Skip to content

C++: Fix cartesian-like join in ExternalFlow.qll #20783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 10, 2025
+207 −19,685
Merged

C++: Fix cartesian-like join in ExternalFlow.qll #20783

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a922d50
C++: Factor out some conjuncts from 'interpretElement0' and into a ne…
MathiasVP Nov 8, 2025
bfe2b7d
C++: Use the new predicate to remove a cartesian-like join.
MathiasVP Nov 8, 2025
3d6b3a3
C++: Also join on the 'namespace'.
MathiasVP Nov 8, 2025
dfdc2a6
C++: Delete an incorrect comment.
MathiasVP Nov 8, 2025
29a294f
C++: Bind the columns inside the predicate instead of relying on 'bin…
MathiasVP Nov 10, 2025
7b052e2
Merge branch 'main' into fix-cp-in-external-flow
MathiasVP Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 23 additions & 15 deletions cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -656,6 +656,7 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
* Normalize the `n`'th parameter of `f` by replacing template names
* with `class:N` (where `N` is the index of the template).
*/
pragma[nomagic]
private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining) {
// If there is a declaring type then we start by expanding the function templates
exists(Class template |
Expand Down Expand Up @@ -727,6 +728,7 @@ private string getSignatureWithoutClassTemplateNames(
* - The `remaining` number of template arguments in `partiallyNormalizedSignature`
* with their index in `nameArgs`.
*/
pragma[nomagic]
private string getSignatureWithoutFunctionTemplateNames(
string partiallyNormalizedSignature, string typeArgs, string nameArgs, int remaining
) {
Expand Down Expand Up @@ -770,6 +772,7 @@ private string getSignatureWithoutFunctionTemplateNames(
* ```
* In this case, `normalizedSignature` will be `"(const func:0 &,int,class:1,class:0 *)"`.
*/
pragma[nomagic]
private predicate elementSpecWithArguments(
string signature, string type, string name, string normalizedSignature, string typeArgs,
string nameArgs
Expand All @@ -795,23 +798,26 @@ private string getSignatureParameterName(string signature, string type, string n
* If `subtypes` is `true` then the result may be an override of the function
* identified by the components.
*/
bindingset[type, name]
pragma[nomagic]
private Function getFunction(string namespace, string type, boolean subtypes, string name) {
funcHasQualifiedName(result, namespace, name) and
subtypes = false and
type = ""
or
exists(Class namedClass, Class classWithMethod |
hasClassAndName(classWithMethod, result, name) and
classHasQualifiedName(namedClass, namespace, type)
|
// member declared in the named type or a subtype of it
subtypes = true and
classWithMethod = namedClass.getADerivedClass*()
or
// member declared directly in the named type
elementSpec(namespace, type, subtypes, name, _, _) and
(
funcHasQualifiedName(result, namespace, name) and
subtypes = false and
classWithMethod = namedClass
type = ""
or
exists(Class namedClass, Class classWithMethod |
hasClassAndName(classWithMethod, result, name) and
classHasQualifiedName(namedClass, namespace, type)
|
// member declared in the named type or a subtype of it
subtypes = true and
classWithMethod = namedClass.getADerivedClass*()
or
// member declared directly in the named type
subtypes = false and
classWithMethod = namedClass
)
)
}

Expand All @@ -838,6 +844,7 @@ private Function getFunction(string namespace, string type, boolean subtypes, st
* is `func:n` then the signature name is compared with the `n`'th name
* in `name`.
*/
pragma[nomagic]
private predicate signatureMatches(
Function func, string namespace, string signature, string type, string name, int i
) {
Expand Down Expand Up @@ -912,6 +919,7 @@ private predicate parseParens(string s, string betweenParens) { s = "(" + betwee
* - `signatureWithoutParens` equals `signature`, but with the surrounding
* parentheses removed.
*/
pragma[nomagic]
private predicate elementSpecWithArguments0(
string signature, string type, string name, string signatureWithoutParens, string typeArgs,
string nameArgs
Expand Down
1 change: 0 additions & 1 deletion cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,6 @@ signatureMatches
| stl.h:678:33:678:38 | format | std | (format_string,Args &&) | | format<Args> | 0 |
| stl.h:678:33:678:38 | format | std | (format_string,Args &&) | | format<Args> | 1 |
| stl.h:678:33:678:38 | format | std | (format_string,Args &&) | | format<Args> | 1 |
| taint.cpp:735:7:735:12 | malloc | | (size_t) | | malloc | 0 |
Copy link
Contributor Author

@MathiasVP MathiasVP Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is expected since the signatureMatches predicate now has its columns restricted to only functions for which we have a MaD row. And since we don't have any MaD summary for malloc this signatureMatches result disappears

| taint.cpp:847:5:847:11 | toupper | | (int) | | toupper | 0 |
| taint.cpp:848:5:848:11 | tolower | | (int) | | tolower | 0 |
getSignatureParameterName
Expand Down