Skip to content

C++: Replace QL models for std::map (and friends) with MaD models #22939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MathiasVP wants to merge 32 commits into
base: main
Choose a base branch
from
Open

C++: Replace QL models for std::map (and friends) with MaD models #22939

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
e6b9042
C++: Fix const'ness in the map tests. The containers were incorrectly…
MathiasVP Oct 12, 2026
b63ce1d
C++: Make map in the azure test more realistic.
MathiasVP Oct 12, 2026
f9e4a41
C++: Make strings in the azure test more realistic.
MathiasVP Oct 12, 2026
c34cdde
C++: Test nested typedefs in forwarding.
MathiasVP Oct 12, 2026
5fe32d3
C++: Support typedef's in forward models.
MathiasVP Oct 22, 2026
4c29747
C++: Make sure 'Nullable' actually has a member so that we can refere…
MathiasVP Oct 12, 2026
676c670
C++: Add missing map-related APIs.
MathiasVP Oct 29, 2026
23320e8
C++: Add more string tests.
MathiasVP Oct 29, 2026
db73714
C++: Add map models.
MathiasVP Oct 12, 2026
fe7a9f4
C++: Add string models.
MathiasVP Oct 12, 2026
e277464
C++: Add unordered map models.
MathiasVP Oct 12, 2026
0873d57
C++: Add pair models.
MathiasVP Oct 12, 2026
775ec38
C++: Replace vector dataflow models with forwarding models.
MathiasVP Oct 12, 2026
a655986
C++: Accept azure testcases and add another failing azure taint-track…
MathiasVP Oct 29, 2026
de85fc8
C++: Fixup azure models after map changes and accept tests.
MathiasVP Oct 29, 2026
344369b
C++: Sync bsl models with std models.
MathiasVP Oct 12, 2026
88cbb62
C++: Add implicit taint reads for content stored in maps. Since a val…
MathiasVP Oct 12, 2026
155ad79
C++: Add string_view models.
MathiasVP Oct 22, 2026
13cbcdf
C++: Add pair constructors. Also delete the actual implementation of …
MathiasVP Oct 12, 2026
5042c65
C++: Ensure instantiation.
MathiasVP Oct 12, 2026
0a45b00
C++: Fix another type error.
MathiasVP Oct 12, 2026
183774e
C++: Accept test changes.
MathiasVP Oct 29, 2026
16706b6
C++: Speed up forwarding logic code by computing the relevant tuples …
MathiasVP Oct 22, 2026
9fbef3b
C++: Add two missing results. One from the fact that we block flow on…
MathiasVP Oct 28, 2026
78026b9
C++: Fixup CWE-311 queries.
MathiasVP Oct 22, 2026
683a97a
C++: Modify 'asExpr' so that it holds for the the indirect node when …
MathiasVP Oct 22, 2026
d64aa55
C++: Fixup the 'cpp/command-line-injection' query. Previously the nod…
MathiasVP Oct 28, 2026
f912927
C++: Accept query path changes.
MathiasVP Oct 28, 2026
57a8a61
C++: Add change note.
MathiasVP Oct 29, 2026
5112df3
C++: Fix Copilot comments.
MathiasVP Oct 29, 2026
7abf69d
C++: Pretty print MaD summaries in 'cpp/command-line-injection' and a…
MathiasVP Oct 29, 2026
d6bf61a
C++: Big cleanup of declarations in the taint-tests to get rid of dup…
MathiasVP Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cpp/ql/lib/change-notes/2026-10-29-stl-containers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Dataflow through STL containers are now tracked more precisely.
18 changes: 9 additions & 9 deletions cpp/ql/lib/ext/azure.core.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ extensions:
pack: codeql/cpp-all
extensible: sourceModel
data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
- ["Azure::Core::Http", "RawResponse", True, "GetHeaders", "", "", "ReturnValue[*]", "remote", "manual"]
- ["Azure::Core::Http", "RawResponse", True, "GetHeaders", "", "", "ReturnValue[*].Element.Field[std::pair::second]", "remote", "manual"]
- ["Azure::Core::Http", "RawResponse", True, "GetBody", "", "", "ReturnValue[*]", "remote", "manual"]
- ["Azure::Core::Http", "RawResponse", True, "ExtractBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]
- ["Azure::Core::Http", "Request", True, "GetHeaders", "", "", "ReturnValue", "remote", "manual"]
- ["Azure::Core::Http", "Request", True, "GetHeader", "", "", "ReturnValue", "remote", "manual"]
- ["Azure::Core::Http", "Request", True, "GetHeaders", "", "", "ReturnValue.Element.Field[std::pair::second]", "remote", "manual"]
- ["Azure::Core::Http", "Request", True, "GetHeader", "", "", "ReturnValue.Field[Azure::Nullable::m_value]", "remote", "manual"]
- ["Azure::Core::Http", "Request", True, "GetBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]

- addsTo:
Expand All @@ -19,13 +19,13 @@ extensions:
- ["Azure::Core", "Url", True, "SetHost", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "SetPort", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "SetPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "SetQueryParameters", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "SetQueryParameters", "", "", "Argument[0].Element.Field[std::pair::second]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "AppendPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "AppendQueryParameter", "", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetHost", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetPath", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetPort", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetQueryParameters", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetQueryParameters", "", "", "Argument[-1]", "ReturnValue.Element.Field[std::pair::second]", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetScheme", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetRelativeUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["Azure::Core", "Url", True, "GetAbsoluteUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
Expand All @@ -34,8 +34,8 @@ extensions:
- ["Azure::Core::IO", "BodyStream", True, "Read", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
- ["Azure::Core::IO", "BodyStream", True, "ReadToCount", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
- ["Azure::Core::IO", "BodyStream", True, "ReadToEnd", "", "", "Argument[-1]", "ReturnValue.Element", "taint", "manual"]
- ["Azure", "Nullable", True, "Nullable", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["Azure", "Nullable", True, "Nullable", "", "", "Argument[@0]", "Argument[-1].Field[@Azure::Nullable::m_value]", "value", "manual"]
- ["Azure", "Nullable", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
- ["Azure", "Nullable", True, "Value", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure", "Nullable", True, "operator->", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure", "Nullable", True, "operator*", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
- ["Azure", "Nullable", True, "Value", "", "", "Argument[-1].Field[@Azure::Nullable::m_value]", "ReturnValue[*@]", "value", "manual"]
- ["Azure", "Nullable", True, "operator->", "", "", "Argument[-1].Field[@Azure::Nullable::m_value]", "ReturnValue[*@]", "value", "manual"]
- ["Azure", "Nullable", True, "operator*", "", "", "Argument[-1].Field[@Azure::Nullable::m_value]", "ReturnValue[*@]", "value", "manual"]
Loading
Loading