Skip to content

Java/C#: Introduce kind for neutrals. #12931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michaelnebel merged 13 commits into from
May 9, 2023
Merged

Java/C#: Introduce kind for neutrals. #12931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
4dcfb4d
C#: Extend neutrals with a kind column and introduce validation.
michaelnebel Apr 25, 2023
fe32abe
C#: Update existing neutrals to include kind information.
michaelnebel Apr 25, 2023
4ac0396
Go/Python/Ruby/Swift: Sync files and make dummy implementation.
michaelnebel Apr 26, 2023
bcbda90
Java: Extend neutrals with a kind column and introduce validation.
michaelnebel Apr 26, 2023
bd23814
Java: Update existing neutrals to include kind information.
michaelnebel Apr 26, 2023
d103a57
Java: Adjust the model generator to produce kinds.
michaelnebel Apr 26, 2023
c30f080
Java: Update expected test out for the model generator.
michaelnebel Apr 26, 2023
7c3a258
C#: Adjust the model generator to produce kinds for neutrals.
michaelnebel Apr 26, 2023
87731b2
C#: Update expected test output for the model generator test.
michaelnebel Apr 26, 2023
7858da6
C#/Java: Add change note.
michaelnebel Apr 26, 2023
8435c31
C#/Java: Update model converter queries to handle kind information.
michaelnebel Apr 26, 2023
efa2bd8
Apply suggestions from code review
michaelnebel May 8, 2023
baee4ce
Apply suggestions from code review
michaelnebel May 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions csharp/ql/lib/change-notes/2023-04-26-neutral-model-kinds.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Updated the `neutralModel` extensible predicate to include a `kind` column.
83,500 changes: 41,750 additions & 41,750 deletions csharp/ql/lib/ext/generated/dotnet_runtime.model.yml
View file
Open in desktop

Large diffs are not rendered by default.

21 changes: 14 additions & 7 deletions csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; provenance`
* A neutral is used to indicate that there is no flow via a callable.
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
Expand Down Expand Up @@ -72,7 +72,9 @@
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step.
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
* 9. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
Expand Down Expand Up @@ -103,8 +105,8 @@ predicate sinkModel = Extensions::sinkModel/9;
/** Holds if a summary model exists for the given parameters. */
predicate summaryModel = Extensions::summaryModel/10;

/** Holds if a model exists indicating there is no flow for the given parameters. */
predicate neutralModel = Extensions::neutralModel/5;
/** Holds if a neutral model exists for the given parameters. */
predicate neutralModel = Extensions::neutralModel/6;

private predicate relevantNamespace(string namespace) {
sourceModel(namespace, _, _, _, _, _, _, _, _) or
Expand Down Expand Up @@ -218,6 +220,11 @@ module ModelValidation {
not kind = ["local", "remote", "file", "file-write"] and
result = "Invalid kind \"" + kind + "\" in source model."
)
or
exists(string kind | neutralModel(_, _, _, _, kind, _) |
not kind = ["summary", "source", "sink"] and
result = "Invalid kind \"" + kind + "\" in neutral model."
)
}

private string getInvalidModelSignature() {
Expand All @@ -232,7 +239,7 @@ module ModelValidation {
summaryModel(namespace, type, _, name, signature, ext, _, _, _, provenance) and
pred = "summary"
or
neutralModel(namespace, type, name, signature, provenance) and
neutralModel(namespace, type, name, signature, _, provenance) and
ext = "" and
pred = "neutral"
|
Expand Down Expand Up @@ -275,7 +282,7 @@ private predicate elementSpec(
or
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _)
or
neutralModel(namespace, type, name, signature, _) and ext = "" and subtypes = false
neutralModel(namespace, type, name, signature, _, _) and ext = "" and subtypes = false
}

private predicate elementSpec(
Expand Down
4 changes: 2 additions & 2 deletions csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlowExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ extensible predicate summaryModel(
);

/**
* Holds if a model exists indicating there is no flow for the given parameters.
* Holds if a neutral model exists for the given parameters.
*/
extensible predicate neutralModel(
string namespace, string type, string name, string signature, string provenance
string namespace, string type, string name, string signature, string kind, string provenance
);
2 changes: 1 addition & 1 deletion csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,7 @@ module Public {
class NeutralCallable extends SummarizedCallableBase {
private Provenance provenance;

NeutralCallable() { neutralElement(this, provenance) }
NeutralCallable() { neutralSummaryElement(this, provenance) }

/**
* Holds if the neutral is auto generated.
Expand Down
6 changes: 3 additions & 3 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,12 +111,12 @@ predicate summaryElement(Callable c, string input, string output, string kind, s
}

/**
* Holds if a neutral model exists for `c` with provenance `provenace`,
* Holds if a neutral summary model exists for `c` with provenance `provenace`,
* which means that there is no flow through `c`.
*/
predicate neutralElement(Callable c, string provenance) {
predicate neutralSummaryElement(Callable c, string provenance) {
exists(string namespace, string type, string name, string signature |
neutralModel(namespace, type, name, signature, provenance) and
neutralModel(namespace, type, name, signature, "summary", provenance) and
c = interpretElement(namespace, type, false, name, signature, "")
)
}
Expand Down
7 changes: 4 additions & 3 deletions csharp/ql/src/utils/modelconverter/ExtractNeutrals.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,9 @@
import csharp
import semmle.code.csharp.dataflow.ExternalFlow

from string package, string type, string name, string signature, string provenance
from string package, string type, string name, string signature, string kind, string provenance
where
neutralModel(package, type, name, signature, provenance) and
neutralModel(package, type, name, signature, kind, provenance) and
not provenance.matches("%generated")
select package, type, name, signature, provenance order by package, type, name, signature
select package, type, name, signature, kind, provenance order by
package, type, name, signature, kind
7 changes: 5 additions & 2 deletions csharp/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,11 @@ module PrintingImpl<PrintingSig Printing> {
+ Printing::getProvenance()
}

string asNeutralModel(Printing::Api api) {
result = asPartialNeutralModel(api) + Printing::getProvenance()
string asNeutralSummaryModel(Printing::Api api) {
result =
asPartialNeutralModel(api) //
+ "summary" + ";" //
+ Printing::getProvenance()
}

/**
Expand Down
2 changes: 1 addition & 1 deletion csharp/ql/src/utils/modelgenerator/internal/CaptureSummaryFlowQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,5 +86,5 @@ string captureFlow(DataFlowTargetApi api) {
*/
string captureNoFlow(DataFlowTargetApi api) {
not exists(captureFlow(api)) and
result = ModelPrinting::asNeutralModel(api)
result = ModelPrinting::asNeutralSummaryModel(api)
}
56 changes: 28 additions & 28 deletions csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,28 @@
| NoSummaries;BaseClass;M1;(System.String);df-generated |
| NoSummaries;BaseClass;M2;(System.String);df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);df-generated |
| NoSummaries;EquatableBound;Equals;(System.Object);df-generated |
| NoSummaries;EquatableUnBound<>;Equals;(T);df-generated |
| NoSummaries;SimpleTypes;M1;(System.Boolean);df-generated |
| NoSummaries;SimpleTypes;M2;(System.Boolean);df-generated |
| NoSummaries;SimpleTypes;M3;(System.Int32);df-generated |
| NoSummaries;SimpleTypes;M4;(System.Int32);df-generated |
| Sinks;NewSinks;WrapFieldResponseWriteFile;();df-generated |
| Sinks;NewSinks;WrapPrivateFieldResponseWriteFile;();df-generated |
| Sinks;NewSinks;WrapPrivatePropResponseWriteFile;();df-generated |
| Sinks;NewSinks;WrapPropPrivateSetResponseWriteFile;();df-generated |
| Sinks;NewSinks;WrapPropResponseWriteFile;();df-generated |
| Sinks;NewSinks;WrapResponseWrite;(System.Object);df-generated |
| Sinks;NewSinks;WrapResponseWriteFile;(System.String);df-generated |
| Sinks;NewSinks;get_PrivateSetTaintedProp;();df-generated |
| Sinks;NewSinks;get_TaintedProp;();df-generated |
| Sinks;NewSinks;set_PrivateSetTaintedProp;(System.String);df-generated |
| Sinks;NewSinks;set_TaintedProp;(System.String);df-generated |
| Sources;NewSources;WrapConsoleReadKey;();df-generated |
| Sources;NewSources;WrapConsoleReadLine;();df-generated |
| Sources;NewSources;WrapConsoleReadLineAndProcees;(System.String);df-generated |
| Summaries;EqualsGetHashCodeNoFlow;Equals;(System.Object);df-generated |
| Summaries;EqualsGetHashCodeNoFlow;GetHashCode;();df-generated |
| Summaries;OperatorFlow;op_Increment;(Summaries.OperatorFlow);df-generated |
| NoSummaries;BaseClass;M1;(System.String);summary;df-generated |
| NoSummaries;BaseClass;M2;(System.String);summary;df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);summary;df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);summary;df-generated |
| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);summary;df-generated |
| NoSummaries;EquatableBound;Equals;(System.Object);summary;df-generated |
| NoSummaries;EquatableUnBound<>;Equals;(T);summary;df-generated |
| NoSummaries;SimpleTypes;M1;(System.Boolean);summary;df-generated |
| NoSummaries;SimpleTypes;M2;(System.Boolean);summary;df-generated |
| NoSummaries;SimpleTypes;M3;(System.Int32);summary;df-generated |
| NoSummaries;SimpleTypes;M4;(System.Int32);summary;df-generated |
| Sinks;NewSinks;WrapFieldResponseWriteFile;();summary;df-generated |
| Sinks;NewSinks;WrapPrivateFieldResponseWriteFile;();summary;df-generated |
| Sinks;NewSinks;WrapPrivatePropResponseWriteFile;();summary;df-generated |
| Sinks;NewSinks;WrapPropPrivateSetResponseWriteFile;();summary;df-generated |
| Sinks;NewSinks;WrapPropResponseWriteFile;();summary;df-generated |
| Sinks;NewSinks;WrapResponseWrite;(System.Object);summary;df-generated |
| Sinks;NewSinks;WrapResponseWriteFile;(System.String);summary;df-generated |
| Sinks;NewSinks;get_PrivateSetTaintedProp;();summary;df-generated |
| Sinks;NewSinks;get_TaintedProp;();summary;df-generated |
| Sinks;NewSinks;set_PrivateSetTaintedProp;(System.String);summary;df-generated |
| Sinks;NewSinks;set_TaintedProp;(System.String);summary;df-generated |
| Sources;NewSources;WrapConsoleReadKey;();summary;df-generated |
| Sources;NewSources;WrapConsoleReadLine;();summary;df-generated |
| Sources;NewSources;WrapConsoleReadLineAndProcees;(System.String);summary;df-generated |
| Summaries;EqualsGetHashCodeNoFlow;Equals;(System.Object);summary;df-generated |
| Summaries;EqualsGetHashCodeNoFlow;GetHashCode;();summary;df-generated |
| Summaries;OperatorFlow;op_Increment;(Summaries.OperatorFlow);summary;df-generated |
2 changes: 1 addition & 1 deletion go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,7 @@ module Public {
class NeutralCallable extends SummarizedCallableBase {
private Provenance provenance;

NeutralCallable() { neutralElement(this, provenance) }
NeutralCallable() { neutralSummaryElement(this, provenance) }

/**
* Holds if the neutral is auto generated.
Expand Down
4 changes: 2 additions & 2 deletions go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImplSpecific.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,11 +72,11 @@ predicate summaryElement(
}

/**
* Holds if a neutral model exists for `c` with provenance `provenance`,
* Holds if a neutral summary model exists for `c` with provenance `provenance`,
* which means that there is no flow through `c`.
* Note. Neutral models have not been implemented for Go.
*/
predicate neutralElement(SummarizedCallable c, string provenance) { none() }
predicate neutralSummaryElement(SummarizedCallable c, string provenance) { none() }

/** Gets the summary component for specification component `c`, if any. */
bindingset[c]
Expand Down
4 changes: 4 additions & 0 deletions java/ql/lib/change-notes/2023-04-26-neutral-model-kinds.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Updated the `neutralModel` extensible predicate to include a `kind` column.
Loading