Diff-informed queries via primary/secondary abstractions #19586
Conversation
I haven't figured out how to avoid the redundancy between
`getASelected{Source,Sink}Location` in the module and the class. Maybe
we need a strong notion of primary and secondary data-flow
configurations.
For now I've only implemented what XSS.qll needs
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -15,6 +15,16 @@ | |||
| import semmle.code.java.security.XssQuery | |||
| import XssFlow::PathGraph | |||
|
|
|||
| class IsDiffInformed extends DataFlow::DiffInformedQuery { | |||
| // This predicate is overridden to be more precise than the default | |||
| // implementation in order to support secondary secondary data-flow | |||
Check warning
Code scanning / CodeQL
Comment has repeated word Warning
| @@ -742,6 +746,33 @@ | |||
| import Flow | |||
| } | |||
|
|
|||
| module Primary<ConfigSig Config> implements GlobalFlowSig { | |||
| private module Config0 implements FullStateConfigSig { | |||
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| module FindSinks<DataFlow::ConfigSig Config, DataFlow::SecondaryConfig SC> implements | ||
| DataFlow::GlobalFlowSig | ||
| { | ||
| private module Config0 implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
This PR is a proof of concept for how diff-informed queries could be made more high level, reducing hard-to-remember design patterns and simultaneously reducing reverse dependencies and the "module soup" I proposed in #17846.
I've only implemented what's necessary for
XSS.qlso far since I expect a lot of changes to names and APIs.