@@ -47,6 +47,20 @@ private predicate defaultSource(DataFlow::Node src) {
4747 src .asExpr ( ) .( MethodAccess ) .getMethod ( ) .getName ( ) = [ "source" , "taint" ]
4848}
4949
50+ private module DefaultFlowConf implements DataFlow:: ConfigSig {
51+ predicate isSource ( DataFlow:: Node n ) { defaultSource ( n ) }
52+
53+ predicate isSink ( DataFlow:: Node n ) {
54+ exists ( MethodAccess ma | ma .getMethod ( ) .hasName ( "sink" ) | n .asExpr ( ) = ma .getAnArgument ( ) )
55+ }
56+
57+ int fieldFlowBranchLimit ( ) { result = 1000 }
58+ }
59+
60+ private module DefaultValueFlow = DataFlow:: Make< DefaultFlowConf > ;
61+
62+ private module DefaultTaintFlow = TaintTracking:: Make< DefaultFlowConf > ;
63+
5064class DefaultValueFlowConf extends DataFlow:: Configuration {
5165 DefaultValueFlowConf ( ) { this = "qltest:defaultValueFlowConf" }
5266
@@ -76,26 +90,47 @@ private string getSourceArgString(DataFlow::Node src) {
7690 src .asExpr ( ) .( MethodAccess ) .getAnArgument ( ) .( StringLiteral ) .getValue ( ) = result
7791}
7892
93+ abstract class EnableLegacyConfiguration extends Unit { }
94+
7995class InlineFlowTest extends InlineExpectationsTest {
8096 InlineFlowTest ( ) { this = "HasFlowTest" }
8197
8298 override string getARelevantTag ( ) { result = [ "hasValueFlow" , "hasTaintFlow" ] }
8399
84100 override predicate hasActualResult ( Location location , string element , string tag , string value ) {
85- tag = "hasValueFlow" and
86- exists ( DataFlow:: Node src , DataFlow:: Node sink | getValueFlowConfig ( ) .hasFlow ( src , sink ) |
87- sink .getLocation ( ) = location and
88- element = sink .toString ( ) and
89- if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
90- )
91- or
92- tag = "hasTaintFlow" and
93- exists ( DataFlow:: Node src , DataFlow:: Node sink |
94- getTaintFlowConfig ( ) .hasFlow ( src , sink ) and not getValueFlowConfig ( ) .hasFlow ( src , sink )
95- |
96- sink .getLocation ( ) = location and
97- element = sink .toString ( ) and
98- if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
101+ if exists ( EnableLegacyConfiguration e )
102+ then
103+ tag = "hasValueFlow" and
104+ exists ( DataFlow:: Node src , DataFlow:: Node sink | getValueFlowConfig ( ) .hasFlow ( src , sink ) |
105+ sink .getLocation ( ) = location and
106+ element = sink .toString ( ) and
107+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
108+ )
109+ or
110+ tag = "hasTaintFlow" and
111+ exists ( DataFlow:: Node src , DataFlow:: Node sink |
112+ getTaintFlowConfig ( ) .hasFlow ( src , sink ) and not getValueFlowConfig ( ) .hasFlow ( src , sink )
113+ |
114+ sink .getLocation ( ) = location and
115+ element = sink .toString ( ) and
116+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
117+ )
118+ else (
119+ tag = "hasValueFlow" and
120+ exists ( DataFlow:: Node src , DataFlow:: Node sink | DefaultValueFlow:: hasFlow ( src , sink ) |
121+ sink .getLocation ( ) = location and
122+ element = sink .toString ( ) and
123+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
124+ )
125+ or
126+ tag = "hasTaintFlow" and
127+ exists ( DataFlow:: Node src , DataFlow:: Node sink |
128+ DefaultTaintFlow:: hasFlow ( src , sink ) and not DefaultValueFlow:: hasFlow ( src , sink )
129+ |
130+ sink .getLocation ( ) = location and
131+ element = sink .toString ( ) and
132+ if exists ( getSourceArgString ( src ) ) then value = getSourceArgString ( src ) else value = ""
133+ )
99134 )
100135 }
101136
0 commit comments