C++: Support for access path at sources and sinks.

Author: hvitved

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -115,6 +115,7 @@ private import new.DataFlow
 private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes as Nodes
 private import internal.FlowSummaryImpl
 private import internal.FlowSummaryImpl::Public
 private import internal.FlowSummaryImpl::Private
@@ -952,9 +953,7 @@ private module Cached {
    */
   cached
   predicate sourceNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSourceNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSource(kind, model)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -13,15 +13,11 @@ private import semmle.code.cpp.dataflow.ExternalFlow
 private import semmle.code.cpp.ir.IR
 
 module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
-  private import codeql.util.Void
-
   class SummarizedCallableBase = Function;
 
-  class SourceBase extends Void {
-    Location getLocation() { none() }
-  }
+  class SourceBase = Function;
 
-  class SinkBase = SourceBase;
+  class SinkBase = Function;
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -134,35 +130,92 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
-private module Input2 implements Impl::Private::InputSig2 {
-  private import codeql.util.Void
+module Input2 implements Impl::Private::InputSig2 {
+  class SourceSinkReportingElement extends Element {
+    private Function getEnclosingFunction() {
+      result = this.(StmtParent).getEnclosingFunction()
+      or
+      this = result.getAParameter()
+    }
 
-  class SourceSinkReportingElement extends Void {
-    Location getLocation() { none() }
+    DataFlowCallable getEnclosingCallable() {
+      result.asSourceCallable() = this.getEnclosingFunction()
+    }
+  }
 
-    DataFlowCallable getEnclosingCallable() { none() }
+  private SourceSinkReportingElement getSourceSinkArgumentElement(
+    Call call, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Position pos, int i |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      i = pos.getArgumentIndex()
+    |
+      result = call.getArgument(i)
+      or
+      i = -1 and
+      result = call.getQualifier()
+    )
   }
 
-  bindingset[source, s]
   SourceSinkReportingElement getSourceEntryElement(
     Impl::Public::SourceElement source, Impl::Private::SummaryComponentStack s
   ) {
-    none()
+    s.headOfSingleton() = Impl::Private::SummaryComponent::return(_) and
+    result.(Call).getTarget() = source
+    or
+    exists(Position pos, Function f |
+      s.head() = Impl::Private::SummaryComponent::parameter(pos) and
+      result = f.getParameter(pos.getArgumentIndex())
+    |
+      // TODO: callbacks
+      // exists(Call call |
+      //   call.getTarget() = source and
+      //   f = getSourceSinkArgumentElement(call, s.tail().headOfSingleton())
+      // )
+      // or
+      s.length() = 1 and
+      f = source
+    )
+    or
+    exists(Call call |
+      call.getTarget() = source and
+      result = getSourceSinkArgumentElement(call, s.headOfSingleton())
+    )
+  }
+
+  private ArgumentNode getSourceNodeArgument(Call c, Impl::Private::SummaryComponent sc) {
+    exists(Position pos, DataFlowCall call |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      c = call.asCallInstruction().getUnconvertedResultExpression() and
+      result.argumentOf(call, pos)
+    )
   }
 
   bindingset[e, s]
   Node getSourceExitNode(SourceSinkReportingElement e, Impl::Private::SummaryComponentStack s) {
-    none()
+    exists(ReturnKind rk, DataFlowCall call |
+      s.head() = Impl::Private::SummaryComponent::return(rk) and
+      call.asCallInstruction().getUnconvertedResultExpression() = e and
+      result = getAnOutNode(call, rk)
+    )
+    or
+    result.(ParameterNode).getParameter() = e
+    or
+    exists(Call call, Impl::Private::SummaryComponent arg |
+      arg = s.headOfSingleton() and
+      e = getSourceSinkArgumentElement(call, arg) and
+      result.(PostUpdateNode).getPreUpdateNode() = getSourceNodeArgument(call, arg)
+    )
   }
 
+  bindingset[e, sc]
+  Node getSinkEntryNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) { none() }
+
   SourceSinkReportingElement getSinkExitElement(
     Impl::Public::SinkElement sink, Impl::Private::SummaryComponent sc
   ) {
     none()
   }
-
-  bindingset[e, sc]
-  Node getSinkEntryNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) { none() }
 }
 
 private import Impl::Private::Make2<Input2> as Impl2
@@ -338,3 +391,23 @@ module Private {
 }
 
 module Public = Impl::Public;
+
+private class SourceModel extends Public::SourceElement {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SourceModel() {
+    sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSource(
+    string output, string kind, Public::Provenance provenance, string model
+  ) {
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model)
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

@@ -1527,13 +1527,20 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
    */
   FlowSummaryImpl::Private::SummaryNode getSummaryNode() { this = TFlowSummaryNode(result) }
 
-  /**
-   * Gets the summarized callable that this node belongs to.
-   */
-  FlowSummaryImpl::Public::SummarizedCallable getSummarizedCallable() {
-    result = this.getSummaryNode().getSummarizedCallable()
+  /** Holds if this node is a source node of kind `kind`. */
+  predicate isSource(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SourceOutputNode).isEntry(kind, model)
+  }
+
+  /** Holds if this node is a sink node of kind `kind`. */
+  predicate isSink(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SinkInputNode).isExit(kind, model)
   }
 
+  /**
+   * Gets the enclosing callable. For a `FlowSummaryNode` this is always the
+   * summarized function this node is part of.
+   */
   override DataFlowCallable getEnclosingCallable() {
     result = this.getSummaryNode().getEnclosingCallable()
   }
@@ -1780,7 +1787,7 @@ class SummaryParameterNode extends AbstractParameterNode, FlowSummaryNode {
   override predicate isSummaryParameterOf(
     FlowSummaryImpl::Public::SummarizedCallable c, ParameterPosition p
   ) {
-    c = this.getSummarizedCallable() and
+    c = this.getSummaryNode().getSummarizedCallable() and
     p = this.getPosition()
   }
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -121,6 +121,8 @@ private module Cached {
     // models-as-data summarized flow
     FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
       n2.(FlowSummaryNode).getSummaryNode())
+    or
+    FlowSummaryImpl::Private::Steps::sourceJumpStep(n1.(FlowSummaryNode).getSummaryNode(), n2)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -160,6 +160,12 @@ private module Cached {
     // models-as-data summarized flow
     FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
       nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
+    or
+    FlowSummaryImpl::Private::Steps::sourceLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
+      nodeTo, model)
+    or
+    FlowSummaryImpl::Private::Steps::sinkLocalStep(nodeFrom,
+      nodeTo.(FlowSummaryNode).getSummaryNode(), model)
   }
 
   private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {