Diff-informed queries via primary/secondary abstractions #19586
Conversation
I haven't figured out how to avoid the redundancy between
`getASelected{Source,Sink}Location` in the module and the class. Maybe
we need a strong notion of primary and secondary data-flow
configurations.
For now I've only implemented what XSS.qll needs
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| class IsDiffInformed extends DataFlow::DiffInformedQuery { | ||
| // This predicate is overridden to be more precise than the default | ||
| // implementation in order to support secondary secondary data-flow |
Check warning
Code scanning / CodeQL
Comment has repeated word Warning
| } | ||
|
|
||
| module Primary<ConfigSig Config> implements GlobalFlowSig { | ||
| private module Config0 implements FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| module FindSinks<DataFlow::ConfigSig Config, DataFlow::SecondaryConfig SC> implements | ||
| DataFlow::GlobalFlowSig | ||
| { | ||
| private module Config0 implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
| } | ||
| } | ||
|
|
||
| private module C implements DataFlowInternal::FullStateConfigSig { |
Check warning
Code scanning / CodeQL
Data flow configuration module naming Warning
|
Superseded by #20386 |
1 participant
This PR is a proof of concept for how diff-informed queries could be made more high level, reducing hard-to-remember design patterns and simultaneously reducing reverse dependencies and the "module soup" I proposed in #17846.
I've only implemented what's necessary for
XSS.qlso far since I expect a lot of changes to names and APIs.