C++: use IR TaintTracking::Configuration in UncontrolledFormatString #3867
Closed
rdmarsh2 wants to merge 19 commits intogithub:mainfrom
Closed
C++: use IR TaintTracking::Configuration in UncontrolledFormatString #3867rdmarsh2 wants to merge 19 commits intogithub:mainfrom
rdmarsh2 wants to merge 19 commits intogithub:mainfrom
Conversation
| @@ -0,0 +1,22 @@ | |||
| /** | |||
| * Provides an implementation class modelling the POSIX function `getenv`. | |||
MathiasVP
reviewed
Jul 2, 2020
jbj
reviewed
Jul 9, 2020
Contributor
jbj
left a comment
jbj
left a comment
There was a problem hiding this comment.
I have a few comments, and I also second @MathiasVP's request for a common superclass for the two new flow-source classes.
The next step is then a CPP-Differences test and ideally also a diff query against our list of lgtm.com test projects.
Co-authored-by: Jonas Jensen <jbj@github.com>
Prevents DefaultTaintTracking dataflow configurations from being active
geoffw0
added
the
depends on internal PR
added 2 commits
August 13, 2020 09:43
Changes result from ad4a753
Merged
Contributor
added 7 commits
September 24, 2020 14:43
Fix merge conflicts and accept funcsLocal.expected changes
Contributor
|
The code LGTM. I think we can merge this when we have a good CPP-difference 🤞 |
1 task
Contributor
|
I found this in my notes from talking to @rdmarsh2 on 2020-11-04:
|
Contributor
|
Superseded by #3364, I believe. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This converts UncontrolledFormatString.ql to use the IR version of
TaintTracking::Configurationand includes some additional changes to make that easier to write.LocalFlowSourceis added to handleargvandgetenvas sources.ArgumentIndirectionNodeis made public and has some added methods to make it easier to use argument indirections as sinks.argvbut should be useful more broadly.