@@ -9,9 +9,9 @@ import semmle.code.cpp.models.interfaces.Iterator
9
9
import semmle.code.cpp.models.interfaces.DataFlow
10
10
11
11
/**
12
- * The `std::basic_string` template class.
12
+ * The `std::basic_string` template class instantiations .
13
13
*/
14
- private class StdBasicString extends TemplateClass {
14
+ private class StdBasicString extends ClassTemplateInstantiation {
15
15
StdBasicString ( ) { this .hasQualifiedName ( "std" , "basic_string" ) }
16
16
}
17
17
@@ -24,7 +24,7 @@ private class StdBasicString extends TemplateClass {
24
24
* ```
25
25
*/
26
26
private class StdStringConstructor extends Constructor , TaintFunction {
27
- StdStringConstructor ( ) { this .getDeclaringType ( ) . hasQualifiedName ( "std" , "basic_string" ) }
27
+ StdStringConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicString }
28
28
29
29
/**
30
30
* Gets the index of a parameter to this function that is a string (or
@@ -69,7 +69,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
69
69
* The `std::string` function `c_str`.
70
70
*/
71
71
private class StdStringCStr extends TaintFunction {
72
- StdStringCStr ( ) { this .hasQualifiedName ( "std" , "basic_string" , " c_str") }
72
+ StdStringCStr ( ) { this .getClassAndName ( " c_str") instanceof StdBasicString }
73
73
74
74
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
75
75
// flow from string itself (qualifier) to return value
@@ -82,7 +82,7 @@ private class StdStringCStr extends TaintFunction {
82
82
* The `std::string` function `data`.
83
83
*/
84
84
private class StdStringData extends TaintFunction {
85
- StdStringData ( ) { this .hasQualifiedName ( "std" , "basic_string" , " data") }
85
+ StdStringData ( ) { this .getClassAndName ( " data") instanceof StdBasicString }
86
86
87
87
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
88
88
// flow from string itself (qualifier) to return value
@@ -100,7 +100,7 @@ private class StdStringData extends TaintFunction {
100
100
* The `std::string` function `push_back`.
101
101
*/
102
102
private class StdStringPush extends TaintFunction {
103
- StdStringPush ( ) { this .hasQualifiedName ( "std" , "basic_string" , " push_back") }
103
+ StdStringPush ( ) { this .getClassAndName ( " push_back") instanceof StdBasicString }
104
104
105
105
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
106
106
// flow from parameter to qualifier
@@ -113,7 +113,7 @@ private class StdStringPush extends TaintFunction {
113
113
* The `std::string` functions `front` and `back`.
114
114
*/
115
115
private class StdStringFrontBack extends TaintFunction {
116
- StdStringFrontBack ( ) { this .hasQualifiedName ( "std" , "basic_string" , [ "front" , "back" ] ) }
116
+ StdStringFrontBack ( ) { this .getClassAndName ( [ "front" , "back" ] ) instanceof StdBasicString }
117
117
118
118
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
119
119
// flow from object to returned reference
@@ -123,12 +123,12 @@ private class StdStringFrontBack extends TaintFunction {
123
123
}
124
124
125
125
/**
126
- * The `std::string` function `operator+`.
126
+ * The (non-member) `std::string` function `operator+`.
127
127
*/
128
128
private class StdStringPlus extends TaintFunction {
129
129
StdStringPlus ( ) {
130
130
this .hasQualifiedName ( "std" , "operator+" ) and
131
- this .getUnspecifiedType ( ) = any ( StdBasicString s ) . getAnInstantiation ( )
131
+ this .getUnspecifiedType ( ) instanceof StdBasicString
132
132
}
133
133
134
134
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
@@ -148,7 +148,7 @@ private class StdStringPlus extends TaintFunction {
148
148
*/
149
149
private class StdStringAppend extends TaintFunction {
150
150
StdStringAppend ( ) {
151
- this .hasQualifiedName ( "std" , "basic_string" , [ "operator+=" , "append" , "insert" , "replace" ] )
151
+ this .getClassAndName ( [ "operator+=" , "append" , "insert" , "replace" ] ) instanceof StdBasicString
152
152
}
153
153
154
154
/**
@@ -190,7 +190,7 @@ private class StdStringAppend extends TaintFunction {
190
190
* The standard function `std::string.assign`.
191
191
*/
192
192
private class StdStringAssign extends TaintFunction {
193
- StdStringAssign ( ) { this .hasQualifiedName ( "std" , "basic_string" , " assign") }
193
+ StdStringAssign ( ) { this .getClassAndName ( " assign") instanceof StdBasicString }
194
194
195
195
/**
196
196
* Gets the index of a parameter to this function that is a string (or
@@ -230,7 +230,7 @@ private class StdStringAssign extends TaintFunction {
230
230
* The standard function `std::string.copy`.
231
231
*/
232
232
private class StdStringCopy extends TaintFunction {
233
- StdStringCopy ( ) { this .hasQualifiedName ( "std" , "basic_string" , " copy") }
233
+ StdStringCopy ( ) { this .getClassAndName ( " copy") instanceof StdBasicString }
234
234
235
235
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
236
236
// copy(dest, num, pos)
@@ -243,7 +243,7 @@ private class StdStringCopy extends TaintFunction {
243
243
* The standard function `std::string.substr`.
244
244
*/
245
245
private class StdStringSubstr extends TaintFunction {
246
- StdStringSubstr ( ) { this .hasQualifiedName ( "std" , "basic_string" , " substr") }
246
+ StdStringSubstr ( ) { this .getClassAndName ( " substr") instanceof StdBasicString }
247
247
248
248
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
249
249
// substr(pos, num)
@@ -252,11 +252,18 @@ private class StdStringSubstr extends TaintFunction {
252
252
}
253
253
}
254
254
255
+ /**
256
+ * The `std::basic_stringstream` template class instantiations.
257
+ */
258
+ private class StdBasicStringStream extends ClassTemplateInstantiation {
259
+ StdBasicStringStream ( ) { this .hasQualifiedName ( "std" , "basic_stringstream" ) }
260
+ }
261
+
255
262
/**
256
263
* The `std::string` functions `at` and `operator[]`.
257
264
*/
258
265
private class StdStringAt extends TaintFunction {
259
- StdStringAt ( ) { this .hasQualifiedName ( "std" , "basic_string" , [ "at" , "operator[]" ] ) }
266
+ StdStringAt ( ) { this .getClassAndName ( [ "at" , "operator[]" ] ) instanceof StdBasicString }
260
267
261
268
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
262
269
// flow from qualifier to referenced return value
@@ -270,17 +277,17 @@ private class StdStringAt extends TaintFunction {
270
277
}
271
278
272
279
/**
273
- * The `std::basic_istream` template class.
280
+ * The `std::basic_istream` template class instantiations .
274
281
*/
275
- private class StdBasicIStream extends TemplateClass {
282
+ private class StdBasicIStream extends ClassTemplateInstantiation {
276
283
StdBasicIStream ( ) { this .hasQualifiedName ( "std" , "basic_istream" ) }
277
284
}
278
285
279
286
/**
280
287
* The `std::istream` function `operator>>` (defined as a member function).
281
288
*/
282
289
private class StdIStreamIn extends DataFlowFunction , TaintFunction {
283
- StdIStreamIn ( ) { this .hasQualifiedName ( "std" , "basic_istream" , " operator>>") }
290
+ StdIStreamIn ( ) { this .getClassAndName ( " operator>>") instanceof StdBasicIStream }
284
291
285
292
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
286
293
// returns reference to `*this`
@@ -305,8 +312,7 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
305
312
private class StdIStreamInNonMember extends DataFlowFunction , TaintFunction {
306
313
StdIStreamInNonMember ( ) {
307
314
this .hasQualifiedName ( "std" , "operator>>" ) and
308
- this .getUnspecifiedType ( ) .( ReferenceType ) .getBaseType ( ) =
309
- any ( StdBasicIStream s ) .getAnInstantiation ( )
315
+ this .getUnspecifiedType ( ) .( ReferenceType ) .getBaseType ( ) instanceof StdBasicIStream
310
316
}
311
317
312
318
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
@@ -331,7 +337,7 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
331
337
*/
332
338
private class StdIStreamGet extends TaintFunction {
333
339
StdIStreamGet ( ) {
334
- this .hasQualifiedName ( "std" , "basic_istream" , [ "get" , "peek" ] ) and
340
+ this .getClassAndName ( [ "get" , "peek" ] ) instanceof StdBasicIStream and
335
341
this .getNumberOfParameters ( ) = 0
336
342
}
337
343
@@ -347,7 +353,7 @@ private class StdIStreamGet extends TaintFunction {
347
353
*/
348
354
private class StdIStreamRead extends DataFlowFunction , TaintFunction {
349
355
StdIStreamRead ( ) {
350
- this .hasQualifiedName ( "std" , "basic_istream" , [ "get" , "read" ] ) and
356
+ this .getClassAndName ( [ "get" , "read" ] ) instanceof StdBasicIStream and
351
357
this .getNumberOfParameters ( ) > 0
352
358
}
353
359
@@ -372,7 +378,7 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
372
378
* The `std::istream` function `readsome`.
373
379
*/
374
380
private class StdIStreamReadSome extends TaintFunction {
375
- StdIStreamReadSome ( ) { this .hasQualifiedName ( "std" , "basic_istream" , " readsome") }
381
+ StdIStreamReadSome ( ) { this .getClassAndName ( " readsome") instanceof StdBasicIStream }
376
382
377
383
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
378
384
// flow from qualifier to first parameter
@@ -385,7 +391,7 @@ private class StdIStreamReadSome extends TaintFunction {
385
391
* The `std::istream` function `putback`.
386
392
*/
387
393
private class StdIStreamPutBack extends DataFlowFunction , TaintFunction {
388
- StdIStreamPutBack ( ) { this .hasQualifiedName ( "std" , "basic_istream" , " putback") }
394
+ StdIStreamPutBack ( ) { this .getClassAndName ( " putback") instanceof StdBasicIStream }
389
395
390
396
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
391
397
// returns reference to `*this`
@@ -418,7 +424,7 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
418
424
* The `std::istream` function `getline`.
419
425
*/
420
426
private class StdIStreamGetLine extends DataFlowFunction , TaintFunction {
421
- StdIStreamGetLine ( ) { this .hasQualifiedName ( "std" , "basic_istream" , " getline") }
427
+ StdIStreamGetLine ( ) { this .getClassAndName ( " getline") instanceof StdBasicIStream }
422
428
423
429
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
424
430
// returns reference to `*this`
@@ -461,9 +467,9 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
461
467
}
462
468
463
469
/**
464
- * The `std::basic_ostream` template class.
470
+ * The `std::basic_ostream` template class instantiations .
465
471
*/
466
- private class StdBasicOStream extends TemplateClass {
472
+ private class StdBasicOStream extends ClassTemplateInstantiation {
467
473
StdBasicOStream ( ) { this .hasQualifiedName ( "std" , "basic_ostream" ) }
468
474
}
469
475
@@ -472,7 +478,9 @@ private class StdBasicOStream extends TemplateClass {
472
478
* `put` and `write`.
473
479
*/
474
480
private class StdOStreamOut extends DataFlowFunction , TaintFunction {
475
- StdOStreamOut ( ) { this .hasQualifiedName ( "std" , "basic_ostream" , [ "operator<<" , "put" , "write" ] ) }
481
+ StdOStreamOut ( ) {
482
+ this .getClassAndName ( [ "operator<<" , "put" , "write" ] ) instanceof StdBasicOStream
483
+ }
476
484
477
485
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
478
486
// returns reference to `*this`
@@ -507,8 +515,7 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
507
515
private class StdOStreamOutNonMember extends DataFlowFunction , TaintFunction {
508
516
StdOStreamOutNonMember ( ) {
509
517
this .hasQualifiedName ( "std" , "operator<<" ) and
510
- this .getUnspecifiedType ( ) .( ReferenceType ) .getBaseType ( ) =
511
- any ( StdBasicOStream s ) .getAnInstantiation ( )
518
+ this .getUnspecifiedType ( ) .( ReferenceType ) .getBaseType ( ) instanceof StdBasicOStream
512
519
}
513
520
514
521
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
@@ -537,9 +544,7 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
537
544
* input parameter.
538
545
*/
539
546
private class StdStringStreamConstructor extends Constructor , TaintFunction {
540
- StdStringStreamConstructor ( ) {
541
- this .getDeclaringType ( ) .hasQualifiedName ( "std" , "basic_stringstream" )
542
- }
547
+ StdStringStreamConstructor ( ) { this .getDeclaringType ( ) instanceof StdBasicStringStream }
543
548
544
549
/**
545
550
* Gets the index of a parameter to this function that is a string.
@@ -563,7 +568,7 @@ private class StdStringStreamConstructor extends Constructor, TaintFunction {
563
568
* The `std::stringstream` function `str`.
564
569
*/
565
570
private class StdStringStreamStr extends TaintFunction {
566
- StdStringStreamStr ( ) { this .hasQualifiedName ( "std" , "basic_stringstream" , " str") }
571
+ StdStringStreamStr ( ) { this .getClassAndName ( " str") instanceof StdBasicStringStream }
567
572
568
573
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
569
574
// flow from qualifier to return value (if any)
@@ -576,15 +581,24 @@ private class StdStringStreamStr extends TaintFunction {
576
581
}
577
582
}
578
583
584
+ /**
585
+ * The `std::basic_ios` template class instantiations.
586
+ */
587
+ private class StdBasicIOS extends ClassTemplateInstantiation {
588
+ StdBasicIOS ( ) { this .hasQualifiedName ( "std" , "basic_ios" ) }
589
+ }
590
+
579
591
/**
580
592
* A `std::` stream function that does not require a model, except that it
581
593
* returns a reference to `*this` and thus could be used in a chain.
582
594
*/
583
595
private class StdStreamFunction extends DataFlowFunction , TaintFunction {
584
596
StdStreamFunction ( ) {
585
- this .hasQualifiedName ( "std" , "basic_istream" , [ "ignore" , "unget" , "seekg" ] ) or
586
- this .hasQualifiedName ( "std" , "basic_ostream" , [ "seekp" , "flush" ] ) or
587
- this .hasQualifiedName ( "std" , "basic_ios" , "copyfmt" )
597
+ this .getClassAndName ( [ "ignore" , "unget" , "seekg" ] ) instanceof StdBasicIStream
598
+ or
599
+ this .getClassAndName ( [ "seekp" , "flush" ] ) instanceof StdBasicOStream
600
+ or
601
+ this .getClassAndName ( "copyfmt" ) instanceof StdBasicIOS
588
602
}
589
603
590
604
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
0 commit comments