Merge pull request #2864 from jbj/DefaultTaintTracking-cached

MathiasVP · web-flow · commit b9bb2ec0ac76 · 2020-02-25T10:15:43.000+01:00
C++: Cache DefaultTaintTracking
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -343,13 +343,15 @@ private Element adjustedSink(DataFlow::Node sink) {
   result.(AssignOperation).getAnOperand() = sink.asExpr()
 }
 
+cached
 predicate tainted(Expr source, Element tainted) {
   exists(DefaultTaintTrackingCfg cfg, DataFlow::Node sink |
     cfg.hasFlow(getNodeForSource(source), sink) and
     tainted = adjustedSink(sink)
   )
 }
 
+cached
 predicate taintedIncludingGlobalVars(Expr source, Element tainted, string globalVar) {
   tainted(source, tainted) and
   globalVar = ""

Original file line number	Diff line number	Diff line change
`@@ -343,13 +343,15 @@ private Element adjustedSink(DataFlow::Node sink) {`
`343`	`343`	`result.(AssignOperation).getAnOperand() = sink.asExpr()`
`344`	`344`	`}`
`345`	`345`
	`346`	`+cached`
`346`	`347`	`predicate tainted(Expr source, Element tainted) {`
`347`	`348`	`exists(DefaultTaintTrackingCfg cfg, DataFlow::Node sink \|`
`348`	`349`	`cfg.hasFlow(getNodeForSource(source), sink) and`
`349`	`350`	`tainted = adjustedSink(sink)`
`350`	`351`	`)`
`351`	`352`	`}`
`352`	`353`
	`354`	`+cached`
`353`	`355`	`predicate taintedIncludingGlobalVars(Expr source, Element tainted, string globalVar) {`
`354`	`356`	`tainted(source, tainted) and`
`355`	`357`	`globalVar = ""`