Skip to content

Commit e8f8aa2

Browse files
geoffw0geoffw0
committed
Merge remote-tracking branch 'upstream/main' into pointermodels
2 parents 023d72b + 25a1b05 commit e8f8aa2

File tree

17 files changed

+587
-232
lines changed

17 files changed

+587
-232
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ private import semmle.code.cpp.ir.internal.IRCppLanguage
66
private import SsaInternals as Ssa
77
private import DataFlowImplCommon as DataFlowImplCommon
88
private import codeql.util.Unit
9+
private import Node0ToString
910

1011
cached
1112
private module Cached {
@@ -138,11 +139,7 @@ abstract class InstructionNode0 extends Node0Impl {
138139

139140
override DataFlowType getType() { result = getInstructionType(instr, _) }
140141

141-
override string toStringImpl() {
142-
if instr.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
143-
then result = "this"
144-
else result = instr.getAst().toString()
145-
}
142+
override string toStringImpl() { result = instructionToString(instr) }
146143

147144
override Location getLocationImpl() {
148145
if exists(instr.getAst().getLocation())
@@ -187,11 +184,7 @@ abstract class OperandNode0 extends Node0Impl {
187184

188185
override DataFlowType getType() { result = getOperandType(op, _) }
189186

190-
override string toStringImpl() {
191-
if op.getDef().(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
192-
then result = "this"
193-
else result = op.getDef().getAst().toString()
194-
}
187+
override string toStringImpl() { result = operandToString(op) }
195188

196189
override Location getLocationImpl() {
197190
if exists(op.getDef().getAst().getLocation())

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ private import ModelUtil
1515
private import SsaInternals as Ssa
1616
private import DataFlowImplCommon as DataFlowImplCommon
1717
private import codeql.util.Unit
18+
private import Node0ToString
1819

1920
/**
2021
* The IR dataflow graph consists of the following nodes:
@@ -486,10 +487,13 @@ class Node extends TIRDataFlowNode {
486487
}
487488

488489
private string toExprString(Node n) {
489-
result = n.asExpr(0).toString()
490-
or
491-
not exists(n.asExpr()) and
492-
result = n.asIndirectExpr(0, 1).toString() + " indirection"
490+
not isDebugMode() and
491+
(
492+
result = n.asExpr(0).toString()
493+
or
494+
not exists(n.asExpr()) and
495+
result = n.asIndirectExpr(0, 1).toString() + " indirection"
496+
)
493497
}
494498

495499
/**

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DebugPrinting.qll

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
/**
2+
* This file activates debugging mode for dataflow node printing.
3+
*/
4+
5+
private import Node0ToString
6+
7+
private class DebugNode0ToString extends Node0ToString {
8+
final override predicate isDebugMode() { any() }
9+
}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/Node0ToString.qll

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/**
2+
* This file contains the abstract class that serves as the base class for
3+
* dataflow node printing.
4+
*
5+
* By default, a non-debug string is produced. However, a debug-friendly
6+
* string can be produced by importing `DebugPrinting.qll`.
7+
*/
8+
9+
private import semmle.code.cpp.ir.IR
10+
private import codeql.util.Unit
11+
12+
/**
13+
* A class to control whether a debugging version of instructions and operands
14+
* should be printed as part of the `toString` output of dataflow nodes.
15+
*
16+
* To enable debug printing import the `DebugPrinting.ql` file. By default,
17+
* non-debug output will be used.
18+
*/
19+
class Node0ToString extends Unit {
20+
abstract predicate isDebugMode();
21+
22+
private string normalInstructionToString(Instruction i) {
23+
not this.isDebugMode() and
24+
if i.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
25+
then result = "this"
26+
else result = i.getAst().toString()
27+
}
28+
29+
private string normalOperandToString(Operand op) {
30+
not this.isDebugMode() and
31+
if op.getDef().(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
32+
then result = "this"
33+
else result = op.getDef().getAst().toString()
34+
}
35+
36+
/**
37+
* Gets the string that should be used by `InstructionNode.toString`
38+
*/
39+
string instructionToString(Instruction i) {
40+
if this.isDebugMode()
41+
then result = i.getDumpString()
42+
else result = this.normalInstructionToString(i)
43+
}
44+
45+
/**
46+
* Gets the string that should be used by `OperandNode.toString`.
47+
*/
48+
string operandToString(Operand op) {
49+
if this.isDebugMode()
50+
then result = op.getDumpString() + " @ " + op.getUse().getResultId()
51+
else result = this.normalOperandToString(op)
52+
}
53+
}
54+
55+
private class NoDebugNode0ToString extends Node0ToString {
56+
final override predicate isDebugMode() { none() }
57+
}
58+
59+
/**
60+
* Gets the string that should be used by `OperandNode.toString`.
61+
*/
62+
string operandToString(Operand op) { result = any(Node0ToString nts).operandToString(op) }
63+
64+
/**
65+
* Gets the string that should be used by `InstructionNode.toString`
66+
*/
67+
string instructionToString(Instruction i) { result = any(Node0ToString nts).instructionToString(i) }
68+
69+
/**
70+
* Holds if debugging mode is enabled.
71+
*
72+
* In debug mode the `toString` on dataflow nodes is more expensive to compute,
73+
* but gives more precise information about the different dataflow nodes.
74+
*/
75+
predicate isDebugMode() { any(Node0ToString nts).isDebugMode() }

‎csharp/ql/lib/change-notes/2023-06-22-aws-lambda-models.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Additional support for `Amazon.Lambda` SDK

‎csharp/ql/lib/ext/Amazon.Lambda.model.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/csharp-all
4+
extensible: sourceModel
5+
data:
6+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_Headers","()","","ReturnValue","remote","manual"]
7+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_Body","()","","ReturnValue","remote","manual"]
8+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_RawPath","()","","ReturnValue","remote","manual"]
9+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_RawQueryString","()","","ReturnValue","remote","manual"]
10+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_Cookies","()","","ReturnValue","remote","manual"]
11+
- ["Amazon.Lambda.APIGatewayEvents","APIGatewayHttpApiV2ProxyRequest",true,"get_PathParameters","()","","ReturnValue","remote","manual"]
12+
13+
- addsTo:
14+
pack: codeql/csharp-all
15+
extensible: sinkModel
16+
data:
17+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"Log","(System.String)","","Argument[0]","log-injection","manual"]
18+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogLine","(System.String)","","Argument[0]","log-injection","manual"]
19+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogTrace","(System.String)","","Argument[0]","log-injection","manual"]
20+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogDebug","(System.String)","","Argument[0]","log-injection","manual"]
21+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogInformation","(System.String)","","Argument[0]","log-injection","manual"]
22+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogWarning","(System.String)","","Argument[0]","log-injection","manual"]
23+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogError","(System.String)","","Argument[0]","log-injection","manual"]
24+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"LogCritical","(System.String)","","Argument[0]","log-injection","manual"]
25+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"Log","(System.String,System.String)","","Argument[1]","log-injection","manual"]
26+
- ["Amazon.Lambda.Core","ILambdaLogger",true,"Log","(Amazon.Lambda.Core.LogLevel,System.String)","","Argument[1]","log-injection","manual"]
27+
28+
- addsTo:
29+
pack: codeql/csharp-all
30+
extensible: summaryModel
31+
data: []

‎csharp/ql/test/library-tests/frameworks/Aws/lambda.cs

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
using System.Net;
2+
using System.Collections.Generic;
3+
4+
using Amazon.Lambda.Core;
5+
using Amazon.Lambda.APIGatewayEvents;
6+
7+
8+
namespace LambdaTests {
9+
public class Functions {
10+
public APIGatewayProxyResponse Get(APIGatewayHttpApiV2ProxyRequest request, ILambdaContext context) {
11+
string body = request.Body; // source
12+
string cookie = request.Cookies[0]; // source
13+
14+
string rawpath = request.RawPath; // source
15+
string rawquery = request.RawQueryString; // source
16+
request.PathParameters.TryGetValue("x", out var pathparameter); // source
17+
18+
string header = request.Headers["test"]; // source
19+
request.Headers.TryGetValue("test", out var header2); // source
20+
21+
22+
return new APIGatewayProxyResponse {
23+
StatusCode = 200
24+
};
25+
}
26+
27+
public void Logging(ILambdaContext context, string data)
28+
{
29+
// logging
30+
context.Logger.Log($"Log Data :: {data}");
31+
context.Logger.LogLine($"Log Data :: {data}");
32+
context.Logger.Log("Information", $"Log Data :: {data}");
33+
context.Logger.Log(LogLevel.Information, $"Log Data :: {data}");
34+
context.Logger.LogTrace($"Log Data :: {data}");
35+
context.Logger.LogDebug($"Log Data :: {data}");
36+
context.Logger.LogInformation($"Log Data :: {data}");
37+
context.Logger.LogWarning($"Log Data :: {data}");
38+
context.Logger.LogError($"Log Data :: {data}");
39+
context.Logger.LogCritical($"Log Data :: {data}");
40+
}
41+
}
42+
}

‎csharp/ql/test/library-tests/frameworks/Aws/lambda.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
awsRemoteSources
2+
| lambda.cs:11:27:11:38 | access to property Body |
3+
| lambda.cs:12:29:12:43 | access to property Cookies |
4+
| lambda.cs:14:30:14:44 | access to property RawPath |
5+
| lambda.cs:15:31:15:52 | access to property RawQueryString |
6+
| lambda.cs:16:13:16:34 | access to property PathParameters |
7+
| lambda.cs:18:29:18:43 | access to property Headers |
8+
| lambda.cs:19:13:19:27 | access to property Headers |
9+
awsLoggingSinks
10+
| lambda.cs:30:32:30:52 | $"..." |
11+
| lambda.cs:31:36:31:56 | $"..." |
12+
| lambda.cs:32:47:32:67 | $"..." |
13+
| lambda.cs:33:54:33:74 | $"..." |
14+
| lambda.cs:34:37:34:57 | $"..." |
15+
| lambda.cs:35:37:35:57 | $"..." |
16+
| lambda.cs:36:43:36:63 | $"..." |
17+
| lambda.cs:37:39:37:59 | $"..." |
18+
| lambda.cs:38:37:38:57 | $"..." |
19+
| lambda.cs:39:40:39:60 | $"..." |

‎csharp/ql/test/library-tests/frameworks/Aws/lambda.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import csharp
2+
import semmle.code.csharp.dataflow.internal.ExternalFlow
3+
4+
query predicate awsRemoteSources(DataFlow::ExprNode node) { sourceNode(node, "remote") }
5+
6+
query predicate awsLoggingSinks(DataFlow::ExprNode node) { sinkNode(node, "log-injection") }

‎csharp/ql/test/library-tests/frameworks/Aws/options

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/Amazon.Lambda.Core/2.2.0/Amazon.Lambda.Core.csproj
3+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/Amazon.Lambda.APIGatewayEvents/2.7.0/Amazon.Lambda.APIGatewayEvents.csproj

0 commit comments

Comments
 (0)