Skip to content

Commit cd52087

Browse files
author
Alvaro Muñoz
authored
Merge pull request #33 from GitHubSecurityLab/fix_csharp_asPartialModel
Refactor Partial Path Queries
2 parents 1e9f745 + 5faa61a commit cd52087

19 files changed

+110
-74
lines changed

‎cpp/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlowRev(n, _, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎cpp/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlow(_, n, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎cpp/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2727

2828
int explorationLimit() { result = 10 }
2929

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
30+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3131

3232
from PartialFlow::PartialPathNode n, int dist
3333
where
34-
PartialFlow::partialFlowRev(n, _, dist) and
34+
PartialFlow::partialFlow(n, _, dist) and
3535
n.getNode() instanceof DataFlow::ParameterNode
3636
select dist, n

‎csharp/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlowRev(n, _, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎csharp/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlow(_, n, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎csharp/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2727

2828
int explorationLimit() { result = 10 }
2929

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
30+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3131

3232
from PartialFlow::PartialPathNode n, int dist
3333
where
34-
PartialFlow::partialFlowRev(n, _, dist) and
34+
PartialFlow::partialFlow(n, _, dist) and
3535
exists(Parameter p | n.getNode().asParameter() = p)
3636
select dist, n

‎csharp/src/library_sources/ExternalAPIsQuery.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ private import semmle.code.csharp.dataflow.flowsources.Remote
99
private import semmle.code.csharp.frameworks.System
1010
private import semmle.code.csharp.dataflow.FlowSummary
1111
// SECLAB: Import CSV utils
12-
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate as DataFlowPrivate
12+
private import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
1313

1414
// SECLAB: Import Csv::asPartialModel
15-
predicate asPartialModel = DataFlowPrivate::Csv::asPartialModel/1;
15+
predicate asPartialModel = ExternalFlow::asPartialModel/1;
1616

1717
/**
1818
* A callable that is considered a "safe" external API from a security perspective.

‎go/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlowRev(n, _, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎go/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlow(_, n, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎go/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Make<..
2727

2828
int explorationLimit() { result = 10 }
2929

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
30+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3131

3232
from PartialFlow::PartialPathNode n, int dist
3333
where
34-
PartialFlow::partialFlowRev(n, _, dist) and
34+
PartialFlow::partialFlow(n, _, dist) and
3535
n.getNode() instanceof DataFlow::ParameterNode
3636
select dist, n

‎java/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -28,8 +30,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2830

2931
int explorationLimit() { result = 10 }
3032

31-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
33+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3234

33-
from PartialFlow::PartialPathNode n, int dist
34-
where PartialFlow::partialFlowRev(n, _, dist)
35-
select dist, n
35+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
36+
where PartialFlow::partialFlow(source, sink, _)
37+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
38+
"this source"

‎java/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -28,8 +30,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2830

2931
int explorationLimit() { result = 10 }
3032

31-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
33+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3234

33-
from PartialFlow::PartialPathNode n, int dist
34-
where PartialFlow::partialFlow(_, n, dist)
35-
select dist, n
35+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
36+
where PartialFlow::partialFlow(source, sink, _)
37+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
38+
"this source"

‎java/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2828

2929
int explorationLimit() { result = 10 }
3030

31-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3232

3333
from PartialFlow::PartialPathNode n, int dist
3434
where
35-
PartialFlow::partialFlowRev(n, _, dist) and
35+
PartialFlow::partialFlow(n, _, dist) and
3636
n.getNode() instanceof DataFlow::ExplicitParameterNode
3737
select dist, n

‎python/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -32,8 +34,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
3234

3335
int explorationLimit() { result = 10 }
3436

35-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
37+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3638

37-
from PartialFlow::PartialPathNode n, int dist
38-
where PartialFlow::partialFlowRev(n, _, dist)
39-
select dist, n
39+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
40+
where PartialFlow::partialFlow(source, sink, _)
41+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
42+
"this source"

‎python/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -29,8 +31,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2931

3032
int explorationLimit() { result = 10 }
3133

32-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
34+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3335

34-
from PartialFlow::PartialPathNode n, int dist
35-
where PartialFlow::partialFlow(_, n, dist)
36-
select dist, n
36+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
37+
where PartialFlow::partialFlow(source, sink, _)
38+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
39+
"this source"

‎python/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2828

2929
int explorationLimit() { result = 10 }
3030

31-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3232

3333
from PartialFlow::PartialPathNode n, int dist
3434
where
35-
PartialFlow::partialFlowRev(n, _, dist) and
35+
PartialFlow::partialFlow(n, _, dist) and
3636
n.getNode() instanceof DataFlow::ParameterNode
3737
select dist, n

‎ruby/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Backwards Partial Dataflow
33
* @description Backwards Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/backwards-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlowRev(n, _, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎ruby/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Forward Partial Dataflow
33
* @description Forward Partial Dataflow
4-
* @kind table
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
57
* @id githubsecuritylab/forward-partial-dataflow
68
* @tags template
79
*/
@@ -27,8 +29,9 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2729

2830
int explorationLimit() { result = 10 }
2931

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
32+
private module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
3133

32-
from PartialFlow::PartialPathNode n, int dist
33-
where PartialFlow::partialFlow(_, n, dist)
34-
select dist, n
34+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
35+
where PartialFlow::partialFlow(source, sink, _)
36+
select sink.getNode(), source, sink, "This node receives taint from $@.", source.getNode(),
37+
"this source"

‎ruby/src/audit/templates/HoistSink.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<
2727

2828
int explorationLimit() { result = 10 }
2929

30-
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
30+
private module PartialFlow = MyFlow::FlowExplorationRev<explorationLimit/0>;
3131

3232
from PartialFlow::PartialPathNode n, int dist
3333
where
34-
PartialFlow::partialFlowRev(n, _, dist) and
34+
PartialFlow::partialFlow(n, _, dist) and
3535
n.getNode() instanceof DataFlow::ParameterNode
3636
select dist, n

0 commit comments

Comments
 (0)