Skip to content

Commit 2e266c7

Browse files
hvitvedhvitved
authored
Merge pull request #5756 from hvitved/csharp/string-builder-fluent
C#: Add missing `StringBuilder` flow summaries
2 parents fb60611 + 824c243 commit 2e266c7

File tree

5 files changed

+81
-36
lines changed

5 files changed

+81
-36
lines changed

‎csharp/change-notes/2021-04-26-string-builder-summaries.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Data-flow modelling of `StringBuilder` objects has been improved.

‎csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -807,17 +807,29 @@ class SystemTextStringBuilderFlow extends LibraryTypeDataFlow, SystemTextStringB
807807
sinkAp = AccessPath::empty() and
808808
preservesValue = false
809809
or
810-
exists(int i, Type t |
811-
name.regexpMatch("Append(Format|Line)?") and
812-
t = m.getParameter(i).getType() and
813-
source = TCallableFlowSourceArg(i) and
810+
name.regexpMatch("Append(Format|Line|Join)?") and
811+
preservesValue = true and
812+
(
813+
exists(int i, Type t |
814+
t = m.getParameter(i).getType() and
815+
source = TCallableFlowSourceArg(i) and
816+
sink = TCallableFlowSinkQualifier() and
817+
sinkAp = AccessPath::element()
818+
|
819+
(
820+
t instanceof StringType or
821+
t instanceof ObjectType
822+
) and
823+
sourceAp = AccessPath::empty()
824+
or
825+
isCollectionType(t) and
826+
sourceAp = AccessPath::element()
827+
)
828+
or
829+
source = TCallableFlowSourceQualifier() and
814830
sourceAp = AccessPath::empty() and
815-
sink = [TCallableFlowSinkQualifier().(TCallableFlowSink), TCallableFlowSinkReturn()] and
816-
sinkAp = AccessPath::element() and
817-
preservesValue = true
818-
|
819-
t instanceof StringType or
820-
t instanceof ObjectType
831+
sink = TCallableFlowSinkReturn() and
832+
sinkAp = AccessPath::empty()
821833
)
822834
)
823835
}

‎csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

Lines changed: 53 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2211,54 +2211,83 @@
22112211
| System.Text.RegularExpressions.MatchCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
22122212
| System.Text.RegularExpressions.MatchCollection.set_Item(int, Match) | argument 1 -> element of argument -1 | true |
22132213
| System.Text.RegularExpressions.MatchCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
2214+
| System.Text.StringBuilder.Append(Char[]) | argument -1 -> return (normal) | true |
2215+
| System.Text.StringBuilder.Append(Char[]) | element of argument 0 -> element of argument -1 | true |
2216+
| System.Text.StringBuilder.Append(Char[], int, int) | argument -1 -> return (normal) | true |
2217+
| System.Text.StringBuilder.Append(Char[], int, int) | element of argument 0 -> element of argument -1 | true |
2218+
| System.Text.StringBuilder.Append(ReadOnlyMemory<Char>) | argument -1 -> return (normal) | true |
2219+
| System.Text.StringBuilder.Append(ReadOnlySpan<Char>) | argument -1 -> return (normal) | true |
2220+
| System.Text.StringBuilder.Append(StringBuilder) | argument -1 -> return (normal) | true |
2221+
| System.Text.StringBuilder.Append(StringBuilder, int, int) | argument -1 -> return (normal) | true |
2222+
| System.Text.StringBuilder.Append(bool) | argument -1 -> return (normal) | true |
2223+
| System.Text.StringBuilder.Append(byte) | argument -1 -> return (normal) | true |
2224+
| System.Text.StringBuilder.Append(char) | argument -1 -> return (normal) | true |
2225+
| System.Text.StringBuilder.Append(char*, int) | argument -1 -> return (normal) | true |
2226+
| System.Text.StringBuilder.Append(char, int) | argument -1 -> return (normal) | true |
2227+
| System.Text.StringBuilder.Append(decimal) | argument -1 -> return (normal) | true |
2228+
| System.Text.StringBuilder.Append(double) | argument -1 -> return (normal) | true |
2229+
| System.Text.StringBuilder.Append(float) | argument -1 -> return (normal) | true |
2230+
| System.Text.StringBuilder.Append(int) | argument -1 -> return (normal) | true |
2231+
| System.Text.StringBuilder.Append(long) | argument -1 -> return (normal) | true |
22142232
| System.Text.StringBuilder.Append(object) | argument 0 -> element of argument -1 | true |
2215-
| System.Text.StringBuilder.Append(object) | argument 0 -> element of return (normal) | true |
2233+
| System.Text.StringBuilder.Append(object) | argument -1 -> return (normal) | true |
2234+
| System.Text.StringBuilder.Append(sbyte) | argument -1 -> return (normal) | true |
2235+
| System.Text.StringBuilder.Append(short) | argument -1 -> return (normal) | true |
22162236
| System.Text.StringBuilder.Append(string) | argument 0 -> element of argument -1 | true |
2217-
| System.Text.StringBuilder.Append(string) | argument 0 -> element of return (normal) | true |
2237+
| System.Text.StringBuilder.Append(string) | argument -1 -> return (normal) | true |
22182238
| System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of argument -1 | true |
2219-
| System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of return (normal) | true |
2239+
| System.Text.StringBuilder.Append(string, int, int) | argument -1 -> return (normal) | true |
2240+
| System.Text.StringBuilder.Append(uint) | argument -1 -> return (normal) | true |
2241+
| System.Text.StringBuilder.Append(ulong) | argument -1 -> return (normal) | true |
2242+
| System.Text.StringBuilder.Append(ushort) | argument -1 -> return (normal) | true |
22202243
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of argument -1 | true |
2221-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of return (normal) | true |
22222244
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of argument -1 | true |
2223-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of return (normal) | true |
2245+
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument -1 -> return (normal) | true |
22242246
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of argument -1 | true |
2225-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of return (normal) | true |
22262247
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of argument -1 | true |
2227-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of return (normal) | true |
22282248
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of argument -1 | true |
2229-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of return (normal) | true |
2249+
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument -1 -> return (normal) | true |
22302250
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of argument -1 | true |
2231-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of return (normal) | true |
22322251
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of argument -1 | true |
2233-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of return (normal) | true |
22342252
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of argument -1 | true |
2235-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of return (normal) | true |
22362253
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of argument -1 | true |
2237-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of return (normal) | true |
2254+
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument -1 -> return (normal) | true |
22382255
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of argument -1 | true |
2239-
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of return (normal) | true |
2256+
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument -1 -> return (normal) | true |
2257+
| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | element of argument 2 -> element of argument -1 | true |
22402258
| System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of argument -1 | true |
2241-
| System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of return (normal) | true |
22422259
| System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of argument -1 | true |
2243-
| System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of return (normal) | true |
2260+
| System.Text.StringBuilder.AppendFormat(string, object) | argument -1 -> return (normal) | true |
22442261
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of argument -1 | true |
2245-
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of return (normal) | true |
22462262
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of argument -1 | true |
2247-
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of return (normal) | true |
22482263
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of argument -1 | true |
2249-
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of return (normal) | true |
2264+
| System.Text.StringBuilder.AppendFormat(string, object, object) | argument -1 -> return (normal) | true |
22502265
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of argument -1 | true |
2251-
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of return (normal) | true |
22522266
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of argument -1 | true |
2253-
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of return (normal) | true |
22542267
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of argument -1 | true |
2255-
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of return (normal) | true |
22562268
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of argument -1 | true |
2257-
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of return (normal) | true |
2269+
| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument -1 -> return (normal) | true |
22582270
| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of argument -1 | true |
2259-
| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of return (normal) | true |
2271+
| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument -1 -> return (normal) | true |
2272+
| System.Text.StringBuilder.AppendFormat(string, params Object[]) | element of argument 1 -> element of argument -1 | true |
2273+
| System.Text.StringBuilder.AppendJoin(char, params Object[]) | argument -1 -> return (normal) | true |
2274+
| System.Text.StringBuilder.AppendJoin(char, params Object[]) | element of argument 1 -> element of argument -1 | true |
2275+
| System.Text.StringBuilder.AppendJoin(char, params String[]) | argument -1 -> return (normal) | true |
2276+
| System.Text.StringBuilder.AppendJoin(char, params String[]) | element of argument 1 -> element of argument -1 | true |
2277+
| System.Text.StringBuilder.AppendJoin(string, params Object[]) | argument 0 -> element of argument -1 | true |
2278+
| System.Text.StringBuilder.AppendJoin(string, params Object[]) | argument -1 -> return (normal) | true |
2279+
| System.Text.StringBuilder.AppendJoin(string, params Object[]) | element of argument 1 -> element of argument -1 | true |
2280+
| System.Text.StringBuilder.AppendJoin(string, params String[]) | argument 0 -> element of argument -1 | true |
2281+
| System.Text.StringBuilder.AppendJoin(string, params String[]) | argument -1 -> return (normal) | true |
2282+
| System.Text.StringBuilder.AppendJoin(string, params String[]) | element of argument 1 -> element of argument -1 | true |
2283+
| System.Text.StringBuilder.AppendJoin<T>(char, IEnumerable<T>) | argument -1 -> return (normal) | true |
2284+
| System.Text.StringBuilder.AppendJoin<T>(char, IEnumerable<T>) | element of argument 1 -> element of argument -1 | true |
2285+
| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | argument 0 -> element of argument -1 | true |
2286+
| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | argument -1 -> return (normal) | true |
2287+
| System.Text.StringBuilder.AppendJoin<T>(string, IEnumerable<T>) | element of argument 1 -> element of argument -1 | true |
2288+
| System.Text.StringBuilder.AppendLine() | argument -1 -> return (normal) | true |
22602289
| System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of argument -1 | true |
2261-
| System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of return (normal) | true |
2290+
| System.Text.StringBuilder.AppendLine(string) | argument -1 -> return (normal) | true |
22622291
| System.Text.StringBuilder.StringBuilder(string) | argument 0 -> element of return (normal) | true |
22632292
| System.Text.StringBuilder.StringBuilder(string, int) | argument 0 -> element of return (normal) | true |
22642293
| System.Text.StringBuilder.StringBuilder(string, int, int, int) | argument 0 -> element of return (normal) | true |

‎csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,7 @@
310310
| LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) | LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 |
311311
| LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder | LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) |
312312
| LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
313+
| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
313314
| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
314315
| LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) | LocalDataFlow.cs:240:15:240:23 | access to local variable nonSink10 |
315316
| LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) |
@@ -322,6 +323,7 @@
322323
| LocalDataFlow.cs:242:15:242:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
323324
| LocalDataFlow.cs:242:15:242:22 | access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
324325
| LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
326+
| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
325327
| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
326328
| LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
327329
| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |

‎csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -400,9 +400,9 @@
400400
| LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder | LocalDataFlow.cs:234:13:234:42 | SSA def(sink36) |
401401
| LocalDataFlow.cs:234:40:234:41 | "" | LocalDataFlow.cs:234:22:234:42 | object creation of type StringBuilder |
402402
| LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
403+
| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
403404
| LocalDataFlow.cs:235:9:235:14 | access to local variable sink36 | LocalDataFlow.cs:236:15:236:20 | access to local variable sink36 |
404405
| LocalDataFlow.cs:235:27:235:32 | access to local variable sink35 | LocalDataFlow.cs:235:9:235:14 | [post] access to local variable sink36 |
405-
| LocalDataFlow.cs:235:27:235:32 | access to local variable sink35 | LocalDataFlow.cs:235:9:235:33 | call to method AppendLine |
406406
| LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) | LocalDataFlow.cs:240:15:240:23 | access to local variable nonSink10 |
407407
| LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder | LocalDataFlow.cs:239:13:239:51 | SSA def(nonSink10) |
408408
| LocalDataFlow.cs:239:43:239:50 | access to local variable nonSink0 | LocalDataFlow.cs:239:25:239:51 | object creation of type StringBuilder |
@@ -416,9 +416,9 @@
416416
| LocalDataFlow.cs:242:15:242:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
417417
| LocalDataFlow.cs:242:15:242:22 | access to local variable nonSink0 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 |
418418
| LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
419+
| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
419420
| LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
420421
| LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 | LocalDataFlow.cs:243:9:243:17 | [post] access to local variable nonSink10 |
421-
| LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
422422
| LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
423423
| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |
424424
| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AString) | LocalDataFlow.cs:248:22:248:48 | access to property AString |

0 commit comments

Comments
 (0)