

661691
module EVP_PKEY_CTX_Ptr_Source_to_KeyGenOperationWithNoSize_Flow =

Diff for: ‎cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

+2
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ module PrivateCleartextWrite {
4242
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
4343

4444
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
45+
46+
predicate observeDiffInformedIncrementalMode() { any() }
4547
}
4648

4749
module WriteFlow = TaintTracking::Global<WriteConfig>;

Diff for: ‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

+6
Original file line numberDiff line numberDiff line change
@@ -756,6 +756,12 @@ private module FieldFlow {
756756
or
757757
node.asExpr().getParent() instanceof ThrowExpr
758758
}
759+
760+
predicate observeDiffInformedIncrementalMode() {
761+
// TODO(diff-informed): Manually verify if config can be diff-informed.
762+
// ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll:764: Flow call outside 'select' clause
763+
none()
764+
}
759765
}
760766

761767
private module Flow = DataFlow::Global<FieldConfig>;

Diff for: ‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll

+7
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,13 @@ module ProductFlow {
387387
predicate isBarrierIn(DataFlow::Node node) { Config::isBarrierIn1(node) }
388388

389389
int fieldFlowBranchLimit() { result = Config::fieldFlowBranchLimit1() }
390+
391+
predicate observeDiffInformedIncrementalMode() {
392+
// TODO(diff-informed): Manually verify if config can be diff-informed.
393+
// ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll:400: Flow call outside 'select' clause
394+
// ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll:407: Flow call outside 'select' clause
395+
none()
396+
}
390397
}
391398

392399
private module Flow1 = DataFlow::GlobalWithState<Config1>;

Diff for: ‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll

+14
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,14 @@ private module SizeBarrier {
142142
}
143143

144144
predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
145+
146+
predicate observeDiffInformedIncrementalMode() {
147+
// TODO(diff-informed): Manually verify if config can be diff-informed.
148+
// ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:151: Flow call outside 'select' clause
149+
// ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:162: Flow call outside 'select' clause
150+
// ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:211: Flow call outside 'select' clause
151+
none()
152+
}
145153
}
146154

147155
module SizeBarrierFlow = DataFlow::Global<SizeBarrierConfig>;
@@ -330,6 +338,12 @@ private module Config implements ProductFlow::StateConfigSig {
330338
predicate isBarrierOut2(DataFlow::Node node) {
331339
node = any(DataFlow::SsaPhiNode phi).getAnInput(true)
332340
}
341+
342+
predicate observeDiffInformedIncrementalMode() {
343+
// TODO(diff-informed): Manually verify if config can be diff-informed.
344+
// ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:377: Flow call outside 'select' clause
345+
none()
346+
}
333347
}
334348

335349
private module AllocToInvalidPointerFlow = ProductFlow::GlobalWithState<Config>;

Diff for: ‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

+6
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,12 @@ private module InvalidPointerToDerefBarrier {
110110
predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
111111

112112
int fieldFlowBranchLimit() { result = invalidPointerToDereferenceFieldFlowBranchLimit() }
113+
114+
predicate observeDiffInformedIncrementalMode() {
115+
// TODO(diff-informed): Manually verify if config can be diff-informed.
116+
// ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll:129: Flow call outside 'select' clause
117+
none()
118+
}
113119
}
114120

115121
private module BarrierFlow = DataFlow::Global<BarrierConfig>;

Diff for: ‎cpp/ql/lib/semmle/code/cpp/security/boostorg/asio/protocols.qll

+6
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,12 @@ module BoostorgAsio {
503503
not sink.getLocation().getFile().toString().matches("%/boost/asio/%")
504504
)
505505
}
506+
507+
predicate observeDiffInformedIncrementalMode() {
508+
// TODO(diff-informed): Manually verify if config can be diff-informed.
509+
// ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql:48: Flow call outside 'select' clause
510+
none()
511+
}
506512
}
507513

508514
module SslOptionFlow = DataFlow::Global<SslOptionConfig>;

Diff for: ‎cpp/ql/src/Critical/MissingCheckScanf.ql

+12
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,12 @@ module UninitializedToScanfConfig implements ConfigSig {
6060
FlowFeature getAFeature() { result instanceof FeatureEqualSourceSinkCallContext }
6161

6262
int accessPathLimit() { result = 0 }
63+
64+
predicate observeDiffInformedIncrementalMode() {
65+
// TODO(diff-informed): Manually verify if config can be diff-informed.
66+
// ql/src/Critical/MissingCheckScanf.ql:72: Flow call outside 'select' clause
67+
none()
68+
}
6369
}
6470

6571
module UninitializedToScanfFlow = Global<UninitializedToScanfConfig>;
@@ -111,6 +117,12 @@ module ScanfToUseConfig implements ConfigSig {
111117
// modified, and thus it's safe to later read the value.
112118
exists(n.asIndirectArgument())
113119
}
120+
121+
predicate observeDiffInformedIncrementalMode() {
122+
// TODO(diff-informed): Manually verify if config can be diff-informed.
123+
// ql/src/Critical/MissingCheckScanf.ql:127: Flow call outside 'select' clause
124+
none()
125+
}
114126
}
115127

116128
module ScanfToUseFlow = Global<ScanfToUseConfig>;

Diff for: ‎cpp/ql/src/Critical/OverflowDestination.ql

+6
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,12 @@ module OverflowDestinationConfig implements DataFlow::ConfigSig {
8282
nodeIsBarrierEqualityCandidate(node, access, checkedVar)
8383
)
8484
}
85+
86+
predicate observeDiffInformedIncrementalMode() {
87+
// TODO(diff-informed): Manually verify if config can be diff-informed.
88+
// ql/src/Critical/OverflowDestination.ql:93: Column 1 does not select a source or sink originating from the flow call on line 91
89+
none()
90+
}
8591
}
8692

8793
module OverflowDestination = TaintTracking::Global<OverflowDestinationConfig>;

Diff for: ‎cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql

+2
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ module CastToPointerArithFlowConfig implements DataFlow::StateConfigSig {
4444
) and
4545
getFullyConvertedType(node) = state
4646
}
47+
48+
predicate observeDiffInformedIncrementalMode() { any() }
4749
}
4850

4951
/**

Diff for: ‎cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

+6
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,12 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {
168168
cannotContainString(t)
169169
)
170170
}
171+
172+
predicate observeDiffInformedIncrementalMode() {
173+
// TODO(diff-informed): Manually verify if config can be diff-informed.
174+
// ql/src/Likely Bugs/Format/NonConstantFormat.ql:184: Column 5 does not select a source or sink originating from the flow call on line 181
175+
none()
176+
}
171177
}
172178

173179
module NonConstFlow = TaintTracking::Global<NonConstFlowConfig>;

Diff for: ‎cpp/ql/src/Likely Bugs/Leap Year/LeapYear.qll

+18
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,17 @@ private module LeapYearCheckConfig implements DataFlow::ConfigSig {
215215
predicate isSink(DataFlow::Node sink) {
216216
exists(ChecksForLeapYearFunctionCall fc | sink.asExpr() = fc.getAnArgument())
217217
}
218+
219+
predicate observeDiffInformedIncrementalMode() {
220+
// TODO(diff-informed): Manually verify if config can be diff-informed.
221+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:57: Column 1 does not select a source or sink originating from the flow call on line 34
222+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:57: Column 1 does not select a source or sink originating from the flow call on line 41
223+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:59: Column 3 does not select a source or sink originating from the flow call on line 34
224+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:59: Column 3 does not select a source or sink originating from the flow call on line 41
225+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:59: Column 5 does not select a source or sink originating from the flow call on line 34
226+
// ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql:59: Column 5 does not select a source or sink originating from the flow call on line 41
227+
none()
228+
}
218229
}
219230

220231
module LeapYearCheckFlow = DataFlow::Global<LeapYearCheckConfig>;
@@ -285,6 +296,13 @@ private module PossibleYearArithmeticOperationCheckConfig implements DataFlow::C
285296
aexpr.getLValue() = fa
286297
)
287298
}
299+
300+
predicate observeDiffInformedIncrementalMode() {
301+
// TODO(diff-informed): Manually verify if config can be diff-informed.
302+
// ql/src/Likely Bugs/Leap Year/Adding365DaysPerYear.ql:21: Column 1 does not select a source or sink originating from the flow call on line 19
303+
// ql/src/Likely Bugs/Leap Year/Adding365DaysPerYear.ql:23: Column 3 does not select a source or sink originating from the flow call on line 19
304+
none()
305+
}
288306
}
289307

290308
module PossibleYearArithmeticOperationCheckFlow =

Diff for: ‎cpp/ql/src/Likely Bugs/Memory Management/NtohlArrayNoBound.qll

+2
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,8 @@ private module NetworkToBufferSizeConfig implements DataFlow::ConfigSig {
141141
gc.controls(node.asExpr().getBasicBlock(), _)
142142
)
143143
}
144+
145+
predicate observeDiffInformedIncrementalMode() { any() }
144146
}
145147

146148
module NetworkToBufferSizeFlow = DataFlow::Global<NetworkToBufferSizeConfig>;

Diff for: ‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql

+6
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@ module ExistsAnyFlowConfig implements DataFlow::ConfigSig {
2828
predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
2929

3030
predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
31+
32+
predicate observeDiffInformedIncrementalMode() {
33+
// TODO(diff-informed): Manually verify if config can be diff-informed.
34+
// ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql:43: Flow call outside 'select' clause
35+
none()
36+
}
3137
}
3238

3339
module ExistsAnyFlow = DataFlow::Global<ExistsAnyFlowConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll

+7
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
5151
}
5252

5353
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
54+
55+
predicate observeDiffInformedIncrementalMode() {
56+
// TODO(diff-informed): Manually verify if config can be diff-informed.
57+
// ql/src/Security/CWE/CWE-020/ExternalAPIs.qll:13: Flow call outside 'select' clause
58+
// ql/src/Security/CWE/CWE-020/ExternalAPIs.qll:16: Flow call outside 'select' clause
59+
none()
60+
}
5461
}
5562

5663
module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIsSpecific.qll

+7
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,13 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
4646
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
4747

4848
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
49+
50+
predicate observeDiffInformedIncrementalMode() {
51+
// TODO(diff-informed): Manually verify if config can be diff-informed.
52+
// ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll:13: Flow call outside 'select' clause
53+
// ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll:16: Flow call outside 'select' clause
54+
none()
55+
}
4956
}
5057

5158
module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql

+6
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,12 @@ module TaintedPathConfig implements DataFlow::ConfigSig {
9393
// make sinks barriers so that we only report the closest instance
9494
isSink(node)
9595
}
96+
97+
predicate observeDiffInformedIncrementalMode() {
98+
// TODO(diff-informed): Manually verify if config can be diff-informed.
99+
// ql/src/Security/CWE/CWE-022/TaintedPath.ql:108: Column 1 selects sink.asIndirectArgument
100+
none()
101+
}
96102
}
97103

98104
module TaintedPath = TaintTracking::Global<TaintedPathConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql

+13
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,12 @@ module ExecStateConfig implements DataFlow::ConfigSig {
106106
predicate isBarrierOut(DataFlow::Node node) {
107107
isSink(node) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
108108
}
109+
110+
predicate observeDiffInformedIncrementalMode() {
111+
// TODO(diff-informed): Manually verify if config can be diff-informed.
112+
// ql/src/Security/CWE/CWE-078/ExecTainted.ql:78: Flow call outside 'select' clause
113+
none()
114+
}
109115
}
110116

111117
module ExecState = TaintTracking::Global<ExecStateConfig>;
@@ -136,6 +142,13 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {
136142
predicate isBarrierOut(DataFlow::Node node) {
137143
isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
138144
}
145+
146+
predicate observeDiffInformedIncrementalMode() {
147+
// TODO(diff-informed): Manually verify if config can be diff-informed.
148+
// ql/src/Security/CWE/CWE-078/ExecTainted.ql:151: Column 1 does not select a source or sink originating from the flow call on line 147
149+
// ql/src/Security/CWE/CWE-078/ExecTainted.ql:153: Column 7 does not select a source or sink originating from the flow call on line 147
150+
none()
151+
}
139152
}
140153

141154
module ExecTaint = TaintTracking::GlobalWithState<ExecTaintConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql

+6
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ module Config implements DataFlow::ConfigSig {
3939
or
4040
node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
4141
}
42+
43+
predicate observeDiffInformedIncrementalMode() {
44+
// TODO(diff-informed): Manually verify if config can be diff-informed.
45+
// ql/src/Security/CWE/CWE-079/CgiXss.ql:51: Column 5 selects source.asIndirectExpr
46+
none()
47+
}
4248
}
4349

4450
module Flow = TaintTracking::Global<Config>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql

+6
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
5151
sql.barrierSqlArgument(input, _)
5252
)
5353
}
54+
55+
predicate observeDiffInformedIncrementalMode() {
56+
// TODO(diff-informed): Manually verify if config can be diff-informed.
57+
// ql/src/Security/CWE/CWE-089/SqlTainted.ql:66: Column 1 does not select a source or sink originating from the flow call on line 63
58+
none()
59+
}
5460
}
5561

5662
module SqlTainted = TaintTracking::Global<SqlTaintedConfig>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql

+2
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ module Config implements DataFlow::ConfigSig {
3939
or
4040
node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
4141
}
42+
43+
predicate observeDiffInformedIncrementalMode() { any() }
4244
}
4345

4446
module Flow = TaintTracking::Global<Config>;

Diff for: ‎cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql

+8
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,14 @@ module StringSizeConfig implements ProductFlow::StateConfigSig {
225225
state1 = state2 + delta
226226
)
227227
}
228+
229+
predicate observeDiffInformedIncrementalMode() {
230+
// TODO(diff-informed): Manually verify if config can be diff-informed.
231+
// ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql:251: Flow call outside 'select' clause
232+
// ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql:271: Column 1 does not select a source or sink originating from the flow call on line 265
233+
// ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql:272: Column 5 does not select a source or sink originating from the flow call on line 265
234+
none()
235+
}
228236
}
229237

230238
module StringSizeFlow = ProductFlow::GlobalWithState<StringSizeConfig>;

0 commit comments

Comments
 (0)