Skip to content

Commit 3395dc9

Browse files
hvitvedhvitved
authored
Merge pull request #16576 from hvitved/csharp/static-field-side-effect
C#: Add support for flow through side-effects on static fields
2 parents aeabee3 + 1bcac50 commit 3395dc9

File tree

4 files changed

+51
-2
lines changed

4 files changed

+51
-2
lines changed

‎csharp/ql/lib/change-notes/2024-05-23-static-field-side-effect.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* Added support for data flow through side-effects on static fields. For example, when a static field containing an array is updated.

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

+4-2
Original file line numberDiff line numberDiff line change
@@ -2170,9 +2170,11 @@ predicate jumpStep(Node pred, Node succ) {
21702170
f.getAnAssignedValue() = pred.asExpr() and
21712171
succ = TFlowInsensitiveFieldNode(f)
21722172
or
2173-
exists(FieldOrPropertyRead fr |
2173+
exists(FieldOrPropertyRead fr | f.getAnAccess() = fr |
2174+
fr = pred.(PostUpdateNode).getPreUpdateNode().asExpr() and
2175+
succ = TFlowInsensitiveFieldNode(f)
2176+
or
21742177
pred = TFlowInsensitiveFieldNode(f) and
2175-
f.getAnAccess() = fr and
21762178
fr = succ.asExpr() and
21772179
fr.hasNonlocalValue()
21782180
)

‎csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected

+24
Original file line numberDiff line numberDiff line change
@@ -1152,6 +1152,16 @@ edges
11521152
| J.cs:125:14:125:14 | access to local variable a : Int32[] [element] : Int32 | J.cs:125:14:125:17 | access to array element : Int32 | provenance | |
11531153
| J.cs:125:14:125:17 | access to array element : Int32 | J.cs:125:14:125:17 | (...) ... | provenance | |
11541154
| J.cs:125:14:125:17 | access to array element : Int32 | J.cs:125:14:125:17 | (...) ... | provenance | |
1155+
| K.cs:7:13:7:13 | access to local variable o : String | K.cs:8:22:8:22 | access to local variable o : String | provenance | |
1156+
| K.cs:7:13:7:13 | access to local variable o : String | K.cs:8:22:8:22 | access to local variable o : String | provenance | |
1157+
| K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:7:13:7:13 | access to local variable o : String | provenance | |
1158+
| K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:7:13:7:13 | access to local variable o : String | provenance | |
1159+
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | provenance | |
1160+
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | provenance | |
1161+
| K.cs:8:22:8:22 | access to local variable o : String | K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | provenance | |
1162+
| K.cs:8:22:8:22 | access to local variable o : String | K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | provenance | |
1163+
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | K.cs:13:14:13:23 | access to array element | provenance | |
1164+
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | K.cs:13:14:13:23 | access to array element | provenance | |
11551165
nodes
11561166
| A.cs:5:13:5:13 | access to local variable c : C | semmle.label | access to local variable c : C |
11571167
| A.cs:5:13:5:13 | access to local variable c : C | semmle.label | access to local variable c : C |
@@ -2393,6 +2403,18 @@ nodes
23932403
| J.cs:125:14:125:17 | (...) ... | semmle.label | (...) ... |
23942404
| J.cs:125:14:125:17 | access to array element : Int32 | semmle.label | access to array element : Int32 |
23952405
| J.cs:125:14:125:17 | access to array element : Int32 | semmle.label | access to array element : Int32 |
2406+
| K.cs:7:13:7:13 | access to local variable o : String | semmle.label | access to local variable o : String |
2407+
| K.cs:7:13:7:13 | access to local variable o : String | semmle.label | access to local variable o : String |
2408+
| K.cs:7:17:7:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
2409+
| K.cs:7:17:7:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
2410+
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | semmle.label | [post] access to field Strings : String[] [element] : String |
2411+
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | semmle.label | [post] access to field Strings : String[] [element] : String |
2412+
| K.cs:8:22:8:22 | access to local variable o : String | semmle.label | access to local variable o : String |
2413+
| K.cs:8:22:8:22 | access to local variable o : String | semmle.label | access to local variable o : String |
2414+
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | semmle.label | access to field Strings : String[] [element] : String |
2415+
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | semmle.label | access to field Strings : String[] [element] : String |
2416+
| K.cs:13:14:13:23 | access to array element | semmle.label | access to array element |
2417+
| K.cs:13:14:13:23 | access to array element | semmle.label | access to array element |
23962418
subpaths
23972419
| A.cs:6:24:6:24 | access to local variable c : C | A.cs:147:32:147:32 | c : C | A.cs:149:20:149:27 | object creation of type B : B [field c] : C | A.cs:6:17:6:25 | call to method Make : B [field c] : C |
23982420
| A.cs:6:24:6:24 | access to local variable c : C | A.cs:147:32:147:32 | c : C | A.cs:149:20:149:27 | object creation of type B : B [field c] : C | A.cs:6:17:6:25 | call to method Make : B [field c] : C |
@@ -2648,3 +2670,5 @@ testFailures
26482670
| J.cs:107:14:107:17 | access to property Y | J.cs:105:32:105:48 | call to method Source<Object> : Object | J.cs:107:14:107:17 | access to property Y | $@ | J.cs:105:32:105:48 | call to method Source<Object> : Object | call to method Source<Object> : Object |
26492671
| J.cs:125:14:125:17 | (...) ... | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | J.cs:125:14:125:17 | (...) ... | $@ | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | call to method Source<Int32> : Int32 |
26502672
| J.cs:125:14:125:17 | (...) ... | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | J.cs:125:14:125:17 | (...) ... | $@ | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | call to method Source<Int32> : Int32 |
2673+
| K.cs:13:14:13:23 | access to array element | K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:13:14:13:23 | access to array element | $@ | K.cs:7:17:7:33 | call to method Source<String> : String | call to method Source<String> : String |
2674+
| K.cs:13:14:13:23 | access to array element | K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:13:14:13:23 | access to array element | $@ | K.cs:7:17:7:33 | call to method Source<String> : String | call to method Source<String> : String |

‎csharp/ql/test/library-tests/dataflow/fields/K.cs

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
public class K
2+
{
3+
static string[] Strings = new string[10];
4+
5+
private void M1()
6+
{
7+
var o = Source<string>(1);
8+
Strings[0] = o;
9+
}
10+
11+
private void M2()
12+
{
13+
Sink(Strings[0]); // $ hasValueFlow=1
14+
}
15+
16+
public static void Sink(object o) { }
17+
18+
static T Source<T>(object source) => throw null;
19+
}

0 commit comments

Comments
 (0)