Skip to content

Commit 5bddc8d

Browse files
aschackmullaschackmull
committed
Go: Move Go package-grouping support into shared lib.
1 parent e262438 commit 5bddc8d

8 files changed

Lines changed: 104 additions & 138 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ extensible predicate neutralModel(
5353

5454
module Extensions implements SharedMaD::ExtensionsSig {
5555
import ExternalFlowExtensions
56+
57+
predicate packageGrouping(string group, string package) { none() }
5658
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ extensible predicate neutralModel(
5353

5454
module Extensions implements SharedMaD::ExtensionsSig {
5555
import ExternalFlowExtensions
56+
57+
predicate packageGrouping(string group, string package) { none() }
5658
}

‎go/ql/lib/semmle/go/dataflow/ExternalFlow.qll‎

Lines changed: 0 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -107,86 +107,6 @@ module FlowExtensions = Extensions;
107107
/** Gets the prefix for a group of packages. */
108108
private string groupPrefix() { result = "group:" }
109109

110-
/**
111-
* Gets a package represented by `packageOrGroup`.
112-
*
113-
* If `packageOrGroup` is of the form `group:<groupname>` then `result` is a
114-
* package in the group `<groupname>`, as determined by `packageGrouping`.
115-
* Otherwise, `result` is `packageOrGroup`.
116-
*/
117-
bindingset[packageOrGroup]
118-
private string getPackage(string packageOrGroup) {
119-
not exists(string group | packageOrGroup = groupPrefix() + group) and result = packageOrGroup
120-
or
121-
exists(string group |
122-
FlowExtensions::packageGrouping(group, result) and
123-
packageOrGroup = groupPrefix() + group
124-
)
125-
}
126-
127-
/**
128-
* Holds if a source model exists for the given parameters.
129-
*
130-
* Note that `group:` references are expanded into one or more actual packages
131-
* by this predicate.
132-
*/
133-
predicate sourceModel(
134-
string package, string type, boolean subtypes, string name, string signature, string ext,
135-
string output, string kind, string provenance, QlBuiltins::ExtensionId madId
136-
) {
137-
exists(string packageOrGroup |
138-
package = getPackage(packageOrGroup) and
139-
FlowExtensions::sourceModel(packageOrGroup, type, subtypes, name, signature, ext, output, kind,
140-
provenance, madId)
141-
)
142-
}
143-
144-
/**
145-
* Holds if a sink model exists for the given parameters.
146-
*
147-
* Note that `group:` references are expanded into one or more actual packages
148-
* by this predicate.
149-
*/
150-
predicate sinkModel(
151-
string package, string type, boolean subtypes, string name, string signature, string ext,
152-
string input, string kind, string provenance, QlBuiltins::ExtensionId madId
153-
) {
154-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
155-
FlowExtensions::sinkModel(packageOrGroup, type, subtypes, name, signature, ext, input, kind,
156-
provenance, madId)
157-
)
158-
}
159-
160-
/**
161-
* Holds if a summary model exists for the given parameters.
162-
*
163-
* Note that `group:` references are expanded into one or more actual packages
164-
* by this predicate.
165-
*/
166-
predicate summaryModel(
167-
string package, string type, boolean subtypes, string name, string signature, string ext,
168-
string input, string output, string kind, string provenance, QlBuiltins::ExtensionId madId
169-
) {
170-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
171-
FlowExtensions::summaryModel(packageOrGroup, type, subtypes, name, signature, ext, input,
172-
output, kind, provenance, madId)
173-
)
174-
}
175-
176-
/**
177-
* Holds if a neutral model exists for the given parameters.
178-
*
179-
* Note that `group:` references are expanded into one or more actual packages
180-
* by this predicate.
181-
*/
182-
predicate neutralModel(
183-
string package, string type, string name, string signature, string kind, string provenance
184-
) {
185-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
186-
FlowExtensions::neutralModel(packageOrGroup, type, name, signature, kind, provenance)
187-
)
188-
}
189-
190110
bindingset[p]
191111
private string cleanPackage(string p) {
192112
exists(string noPrefix |

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -137,11 +137,9 @@ module SourceSinkInterpretationInput implements
137137
SourceOrSinkElement e, string output, string kind, Public::Provenance provenance, string model
138138
) {
139139
exists(
140-
string package, string type, boolean subtypes, string name, string signature, string ext,
141-
QlBuiltins::ExtensionId madId
140+
string package, string type, boolean subtypes, string name, string signature, string ext
142141
|
143-
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance, madId) and
144-
model = "MaD:" + madId.toString() and
142+
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance, model) and
145143
e = interpretElement(package, type, subtypes, name, signature, ext)
146144
)
147145
}
@@ -154,11 +152,9 @@ module SourceSinkInterpretationInput implements
154152
SourceOrSinkElement e, string input, string kind, Public::Provenance provenance, string model
155153
) {
156154
exists(
157-
string package, string type, boolean subtypes, string name, string signature, string ext,
158-
QlBuiltins::ExtensionId madId
155+
string package, string type, boolean subtypes, string name, string signature, string ext
159156
|
160-
sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, madId) and
161-
model = "MaD:" + madId.toString() and
157+
sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, model) and
162158
e = interpretElement(package, type, subtypes, name, signature, ext)
163159
)
164160
}
@@ -504,12 +500,10 @@ module Private {
504500
string model
505501
) {
506502
exists(
507-
string namespace, string type, boolean subtypes, string name, string signature, string ext,
508-
QlBuiltins::ExtensionId madId
503+
string namespace, string type, boolean subtypes, string name, string signature, string ext
509504
|
510505
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind,
511-
provenance, madId) and
512-
model = "MaD:" + madId.toString() and
506+
provenance, model) and
513507
c.asFunction() =
514508
interpretElement(namespace, type, subtypes, name, signature, ext).asEntity()
515509
)

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -192,24 +192,6 @@ abstract private class ActiveExperimentalModelsInternal extends string {
192192

193193
deprecated class ActiveExperimentalModels = ActiveExperimentalModelsInternal;
194194

195-
/** Holds if a barrier model exists for the given parameters. */
196-
predicate barrierModel(
197-
string package, string type, boolean subtypes, string name, string signature, string ext,
198-
string output, string kind, string provenance, QlBuiltins::ExtensionId madId
199-
) {
200-
Extensions::barrierModel(package, type, subtypes, name, signature, ext, output, kind, provenance,
201-
madId)
202-
}
203-
204-
/** Holds if a barrier guard model exists for the given parameters. */
205-
predicate barrierGuardModel(
206-
string package, string type, boolean subtypes, string name, string signature, string ext,
207-
string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
208-
) {
209-
Extensions::barrierGuardModel(package, type, subtypes, name, signature, ext, input,
210-
acceptingvalue, kind, provenance, madId)
211-
}
212-
213195
/**
214196
* Holds if the given extension tuple `madId` should pretty-print as `model`.
215197
*
@@ -255,9 +237,6 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
255237
)
256238
}
257239

258-
/** Holds if a neutral model exists for the given parameters. */
259-
predicate neutralModel = Extensions::neutralModel/6;
260-
261240
/** Provides a query predicate to check the MaD models for validation errors. */
262241
module ModelValidation {
263242
private import codeql.dataflow.internal.AccessPathSyntax as AccessPathSyntax

‎java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,4 +98,6 @@ extensible predicate experimentalSummaryModel(
9898

9999
module Extensions implements SharedMaD::ExtensionsSig {
100100
import ExternalFlowExtensions
101+
102+
predicate packageGrouping(string group, string package) { none() }
101103
}

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -264,11 +264,10 @@ module SourceSinkInterpretationInput implements
264264
) {
265265
exists(
266266
string namespace, string type, boolean subtypes, string name, string signature, string ext,
267-
SourceOrSinkElement baseBarrier, string originalOutput, QlBuiltins::ExtensionId madId
267+
SourceOrSinkElement baseBarrier, string originalOutput
268268
|
269269
barrierModel(namespace, type, subtypes, name, signature, ext, originalOutput, kind,
270-
provenance, madId) and
271-
model = "MaD:" + madId.toString() and
270+
provenance, model) and
272271
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
273272
(
274273
e = baseBarrier and output = originalOutput
@@ -284,11 +283,10 @@ module SourceSinkInterpretationInput implements
284283
) {
285284
exists(
286285
string namespace, string type, boolean subtypes, string name, string signature, string ext,
287-
SourceOrSinkElement baseBarrier, string originalInput, QlBuiltins::ExtensionId madId
286+
SourceOrSinkElement baseBarrier, string originalInput
288287
|
289288
barrierGuardModel(namespace, type, subtypes, name, signature, ext, originalInput,
290-
acceptingvalue, kind, provenance, madId) and
291-
model = "MaD:" + madId.toString() and
289+
acceptingvalue, kind, provenance, model) and
292290
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
293291
(
294292
e = baseBarrier and input = originalInput

‎shared/mad/codeql/mad/static/MaD.qll‎

Lines changed: 88 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ signature module ExtensionsSig {
4949
predicate neutralModel(
5050
string namespace, string type, string name, string signature, string kind, string provenance
5151
);
52+
53+
/**
54+
* Holds if the package `package` is part of the group `group`.
55+
*/
56+
predicate packageGrouping(string group, string package);
5257
}
5358

5459
signature module InputSig {
@@ -157,21 +162,44 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
157162
)
158163
}
159164

165+
/** Gets the prefix for a group of packages/namespaces. */
166+
private string groupPrefix() { result = "group:" }
167+
168+
/**
169+
* Gets a package/namespace represented by `namespaceOrGroup`.
170+
*
171+
* If `namespaceOrGroup` is of the form `group:<groupname>` then `result` is a
172+
* package/namespace in the group `<groupname>`, as determined by `packageGrouping`.
173+
* Otherwise, `result` is `namespaceOrGroup`.
174+
*/
175+
bindingset[namespaceOrGroup]
176+
private string getNamespace(string namespaceOrGroup) {
177+
not exists(string group | namespaceOrGroup = groupPrefix() + group) and
178+
result = namespaceOrGroup
179+
or
180+
exists(string group |
181+
Extensions::packageGrouping(group, result) and
182+
namespaceOrGroup = groupPrefix() + group
183+
)
184+
}
185+
160186
/**
161187
* Holds if a source model exists for the given parameters.
162188
*/
163189
predicate sourceModel(
164190
string namespace, string type, boolean subtypes, string name, string signature, string ext,
165191
string output, string kind, string provenance, string model
166192
) {
167-
exists(QlBuiltins::ExtensionId madId |
168-
Extensions::sourceModel(namespace, type, subtypes, name, signature, ext, output, kind,
169-
provenance, madId) and
170-
model = "MaD:" + madId.toString()
193+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
194+
exists(QlBuiltins::ExtensionId madId |
195+
Extensions::sourceModel(namespaceOrGroup, type, subtypes, name, signature, ext, output,
196+
kind, provenance, madId) and
197+
model = "MaD:" + madId.toString()
198+
)
199+
or
200+
Input::additionalSourceModel(namespaceOrGroup, type, subtypes, name, signature, ext, output,
201+
kind, provenance, model)
171202
)
172-
or
173-
Input::additionalSourceModel(namespace, type, subtypes, name, signature, ext, output, kind,
174-
provenance, model)
175203
}
176204

177205
/**
@@ -181,14 +209,42 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
181209
string namespace, string type, boolean subtypes, string name, string signature, string ext,
182210
string input, string kind, string provenance, string model
183211
) {
184-
exists(QlBuiltins::ExtensionId madId |
185-
Extensions::sinkModel(namespace, type, subtypes, name, signature, ext, input, kind,
212+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
213+
exists(QlBuiltins::ExtensionId madId |
214+
Extensions::sinkModel(namespaceOrGroup, type, subtypes, name, signature, ext, input, kind,
215+
provenance, madId) and
216+
model = "MaD:" + madId.toString()
217+
)
218+
or
219+
Input::additionalSinkModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
220+
kind, provenance, model)
221+
)
222+
}
223+
224+
/** Holds if a barrier model exists for the given parameters. */
225+
predicate barrierModel(
226+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
227+
string output, string kind, string provenance, string model
228+
) {
229+
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
230+
namespace = getNamespace(namespaceOrGroup) and
231+
Extensions::barrierModel(namespaceOrGroup, type, subtypes, name, signature, ext, output, kind,
186232
provenance, madId) and
187233
model = "MaD:" + madId.toString()
188234
)
189-
or
190-
Input::additionalSinkModel(namespace, type, subtypes, name, signature, ext, input, kind,
191-
provenance, model)
235+
}
236+
237+
/** Holds if a barrier guard model exists for the given parameters. */
238+
predicate barrierGuardModel(
239+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
240+
string input, string acceptingvalue, string kind, string provenance, string model
241+
) {
242+
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
243+
namespace = getNamespace(namespaceOrGroup) and
244+
Extensions::barrierGuardModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
245+
acceptingvalue, kind, provenance, madId) and
246+
model = "MaD:" + madId.toString()
247+
)
192248
}
193249

194250
/**
@@ -198,14 +254,27 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
198254
string namespace, string type, boolean subtypes, string name, string signature, string ext,
199255
string input, string output, string kind, string provenance, string model
200256
) {
201-
exists(QlBuiltins::ExtensionId madId |
202-
Extensions::summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind,
203-
provenance, madId) and
204-
model = "MaD:" + madId.toString()
257+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
258+
exists(QlBuiltins::ExtensionId madId |
259+
Extensions::summaryModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
260+
output, kind, provenance, madId) and
261+
model = "MaD:" + madId.toString()
262+
)
263+
or
264+
Input::additionalSummaryModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
265+
output, kind, provenance, model)
266+
)
267+
}
268+
269+
/**
270+
* Holds if a neutral model exists for the given parameters.
271+
*/
272+
predicate neutralModel(
273+
string namespace, string type, string name, string signature, string kind, string provenance
274+
) {
275+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
276+
Extensions::neutralModel(namespaceOrGroup, type, name, signature, kind, provenance)
205277
)
206-
or
207-
Input::additionalSummaryModel(namespace, type, subtypes, name, signature, ext, input, output,
208-
kind, provenance, model)
209278
}
210279

211280
private predicate relevantNamespace(string namespace) {

0 commit comments

Comments
 (0)