CodeQL library for C/C++
Search

Module TaintTracking

Import path

import semmle.code.cpp.dataflow.TaintTracking

Predicates

defaultAdditionalTaintStep

Holds if the additional step from src to sink should be included in all global taint flow configurations.

defaultImplicitTaintRead

Holds if default TaintTracking::Configurations should allow implicit reads of c at sinks and inputs to additional taint steps.

defaultTaintSanitizer

Holds if node should be a sanitizer in all global taint flow configurations but not in local taint.

localAdditionalTaintStep

Holds if taint can flow in one local step from nodeFrom to nodeTo excluding local data flow steps. That is, nodeFrom and nodeTo are likely to represent different objects.

localExprTaint

Holds if taint can flow from e1 to e2 in zero or more local (intra-procedural) steps.

localTaint

Holds if taint may propagate from source to sink in zero or more local (intra-procedural) steps.

localTaintStep

Holds if taint propagates from nodeFrom to nodeTo in exactly one local (intra-procedural) step.

Classes

Configuration

A configuration of interprocedural taint tracking analysis. This defines sources, sinks, and any other configurable aspect of the analysis. Each use of the taint tracking library must define its own unique extension of this abstract class.

Aliases

Configuration2

DEPRECATED: Use TaintTracking2::Configuration instead.