unified: Sharpen CFG node for post-updates · github/codeql@1b9cc61 · GitHub
Skip to content

Commit 1b9cc61

Browse files
asgerfasgerf
committed
unified: Sharpen CFG node for post-updates
1 parent 5c00811 commit 1b9cc61

5 files changed

Lines changed: 38 additions & 18 deletions

File tree

‎shared/ssa/codeql/ssa/Ssa.qll‎

Lines changed: 24 additions & 1 deletion

‎unified/ql/lib/codeql/unified/internal/dataflow/DataFlowNode.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ predicate performsVariableAccess(
2727
or
2828
hasIncomingValueAtCfgNode(access, cfgNode) and kind.isWrite()
2929
or
30-
// TODO: Make the SSA library use this CFG node for post-updates. It currently picks the same as the read.
3130
hasPostUpdate(access, cfgNode) and kind.isPostUpdate()
3231
)
3332
or

‎unified/ql/lib/codeql/unified/internal/dataflow/LocalSsa.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ module LocalSsaInput implements InputSig<Location, BasicBlock> {
2727
predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
2828
certain = true and
2929
performsVariableAccess(_, v, TRead(), bb.getNode(i))
30+
or
31+
certain = true and
32+
performsVariableAccess(_, v, TPostUpdate(), bb.getNode(i))
3033
}
3134
}
3235

@@ -58,6 +61,13 @@ module LocalSsaDataFlowInput implements DataFlowIntegrationInputSig {
5861
}
5962

6063
predicate guardDirectlyControlsBlock(Guard guard, BasicBlock bb, GuardValue val) { none() }
64+
65+
predicate postUpdateCfgNode(Expr read, BasicBlock bb, int i) {
66+
exists(LocalVariable var, U::Expr expr |
67+
read = TLocalVariableRefNode(expr, var, TRead()) and
68+
performsVariableAccess(expr, var, TPostUpdate(), bb.getNode(i))
69+
)
70+
}
6171
}
6272

6373
module LocalSsaDataFlowOutput = DataFlowIntegration<LocalSsaDataFlowInput>;

‎unified/ql/test/library-tests/dataflow/implicit-self.swift‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,28 +56,28 @@ class C {
5656

5757
func t9() {
5858
x = "safe";
59-
x += sink(x) + source("t9.1"); // $ SPURIOUS: hasTaintFlow=t9.1
59+
x += sink(x) + source("t9.1");
6060
sink(x); // $ hasTaintFlow=t9.1
6161
sink(self.x); // $ hasTaintFlow=t9.1
6262
}
6363

6464
func t10() {
6565
x = "safe";
66-
self.x += sink(x) + source("t10.1"); // $ SPURIOUS: hasTaintFlow=t10.1
66+
self.x += sink(x) + source("t10.1");
6767
sink(x); // $ hasTaintFlow=t10.1
6868
sink(self.x); // $ hasTaintFlow=t10.1
6969
}
7070

7171
func t11() {
7272
self.x = "safe";
73-
x += sink(x) + source("t11.1"); // $ SPURIOUS: hasTaintFlow=t11.1
73+
x += sink(x) + source("t11.1");
7474
sink(x); // $ hasTaintFlow=t11.1
7575
sink(self.x); // $ hasTaintFlow=t11.1
7676
}
7777

7878
func t12() {
7979
self.x = "safe";
80-
self.x += sink(x) + source("t12.1"); // $ SPURIOUS: hasTaintFlow=t12.1
80+
self.x += sink(x) + source("t12.1");
8181
sink(x); // $ hasTaintFlow=t12.1
8282
sink(self.x); // $ hasTaintFlow=t12.1
8383
}

‎unified/ql/test/library-tests/dataflow/test.expected‎

Lines changed: 0 additions & 12 deletions

0 commit comments

Comments
 (0)