Skip to content

Conversation

@hvitved
Copy link
Contributor

@hvitved hvitved commented Feb 20, 2024

This PR adopts the shared variable capture library to C#.

Previously, the SSA library had ad-hoc support for variable capture, but that support has now been removed (actually, we still allow captured variables where all writes happen in the defining method), and we instead rely solely on the implementation from the shared library.

The implementation of the input to the shared library is somewhat standard, except local functions need to be treated as if they were lambdas, which prompts the need for additional synthetic nodes (LocalFunctionCreationNode) and local/jump steps (LocalFunctionCreationNode.getAnAccess).

Since the SSA library now has limited support for captured variables, we apply control-flow insensitive data flow through captured variables when resolving lambda calls.

DCA reports a bunch of new results, as expected, including a new TP in WebGoat, where data flows through a captured string builder.

@github-actions github-actions bot added the C# label Feb 20, 2024
}

private module CaptureInput implements Shared::InputSig<Location> {
private import csharp as Cs

Check warning

Code scanning / CodeQL

Names only differing by case

Cs is only different by casing from CS that is used elsewhere for modules.
@hvitved hvitved force-pushed the csharp/variable-capture branch 3 times, most recently from b043381 to a1c048b Compare February 21, 2024 09:04
@hvitved hvitved force-pushed the csharp/variable-capture branch 2 times, most recently from 4e861b0 to 7d8857f Compare February 22, 2024 10:13
@hvitved hvitved force-pushed the csharp/variable-capture branch 5 times, most recently from d6af861 to 3e1ac2e Compare February 23, 2024 20:17
@hvitved hvitved force-pushed the csharp/variable-capture branch from 3e1ac2e to acd5219 Compare February 26, 2024 08:53
@hvitved hvitved marked this pull request as ready for review February 27, 2024 08:33
@hvitved hvitved requested a review from a team as a code owner February 27, 2024 08:33
Copy link
Contributor

@michaelnebel michaelnebel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks plausible to me, but I must admit I am not sufficiently familiar with code to provide a semantic review.
Good work :-D

@hvitved hvitved merged commit 297a179 into github:main Feb 28, 2024
@hvitved hvitved deleted the csharp/variable-capture branch February 28, 2024 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants