wip

Author: hvitved

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -15,30 +15,9 @@ private import semmle.code.cpp.ir.IR
 module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
   class SummarizedCallableBase = Function;
 
-  abstract private class SourceSinkBase extends Element {
-    /** Gets the call associated with this element, if any. */
-    CallInstruction getCall() { none() }
+  class SourceBase = Function;
 
-    /** Gets the function associated with this element, if any. */
-    Function getFunction() { none() }
-
-    /** Gets the enclosing function of this element. */
-    abstract Declaration getEnclosingFunction();
-  }
-
-  abstract class SourceBase extends SourceSinkBase { }
-
-  abstract class SinkBase extends SourceSinkBase { }
-
-  private class SourceSinkCall extends SourceBase, SinkBase instanceof Call {
-    CallInstruction call;
-
-    SourceSinkCall() { call.getUnconvertedResultExpression() = this }
-
-    final override CallInstruction getCall() { result = call }
-
-    final override Declaration getEnclosingFunction() { result = Call.super.getEnclosingFunction() }
-  }
+  class SinkBase = Function;
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -151,65 +130,110 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
-private module StepsInput implements Impl::Private::StepsInputSig {
-  Impl::Private::SummaryNode getSummaryNode(Node n) {
-    result = n.(FlowSummaryNode).getSummaryNode()
-  }
+module Input2 implements Impl::Private::InputSig2 {
+  class SourceSinkReportingElement extends Element {
+    private Function getEnclosingFunction() {
+      result = this.(StmtParent).getEnclosingFunction()
+      or
+      this = result.getAParameter()
+    }
 
-  DataFlowCall getACall(Public::SummarizedCallable sc) {
-    result.getStaticCallTarget().getUnderlyingCallable() = sc
+    DataFlowCallable getEnclosingCallable() {
+      result.asSourceCallable() = this.getEnclosingFunction()
+    }
   }
 
-  Node getSourceOutNode(Input::FlowSummaryCallBase call, ReturnKind rk) {
-    exists(IndirectReturnOutNode out | result = out |
-      out.getCallInstruction() = call and
-      pragma[only_bind_out](rk.(NormalReturnKind).getIndirectionIndex()) =
-        pragma[only_bind_out](out.getIndirectionIndex())
+  private SourceSinkReportingElement getSourceSinkArgumentElement(
+    Call call, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Position pos, int i |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      i = pos.getArgumentIndex()
+    |
+      result = call.getArgument(i)
+      or
+      i = -1 and
+      result = call.getQualifier()
     )
   }
 
-  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) {
-    result.asSourceCallable() = source.getEnclosingFunction()
+  SourceSinkReportingElement getSourceEntryElement(
+    Impl::Public::SourceElement source, Impl::Private::SummaryComponentStack s
+  ) {
+    s.headOfSingleton() = Impl::Private::SummaryComponent::return(_) and
+    result.(Call).getTarget() = source
+    or
+    exists(Position pos, Function f |
+      s.head() = Impl::Private::SummaryComponent::parameter(pos) and
+      result = f.getParameter(pos.getArgumentIndex())
+    |
+      // TODO: callbacks
+      // exists(Call call |
+      //   call.getTarget() = source and
+      //   f = getSourceSinkArgumentElement(call, s.tail().headOfSingleton())
+      // )
+      // or
+      s.length() = 1 and
+      f = source
+    )
+    or
+    exists(Call call |
+      call.getTarget() = source and
+      result = getSourceSinkArgumentElement(call, s.headOfSingleton())
+    )
   }
 
-  private ArgumentNode getSourceNodeArgument(
-    Input::SourceBase source, Impl::Private::SummaryComponent sc
-  ) {
+  private ArgumentNode getSourceNodeArgument(Call c, Impl::Private::SummaryComponent sc) {
     exists(Position pos, DataFlowCall call |
       sc = Impl::Private::SummaryComponent::argument(pos) and
-      source.getCall() = call.asCallInstruction() and
+      c = call.asCallInstruction().getUnconvertedResultExpression() and
       result.argumentOf(call, pos)
     )
   }
 
-  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
+  bindingset[e, s]
+  Node getSourceExitNode(SourceSinkReportingElement e, Impl::Private::SummaryComponentStack s) {
     exists(ReturnKind rk, DataFlowCall call |
       s.head() = Impl::Private::SummaryComponent::return(rk) and
-      source.getCall() = call.asCallInstruction() and
+      call.asCallInstruction().getUnconvertedResultExpression() = e and
       result = getAnOutNode(call, rk)
     )
     or
-    exists(Position pos, DataFlowCallable callable |
-      s.head() = Impl::Private::SummaryComponent::parameter(pos) and
-      result.(ParameterNode).isParameterOf(callable, pos)
-    |
-      exists(ArgumentNode arg, DataFlowCall call |
-        arg = getSourceNodeArgument(source, s.tail().headOfSingleton()) and
-        arg.argumentOf(call, pos) and
-        callable = call.getStaticCallTarget()
-      )
-      or
-      source.getFunction() = callable.asSourceCallable()
-    )
+    result.(ParameterNode).getParameter() = e
     or
-    exists(Position pos |
-      s.head() = Impl::Private::SummaryComponent::argument(pos) and
-      result.(PostUpdateNode).getPreUpdateNode() =
-        getSourceNodeArgument(source, s.headOfSingleton())
+    exists(Call call, Impl::Private::SummaryComponent arg |
+      arg = s.headOfSingleton() and
+      e = getSourceSinkArgumentElement(call, arg) and
+      result.(PostUpdateNode).getPreUpdateNode() = getSourceNodeArgument(call, arg)
     )
   }
 
-  Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
+  bindingset[e, sc]
+  Node getSinkEntryNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) { none() }
+
+  SourceSinkReportingElement getSinkExitElement(
+    Impl::Public::SinkElement sink, Impl::Private::SummaryComponent sc
+  ) {
+    none()
+  }
+}
+
+private import Impl::Private::Make2<Input2> as Impl2
+
+private module StepsInput implements Impl2::StepsInputSig {
+  Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
+
+  DataFlowCall getACall(Public::SummarizedCallable sc) {
+    result.getStaticCallTarget().getUnderlyingCallable() = sc
+  }
+
+  Node getSourceOutNode(Input::FlowSummaryCallBase call, ReturnKind rk) {
+    exists(IndirectReturnOutNode out | result = out |
+      out.getCallInstruction() = call and
+      pragma[only_bind_out](rk.(NormalReturnKind).getIndirectionIndex()) =
+        pragma[only_bind_out](out.getIndirectionIndex())
+    )
+  }
 }
 
 module SourceSinkInterpretationInput implements
@@ -326,8 +350,9 @@ module SourceSinkInterpretationInput implements
 
 module Private {
   import Impl::Private
+  import Impl2
 
-  module Steps = Impl::Private::Steps<StepsInput>;
+  module Steps = Impl2::Steps<StepsInput>;
 
   module External {
     import Impl::Private::External
@@ -367,17 +392,17 @@ module Private {
 
 module Public = Impl::Public;
 
-private class SourceModelCall extends Public::SourceElement instanceof Call {
+private class SourceModel extends Public::SourceElement {
   private string namespace;
   private string type;
   private boolean subtypes;
   private string name;
   private string signature;
   private string ext;
 
-  SourceModelCall() {
+  SourceModel() {
     sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
-    this.getTarget() = interpretElement(namespace, type, subtypes, name, signature, ext)
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
   }
 
   override predicate isSource(

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

@@ -1527,23 +1527,6 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
    */
   FlowSummaryImpl::Private::SummaryNode getSummaryNode() { this = TFlowSummaryNode(result) }
 
-  /**
-   * Gets the summarized callable that this node belongs to.
-   */
-  FlowSummaryImpl::Public::SummarizedCallable getSummarizedCallable() {
-    result = this.getSummaryNode().getSummarizedCallable()
-  }
-
-  /** Gets the source element that this node belongs to, if any. */
-  FlowSummaryImpl::Public::SourceElement getSourceElement() {
-    result = this.getSummaryNode().getSourceElement()
-  }
-
-  /** Gets the sink element that this node belongs to, if any. */
-  FlowSummaryImpl::Public::SinkElement getSinkElement() {
-    result = this.getSummaryNode().getSinkElement()
-  }
-
   /** Holds if this node is a source node of kind `kind`. */
   predicate isSource(string kind, string model) {
     this.getSummaryNode().(FlowSummaryImpl::Private::SourceOutputNode).isEntry(kind, model)
@@ -1559,21 +1542,10 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
    * summarized function this node is part of.
    */
   override DataFlowCallable getEnclosingCallable() {
-    result = FlowSummaryImpl::Private::getEnclosingCallable(this.getSummaryNode())
-    or
-    // TODO: This could actually be done by the shared library.
-    result.asSourceCallable() = this.getSourceElement().getEnclosingFunction()
-    or
-    result.asSourceCallable() = this.getSinkElement().getEnclosingFunction()
+    result = this.getSummaryNode().getEnclosingCallable()
   }
 
-  override Location getLocationImpl() {
-    result = this.getSummarizedCallable().getLocation()
-    or
-    result = this.getSourceElement().getLocation()
-    or
-    result = this.getSinkElement().getLocation()
-  }
+  override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
 
   override string toStringImpl() { result = this.getSummaryNode().toString() }
 }
@@ -1815,7 +1787,7 @@ class SummaryParameterNode extends AbstractParameterNode, FlowSummaryNode {
   override predicate isSummaryParameterOf(
     FlowSummaryImpl::Public::SummarizedCallable c, ParameterPosition p
   ) {
-    c = this.getSummarizedCallable() and
+    c = this.getSummaryNode().getSummarizedCallable() and
     p = this.getPosition()
   }
 }