Skip to content

Commit 0c95ab2

Browse files
aschackmullaschackmull
authored
Merge pull request github#12474 from hvitved/dataflow/call-back-post-update
Data flow: Synthesize post-update nodes for callback arguments inside summarized callables
2 parents 6e75df4 + 32a699e commit 0c95ab2

File tree

12 files changed

+49
-31
lines changed

12 files changed

+49
-31
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ module Private {
301301
TWithoutContentSummaryComponent(ContentSet c) or
302302
TWithContentSummaryComponent(ContentSet c)
303303

304-
private TParameterSummaryComponent thisParam() {
305-
result = TParameterSummaryComponent(instanceParameterPosition())
304+
private TParameterSummaryComponent callbackSelfParam() {
305+
result = TParameterSummaryComponent(callbackSelfParameterPosition())
306306
}
307307

308308
newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
311311
any(RequiredSummaryComponentStack x).required(head, tail)
312312
or
313313
any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
314-
head = thisParam()
314+
head = callbackSelfParam()
315315
or
316316
derivedFluentFlowPush(_, _, _, head, tail, _)
317317
}
@@ -336,7 +336,7 @@ module Private {
336336
callbackRef = s.drop(_) and
337337
(isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
338338
input = callbackRef.tail() and
339-
output = TConsSummaryComponentStack(thisParam(), input) and
339+
output = TConsSummaryComponentStack(callbackSelfParam(), input) and
340340
preservesValue = true
341341
)
342342
or
@@ -439,6 +439,9 @@ module Private {
439439
out.head() = TParameterSummaryComponent(_) and
440440
s = out.tail()
441441
)
442+
or
443+
// Add the post-update node corresponding to the requested argument node
444+
outputState(c, s) and isCallbackParameter(s)
442445
}
443446

444447
private newtype TSummaryNodeState =

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class SummarizedCallableBase extends Callable {
2222
DataFlowCallable inject(SummarizedCallable c) { result.asSummarizedCallable() = c }
2323

2424
/** Gets the parameter position of the instance parameter. */
25-
ArgumentPosition instanceParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
25+
ArgumentPosition callbackSelfParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
2626

2727
/** Gets the synthesized summary data-flow node for the given values. */
2828
Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ module Private {
301301
TWithoutContentSummaryComponent(ContentSet c) or
302302
TWithContentSummaryComponent(ContentSet c)
303303

304-
private TParameterSummaryComponent thisParam() {
305-
result = TParameterSummaryComponent(instanceParameterPosition())
304+
private TParameterSummaryComponent callbackSelfParam() {
305+
result = TParameterSummaryComponent(callbackSelfParameterPosition())
306306
}
307307

308308
newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
311311
any(RequiredSummaryComponentStack x).required(head, tail)
312312
or
313313
any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
314-
head = thisParam()
314+
head = callbackSelfParam()
315315
or
316316
derivedFluentFlowPush(_, _, _, head, tail, _)
317317
}
@@ -336,7 +336,7 @@ module Private {
336336
callbackRef = s.drop(_) and
337337
(isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
338338
input = callbackRef.tail() and
339-
output = TConsSummaryComponentStack(thisParam(), input) and
339+
output = TConsSummaryComponentStack(callbackSelfParam(), input) and
340340
preservesValue = true
341341
)
342342
or
@@ -439,6 +439,9 @@ module Private {
439439
out.head() = TParameterSummaryComponent(_) and
440440
s = out.tail()
441441
)
442+
or
443+
// Add the post-update node corresponding to the requested argument node
444+
outputState(c, s) and isCallbackParameter(s)
442445
}
443446

444447
private newtype TSummaryNodeState =

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ class SummarizedCallableBase = Callable;
2020
DataFlowCallable inject(SummarizedCallable c) { result.asCallable() = c }
2121

2222
/** Gets the parameter position of the instance parameter. */
23-
ArgumentPosition instanceParameterPosition() { result = -1 }
23+
ArgumentPosition callbackSelfParameterPosition() { result = -1 }
2424

2525
/** Gets the textual representation of a parameter position in the format used for flow summaries. */
2626
string getParameterPosition(ParameterPosition pos) { result = pos.toString() }

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ module Private {
301301
TWithoutContentSummaryComponent(ContentSet c) or
302302
TWithContentSummaryComponent(ContentSet c)
303303

304-
private TParameterSummaryComponent thisParam() {
305-
result = TParameterSummaryComponent(instanceParameterPosition())
304+
private TParameterSummaryComponent callbackSelfParam() {
305+
result = TParameterSummaryComponent(callbackSelfParameterPosition())
306306
}
307307

308308
newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
311311
any(RequiredSummaryComponentStack x).required(head, tail)
312312
or
313313
any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
314-
head = thisParam()
314+
head = callbackSelfParam()
315315
or
316316
derivedFluentFlowPush(_, _, _, head, tail, _)
317317
}
@@ -336,7 +336,7 @@ module Private {
336336
callbackRef = s.drop(_) and
337337
(isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
338338
input = callbackRef.tail() and
339-
output = TConsSummaryComponentStack(thisParam(), input) and
339+
output = TConsSummaryComponentStack(callbackSelfParam(), input) and
340340
preservesValue = true
341341
)
342342
or
@@ -439,6 +439,9 @@ module Private {
439439
out.head() = TParameterSummaryComponent(_) and
440440
s = out.tail()
441441
)
442+
or
443+
// Add the post-update node corresponding to the requested argument node
444+
outputState(c, s) and isCallbackParameter(s)
442445
}
443446

444447
private newtype TSummaryNodeState =

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ private module SyntheticGlobals {
2424
DataFlowCallable inject(SummarizedCallable c) { result.asSummarizedCallable() = c }
2525

2626
/** Gets the parameter position of the instance parameter. */
27-
ArgumentPosition instanceParameterPosition() { result = -1 }
27+
ArgumentPosition callbackSelfParameterPosition() { result = -1 }
2828

2929
/** Gets the synthesized summary data-flow node for the given values. */
3030
Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = getSummaryNode(c, state) }

‎python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ module Private {
301301
TWithoutContentSummaryComponent(ContentSet c) or
302302
TWithContentSummaryComponent(ContentSet c)
303303

304-
private TParameterSummaryComponent thisParam() {
305-
result = TParameterSummaryComponent(instanceParameterPosition())
304+
private TParameterSummaryComponent callbackSelfParam() {
305+
result = TParameterSummaryComponent(callbackSelfParameterPosition())
306306
}
307307

308308
newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
311311
any(RequiredSummaryComponentStack x).required(head, tail)
312312
or
313313
any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
314-
head = thisParam()
314+
head = callbackSelfParam()
315315
or
316316
derivedFluentFlowPush(_, _, _, head, tail, _)
317317
}
@@ -336,7 +336,7 @@ module Private {
336336
callbackRef = s.drop(_) and
337337
(isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
338338
input = callbackRef.tail() and
339-
output = TConsSummaryComponentStack(thisParam(), input) and
339+
output = TConsSummaryComponentStack(callbackSelfParam(), input) and
340340
preservesValue = true
341341
)
342342
or
@@ -439,6 +439,9 @@ module Private {
439439
out.head() = TParameterSummaryComponent(_) and
440440
s = out.tail()
441441
)
442+
or
443+
// Add the post-update node corresponding to the requested argument node
444+
outputState(c, s) and isCallbackParameter(s)
442445
}
443446

444447
private newtype TSummaryNodeState =

‎python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ class SummarizedCallableBase = string;
4545
DataFlowCallable inject(SummarizedCallable c) { result.asLibraryCallable() = c }
4646

4747
/** Gets the parameter position of the instance parameter. */
48-
ArgumentPosition instanceParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
48+
ArgumentPosition callbackSelfParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
4949

5050
/** Gets the synthesized summary data-flow node for the given values. */
5151
Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ module Private {
301301
TWithoutContentSummaryComponent(ContentSet c) or
302302
TWithContentSummaryComponent(ContentSet c)
303303

304-
private TParameterSummaryComponent thisParam() {
305-
result = TParameterSummaryComponent(instanceParameterPosition())
304+
private TParameterSummaryComponent callbackSelfParam() {
305+
result = TParameterSummaryComponent(callbackSelfParameterPosition())
306306
}
307307

308308
newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
311311
any(RequiredSummaryComponentStack x).required(head, tail)
312312
or
313313
any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
314-
head = thisParam()
314+
head = callbackSelfParam()
315315
or
316316
derivedFluentFlowPush(_, _, _, head, tail, _)
317317
}
@@ -336,7 +336,7 @@ module Private {
336336
callbackRef = s.drop(_) and
337337
(isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
338338
input = callbackRef.tail() and
339-
output = TConsSummaryComponentStack(thisParam(), input) and
339+
output = TConsSummaryComponentStack(callbackSelfParam(), input) and
340340
preservesValue = true
341341
)
342342
or
@@ -439,6 +439,9 @@ module Private {
439439
out.head() = TParameterSummaryComponent(_) and
440440
s = out.tail()
441441
)
442+
or
443+
// Add the post-update node corresponding to the requested argument node
444+
outputState(c, s) and isCallbackParameter(s)
442445
}
443446

444447
private newtype TSummaryNodeState =

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImplSpecific.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ class SummarizedCallableBase = string;
1515

1616
DataFlowCallable inject(SummarizedCallable c) { result.asLibraryCallable() = c }
1717

18-
/** Gets the parameter position of the instance parameter. */
19-
ArgumentPosition instanceParameterPosition() { none() } // disables implicit summary flow to `self` for callbacks
18+
/** Gets the parameter position representing a callback itself, if any. */
19+
ArgumentPosition callbackSelfParameterPosition() { none() } // disables implicit summary flow to `self` for callbacks
2020

2121
/** Gets the synthesized summary data-flow node for the given values. */
2222
Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }

0 commit comments

Comments
 (0)