From 6e8a2a6375bfafedd0286289f248157272485f89 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 12:08:21 +0000 Subject: [PATCH 01/10] DataFlow: Add a language-specific predicate for modifying 'branch' and 'join'. --- .../code/cpp/ir/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** From 05314b48e8c90c80e3584455f9e7a9a8861568ae Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 12:09:07 +0000 Subject: [PATCH 02/10] C++: Add stub. --- .../cpp/ir/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ .../cpp/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ .../cpp/ir/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 3 files changed, 48 insertions(+) diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll index 58569ef2425c..adcfc06532cb 100644 --- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll @@ -565,3 +565,19 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu any() } } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll index 1749de42f2c1..f5a9eaedbddb 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll @@ -318,3 +318,19 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu // consistency alerts enough that most of them are interesting. } } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll index e068f81f5426..9fbc9360f0e1 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll @@ -414,3 +414,19 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu any() } } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From b667e0136f298df148aa48562430d015ced91c8d Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:58:31 +0000 Subject: [PATCH 03/10] C#: Add stub. --- .../csharp/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll index 8a355d3416a5..3e475059c1a9 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll @@ -2374,3 +2374,19 @@ module Csv { ) } } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From 067abacbb8e2b33163dd94328d47cc3ef9906ef1 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:58:54 +0000 Subject: [PATCH 04/10] Go: Add stub. --- .../go/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll index b65fb3d7d5df..39127bcdcef4 100644 --- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll +++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll @@ -390,3 +390,19 @@ class ContentApprox = Unit; /** Gets an approximated value for content `c`. */ pragma[inline] ContentApprox getContentApprox(Content c) { any() } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From 4720e2a30a96b4b31bdeffaa038ac96f88ab355c Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:59:00 +0000 Subject: [PATCH 05/10] Java: Add stub. --- .../java/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll index ef89d0f51a22..7570d4f744e4 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll @@ -478,3 +478,19 @@ predicate containerContent(Content c) { c instanceof MapKeyContent or c instanceof MapValueContent } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From 5ebd50044f3b2d7a6ad7b350086a918adb7b5d67 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:59:08 +0000 Subject: [PATCH 06/10] Python: Add stub. --- .../dataflow/new/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll index c46cd74e3d44..762befc46c0a 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll @@ -1008,3 +1008,19 @@ class ContentApprox = Unit; /** Gets an approximated value for content `c`. */ pragma[inline] ContentApprox getContentApprox(Content c) { any() } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From e6b6369a21ce27b426ec27f0a984766054ea0daa Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:59:21 +0000 Subject: [PATCH 07/10] Ruby: Add stub. --- .../ruby/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll index b13d551c8376..5b4e93bea1e6 100644 --- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll +++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll @@ -1498,3 +1498,19 @@ class AdditionalJumpStep extends Unit { */ abstract predicate step(Node pred, Node succ); } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From 9647b6a3f59d956d5184a4cc177dbf8430f5d058 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:59:30 +0000 Subject: [PATCH 08/10] Swift: Add stub. --- .../swift/dataflow/internal/DataFlowPrivate.qll | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll index 059fd4ae26f4..c5b2d0eb3dd3 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll @@ -696,3 +696,19 @@ class ContentApprox = Unit; /** Gets an approximated value for content `c`. */ pragma[inline] ContentApprox getContentApprox(Content c) { any() } + +/** + * Gets an additional term that is added to the `join` and `branch` computations to reflect + * an additional forward or backwards branching factor that is not taken into account + * when calculating the (virtual) dispatch cost. + * + * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and + * `p` is the target parameter of a callable to which `call` may resolve. + * + * All these values are bound by the dataflow library, and if this predicate is implemented it + * should be specified with a bindingset annotation that binds all the columns. + */ +bindingset[call, p, arg] +int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { + none() +} From 3bf28cc7527bbd9f929401773f7e92ff227e78d9 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 17 Feb 2023 11:59:53 +0000 Subject: [PATCH 09/10] DataFlow: Sync identical files. --- .../code/cpp/ir/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../code/cpp/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../code/csharp/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../semmle/go/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../code/java/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../python/dataflow/new/internal/DataFlowImpl.qll | 13 +++++++++++++ .../codeql/ruby/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ .../codeql/swift/dataflow/internal/DataFlowImpl.qll | 13 +++++++++++++ 8 files changed, 104 insertions(+) diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll +++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll +++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll +++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll index 0afcba555824..d574f95d1814 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll @@ -959,6 +959,17 @@ module Impl { not inBarrier(p) } + /** + * Gets an additional term that is added to `branch` and `join` when deciding whether + * the amount of forward or backward branching is within the limit specified by the + * configuration. + */ + pragma[nomagic] + private int getLanguageSpecificFlowIntoCallNodeCand1(ArgNodeEx arg, ParamNodeEx p) { + flowIntoCallNodeCand1(_, arg, p) and + result = getAdditionalFlowIntoCallNodeTerm(arg.projectToNode(), p.projectToNode()) + } + /** * Gets the amount of forward branching on the origin of a cross-call path * edge in the graph of paths between sources and sinks that ignores call @@ -968,6 +979,7 @@ module Impl { private int branch(NodeEx n1) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n1, _, n) or flowIntoCallNodeCand1(_, n1, n)) + + sum(ParamNodeEx p1 | | getLanguageSpecificFlowIntoCallNodeCand1(n1, p1)) } /** @@ -979,6 +991,7 @@ module Impl { private int join(NodeEx n2) { result = strictcount(NodeEx n | flowOutOfCallNodeCand1(_, n, _, n2) or flowIntoCallNodeCand1(_, n, n2)) + + sum(ArgNodeEx arg2 | | getLanguageSpecificFlowIntoCallNodeCand1(arg2, n2)) } /** From 92ad099c1b659aee36d237500efbd68499ddcfa8 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 3 Mar 2023 13:14:40 +0000 Subject: [PATCH 10/10] DataFlow: Remove bindingsets, remove the call column, and swap parameter and argument columns. --- .../code/cpp/ir/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../code/cpp/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../code/cpp/ir/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../code/csharp/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../semmle/go/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../code/java/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../python/dataflow/new/internal/DataFlowPrivate.qll | 11 ++--------- .../codeql/ruby/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- .../swift/dataflow/internal/DataFlowPrivate.qll | 11 ++--------- 9 files changed, 18 insertions(+), 81 deletions(-) diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll index adcfc06532cb..a9c067fcc0a4 100644 --- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll @@ -571,13 +571,6 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll index f5a9eaedbddb..f54e3b9a9cba 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll @@ -324,13 +324,6 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll index 9fbc9360f0e1..e232896e8d99 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll @@ -420,13 +420,6 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll index 3e475059c1a9..4edd6dd79bbe 100644 --- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll +++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll @@ -2380,13 +2380,6 @@ module Csv { * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll index 39127bcdcef4..f6cb63c1c75a 100644 --- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll +++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll @@ -396,13 +396,6 @@ ContentApprox getContentApprox(Content c) { any() } * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll index 7570d4f744e4..0194b2609f0b 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowPrivate.qll @@ -484,13 +484,6 @@ predicate containerContent(Content c) { * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll index 762befc46c0a..12ced9d4fdd8 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll @@ -1014,13 +1014,6 @@ ContentApprox getContentApprox(Content c) { any() } * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll index 5b4e93bea1e6..8c73a7bce4b0 100644 --- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll +++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll @@ -1504,13 +1504,6 @@ class AdditionalJumpStep extends Unit { * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() } diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll index c5b2d0eb3dd3..68f03a591ccb 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll @@ -702,13 +702,6 @@ ContentApprox getContentApprox(Content c) { any() } * an additional forward or backwards branching factor that is not taken into account * when calculating the (virtual) dispatch cost. * - * `call` is a call with an argument `arg` that is part of a path from a source to a sink, and - * `p` is the target parameter of a callable to which `call` may resolve. - * - * All these values are bound by the dataflow library, and if this predicate is implemented it - * should be specified with a bindingset annotation that binds all the columns. + * Argument `arg` is part of a path from a source to a sink, and `p` is the target parameter. */ -bindingset[call, p, arg] -int getAdditionalFlowIntoCallNodeTerm(DataFlowCall call, ParameterNode p, ArgumentNode arg) { - none() -} +int getAdditionalFlowIntoCallNodeTerm(ArgumentNode arg, ParameterNode p) { none() }