Class Configuration
A configuration of interprocedural data flow analysis. This defines sources, sinks, and any other configurable aspect of the analysis. Each use of the global data flow library must define its own unique extension of this abstract class. To create a configuration, extend this class with a subclass whose characteristic predicate is a unique singleton string. For example, write
class MyAnalysisConfiguration extends DataFlow::Configuration {
MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
// Override `isSource` and `isSink`.
// Optionally override `isBarrier`.
// Optionally override `isAdditionalFlowStep`.
}
Conceptually, this defines a graph where the nodes are DataFlow::Node
s and
the edges are those data-flow steps that preserve the value of the node
along with any additional edges defined by isAdditionalFlowStep
.
Specifying nodes in isBarrier
will remove those nodes from the graph, and
specifying nodes in isBarrierIn
and/or isBarrierOut
will remove in-going
and/or out-going edges from those nodes, respectively.
Then, to query whether there is flow between some source
and sink
,
write
exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
Multiple configurations can coexist, but two classes extending
DataFlow::Configuration
should never depend on each other. One of them
should instead depend on a DataFlow2::Configuration
, a
DataFlow3::Configuration
, or a DataFlow4::Configuration
.
Import path
import semmle.code.cpp.dataflow.internal.DataFlowImpl3
Direct supertypes
Known direct subtypes
Predicates
explorationLimit | Gets the exploration limit for |
fieldFlowBranchLimit | Gets the virtual dispatch branching limit when calculating field flow. This can be overridden to a smaller value to improve performance (a value of 0 disables field flow), or a larger value to get more results. |
hasFlow | Holds if data may flow from |
hasFlowPath | Holds if data may flow from |
hasFlowTo | Holds if data may flow from some source to |
hasFlowToExpr | Holds if data may flow from some source to |
hasPartialFlow | Holds if there is a partial data flow path from |
hasPartialFlowRev | Holds if there is a partial data flow path from |
isAdditionalFlowStep | Holds if the additional flow step from |
isBarrier | Holds if data flow through |
isBarrierGuard | Holds if data flow through nodes guarded by |
isBarrierIn | Holds if data flow into |
isBarrierOut | Holds if data flow out of |
isSink | Holds if |
isSource | Holds if |
Inherited predicates
charAt | Returns a one-character string containing the character in the receiver at the given index (which ranges from 0 through length minus one) | from string |
indexOf | Returns all the offsets at which the given string occurs in the receiver | from string |
indexOf | Returns the index of n’th occurrence of the given string within receiver, starting at the given offset | from string |
isLowercase | Holds when the receiver contains no upper-case letters | from string |
isUppercase | Holds when the receiver contains no lower-case letters | from string |
length | Returns the length of the receiver (in UTF-16 code units) | from string |
matches | Holds when the receiver matches the pattern. Patterns are matched by case sensitive string matching, and there are two wildcards: _ matches a single character, and % matches any sequence of characters. To match the actual characters _ or % in the pattern, they must be escaped using backslashes. For example, | from string |
prefix | Returns the substring of the receiver ending at the given offset | from string |
regexpCapture | When the given regexp matches the entire receiver, returns the substring matched by the given capture group | from string |
regexpFind | Returns a substring of the receiver which matches the given regexp. Also returns the offset within the receiver at which the match occurred (occurrenceOffset), and the number of matches which occur at smaller offsets (occurrenceIndex) | from string |
regexpMatch | Holds when the given regexp matches the entire receiver | from string |
regexpReplaceAll | Returns a copy of the receiver with every substring which matches the given regexp is replaced by the replacement | from string |
replaceAll | Returns a copy of the receiver with all occurrences of the target replaced by the replacement | from string |
splitAt | Returns all of the substrings obtained by splitting the receiver at every occurrence of the argument | from string |
splitAt | Returns the n’th substring obtained by splitting the receiver at every occurrence of the argument | from string |
substring | Returns the substring of the receiver which starts and ends at the given indices | from string |
suffix | Returns the substring of the receiver starting at the given offset | from string |
toDate | Returns the date, if any, obtained by parsing the receiver | from string |
toFloat | Returns the floating point number, if any, obtained by parsing the receiver | from string |
toInt | Returns the integer, if any, obtained by parsing the receiver | from string |
toLowerCase | Returns a copy of the receiver with all uppercase characters replaced by lowercase ones | from string |
toString | Returns the receiver | from string |
toUpperCase | Returns a copy of the receiver with all lowercase characters replaced by uppercase ones | from string |
trim | Returns a copy of the receiver with all whitespace removed from the beginning and end of the string (where whitespace is defined as unicode codepoints ‘\u0000’ through ‘\u0020’ inclusive) | from string |