Fundamentals of taint tracking using data flow analysis

Any taint tracking or data flow analysis query has three explicit components, one of which is optional, and an implicit component.

The explicit components are:

A taint tracking or data flow query gives results when there is the flow of data from a source to a sink, which is not blocked by a sanitizer.

The purpose of the configuration is to specify exactly which sources and sinks are relevant to the specific query.

The kind of taint determines which non-value-preserving steps are possible, in addition to value-preserving steps that are built into the analysis.

In the above example ``dir = path + "/"``, taint flows from ``path`` to ``dir`` if the taint represents a string, but not if the taint is ``None``.

2. Strings are not source nodes and cannot be tracked using this API. You can, however, use the ``mayHaveStringValue`` predicate on class ``DataFlow::Node``

to reason about the possible string values flowing into a data flow node.

Exercises

Each class has predicates, which are logical propositions about that class. They also define navigable relationships between classes. Predicates are inherited, so for example the ``AddExpr`` class inherits the predicates ``getLeftOperand()`` and ``getRightOperand()`` from ``BinaryArithmeticOperation``, and ``getType()`` from class ``Expr``. This is similar to how methods are inherited in object-oriented programming languages.

Exercises

Files

Class hierarchy

Elements

``Element`` forms a hierarchical structure of the program, which can be navigated using the ``getParent()`` and ``getChild()`` predicates. This is much like an abstract syntax tree, and also applies to elements in assemblies.

Locations

Sometimes elements have several locations, for example if they occur in both source code and an assembly. In this case, only the ``SourceLocation`` is returned.

Declarations

Class hierarchy

Variables

Class hierarchy

Types

The builtin types (``object``, ``int``, ``double`` etc.) have corresponding types (``System.Object``, ``System.Int32`` etc.) in mscorlib.

Callables

The database contains all of the callables in your program and in all referenced assemblies.

Statements

Class hierarchy

Expressions

The ``Access`` class represents any use or cross-reference of another ``Declaration`` such a variable, property, method or field. The ``getTarget()`` predicate gets the declaration being accessed.

Attributes

The attribute of any ``Element`` can be obtained via ``getAnAttribute()``, whereas if you have an attribute, you can find its element via ``getTarget()``. These two query fragments are identical:

The rest of this tutorial briefly summarizes the most important classes and predicates provided by

this library, including references to the `detailed API documentation

representation, followed by an explanation of names and entities, which are used to represent

name-binding information, and of types and type information. Then we move on to control flow and the

data-flow graph, and finally the call graph and a few advanced topics.

``(x + y)``, which is the zeroth child of ``(x + y) * z``, whose first child is ``z``.

All AST nodes belong to class `AstNode

tree traversal predicates:

- ``getChild(i)``: returns the ``i``\ th child of this AST node.

dataset, and hence is not directly accessible to CodeQL queries.

The predicate ``getLocation()`` in class ``AstNode`` returns a `Location

describing the source location of the program element represented by the AST node. You can use its

member predicates ``getFile()``, ``getStartLine()``, ``getStartColumn``, ``getEndLine()``, and

``getEndColumn()`` to obtain information about its file, start line and column, and end line and

column.

The most important subclasses of `AstNode

statements and expressions, respectively. This section briefly discusses some of their more

important subclasses and predicates. For a full reference of all the subclasses of `Stmt

:doc:`Abstract syntax tree classes for Go <abstract-syntax-tree-classes-for-working-with-go-programs>`.

Statements