Skip to content

Commit c222f13

Browse files
asgerfasgerf
committed
C++: mass enable diff-informed data flow
1 parent 772b972 commit c222f13

File tree

53 files changed

+283
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+283
-0
lines changed

‎cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,12 @@ module LiteralAlgorithmTracerConfig implements DataFlow::ConfigSig {
127127
c.(DataFlow::FieldContent).getField().getName() in ["nid", "sn", "ln"]
128128
)
129129
}
130+
131+
predicate observeDiffInformedIncrementalMode() {
132+
// TODO(diff-informed): Manually verify if config can be diff-informed.
133+
// cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll:141: Flow call outside 'select' clause
134+
none()
135+
}
130136
}
131137

132138
module LiteralAlgorithmTracer = DataFlow::Global<LiteralAlgorithmTracerConfig>;
@@ -535,6 +541,12 @@ module KeyGeneration {
535541
c.getArgument(sizeInd) = node.asExpr()
536542
)
537543
}
544+
545+
predicate observeDiffInformedIncrementalMode() {
546+
// TODO(diff-informed): Manually verify if config can be diff-informed.
547+
// cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll:557: Flow call outside 'select' clause
548+
none()
549+
}
538550
}
539551

540552
module AsymExplicitAlgKeyLengthFlow = DataFlow::Global<AsymExplicitAlgKeyLengthFlowConfig>;
@@ -574,6 +586,12 @@ module KeyGeneration {
574586
c.getArgument(3) = node.asExpr()
575587
)
576588
}
589+
590+
predicate observeDiffInformedIncrementalMode() {
591+
// TODO(diff-informed): Manually verify if config can be diff-informed.
592+
// cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll:598: Flow call outside 'select' clause
593+
none()
594+
}
577595
}
578596

579597
module Length_to_RSA_EVP_PKEY_Q_keygen_Flow =
@@ -622,6 +640,12 @@ module KeyGeneration {
622640
isKeyGenOperationWithNoSize(c.getTarget()) and c.getAnArgument() = node.asExpr()
623641
)
624642
}
643+
644+
predicate observeDiffInformedIncrementalMode() {
645+
// TODO(diff-informed): Manually verify if config can be diff-informed.
646+
// cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll:689: Flow call outside 'select' clause
647+
none()
648+
}
625649
}
626650

627651
module KeyGenKeySizeInitToKeyGenFlow = DataFlow::Global<KeyGenKeySizeInitToKeyGenConfig>;
@@ -656,6 +680,12 @@ module KeyGeneration {
656680
predicate isSource(DataFlow::Node source) { isEVP_PKEY_CTX_Source(source, _) }
657681

658682
predicate isSink(DataFlow::Node sink) { isKeyGen_EVP_PKEY_CTX_Sink(sink, _) }
683+
684+
predicate observeDiffInformedIncrementalMode() {
685+
// TODO(diff-informed): Manually verify if config can be diff-informed.
686+
// cpp/ql/lib/experimental/cryptography/modules/OpenSSL.qll:706: Flow call outside 'select' clause
687+
none()
688+
}
659689
}
660690

661691
module EVP_PKEY_CTX_Ptr_Source_to_KeyGenOperationWithNoSize_Flow =

‎cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ module PrivateCleartextWrite {
4242
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
4343

4444
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
45+
46+
predicate observeDiffInformedIncrementalMode() { any() }
4547
}
4648

4749
module WriteFlow = TaintTracking::Global<WriteConfig>;

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -756,6 +756,12 @@ private module FieldFlow {
756756
or
757757
node.asExpr().getParent() instanceof ThrowExpr
758758
}
759+
760+
predicate observeDiffInformedIncrementalMode() {
761+
// TODO(diff-informed): Manually verify if config can be diff-informed.
762+
// cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll:764: Flow call outside 'select' clause
763+
none()
764+
}
759765
}
760766

761767
private module Flow = DataFlow::Global<FieldConfig>;

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,13 @@ module ProductFlow {
387387
predicate isBarrierIn(DataFlow::Node node) { Config::isBarrierIn1(node) }
388388

389389
int fieldFlowBranchLimit() { result = Config::fieldFlowBranchLimit1() }
390+
391+
predicate observeDiffInformedIncrementalMode() {
392+
// TODO(diff-informed): Manually verify if config can be diff-informed.
393+
// cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll:400: Flow call outside 'select' clause
394+
// cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll:407: Flow call outside 'select' clause
395+
none()
396+
}
390397
}
391398

392399
private module Flow1 = DataFlow::GlobalWithState<Config1>;

‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,14 @@ private module SizeBarrier {
142142
}
143143

144144
predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
145+
146+
predicate observeDiffInformedIncrementalMode() {
147+
// TODO(diff-informed): Manually verify if config can be diff-informed.
148+
// cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:151: Flow call outside 'select' clause
149+
// cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:162: Flow call outside 'select' clause
150+
// cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:211: Flow call outside 'select' clause
151+
none()
152+
}
145153
}
146154

147155
module SizeBarrierFlow = DataFlow::Global<SizeBarrierConfig>;
@@ -330,6 +338,12 @@ private module Config implements ProductFlow::StateConfigSig {
330338
predicate isBarrierOut2(DataFlow::Node node) {
331339
node = any(DataFlow::SsaPhiNode phi).getAnInput(true)
332340
}
341+
342+
predicate observeDiffInformedIncrementalMode() {
343+
// TODO(diff-informed): Manually verify if config can be diff-informed.
344+
// cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll:377: Flow call outside 'select' clause
345+
none()
346+
}
333347
}
334348

335349
private module AllocToInvalidPointerFlow = ProductFlow::GlobalWithState<Config>;

‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,12 @@ private module InvalidPointerToDerefBarrier {
110110
predicate isSink(DataFlow::Node sink) { isSink(_, sink, _, _, _) }
111111

112112
int fieldFlowBranchLimit() { result = invalidPointerToDereferenceFieldFlowBranchLimit() }
113+
114+
predicate observeDiffInformedIncrementalMode() {
115+
// TODO(diff-informed): Manually verify if config can be diff-informed.
116+
// cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll:129: Flow call outside 'select' clause
117+
none()
118+
}
113119
}
114120

115121
private module BarrierFlow = DataFlow::Global<BarrierConfig>;

‎cpp/ql/lib/semmle/code/cpp/security/boostorg/asio/protocols.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,12 @@ module BoostorgAsio {
503503
not sink.getLocation().getFile().toString().matches("%/boost/asio/%")
504504
)
505505
}
506+
507+
predicate observeDiffInformedIncrementalMode() {
508+
// TODO(diff-informed): Manually verify if config can be diff-informed.
509+
// cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql:48: Flow call outside 'select' clause
510+
none()
511+
}
506512
}
507513

508514
module SslOptionFlow = DataFlow::Global<SslOptionConfig>;

‎cpp/ql/src/Critical/MissingCheckScanf.ql

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,12 @@ module UninitializedToScanfConfig implements ConfigSig {
6060
FlowFeature getAFeature() { result instanceof FeatureEqualSourceSinkCallContext }
6161

6262
int accessPathLimit() { result = 0 }
63+
64+
predicate observeDiffInformedIncrementalMode() {
65+
// TODO(diff-informed): Manually verify if config can be diff-informed.
66+
// cpp/ql/src/Critical/MissingCheckScanf.ql:72: Flow call outside 'select' clause
67+
none()
68+
}
6369
}
6470

6571
module UninitializedToScanfFlow = Global<UninitializedToScanfConfig>;
@@ -111,6 +117,12 @@ module ScanfToUseConfig implements ConfigSig {
111117
// modified, and thus it's safe to later read the value.
112118
exists(n.asIndirectArgument())
113119
}
120+
121+
predicate observeDiffInformedIncrementalMode() {
122+
// TODO(diff-informed): Manually verify if config can be diff-informed.
123+
// cpp/ql/src/Critical/MissingCheckScanf.ql:127: Flow call outside 'select' clause
124+
none()
125+
}
114126
}
115127

116128
module ScanfToUseFlow = Global<ScanfToUseConfig>;

‎cpp/ql/src/Critical/OverflowDestination.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ module OverflowDestinationConfig implements DataFlow::ConfigSig {
8282
nodeIsBarrierEqualityCandidate(node, access, checkedVar)
8383
)
8484
}
85+
86+
predicate observeDiffInformedIncrementalMode() { any() }
8587
}
8688

8789
module OverflowDestination = TaintTracking::Global<OverflowDestinationConfig>;

‎cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ module CastToPointerArithFlowConfig implements DataFlow::StateConfigSig {
4444
) and
4545
getFullyConvertedType(node) = state
4646
}
47+
48+
predicate observeDiffInformedIncrementalMode() { any() }
4749
}
4850

4951
/**

0 commit comments

Comments
 (0)