Merge pull request #22374 from MathiasVP/cpp-access-paths-for-sources-and-sinks-3

C++: Support access paths for sources and sinks

Author: MathiasVP

cpp/ql/lib/change-notes/2026-08-19-access-paths-for-sources-and-sinks.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Sources and sinks defined using models-as-data now support access paths with fields. For example, the path `ReturnValue.Field[S::f]` makes the field `S::f` a flow source when it is returned by a call.

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -113,6 +113,7 @@
 import cpp
 private import new.DataFlow
 private import semmle.code.cpp.controlflow.IRGuards
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes as Nodes
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
 private import internal.FlowSummaryImpl
@@ -952,9 +953,7 @@ private module Cached {
    */
   cached
   predicate sourceNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSourceNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSource(kind, model)
   }
 
   /**
@@ -963,9 +962,7 @@ private module Cached {
    */
   cached
   predicate sinkNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isSinkNode(n, kind, model) and n.asNode() = node
-    )
+    node.(Nodes::FlowSummaryNode).isSink(kind, model)
   }
 
   private newtype TKindModelPair =

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -17,11 +17,9 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SummarizedCallableBase = Function;
 
-  class SourceBase extends Void {
-    Location getLocation() { none() }
-  }
+  class SourceBase = Function;
 
-  class SinkBase = SourceBase;
+  class SinkBase = Function;
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -134,15 +132,192 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
+private class ConversionCall extends Call {
+  ConversionCall() { this.getTarget() instanceof ConversionOperator }
+}
+
 private module Input2 implements Impl::Private::InputSig2 {
   private import codeql.util.Void
 
-  class SourceSinkReportingElement extends Void {
-    Location getLocation() { none() }
+  pragma[nomagic]
+  private predicate hasFunctionAndIndirectionIndex(
+    Function f, int indirectionIndex, Ssa::ExplicitDefinition def
+  ) {
+    def.getFunction() = f and
+    def.getSourceVariable().getIRVariable() instanceof IRReturnVariable and
+    def.getIndirectionIndex() = indirectionIndex
+  }
+
+  /** Holds if `def` defines `e` as a returned value with return kind `rk`. */
+  bindingset[rk, e]
+  private predicate isReturnExpr(Function f, ReturnKind rk, Expr e) {
+    exists(Ssa::ExplicitDefinition def |
+      hasFunctionAndIndirectionIndex(f, rk.getIndirectionIndex(), def) and
+      e =
+        def.getAssignedInstruction()
+            .(StoreInstruction)
+            .getSourceValue()
+            .getUnconvertedResultExpression()
+    )
+  }
+
+  private MemberFunction getFunctionFromType(Expr e) {
+    result.getClassAndName("operator()").getADerivedClass*() = e.getUnspecifiedType()
+  }
+
+  private Function getFunctionFromExpr(Expr e) {
+    result = e.(FunctionAccess).getTarget()
+    or
+    result = e.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction()
+  }
+
+  class SourceSinkReportingElement extends Element {
+    SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter }
+
+    DataFlowCallable getEnclosingCallable() {
+      result.asSourceCallable() =
+        [this.(Expr).getEnclosingFunction(), this.(Parameter).getFunction()]
+    }
+
+    /** Gets the function invoked when this element is used as a callback. */
+    private Function getCallable() {
+      // The expression is a struct which implements `operator()`.
+      result = getFunctionFromType(this)
+      or
+      // The expression is a function pointer
+      result = getFunctionFromExpr(this)
+      or
+      // The expression is an SSA read of an assignment of a callable
+      exists(Ssa::Definition def |
+        def.getAUse().getDef().getUnconvertedResultExpression() = this and
+        result =
+          getFunctionFromExpr(def.getAnUltimateDefinition()
+                .(Ssa::DirectExplicitDefinition)
+                .getAssignedInstruction()
+                .(StoreInstruction)
+                .getSourceValue()
+                .getUnconvertedResultExpression())
+      )
+    }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) {
+      exists(Function f | f = this.getCallable() |
+        exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
+          result = pos.getParameter(f)
+        )
+        or
+        exists(ReturnKind rk |
+          sc = Impl::Private::SummaryComponent::return(rk) and
+          isReturnExpr(f, rk, result)
+        )
+      )
+    }
+  }
+
+  bindingset[source, sc]
+  SourceSinkReportingElement getASourceReportingElement(
+    Input::SourceBase source, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Call call | call.getTarget() = source |
+      sc = Impl::Private::SummaryComponent::return(_) and
+      result = call
+      or
+      exists(ArgumentPosition pos |
+        sc = Impl::Private::SummaryComponent::argument(pos) and
+        result = pos.getArgument(call)
+      )
+    )
+    or
+    exists(ParameterPosition pos |
+      sc = Impl::Private::SummaryComponent::parameter(pos) and
+      result = pos.getParameter(source)
+    )
+  }
+
+  pragma[nomagic]
+  private IndirectReturnOutNode getIndirectReturn(CallInstruction call, NormalReturnKind rk) {
+    result.getCallInstruction() = call and
+    pragma[only_bind_out](result.getIndirectionIndex()) =
+      pragma[only_bind_out](rk.getIndirectionIndex())
+  }
+
+  pragma[nomagic]
+  private predicate hasKindAndEnclosingFunction(Function f, ReturnKind rk, ReturnNode r) {
+    r.getEnclosingCallable().asSourceCallable() = f and
+    r.getKind() = rk
+  }
 
-    DataFlowCallable getEnclosingCallable() { none() }
+  pragma[nomagic]
+  private predicate hasParameterAndIndirectionIndex(
+    Parameter p, int indirectionIndex, ParameterNode n
+  ) {
+    n.getParameter() = p and
+    n.getIndirectionIndex() = indirectionIndex
+  }
 
-    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
+  bindingset[e, sc]
+  Node getSourceDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    exists(DataFlowCall call |
+      exists(ArgumentPosition pos |
+        sc = Impl::Private::SummaryComponent::argument(pos) and
+        pos.getArgument(call.asCallInstruction().getUnconvertedResultExpression()) = e
+      |
+        pos.getIndirectionIndex() = 0 and
+        result.(PostUpdateNode).getPreUpdateNode().asExpr() = e
+        or
+        result.(PostUpdateNode).getPreUpdateNode().asIndirectExpr(pos.getIndirectionIndex()) = e
+      )
+      or
+      exists(ReturnKind rk |
+        sc = Impl::Private::SummaryComponent::return(rk) and
+        // When `e` is a call the node becomes an `OutNode`.
+        e = call.asCallInstruction().getUnconvertedResultExpression()
+      |
+        rk.getIndirectionIndex() = 0 and
+        simpleOutNode(result, call.asCallInstruction())
+        or
+        result = getIndirectReturn(call.asCallInstruction(), rk)
+      )
+    )
+    or
+    exists(ParameterPosition pos |
+      sc = Impl::Private::SummaryComponent::parameter(pos) and
+      hasParameterAndIndirectionIndex(e, pos.getIndirectionIndex(), result)
+    )
+    or
+    exists(Function f, ReturnKind rk |
+      sc = Impl::Private::SummaryComponent::return(rk) and
+      // When `e` is the returned expression from a function the node is
+      // the `ReturnNode`.
+      isReturnExpr(f, rk, e) and
+      hasKindAndEnclosingFunction(f, rk, result)
+    )
+  }
+
+  bindingset[sink, sc]
+  SourceSinkReportingElement getASinkReportingElement(
+    Input::SinkBase sink, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Call call, ArgumentPosition pos |
+      call.getTarget() = sink and
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      result = pos.getArgument(call)
+    )
+  }
+
+  bindingset[e, sc]
+  Node getSinkDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    exists(ArgumentPosition pos, CallInstruction call |
+      sc = Impl::Private::SummaryComponent::argument(pos) and
+      pos.getArgument(call.getUnconvertedResultExpression()) = e and
+      result.(ArgumentNode).sourceArgumentOf(call, pos)
+    )
+    or
+    exists(Function f, ReturnKind rk |
+      sc = Impl::Private::SummaryComponent::return(rk) and
+      isReturnExpr(f, rk, e) and
+      hasKindAndEnclosingFunction(f, rk, result)
+    )
   }
 }
 
@@ -319,3 +494,41 @@ module Private {
 }
 
 module Public = Impl::Public;
+
+private class SourceModelFunction extends Public::SourceElement instanceof Function {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SourceModelFunction() {
+    sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSource(
+    string output, string kind, Public::Provenance provenance, string model
+  ) {
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model)
+  }
+}
+
+private class SinkModelFunction extends Public::SinkElement instanceof Function {
+  private string namespace;
+  private string type;
+  private boolean subtypes;
+  private string name;
+  private string signature;
+  private string ext;
+
+  SinkModelFunction() {
+    sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) and
+    this = interpretElement(namespace, type, subtypes, name, signature, ext)
+  }
+
+  override predicate isSink(string input, string kind, Public::Provenance provenance, string model) {
+    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, model)
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -6,6 +6,8 @@
 private import cpp
 private import DataFlowImplSpecific
 private import TaintTrackingImplSpecific
+private import DataFlowNodes as Nodes
+private import semmle.code.cpp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import codeql.dataflow.internal.DataFlowImplConsistency
 
 private module Input implements InputSig<Location, CppDataFlow> {
@@ -14,6 +16,12 @@ private module Input implements InputSig<Location, CppDataFlow> {
     // complex to model here.
     any()
   }
+
+  predicate postWithInFlowExclude(CppDataFlow::Node n) {
+    n instanceof Nodes::FlowSummaryNode
+    or
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(_, n, _, _)
+  }
 }
 
 module Consistency = MakeConsistency<Location, CppDataFlow, CppTaintTracking, Input>;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

@@ -1541,6 +1541,43 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
   override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
 
   override string toStringImpl() { result = this.getSummaryNode().toString() }
+
+  /** Gets the source element that this node belongs to, if any. */
+  FlowSummaryImpl::Public::SourceElement getSourceElement() {
+    result = this.getSummaryNode().getSourceElement()
+  }
+
+  /** Gets the sink element that this node belongs to, if any. */
+  FlowSummaryImpl::Public::SinkElement getSinkElement() {
+    result = this.getSummaryNode().getSinkElement()
+  }
+
+  /** Holds if this node is a source node of kind `kind`. */
+  predicate isSource(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SourceOutputNode).isEntry(kind, model)
+  }
+
+  /** Holds if this node is a sink node of kind `kind`. */
+  predicate isSink(string kind, string model) {
+    this.getSummaryNode().(FlowSummaryImpl::Private::SinkInputNode).isExit(kind, model)
+  }
+}
+
+private class SourceOutputNode extends FlowSummaryImpl::Private::SourceOutputNode {
+  final override string toString() {
+    exists(Call call |
+      this.isOutArgument(call) and
+      result = call.getTarget() + " output argument"
+    )
+    or
+    not this.isOutArgument(_) and
+    result = super.toString()
+  }
+
+  private predicate isOutArgument(Call call) {
+    call.getTarget() = this.getSourceElement() and
+    [call.getAnArgument(), call.getQualifier()] = this.getSourceSinkReportingElement()
+  }
 }
 
 /**
@@ -1655,13 +1692,13 @@ abstract private class AbstractParameterNode extends Node {
    * Holds if this node represents an implicit `this` parameter, if it exists.
    */
   predicate isThis() { none() } // overridden by subclasses
-}
 
-abstract private class AbstractIndirectParameterNode extends AbstractParameterNode {
   /** Gets the indirection index of this parameter node. */
-  abstract int getIndirectionIndex();
+  int getIndirectionIndex() { none() }
 }
 
+abstract private class AbstractIndirectParameterNode extends AbstractParameterNode { }
+
 pragma[noinline]
 private predicate indirectParameterNodeHasArgumentIndexAndIndex(
   IndirectInstructionParameterNode node, int argumentIndex, int indirectionIndex
@@ -1725,7 +1762,9 @@ private class IndirectInstructionParameterNode extends AbstractIndirectParameter
   final override int getIndirectionIndex() { this.hasInstructionAndIndirectionIndex(init, result) }
 }
 
-abstract private class AbstractDirectParameterNode extends AbstractParameterNode { }
+abstract private class AbstractDirectParameterNode extends AbstractParameterNode {
+  override int getIndirectionIndex() { result = 0 }
+}
 
 /**
  * A non-indirect parameter node that is represented as an `Instruction`.
@@ -1796,6 +1835,8 @@ private class DirectBodyLessParameterNode extends AbstractExplicitParameterNode,
   }
 
   override Parameter getParameter() { result = p }
+
+  final override int getIndirectionIndex() { result = 0 }
 }
 
 private class IndirectBodyLessParameterNode extends AbstractIndirectParameterNode,