C++: Support for access path at sources and sinks.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -115,6 +115,7 @@ private import new.DataFlow
 private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes as Nodes
 private import internal.FlowSummaryImpl
 private import internal.FlowSummaryImpl::Public
 private import internal.FlowSummaryImpl::Private
@@ -952,9 +953,7 @@ private module Cached {
    */
   cached
   predicate sourceNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSourceNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSource(kind, model)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -13,13 +13,32 @@ private import semmle.code.cpp.dataflow.ExternalFlow
 private import semmle.code.cpp.ir.IR
 
 module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
-  private import codeql.util.Void
-
   class SummarizedCallableBase = Function;
 
-  class SourceBase = Void;
+  abstract private class SourceSinkBase extends Element {
+    /** Gets the call associated with this element, if any. */
+    CallInstruction getCall() { none() }
+
+    /** Gets the function associated with this element, if any. */
+    Function getFunction() { none() }
+
+    /** Gets the enclosing function of this element. */
+    abstract Declaration getEnclosingFunction();
+  }
+
+  abstract class SourceBase extends SourceSinkBase { }
+
+  abstract class SinkBase extends SourceSinkBase { }
+
+  private class SourceSinkCall extends SourceBase, SinkBase instanceof Call {
+    CallInstruction call;
+
+    SourceSinkCall() { call.getUnconvertedResultExpression() = this }
 
-  class SinkBase = Void;
+    final override CallInstruction getCall() { result = call }
+
+    final override Declaration getEnclosingFunction() { result = Call.super.getEnclosingFunction() }
+  }
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -149,9 +168,46 @@ private module StepsInput implements Impl::Private::StepsInputSig {
     )
   }
 
-  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
+  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) {
+    result.asSourceCallable() = source.getEnclosingFunction()
+  }
+
+  private ArgumentNode getSourceNodeArgument(
+    Input::SourceBase source, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Position pos, DataFlowCall call |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      source.getCall() = call.asCallInstruction() and
+      result.argumentOf(call, pos)
+    )
+  }
 
-  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
+  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
+    exists(ReturnKind rk, DataFlowCall call |
+      s.head() = Impl::Private::SummaryComponent::return(rk) and
+      source.getCall() = call.asCallInstruction() and
+      result = getAnOutNode(call, rk)
+    )
+    or
+    exists(Position pos, DataFlowCallable callable |
+      s.head() = Impl::Private::SummaryComponent::parameter(pos) and
+      result.(ParameterNode).isParameterOf(callable, pos)
+    |
+      exists(ArgumentNode arg, DataFlowCall call |
+        arg = getSourceNodeArgument(source, s.tail().headOfSingleton()) and
+        arg.argumentOf(call, pos) and
+        callable = call.getStaticCallTarget()
+      )
+      or
+      source.getFunction() = callable.asSourceCallable()
+    )
+    or
+    exists(Position pos |
+      s.head() = Impl::Private::SummaryComponent::argument(pos) and
+      result.(PostUpdateNode).getPreUpdateNode() =
+        getSourceNodeArgument(source, s.headOfSingleton())
+    )
+  }
 
   Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
 }
@@ -310,3 +366,23 @@ module Private {
 }
 
 module Public = Impl::Public;
+
+private class SourceModelCall extends Public::SourceElement instanceof Call {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SourceModelCall() {
+    sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this.getTarget() = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSource(
+    string output, string kind, Public::Provenance provenance, string model
+  ) {
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model)
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

@@ -1534,11 +1534,46 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
     result = this.getSummaryNode().getSummarizedCallable()
   }
 
+  /** Gets the source element that this node belongs to, if any. */
+  FlowSummaryImpl::Public::SourceElement getSourceElement() {
+    result = this.getSummaryNode().getSourceElement()
+  }
+
+  /** Gets the sink element that this node belongs to, if any. */
+  FlowSummaryImpl::Public::SinkElement getSinkElement() {
+    result = this.getSummaryNode().getSinkElement()
+  }
+
+  /** Holds if this node is a source node of kind `kind`. */
+  predicate isSource(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SourceOutputNode).isEntry(kind, model)
+  }
+
+  /** Holds if this node is a sink node of kind `kind`. */
+  predicate isSink(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SinkInputNode).isExit(kind, model)
+  }
+
+  /**
+   * Gets the enclosing callable. For a `FlowSummaryNode` this is always the
+   * summarized function this node is part of.
+   */
   override DataFlowCallable getEnclosingCallable() {
     result = FlowSummaryImpl::Private::getEnclosingCallable(this.getSummaryNode())
+    or
+    // TODO: This could actually be done by the shared library.
+    result.asSourceCallable() = this.getSourceElement().getEnclosingFunction()
+    or
+    result.asSourceCallable() = this.getSinkElement().getEnclosingFunction()
   }
 
-  override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
+  override Location getLocationImpl() {
+    result = this.getSummarizedCallable().getLocation()
+    or
+    result = this.getSourceElement().getLocation()
+    or
+    result = this.getSinkElement().getLocation()
+  }
 
   override string toStringImpl() { result = this.getSummaryNode().toString() }
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -121,6 +121,8 @@ private module Cached {
     // models-as-data summarized flow
     FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
       n2.(FlowSummaryNode).getSummaryNode())
+    or
+    FlowSummaryImpl::Private::Steps::sourceJumpStep(n1.(FlowSummaryNode).getSummaryNode(), n2)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -160,6 +160,12 @@ private module Cached {
     // models-as-data summarized flow
     FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
       nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
+    or
+    FlowSummaryImpl::Private::Steps::sourceLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
+      nodeTo, model)
+    or
+    FlowSummaryImpl::Private::Steps::sinkLocalStep(nodeFrom,
+      nodeTo.(FlowSummaryNode).getSummaryNode(), model)
   }
 
   private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {