codeql/cpp/ql/test/library-tests/dataflow/fields/qualifiers.cpp at sauyon/java-spring-stringutils · ByteDecoder/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
void sink(void *o);
void *user_input(void);

namespace qualifiers {

  struct Inner {
    void *a;

    void setA(void *value) { this->a = value; }
  };

  void pointerSetA(Inner *inner, void *value) { inner->a = value; }
  void referenceSetA(Inner &inner, void *value) { inner.a = value; }

  struct Outer {
    Inner *inner;

    Inner *getInner() { return inner; }
  };

  void assignToGetter(Outer outer) {
    outer.getInner()->a = user_input();
    sink(outer.inner->a); // $ ast MISSING: ir
  }

  void getterArgument1(Outer outer) {
    outer.getInner()->setA(user_input());
    sink(outer.inner->a); // $ ast MISSING: ir
  }

  void getterArgument2(Outer outer) {
    pointerSetA(outer.getInner(), user_input());
    sink(outer.inner->a); // $ ast MISSING: ir
  }

  void getterArgument2Ref(Outer outer) {
    referenceSetA(*outer.getInner(), user_input());
    sink(outer.inner->a); // $ ast MISSING: ir
  }

  void assignToGetterStar(Outer outer) {
    (*outer.getInner()).a = user_input();
    sink(outer.inner->a); // $ ast MISSING: ir
  }

  void assignToGetterAmp(Outer outer) {
    (&outer)->getInner()->a = user_input();
    sink(outer.inner->a); // $ ast MISSING: ir
  }
}