Skip to content

Commit 4a0cc3b

Browse files
kumarakkumarak
committed
fix(cpp): drop bslx summaries with scalar outputs
Remove the taint summaries whose output is an integer or float (getLength, getVersion, getInt*, getUint*, getFloat*) on ByteInStream and GenericInStream. Most queries sanitize taint through integers, so these rows add nothing. Keep the fluent ReturnValue[*] rows and the string and array outputs. Rework the fixture cases that sank an int to go through getString, and add two no-flow cases for getInt32.
1 parent c7d50f6 commit 4a0cc3b

4 files changed

Lines changed: 237 additions & 314 deletions

File tree

‎cpp/ql/lib/ext/bslx.model.yml‎

Lines changed: 8 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,10 @@ extensions:
1010
# tainted stream; a stream reset with a clean buffer keeps any earlier taint.
1111
- ["BloombergLP::bslx", "ByteInStream", true, "ByteInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
1212
- ["BloombergLP::bslx", "ByteInStream", true, "reset", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
13-
# Taint out: the stream (`this`) taints the deserialized output variable/buffer.
14-
- ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
15-
- ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
16-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
17-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
18-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
19-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
20-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
21-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
22-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
23-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
24-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
25-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
26-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
27-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
28-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
29-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
30-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
31-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
32-
- ["BloombergLP::bslx", "ByteInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
33-
- ["BloombergLP::bslx", "ByteInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
13+
# Taint out: the stream (`this`) taints the deserialized string/array output buffer.
14+
# Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are deliberately
15+
# not modeled as outputs: most queries sanitize taint through integers, so such rows
16+
# would add nothing. Their fluent `ReturnValue[*]` rows below are still modeled.
3417
- ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
3518
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
3619
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
@@ -93,27 +76,10 @@ extensions:
9376
# === bslx::GenericInStream<STREAMBUF>: streambuf-backed in-stream ===
9477
# Taint in: the source buffer/streambuf taints the stream (`this`).
9578
- ["BloombergLP::bslx", "GenericInStream", true, "GenericInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
96-
# Taint out: the stream (`this`) taints the deserialized output variable/buffer.
97-
- ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
98-
- ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
99-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
100-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
101-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
102-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
103-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
104-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
105-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
106-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
107-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
108-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
109-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
110-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
111-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
112-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
113-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
114-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
115-
- ["BloombergLP::bslx", "GenericInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
116-
- ["BloombergLP::bslx", "GenericInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
79+
# Taint out: the stream (`this`) taints the deserialized string/array output buffer.
80+
# Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are deliberately
81+
# not modeled as outputs: most queries sanitize taint through integers, so such rows
82+
# would add nothing. Their fluent `ReturnValue[*]` rows below are still modeled.
11783
- ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
11884
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
11985
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]

‎cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp‎

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -137,12 +137,12 @@ void sink(char);
137137

138138
// --- flow tests (source -> sink) ---
139139

140-
void test_ByteInStream_getInt32() {
140+
void test_ByteInStream_getInt32_no_flow() {
141141
std::string data = std::string(source());
142142
BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
143143
int x = 0;
144144
stream.getInt32(x);
145-
sink(x); // $ ir
145+
sink(x); // no flow: scalar outputs are deliberately not modeled
146146
}
147147

148148
void test_ByteInStream_getArrayInt8() {
@@ -165,35 +165,44 @@ void test_ByteInStream_chained() {
165165
std::string data = std::string(source());
166166
BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
167167
int a = 0;
168-
int b = 0;
169-
stream.getInt32(a).getInt32(b);
170-
sink(b); // $ ir
168+
bsl::string out;
169+
stream.getInt32(a).getString(out);
170+
sink(*out.data()); // $ ir
171171
}
172172

173173
void test_ByteInStream_reset() {
174174
BloombergLP::bslx::ByteInStream stream;
175175
std::string data = std::string(source());
176176
stream.reset(data.data(), data.size());
177-
int x = 0;
178-
stream.getInt32(x);
179-
sink(x); // $ ir
177+
bsl::string out;
178+
stream.getString(out);
179+
sink(*out.data()); // $ ir
180180
}
181181

182182
void test_GenericInStream_flow() {
183+
std::string data = std::string(source());
184+
MyStreamBuf *sb = (MyStreamBuf *)data.data();
185+
BloombergLP::bslx::GenericInStream<MyStreamBuf> stream(sb);
186+
bsl::string out;
187+
stream.getString(out);
188+
sink(*out.data()); // $ ir
189+
}
190+
191+
void test_GenericInStream_getInt32_no_flow() {
183192
std::string data = std::string(source());
184193
MyStreamBuf *sb = (MyStreamBuf *)data.data();
185194
BloombergLP::bslx::GenericInStream<MyStreamBuf> stream(sb);
186195
int x = 0;
187196
stream.getInt32(x);
188-
sink(x); // $ ir
197+
sink(x); // no flow: scalar outputs are deliberately not modeled
189198
}
190199

191200
void test_bdexStreamIn() {
192201
std::string data = std::string(source());
193202
BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
194-
int obj = 0;
203+
bsl::string obj;
195204
BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, obj);
196-
sink(obj); // $ ir
205+
sink(*obj.data()); // $ ir
197206
}
198207

199208
// --- coverage: call every modeled getter so steps.ql verifies each row is consumed ---

0 commit comments

Comments
 (0)