Class TypeBackTracker

A summary of the steps needed to back-track a use of a value to a given dataflow node.

This can for example be used to track callbacks that are passed to a certain API, so we can model specific parameters of that callback as having a certain type.

Note that type back-tracking does not provide a source/sink relation, that is, it may determine that a node will be used in an API call somewhere, but it won’t determine exactly where that use was, or the path that led to the use.

It is recommended that all uses of this type are written in the following form, for back-tracking some callback type myCallback:

DataFlow::TypeTrackingNode myCallback(DataFlow::TypeBackTracker t) {
  t.start() and
  result = (< some API call >).getArgument(< n >).getALocalSource()
  or
  exists (DataFlow::TypeBackTracker t2 |
    result = myCallback(t2).backtrack(t2, t)
  )
}

DataFlow::TypeTrackingNode myCallback() { result = myCallback(DataFlow::TypeBackTracker::end()) }

Instead of result = myCallback(t2).backtrack(t2, t), you can also use the equivalent t2 = t.step(result, myCallback(t2)). If you additionally want to track individual intra-procedural steps, use t2 = t.smallstep(result, myCallback(t2)).