C++: Add taint models for boost::asio::ip::resolve

[MathiasVP]

This PR adds taint models for all the overloads of the ip::basic_resolver::resolve member function. This was needed for some internal Microsoft work.

Annoyingly, whether the interesting parameter is a const std::string& or a boost::asio::string_view depends on a macro BOOST_ASIO_STRING_VIEW_PARAM (see here) so we need to handle both cases in MaD.

[Copilot]

Copilot review overview

🟡 Changes recommended

The summaries omit taint propagation from the service parameter, and the tests do not cover that flow.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	cpp/​ql/​lib/​ext/​Boost.Asio.model.yml — These four summaries only propagate taint from host, but service also determines every returned…
	cpp/​ql/​test/​library-tests/​dataflow/​external-models/​asio_streams.cpp — All new calls use a tainted host with a constant empty service, so the fixture cannot detect…

What changed in this PR

Adds C++ taint models for Boost.Asio resolver overloads across string and string-view configurations.

Changes:

• Models synchronous basic_resolver::resolve overloads.
• Adds fixtures covering overload signatures.
• Updates generated test expectations.

File	Description
cpp/​ql/​lib/​ext/​Boost.Asio.model.yml	Adds resolver taint summaries.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​asio_streams.cpp	Adds resolver fixtures.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​flow.expected	Updates expected model flows.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​sinks.expected	Updates shifted sink locations.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​sources.expected	Updates shifted source locations.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​steps.expected	Adds resolver steps.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​validatemodels.expected	Updates validation output.
cpp/​ql/​test/​library-tests/​dataflow/​taint-tests/​test_mad-signatures.expected	Adds matched signatures.

Suppressed comments (3)

cpp/ql/lib/ext/Boost.Asio.model.yml:33

• The string_view overloads likewise omit flow from service, even though it contributes the returned endpoint's port. Add argument 1 as an input for each signature.

      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,error_code &)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,flags)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,flags,error_code &)", "", "Argument[0]", "ReturnValue", "taint", "manual"]

cpp/ql/lib/ext/Boost.Asio.model.yml:37

• For the protocol-taking string overloads, service is argument 2 and also contributes to the resolved endpoints. Without corresponding Argument[*2] rows, service-controlled ports are treated as untainted.

      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,error_code &)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags,error_code &)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]

cpp/ql/lib/ext/Boost.Asio.model.yml:41

• These protocol-taking string_view summaries also drop taint from argument 2 (service), so a service-derived endpoint is incomplete. Add argument 2 as an input for all four signatures.

      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,error_code &)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
      - ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags,error_code &)", "", "Argument[1]", "ReturnValue", "taint", "manual"]

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.