Module ExternalFlow
INTERNAL use only. This is an experimental API subject to change without notice.
Provides classes and predicates for dealing with MaD flow models specified in data extensions and CSV format.
The CSV specification has the following columns:
- Sources:
package; type; subtypes; name; signature; ext; output; kind; provenance
- Sinks:
package; type; subtypes; name; signature; ext; input; kind; provenance
- Summaries:
package; type; subtypes; name; signature; ext; input; output; kind; provenance
The interpretation of a row is similar to API-graphs with a left-to-right reading.
-
The
package
column selects a package. -
The
type
column selects a type within that package. -
The
subtypes
is a boolean that indicates whether to jump to an arbitrary subtype of that type. -
The
name
column optionally selects a specific named member of the type. -
The
signature
column is always empty. -
The
ext
column is always empty. -
The
input
column specifies how data enters the element selected by the first 6 columns, and theoutput
column specifies how data leaves the element selected by the first 6 columns. Aninput
can be either "", “Argument[n]”, or “Argument[n1..n2]”:- "": Selects a write to the selected element in case this is a field.
- “Argument[n]”: Selects an argument in a call to the selected element.
The arguments are zero-indexed, and
-1
specifies the qualifier. - “Argument[n1..n2]”: Similar to “Argument[n]” but selects any argument in the given range. The range is inclusive at both ends.
An
output
can be either "", “Argument[n]”, “Argument[n1..n2]”, “Parameter”, “Parameter[n]”, “Parameter[n1..n2]”, , “ReturnValue”, “ReturnValue[n]”, or “ReturnValue[n1..n2]”:- "": Selects a read of a selected field.
- “Argument[n]”: Selects the post-update value of an argument in a call to the
selected element. That is, the value of the argument after the call returns.
The arguments are zero-indexed, and
-1
specifies the qualifier. - “Argument[n1..n2]”: Similar to “Argument[n]” but select any argument in the given range. The range is inclusive at both ends.
- “Parameter”: Selects the value of a parameter of the selected element.
- “Parameter[n]”: Similar to “Parameter” but restricted to a specific
numbered parameter (zero-indexed, and
-1
specifies the value ofthis
). - “Parameter[n1..n2]”: Similar to “Parameter[n]” but selects any parameter in the given range. The range is inclusive at both ends.
- “ReturnValue”: Selects the first value being returned by the selected element. This requires that the selected element is a method with a body.
- “ReturnValue[n]”: Similar to “ReturnValue” but selects the specified return value. The return values are zero-indexed
- “ReturnValue[n1..n2]”: Similar to “ReturnValue[n]” but selects any return value in the given range. The range is inclusive at both ends.
For summaries,
input
andoutput
may be suffixed by any number of the following, separated by “.”:- “Field[pkg.className.fieldname]”: Selects the contents of the field
f
which satisfiesf.hasQualifiedName(pkg, className, fieldname)
. - “SyntheticField[f]”: Selects the contents of the synthetic field
f
. - “ArrayElement”: Selects an element in an array or slice.
- “Element”: Selects an element in a collection.
- “MapKey”: Selects a key in a map.
- “MapValue”: Selects a value in a map.
- “Dereference”: Selects the value referenced by a pointer.
-
The
kind
column is a tag that can be referenced from QL to determine to which classes the interpreted elements should be added. For example, for sources “remote” indicates a default remote flow source, and for summaries “taint” indicates a default additional taint step and “value” indicates a globally applicable value-preserving step.
Import path
import semmle.go.dataflow.ExternalFlow
Imports
Cached | |
ExternalFlowExtensions | This module provides extensible predicates for defining MaD models. |
Predicates
hasExternalSpecification | Holds if there is an external specification for |
interpretElement | Gets the source/sink/summary element corresponding to the supplied parameters. |
modelCoverage | Holds if MaD framework coverage of |
paramsString | Gets a parenthesized string containing all parameter types of this callable, separated by a comma. |
parseContent | Holds if the specification component parses as a |
sinkNode | Holds if |
sourceNode | Holds if |
Classes
SyntheticField | A string representing a synthetic instance field. |
Modules
ModelValidation | Provides a query predicate to check the MaD models for validation errors. |