Skip to content
Merged
Changes from 1 commit
Commits
Show all changes
64 commits
Select commit Hold shift + click to select a range
16a11b4
Switch to use-use dataflow. This will make post-update nodes easy to …
owen-mc Nov 10, 2023
4484d5b
Add missing QLDoc
owen-mc Nov 28, 2023
5267671
Clean up code in basicLocalFlowStep
owen-mc Nov 28, 2023
b474315
Include first step from SsaVariableCapture
owen-mc Nov 28, 2023
49b8b0b
Remove local flow step from SSA defn to SSA capture
owen-mc Sep 5, 2025
4e04d27
Adjust SafeFormatArgumentSanitizer to use-use flow
owen-mc Nov 29, 2023
b2a9cec
Fix Allocation Size Overflow for use-use flow
owen-mc Nov 30, 2023
9068315
Fix IncorrectIntegerConversion for use-use flow
owen-mc Nov 30, 2023
a3eb010
Optimise join order for varBlockReaches
smowton Jan 26, 2021
32de211
Use `_` instead of exists variable x2
owen-mc Sep 2, 2025
3594dba
Make insecure randomness test more realistic
owen-mc Mar 6, 2025
5210665
Test result that was missing is now found
owen-mc Nov 10, 2023
c20abf6
Line numbers change because 3 lines were added
owen-mc Nov 29, 2023
14301e0
Expected changes in dataflow edges
owen-mc Nov 10, 2023
d13d717
Fix QLDoc typo
owen-mc May 5, 2025
7a515c1
Pull out post-update node logic into predicate
owen-mc May 5, 2025
c8b8e25
Convert post-update logic to IR (part 1)
owen-mc May 5, 2025
203952f
Convert post-update logic to IR (part 2)
owen-mc Sep 10, 2025
ad18018
Implement `writesComponent` at IR level
owen-mc Sep 12, 2025
05a16dc
Convert post-update logic to IR (part 3)
owen-mc Sep 11, 2025
89ae0e3
Inline predicate only used once
owen-mc Sep 11, 2025
9892836
Switch order of PUN test output
owen-mc Sep 12, 2025
a0c647c
Add Email Injection tests for reverse flow models
owen-mc Sep 18, 2025
118def8
Make separate post-update nodes
owen-mc Sep 12, 2025
d2230c5
Expected changes in test output
owen-mc Sep 12, 2025
ac71f9c
Expected change in test output
owen-mc Sep 16, 2025
3229630
Make store step to send stmt's channel use post-update node
owen-mc Sep 16, 2025
8a3bd84
Fix test expectations for Cleartext Logging
owen-mc Sep 16, 2025
cf6cfe2
Non-initializing writes should target post-update nodes
owen-mc Sep 17, 2025
748c53a
Refactor: Create `writesFieldOnSsaWithFields`
owen-mc Sep 18, 2025
6215587
Fix flow to variable capture
owen-mc Sep 18, 2025
3906f25
Adjust Stack Exposure test so it passes
owen-mc Sep 18, 2025
5efc8ac
Fix backwards flow through TaintTracking::FunctionModel
owen-mc Sep 23, 2025
6cb6953
Add missing qldocs
owen-mc Sep 19, 2025
a9420d4
Fix bad join order
owen-mc Sep 19, 2025
52b6539
Typo
owen-mc Sep 19, 2025
f5f6d64
Add change notes
owen-mc Sep 19, 2025
25f1823
Fix email injection sink that needs local flow
owen-mc Sep 18, 2025
4ee236d
Delete commented out code
owen-mc Sep 25, 2025
1d9a93a
Rename helper predicate
owen-mc Sep 25, 2025
b1bcbec
Use slightly less confusing syntax
owen-mc Sep 25, 2025
630a844
Rename confusing predicate and add qldoc
owen-mc Sep 25, 2025
7b42618
Rephrase change note to avoid technical terms
owen-mc Sep 25, 2025
1144bb9
Convert OpenUrlRedirect tests to InlineExpectations
owen-mc Sep 25, 2025
414bab1
Add OpenUrlRedirect tests for Url.Host field
owen-mc Sep 25, 2025
c9a2816
Fix OpenUrlRedirect barrier for write to Url.Host
owen-mc Sep 25, 2025
489b843
Add and use `WriteNode.writesFieldPreUpdate`
owen-mc Sep 25, 2025
2ffb638
Delete `WriteNode.writesFieldOnSsaWithFields`
owen-mc Sep 25, 2025
6fcd358
Fix pointer content store step for write to field of pointer dereference
owen-mc Sep 26, 2025
59e3c14
Add and use `WriteNode.writesElementPreUpdate`
owen-mc Sep 29, 2025
8a21a4f
Deprecate `WriteNode.writesComponent`
owen-mc Sep 29, 2025
620ae33
Make SafeUrlFlow test more comprehensive (failing)
owen-mc Sep 30, 2025
6e4dbe8
Fix SafeUrlFlow so test passes
owen-mc Sep 30, 2025
8b04d0a
Convert SSRF tests to inline expectations tests
owen-mc Oct 1, 2025
c9ce2c8
Add test for assignment to Url.Host field
owen-mc Oct 1, 2025
f0f5fc7
Improve SSRF additional flow step
owen-mc Oct 1, 2025
6d6852f
Test PathAssignmentBarrier for OpenUrlRedirect
owen-mc Oct 1, 2025
c006777
Simplify PathAssignmentBarrier
owen-mc Oct 1, 2025
2629369
Improve additional flow step for Host field
owen-mc Oct 1, 2025
7fdda87
Fix `go/impossible-interface-nil-check` for separate post-update nodes
owen-mc Oct 2, 2025
d8891e3
Small improvement to `go/unhandled-writable-file-close`
owen-mc Oct 2, 2025
4d48628
Preserve old behaviour of `Write.writesComponent`
owen-mc Oct 2, 2025
cce44b1
Update change notes for api changes
owen-mc Oct 2, 2025
f35d28d
Change note for bug fix in `go/unvalidated-url-redirection`
owen-mc Oct 2, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Convert post-update logic to IR (part 1)
  • Loading branch information
owen-mc committed Oct 1, 2025
commit c8b8e25fbb6bde1eb8f59ba98338e2c2616c49b0
16 changes: 11 additions & 5 deletions go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
Original file line number Diff line number Diff line change
Expand Up @@ -807,12 +807,18 @@ module Public {
abstract Node getPreUpdateNode();
}

predicate insnHasPostUpdateNode(IR::Instruction insn) {
exists(Expr e | insn.(IR::EvalInstruction).getExpr() = e |
e instanceof AddressExpr or
e = any(AddressExpr ae).getOperand() or
e = any(StarExpr ae).getBase() or
e = any(DerefExpr ae).getOperand() or
e = any(IR::EvalImplicitDerefInstruction eidi).getOperand()
)
}

predicate hasPostUpdateNode(Node preupd) {
preupd instanceof AddressOperationNode
or
preupd = any(AddressOperationNode addr).getOperand()
or
preupd = any(PointerDereferenceNode deref).getOperand()
insnHasPostUpdateNode(preupd.asInstruction())
or
preupd = getAWrittenNode()
or
Expand Down