Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
9acb58e
SSA: Add SsaNode predicates that don't mention DefinitionExt.
aschackmull Feb 21, 2025
4e515bc
JS: Remove reference to isInputInto
aschackmull Feb 21, 2025
09b2aeb
SSA: Replace use-use step implementation in data-flow integration.
aschackmull Feb 24, 2025
88fe4fa
SSA: Remove nodes that are no longer used.
aschackmull Feb 24, 2025
782b6cf
SSA: Fix bug in guards for ssa input nodes.
aschackmull Feb 24, 2025
1af753c
JS: Use shared barrier guard for falsy check.
aschackmull Feb 24, 2025
09454f9
SSA: Remove unused.
aschackmull Feb 24, 2025
db7ec4a
Java: Remove getDefinitionExt reference
aschackmull Feb 24, 2025
0583d85
C#: Remove getDefinitionExt references.
aschackmull Feb 24, 2025
7499df4
Rust: Remove getDefinitionExt reference.
aschackmull Feb 24, 2025
22b3dc8
Ruby: Remove getDefinitionExt references.
aschackmull Feb 24, 2025
57c4fd6
JS: Combine phi reads and ssa input nodes into SynthReadNode class.
aschackmull Feb 25, 2025
95cbd21
Ruby: Accept test change following SSA bugfix.
aschackmull Feb 25, 2025
1f628d0
Ruby: Remove reference to SsaInputNode.
aschackmull Feb 25, 2025
f00f2c6
SSA: Deprecate public SsaDefinitionExtNode and SsaInputNode.
aschackmull Feb 25, 2025
b1b72b7
SSA: Add qldoc.
aschackmull Feb 25, 2025
ae3736b
C#: Accept test changes showing that we skip over useless input nodes.
aschackmull Feb 25, 2025
449150e
JS: Accept fixed FP flow.
aschackmull Feb 25, 2025
b2a5955
JS: Remove irrelevant comment.
aschackmull Feb 25, 2025
28e9644
C#: Address review comment.
aschackmull Feb 25, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -664,7 +664,7 @@ module LocalFlow {
ssaDef.getADefinition() = def and
ssaDef.getControlFlowNode() = cfn and
nodeFrom = TAssignableDefinitionNode(def, cfn) and
nodeTo.(SsaDefinitionExtNode).getDefinitionExt() = ssaDef
nodeTo.(SsaDefinitionNode).getDefinition() = ssaDef
)
}

Expand Down Expand Up @@ -1269,78 +1269,33 @@ predicate nodeIsHidden(Node n) {
}

/** An SSA node. */
abstract class SsaNode extends NodeImpl, TSsaNode {
class SsaNode extends NodeImpl, TSsaNode {
SsaImpl::DataFlowIntegration::SsaNode node;
SsaImpl::DefinitionExt def;

SsaNode() {
this = TSsaNode(node) and
def = node.getDefinitionExt()
}

SsaImpl::DefinitionExt getDefinitionExt() { result = def }
SsaNode() { this = TSsaNode(node) }

override DataFlowCallable getEnclosingCallableImpl() {
result.getAControlFlowNode().getBasicBlock() = def.getBasicBlock()
result.getAControlFlowNode().getBasicBlock() = node.getBasicBlock()
}

override Type getTypeImpl() { result = def.getSourceVariable().getType() }
override Type getTypeImpl() { result = node.getSourceVariable().getType() }

override ControlFlow::Node getControlFlowNodeImpl() {
result = def.(Ssa::Definition).getControlFlowNode()
}
override ControlFlow::Node getControlFlowNodeImpl() { none() }

override Location getLocationImpl() { result = node.getLocation() }

override string toStringImpl() { result = node.toString() }
}

/** An (extended) SSA definition, viewed as a node in a data flow graph. */
class SsaDefinitionExtNode extends SsaNode {
override SsaImpl::DataFlowIntegration::SsaDefinitionExtNode node;
}
/** An SSA definition, viewed as a node in a data flow graph. */
class SsaDefinitionNode extends SsaNode {
override SsaImpl::DataFlowIntegration::SsaDefinitionNode node;

/**
* A node that represents an input to an SSA phi (read) definition.
*
* This allows for barrier guards to filter input to phi nodes. For example, in
*
* ```csharp
* var x = taint;
* if (x != "safe")
* {
* x = "safe";
* }
* sink(x);
* ```
*
* the `false` edge out of `x != "safe"` guards the input from `x = taint` into the
* `phi` node after the condition.
*
* It is also relevant to filter input into phi read nodes:
*
* ```csharp
* var x = taint;
* if (b)
* {
* if (x != "safe1")
* {
* return;
* }
* } else {
* if (x != "safe2")
* {
* return;
* }
* }
*
* sink(x);
* ```
*
* both inputs into the phi read node after the outer condition are guarded.
*/
class SsaInputNode extends SsaNode {
override SsaImpl::DataFlowIntegration::SsaInputNode node;
SsaImpl::Definition getDefinition() { result = node.getDefinition() }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you change the return type to Ssa::Definition and avoid the infix cast below?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, done.


override ControlFlow::Node getControlFlowNodeImpl() {
result = this.getDefinition().(Ssa::Definition).getControlFlowNode()
}
}

/** A definition, viewed as a node in a data flow graph. */
Expand Down Expand Up @@ -1728,12 +1683,12 @@ private module ReturnNodes {
* A data-flow node that represents an assignment to an `out` or a `ref`
* parameter.
*/
class OutRefReturnNode extends ReturnNode, SsaDefinitionExtNode {
class OutRefReturnNode extends ReturnNode, SsaDefinitionNode {
OutRefReturnKind kind;

OutRefReturnNode() {
exists(Parameter p |
this.getDefinitionExt().(Ssa::Definition).isLiveOutRefParameterDefinition(p) and
this.getDefinition().(Ssa::Definition).isLiveOutRefParameterDefinition(p) and
kind.getPosition() = p.getPosition()
|
p.isOut() and kind instanceof OutReturnKind
Expand Down Expand Up @@ -2464,7 +2419,7 @@ private predicate readContentStep(Node node1, Content c, Node node2) {
exists(ForeachStmt fs, Ssa::ExplicitDefinition def |
x.hasDefPath(fs.getIterableExpr(), node1.getControlFlowNode(), def.getADefinition(),
def.getControlFlowNode()) and
node2.(SsaDefinitionExtNode).getDefinitionExt() = def and
node2.(SsaDefinitionNode).getDefinition() = def and
c instanceof ElementContent
)
or
Expand Down
11 changes: 11 additions & 0 deletions shared/ssa/codeql/ssa/Ssa.qll
Original file line number Diff line number Diff line change
Expand Up @@ -1677,6 +1677,17 @@ module Make<LocationSig Location, InputSig<Location> Input> {

final class SsaDefinitionExtNode = SsaDefinitionExtNodeImpl;

/** An SSA definition, viewed as a node in a data flow graph. */
private class SsaDefinitionNodeImpl extends SsaDefinitionExtNodeImpl {
private Definition def;

SsaDefinitionNodeImpl() { this = TSsaDefinitionNode(def) }

Definition getDefinition() { result = def }
}

final class SsaDefinitionNode = SsaDefinitionNodeImpl;

/**
* A node that represents an input to an SSA phi (read) definition.
*
Expand Down