File tree 2 files changed +16
-2
lines changed
src/experimental/Security/CWE/CWE-416
test/experimental/query-tests/Security/CWE/CWE-416 2 files changed +16
-2
lines changed Original file line number Diff line number Diff line change @@ -80,6 +80,20 @@ module DestroyedToBeginConfig implements DataFlow::ConfigSig {
80
80
predicate isSource ( DataFlow:: Node source ) { source = getADestroyedNode ( ) }
81
81
82
82
predicate isSink ( DataFlow:: Node sink ) { isSinkImpl ( sink , _) }
83
+
84
+ DataFlow:: FlowFeature getAFeature ( ) {
85
+ // By blocking argument-to-parameter flow we ensure that we don't enter a
86
+ // function body where the temporary outlives anything inside the function.
87
+ // This prevents false positives in cases like:
88
+ // ```cpp
89
+ // void foo(const std::vector<int>& v) {
90
+ // for(auto x : v) { ... } // this is fine since v outlives the loop
91
+ // }
92
+ // ...
93
+ // foo(create_temporary())
94
+ // ```
95
+ result instanceof DataFlow:: FeatureHasSinkCallContext
96
+ }
83
97
}
84
98
85
99
module DestroyedToBeginFlow = DataFlow:: Global< DestroyedToBeginConfig > ;
Original file line number Diff line number Diff line change @@ -744,8 +744,8 @@ std::vector<int> first_in_returnValue_2() {
744
744
}
745
745
746
746
void test2 () {
747
- iterate(returnValue ()); // GOOD [FALSE POSITIVE] (see *)
748
- iterate(returnValue ()[0 ]); // GOOD [FALSE POSITIVE] (see *)
747
+ iterate(returnValue ()); // GOOD
748
+ iterate(returnValue ()[0 ]); // GOOD
749
749
750
750
for (auto x : ref_to_first_in_returnValue_1 ()) {}
751
751
You can’t perform that action at this time.
0 commit comments