C++: How to precisely track data flow through specific class members via smart pointers #19046
Description
Description of the issue
I'm trying to implement precise data flow tracking through a class that contains multiple pointer members when accessed via smart pointers (like std::unique_ptr). Specifically, I want to track the flow from a source pointer to only one specific member, without tainting other members.
Consider the following code:
class A {
public:
A(int* a, int* b) : a_(a), b_(b) {}
int* geta() {return a_;}
int* getb() {return b_;}
private:
int* a_;
int* b_;
};
void test() {
int* ux;
*ux = 10;
int* uy;
*uy = 20;
auto uptr = std::make_unique<A>(ux, uy); // Data flow from ux -> a_ and uy -> b_
int* um = uptr->geta();
int* un = uptr->getb();
int uk = *um + *un;
}
int main() {
test();
return 0;
}
I've added a new taint edge as suggested in #5244:
private predicate uniqueTaintEdge(DataFlow::Node node1, DataFlow::Node node2) {
// Given this assignment:
// u_ptr->data = get_taint();
// This case transfers flow from the assignment to `data` to `u_ptr`.
node2.asPartialDefinition() =
node1.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().(FieldAccess).getQualifier()
or
// Given this read:
// read_taint(u_ptr->data);
// This case transfers flow from `u_ptr.operator->()` to `data`.
node1.asExpr() = node2.asExpr().(FieldAccess).getQualifier()
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2){
uniqueTaintEdge(node1, node2)
}
However, with this implementation, when I track the data flow from ux to um, both um and un are being tainted. I want to track only the specific flow path from ux to um (through a_), without tainting un (which should only be affected by uy through b_).
Is there any way to distinguish between different member paths ?