Skip to content

Commit 7676fe5

Browse files
aschackmullaschackmull
committed
Go: Move Go package-grouping support into shared lib.
1 parent e63c0f8 commit 7676fe5

8 files changed

Lines changed: 104 additions & 138 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ extensible predicate neutralModel(
5353

5454
module Extensions implements SharedMaD::ExtensionsSig {
5555
import ExternalFlowExtensions
56+
57+
predicate packageGrouping(string group, string package) { none() }
5658
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ extensible predicate neutralModel(
5353

5454
module Extensions implements SharedMaD::ExtensionsSig {
5555
import ExternalFlowExtensions
56+
57+
predicate packageGrouping(string group, string package) { none() }
5658
}

‎go/ql/lib/semmle/go/dataflow/ExternalFlow.qll‎

Lines changed: 0 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -107,86 +107,6 @@ module FlowExtensions = Extensions;
107107
/** Gets the prefix for a group of packages. */
108108
private string groupPrefix() { result = "group:" }
109109

110-
/**
111-
* Gets a package represented by `packageOrGroup`.
112-
*
113-
* If `packageOrGroup` is of the form `group:<groupname>` then `result` is a
114-
* package in the group `<groupname>`, as determined by `packageGrouping`.
115-
* Otherwise, `result` is `packageOrGroup`.
116-
*/
117-
bindingset[packageOrGroup]
118-
private string getPackage(string packageOrGroup) {
119-
not exists(string group | packageOrGroup = groupPrefix() + group) and result = packageOrGroup
120-
or
121-
exists(string group |
122-
FlowExtensions::packageGrouping(group, result) and
123-
packageOrGroup = groupPrefix() + group
124-
)
125-
}
126-
127-
/**
128-
* Holds if a source model exists for the given parameters.
129-
*
130-
* Note that `group:` references are expanded into one or more actual packages
131-
* by this predicate.
132-
*/
133-
predicate sourceModel(
134-
string package, string type, boolean subtypes, string name, string signature, string ext,
135-
string output, string kind, string provenance, QlBuiltins::ExtensionId madId
136-
) {
137-
exists(string packageOrGroup |
138-
package = getPackage(packageOrGroup) and
139-
FlowExtensions::sourceModel(packageOrGroup, type, subtypes, name, signature, ext, output, kind,
140-
provenance, madId)
141-
)
142-
}
143-
144-
/**
145-
* Holds if a sink model exists for the given parameters.
146-
*
147-
* Note that `group:` references are expanded into one or more actual packages
148-
* by this predicate.
149-
*/
150-
predicate sinkModel(
151-
string package, string type, boolean subtypes, string name, string signature, string ext,
152-
string input, string kind, string provenance, QlBuiltins::ExtensionId madId
153-
) {
154-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
155-
FlowExtensions::sinkModel(packageOrGroup, type, subtypes, name, signature, ext, input, kind,
156-
provenance, madId)
157-
)
158-
}
159-
160-
/**
161-
* Holds if a summary model exists for the given parameters.
162-
*
163-
* Note that `group:` references are expanded into one or more actual packages
164-
* by this predicate.
165-
*/
166-
predicate summaryModel(
167-
string package, string type, boolean subtypes, string name, string signature, string ext,
168-
string input, string output, string kind, string provenance, QlBuiltins::ExtensionId madId
169-
) {
170-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
171-
FlowExtensions::summaryModel(packageOrGroup, type, subtypes, name, signature, ext, input,
172-
output, kind, provenance, madId)
173-
)
174-
}
175-
176-
/**
177-
* Holds if a neutral model exists for the given parameters.
178-
*
179-
* Note that `group:` references are expanded into one or more actual packages
180-
* by this predicate.
181-
*/
182-
predicate neutralModel(
183-
string package, string type, string name, string signature, string kind, string provenance
184-
) {
185-
exists(string packageOrGroup | package = getPackage(packageOrGroup) |
186-
FlowExtensions::neutralModel(packageOrGroup, type, name, signature, kind, provenance)
187-
)
188-
}
189-
190110
bindingset[p]
191111
private string cleanPackage(string p) {
192112
exists(string noPrefix |

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -137,11 +137,9 @@ module SourceSinkInterpretationInput implements
137137
SourceOrSinkElement e, string output, string kind, Public::Provenance provenance, string model
138138
) {
139139
exists(
140-
string package, string type, boolean subtypes, string name, string signature, string ext,
141-
QlBuiltins::ExtensionId madId
140+
string package, string type, boolean subtypes, string name, string signature, string ext
142141
|
143-
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance, madId) and
144-
model = "MaD:" + madId.toString() and
142+
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance, model) and
145143
e = interpretElement(package, type, subtypes, name, signature, ext)
146144
)
147145
}
@@ -154,11 +152,9 @@ module SourceSinkInterpretationInput implements
154152
SourceOrSinkElement e, string input, string kind, Public::Provenance provenance, string model
155153
) {
156154
exists(
157-
string package, string type, boolean subtypes, string name, string signature, string ext,
158-
QlBuiltins::ExtensionId madId
155+
string package, string type, boolean subtypes, string name, string signature, string ext
159156
|
160-
sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, madId) and
161-
model = "MaD:" + madId.toString() and
157+
sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, model) and
162158
e = interpretElement(package, type, subtypes, name, signature, ext)
163159
)
164160
}
@@ -504,12 +500,10 @@ module Private {
504500
string model
505501
) {
506502
exists(
507-
string namespace, string type, boolean subtypes, string name, string signature, string ext,
508-
QlBuiltins::ExtensionId madId
503+
string namespace, string type, boolean subtypes, string name, string signature, string ext
509504
|
510505
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind,
511-
provenance, madId) and
512-
model = "MaD:" + madId.toString() and
506+
provenance, model) and
513507
c.asFunction() =
514508
interpretElement(namespace, type, subtypes, name, signature, ext).asEntity()
515509
)

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -192,24 +192,6 @@ abstract private class ActiveExperimentalModelsInternal extends string {
192192

193193
deprecated class ActiveExperimentalModels = ActiveExperimentalModelsInternal;
194194

195-
/** Holds if a barrier model exists for the given parameters. */
196-
predicate barrierModel(
197-
string package, string type, boolean subtypes, string name, string signature, string ext,
198-
string output, string kind, string provenance, QlBuiltins::ExtensionId madId
199-
) {
200-
Extensions::barrierModel(package, type, subtypes, name, signature, ext, output, kind, provenance,
201-
madId)
202-
}
203-
204-
/** Holds if a barrier guard model exists for the given parameters. */
205-
predicate barrierGuardModel(
206-
string package, string type, boolean subtypes, string name, string signature, string ext,
207-
string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
208-
) {
209-
Extensions::barrierGuardModel(package, type, subtypes, name, signature, ext, input,
210-
acceptingvalue, kind, provenance, madId)
211-
}
212-
213195
/**
214196
* Holds if the given extension tuple `madId` should pretty-print as `model`.
215197
*
@@ -255,9 +237,6 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
255237
)
256238
}
257239

258-
/** Holds if a neutral model exists for the given parameters. */
259-
predicate neutralModel = Extensions::neutralModel/6;
260-
261240
/** Provides a query predicate to check the MaD models for validation errors. */
262241
module ModelValidation {
263242
private import codeql.dataflow.internal.AccessPathSyntax as AccessPathSyntax

‎java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,4 +98,6 @@ extensible predicate experimentalSummaryModel(
9898

9999
module Extensions implements SharedMaD::ExtensionsSig {
100100
import ExternalFlowExtensions
101+
102+
predicate packageGrouping(string group, string package) { none() }
101103
}

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -264,11 +264,10 @@ module SourceSinkInterpretationInput implements
264264
) {
265265
exists(
266266
string namespace, string type, boolean subtypes, string name, string signature, string ext,
267-
SourceOrSinkElement baseBarrier, string originalOutput, QlBuiltins::ExtensionId madId
267+
SourceOrSinkElement baseBarrier, string originalOutput
268268
|
269269
barrierModel(namespace, type, subtypes, name, signature, ext, originalOutput, kind,
270-
provenance, madId) and
271-
model = "MaD:" + madId.toString() and
270+
provenance, model) and
272271
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
273272
(
274273
e = baseBarrier and output = originalOutput
@@ -284,11 +283,10 @@ module SourceSinkInterpretationInput implements
284283
) {
285284
exists(
286285
string namespace, string type, boolean subtypes, string name, string signature, string ext,
287-
SourceOrSinkElement baseBarrier, string originalOutput, QlBuiltins::ExtensionId madId
286+
SourceOrSinkElement baseBarrier, string originalOutput
288287
|
289288
barrierGuardModel(namespace, type, subtypes, name, signature, ext, originalOutput,
290-
acceptingvalue, kind, provenance, madId) and
291-
model = "MaD:" + madId.toString() and
289+
acceptingvalue, kind, provenance, model) and
292290
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
293291
(
294292
e = baseBarrier and output = originalOutput

‎shared/mad/codeql/mad/static/MaD.qll‎

Lines changed: 88 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@ signature module ExtensionsSig {
4646
predicate neutralModel(
4747
string namespace, string type, string name, string signature, string kind, string provenance
4848
);
49+
50+
/**
51+
* Holds if the package `package` is part of the group `group`.
52+
*/
53+
predicate packageGrouping(string group, string package);
4954
}
5055

5156
signature module InputSig {
@@ -154,21 +159,44 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
154159
)
155160
}
156161

162+
/** Gets the prefix for a group of packages/namespaces. */
163+
private string groupPrefix() { result = "group:" }
164+
165+
/**
166+
* Gets a package/namespace represented by `packageOrGroup`.
167+
*
168+
* If `packageOrGroup` is of the form `group:<groupname>` then `result` is a
169+
* package/namespace in the group `<groupname>`, as determined by `packageGrouping`.
170+
* Otherwise, `result` is `packageOrGroup`.
171+
*/
172+
bindingset[namespaceOrGroup]
173+
private string getNamespace(string namespaceOrGroup) {
174+
not exists(string group | namespaceOrGroup = groupPrefix() + group) and
175+
result = namespaceOrGroup
176+
or
177+
exists(string group |
178+
Extensions::packageGrouping(group, result) and
179+
namespaceOrGroup = groupPrefix() + group
180+
)
181+
}
182+
157183
/**
158184
* Holds if a source model exists for the given parameters.
159185
*/
160186
predicate sourceModel(
161187
string namespace, string type, boolean subtypes, string name, string signature, string ext,
162188
string output, string kind, string provenance, string model
163189
) {
164-
exists(QlBuiltins::ExtensionId madId |
165-
Extensions::sourceModel(namespace, type, subtypes, name, signature, ext, output, kind,
166-
provenance, madId) and
167-
model = "MaD:" + madId.toString()
190+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
191+
exists(QlBuiltins::ExtensionId madId |
192+
Extensions::sourceModel(namespaceOrGroup, type, subtypes, name, signature, ext, output,
193+
kind, provenance, madId) and
194+
model = "MaD:" + madId.toString()
195+
)
196+
or
197+
Input::additionalSourceModel(namespaceOrGroup, type, subtypes, name, signature, ext, output,
198+
kind, provenance, model)
168199
)
169-
or
170-
Input::additionalSourceModel(namespace, type, subtypes, name, signature, ext, output, kind,
171-
provenance, model)
172200
}
173201

174202
/**
@@ -178,14 +206,42 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
178206
string namespace, string type, boolean subtypes, string name, string signature, string ext,
179207
string input, string kind, string provenance, string model
180208
) {
181-
exists(QlBuiltins::ExtensionId madId |
182-
Extensions::sinkModel(namespace, type, subtypes, name, signature, ext, input, kind,
209+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
210+
exists(QlBuiltins::ExtensionId madId |
211+
Extensions::sinkModel(namespaceOrGroup, type, subtypes, name, signature, ext, input, kind,
212+
provenance, madId) and
213+
model = "MaD:" + madId.toString()
214+
)
215+
or
216+
Input::additionalSinkModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
217+
kind, provenance, model)
218+
)
219+
}
220+
221+
/** Holds if a barrier model exists for the given parameters. */
222+
predicate barrierModel(
223+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
224+
string output, string kind, string provenance, string model
225+
) {
226+
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
227+
namespace = getNamespace(namespaceOrGroup) and
228+
Extensions::barrierModel(namespaceOrGroup, type, subtypes, name, signature, ext, output, kind,
183229
provenance, madId) and
184230
model = "MaD:" + madId.toString()
185231
)
186-
or
187-
Input::additionalSinkModel(namespace, type, subtypes, name, signature, ext, input, kind,
188-
provenance, model)
232+
}
233+
234+
/** Holds if a barrier guard model exists for the given parameters. */
235+
predicate barrierGuardModel(
236+
string namespace, string type, boolean subtypes, string name, string signature, string ext,
237+
string input, string acceptingvalue, string kind, string provenance, string model
238+
) {
239+
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
240+
namespace = getNamespace(namespaceOrGroup) and
241+
Extensions::barrierGuardModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
242+
acceptingvalue, kind, provenance, madId) and
243+
model = "MaD:" + madId.toString()
244+
)
189245
}
190246

191247
/**
@@ -195,14 +251,27 @@ module ModelsAsData<ExtensionsSig Extensions, InputSig Input> {
195251
string namespace, string type, boolean subtypes, string name, string signature, string ext,
196252
string input, string output, string kind, string provenance, string model
197253
) {
198-
exists(QlBuiltins::ExtensionId madId |
199-
Extensions::summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind,
200-
provenance, madId) and
201-
model = "MaD:" + madId.toString()
254+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
255+
exists(QlBuiltins::ExtensionId madId |
256+
Extensions::summaryModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
257+
output, kind, provenance, madId) and
258+
model = "MaD:" + madId.toString()
259+
)
260+
or
261+
Input::additionalSummaryModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
262+
output, kind, provenance, model)
263+
)
264+
}
265+
266+
/**
267+
* Holds if a neutral model exists for the given parameters.
268+
*/
269+
predicate neutralModel(
270+
string namespace, string type, string name, string signature, string kind, string provenance
271+
) {
272+
exists(string namespaceOrGroup | namespace = getNamespace(namespaceOrGroup) |
273+
Extensions::neutralModel(namespaceOrGroup, type, name, signature, kind, provenance)
202274
)
203-
or
204-
Input::additionalSummaryModel(namespace, type, subtypes, name, signature, ext, input, output,
205-
kind, provenance, model)
206275
}
207276

208277
private predicate relevantNamespace(string namespace) {

0 commit comments

Comments
 (0)