For other CodeQL resources, including tutorials and examples, see the CodeQL documentation

Module TaintTracking

Provides classes for performing local (intra-procedural) and global (inter-procedural) taint-tracking analyses.

Import path


                                import semmle.code.cpp.dataflow.TaintTracking

Predicates

defaultAdditionalTaintStep	Holds if the additional step from `src` to `sink` should be included in all global taint flow configurations.
defaultImplicitTaintRead	Holds if default `TaintTracking::Configuration`s should allow implicit reads of `c` at sinks and inputs to additional taint steps.
defaultTaintSanitizer	Holds if `node` should be a sanitizer in all global taint flow configurations but not in local taint.
localAdditionalTaintStep	Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding local data flow steps. That is, `nodeFrom` and `nodeTo` are likely to represent different objects.
localExprTaint	Holds if taint can flow from `e1` to `e2` in zero or more local (intra-procedural) steps.
localTaint	Holds if taint may propagate from `source` to `sink` in zero or more local (intra-procedural) steps.
localTaintStep	Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local (intra-procedural) step.

Classes

Configuration

A configuration of interprocedural taint tracking analysis. This defines sources, sinks, and any other configurable aspect of the analysis. Each use of the taint tracking library must define its own unique extension of this abstract class.

Modules

Make	Constructs a standard taint tracking computation.
MakeWithState	Constructs a taint tracking computation using flow state.