-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Problems porting deprecated DataFlow to new IR DataFlow (field-involved) #16470
Comments
Hi @f0rm2l1n 👋 Could you try using taint flow instead of data flow for your query? I.e. |
Hi @mbg, thanks for the reply! Yeah, I tried to use import cpp
import semmle.code.cpp.Print
import semmle.code.cpp.dataflow.new.TaintTracking
from DataFlow::Node source, DataFlow::Node end
where
exists(FunctionCall fc | fc.getTarget().hasName("func1") | source.asExpr() = fc)
and TaintTracking::localTaint(source, end)
select source, source.getLocation(), end, end.getLocation()
If I use deprecated Weird 🤔 |
Hello there, I'm trying to port my query from deprecated DataFlow to new IR DataFlow. However, due to the lack of clear documentation, I got myself stuck in the below scenarios.
The example C code is like below
While the query using old DataFlow is like the one below
In a nutshell, I want to use dataflow to trace the return value of calling
func1
. It's obvious that the analysis should track the flow to call offunc2
.Running that query turned out well, I got result an entry like:
Then, I port this query to the new IR Dataflow by change
import semmle.code.cpp.dataflow.DataFlow
to
import semmle.code.cpp.dataflow.new.DataFlow
And I cannot get the expected result but only the source node itself
I also try to replace the
asExpr
with some statements that don't exist in old DataFlow, such asasConvertedExpr()
,asIndirectExpr()
, etc. But no one works out.I wonder whether this is my problem with using the new IR DataFlow, or the expected incapability of the new IR DataFlow to handle field-involved expression. If I change the example code to the below simple case:
Both the deprecated DataFlow and new DataFlow can track the call to
func2
.Please help me write the new IR DataFlow query that can track the field-involved case. Thanks in advance.
The text was updated successfully, but these errors were encountered: