FilesExpand file tree

 main

/

strings.qll

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

54 lines (45 loc) · 1.74 KB

 main

/

strings.qll

Copy path

Top

File metadata and controls

• Code
• Blame

54 lines (45 loc) · 1.74 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

import python

predicate format_string(StrConst e) {

exists(BinaryExpr b | b.getOp() instanceof Mod and b.getLeft() = e)

}

predicate mapping_format(StrConst e) {

conversion_specifier(e, _).regexpMatch("%\\([A-Z_a-z0-9]+\\).*")

}

/*

* MAPPING_KEY = "(\\([^)]+\\))?"

* CONVERSION_FLAGS = "[#0\\- +]?"

* MINIMUM_FIELD_WIDTH = "(\\*|[0-9]*)"

* PRECISION = "(\\.(\\*|[0-9]*))?"

* LENGTH_MODIFIER = "[hlL]?"

* TYPE = "[bdiouxXeEfFgGcrs%]"

*/

private string conversion_specifier_string(StrConst e, int number, int position) {

exists(string s, string REGEX | s = e.getText() |

REGEX = "%(\\([^)]*\\))?[#0\\- +]*(\\*|[0-9]*)(\\.(\\*|[0-9]*))?(h|H|l|L)?[badiouxXeEfFgGcrs%]" and

result = s.regexpFind(REGEX, number, position)

)

}

private string conversion_specifier(StrConst e, int number) {

result = conversion_specifier_string(e, number, _) and result != "%%"

}

int illegal_conversion_specifier(StrConst e) {

format_string(e) and

"%" = e.getText().charAt(result) and

// not the start of a conversion specifier or the second % of a %%

not exists(conversion_specifier_string(e, _, result)) and

not exists(conversion_specifier_string(e, _, result - 1))

}

/** Gets the number of format items in a format string */

int format_items(StrConst e) {

result =

count(int i | | conversion_specifier(e, i)) +

// a conversion specifier uses an extra item for each *

count(int i, int j | conversion_specifier(e, i).charAt(j) = "*")

}

private string str(Expr e) {

result = e.(Num).getN()

or

result = "'" + e.(StrConst).getText() + "'"

}

/** Gets a string representation of an expression more suited for embedding in message strings than .toString() */

string repr(Expr e) { if exists(str(e)) then result = str(e) else result = e.toString() }