FilesExpand file tree

codeql-cli/v2.27.1

/

Undefined.qll

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

119 lines (105 loc) · 3.44 KB

codeql-cli/v2.27.1

/

Undefined.qll

Copy path

Top

File metadata and controls

• Code
• Blame

119 lines (105 loc) · 3.44 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

import python

import Loop

import semmle.python.dataflow.TaintTracking

private import LegacyPointsTo

/** A marker for "uninitialized". */

class Uninitialized extends TaintKind {

Uninitialized() { this = "undefined" }

}

private predicate loop_entry_variables(EssaVariable pred, EssaVariable succ) {

exists(PhiFunction phi, BasicBlock pb |

loop_entry_edge(pb, phi.getBasicBlock()) and

succ = phi.getVariable() and

pred = phi.getInput(pb)

)

}

private predicate loop_entry_edge(BasicBlock pred, BasicBlock loop) {

pred = loop.getAPredecessor() and

pred = loop.getImmediateDominator() and

exists(Stmt s, ControlFlowNode sCfg |

loop_probably_executes_at_least_once(s) and

sCfg.getNode() = s and

sCfg.getBasicBlock() = loop

)

}

/**

* Since any use of a local will raise if it is uninitialized, then

* any use dominated by another use of the same variable must be defined, or is unreachable.

*/

private predicate first_use(NameNode u, EssaVariable v) {

v.getASourceUse() = u and

not exists(NameNode other |

v.getASourceUse() = other and

other.strictlyDominates(u)

)

}

/**

* Holds if `call` is a call of the form obj.method_name(...) and

* there is a function called `method_name` that can exit the program.

*/

private predicate maybe_call_to_exiting_function(CallNode call) {

exists(FunctionValue exits, string name | exits.neverReturns() and exits.getName() = name |

call.getFunction().(NameNode).getId() = name or

call.getFunction().(AttrNode).getName() = name

)

}

predicate exitFunctionGuardedEdge(EssaVariable pred, EssaVariable succ) {

exists(CallNode exit_call |

succ.(PhiFunction).getInput(exit_call.getBasicBlock()) = pred and

maybe_call_to_exiting_function(exit_call)

)

}

class UninitializedConfig extends TaintTracking::Configuration {

UninitializedConfig() { this = "Uninitialized local config" }

override predicate isSource(DataFlow::Node source, TaintKind kind) {

kind instanceof Uninitialized and

exists(EssaVariable var |

source.asVariable() = var and

var.getSourceVariable() instanceof FastLocalVariable and

not var.getSourceVariable().(Variable).escapes()

|

var instanceof ScopeEntryDefinition

or

var instanceof DeletionDefinition

)

}

override predicate isBarrier(DataFlow::Node node, TaintKind kind) {

kind instanceof Uninitialized and

(

this.definition(node.asVariable())

or

this.use(node.asVariable())

or

this.sanitizingNode(node.asCfgNode())

)

}

private predicate definition(EssaDefinition def) {

def instanceof AssignmentDefinition

or

def instanceof ExceptionCapture

or

def instanceof ParameterDefinition

}

private predicate use(EssaDefinition def) {

exists(def.(EssaNodeRefinement).getInput().getASourceUse())

or

exists(def.(PhiFunction).getAnInput().getASourceUse())

or

exists(def.(EssaEdgeRefinement).getInput().getASourceUse())

}

private predicate sanitizingNode(ControlFlowNode node) {

exists(EssaVariable v |

v.getASourceUse() = node and

not first_use(node, v)

)

}

override predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest) {

/*

* If we are guaranteed to iterate over a loop at least once, then we can prune any edges that

* don't pass through the body.

*/

loop_entry_variables(src.asVariable(), dest.asVariable())

or

exitFunctionGuardedEdge(src.asVariable(), dest.asVariable())

}

}