René's URL Explorer Experiment

Title: DataFlow: Support stateless `isSink` in `StateConfigSig`s by MathiasVP · Pull Request #13851 · github/codeql · GitHub

Open Graph Title: DataFlow: Support stateless `isSink` in `StateConfigSig`s by MathiasVP · Pull Request #13851 · github/codeql

X Title: DataFlow: Support stateless `isSink` in `StateConfigSig`s by MathiasVP · Pull Request #13851 · github/codeql

Description: Sometimes it's necessary to have a state-based configuration to define the correct isBarrier, but if data then does manage to reach a sink, any state should be accepted. Prior to this PR, the only way to prevent a cartesian product would be to do something like: module PruningConfig implements ConfigSig { predicate isSource(Node source) { exists(MyState state | isSourceImpl(source, state)) } predicate isSink(Node sink) { ... } } module PruningFlow = Global; FlowState viableStateForSink(Node sink) { exists(PruningFlow::PathNode pSource, PruningFlow::PathNode pSink | PruningFlow::flowPath(pSource, pSink) and pSink.getNode() = sink and isSourceImpl(pSource.getNode(), result) ) } module RealConfig implements StateConfigSig { class FlowState = MyState predicate isSource(Node source, FlowState state) { isSourceImpl(source, state) } predicate isSink(Node sink, FlowState state) { ... and state = viableStateForSink(sink) // <-- to prevent CP with all flow states. } predicate isBarrier(Node barrier, FlowState state) { ... } } because there was no isSink/1 on StateConfigSig. With this PR we can now do: module RealConfig implements StateConfigSig { predicate isSource(Node source, FlowState state) { ... } predicate isSink(Node sink) { ... } predicate isBarrier(Node barrier, FlowState state) { ... } } with no PruningFlow mess. cc @aschackmull I hope this isn't too controversial?

Open Graph Description: Sometimes it's necessary to have a state-based configuration to define the correct isBarrier, but if data then does manage to reach a sink, any state should be accepted. Prior to this PR, the o...

X Description: Sometimes it&#39;s necessary to have a state-based configuration to define the correct isBarrier, but if data then does manage to reach a sink, any state should be accepted. Prior to this PR, t...

Opengraph URL: https://github.com/github/codeql/pull/13851

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width