Skip to content

Commit b704ed4

Browse files
kumarakkumarak
committed
fix(cpp): address remaining bslx review feedback
1 parent 1021241 commit b704ed4

6 files changed

Lines changed: 881 additions & 485 deletions

File tree

‎cpp/ql/lib/change-notes/2026-08-27-bslx-models.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: minorAnalysis
33
---
4-
* Added taint flow summaries for the BDE `bslx` byte-stream deserializers `BloombergLP::bslx::ByteInStream`, `BloombergLP::bslx::GenericInStream`, and `BloombergLP::bslx::InStreamFunctions::bdexStreamIn`, so that data read from a `bslx` in-stream is tracked as tainted.
4+
* Added taint flow summaries for the BDE `bslx` byte-stream deserializers `BloombergLP::bslx::ByteInStream`, `BloombergLP::bslx::GenericInStream`, and `BloombergLP::bslx::InStreamFunctions::bdexStreamIn`.

‎cpp/ql/lib/ext/bslx.model.yml‎

Lines changed: 14 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -4,33 +4,14 @@ extensions:
44
pack: codeql/cpp-all
55
extensible: summaryModel
66
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
7-
# === bslx::ByteInStream: concrete byte-array in-stream ===
8-
# Taint in: the source buffer/streambuf taints the stream (`this`).
9-
# Note: MaD taint is additive, so `reset` cannot clear taint from a previously
10-
# tainted stream; a stream reset with a clean buffer keeps any earlier taint.
7+
# bslx::ByteInStream
118
- ["BloombergLP::bslx", "ByteInStream", true, "ByteInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
12-
- ["BloombergLP::bslx", "ByteInStream", true, "reset", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
13-
# Taint out: the stream (`this`) taints the deserialized output variable/buffer.
14-
- ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
15-
- ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
16-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
17-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
18-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
19-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
20-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
21-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
22-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
23-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
24-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
25-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
26-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
27-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
28-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
29-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
30-
- ["BloombergLP::bslx", "ByteInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
31-
- ["BloombergLP::bslx", "ByteInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
32-
- ["BloombergLP::bslx", "ByteInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
33-
- ["BloombergLP::bslx", "ByteInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
9+
# Input-taking resets replace the buffer; reset() only rewinds it.
10+
- ["BloombergLP::bslx", "ByteInStream", true, "reset", "(const char *,size_t)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
11+
- ["BloombergLP::bslx", "ByteInStream", true, "reset", "(const StringRef &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
12+
# bslx::ByteInStream getters.
13+
# Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are not modeled,
14+
# as we are generally not interested in tainted scalar values.
3415
- ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
3516
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
3617
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
@@ -50,7 +31,7 @@ extensions:
5031
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
5132
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
5233
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
53-
# Fluent interface: each get* returns `*this`, keeping the returned stream tainted.
34+
# bslx::ByteInStream fluent interface
5435
- ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
5536
- ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
5637
- ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
@@ -90,30 +71,11 @@ extensions:
9071
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
9172
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
9273
- ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
93-
# === bslx::GenericInStream<STREAMBUF>: streambuf-backed in-stream ===
94-
# Taint in: the source buffer/streambuf taints the stream (`this`).
74+
# bslx::GenericInStream
9575
- ["BloombergLP::bslx", "GenericInStream", true, "GenericInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
96-
# Taint out: the stream (`this`) taints the deserialized output variable/buffer.
97-
- ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
98-
- ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
99-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
100-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
101-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
102-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
103-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
104-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
105-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
106-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
107-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
108-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
109-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
110-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
111-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
112-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
113-
- ["BloombergLP::bslx", "GenericInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
114-
- ["BloombergLP::bslx", "GenericInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
115-
- ["BloombergLP::bslx", "GenericInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
116-
- ["BloombergLP::bslx", "GenericInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
76+
# bslx::GenericInStream getters.
77+
# Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are not modeled,
78+
# as we are generally not interested in tainted scalar values.
11779
- ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
11880
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
11981
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
@@ -133,7 +95,7 @@ extensions:
13395
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
13496
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
13597
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
136-
# Fluent interface: each get* returns `*this`, keeping the returned stream tainted.
98+
# bslx::GenericInStream fluent interface
13799
- ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
138100
- ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
139101
- ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
@@ -173,7 +135,6 @@ extensions:
173135
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
174136
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
175137
- ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
176-
# === bslx::InStreamFunctions::bdexStreamIn: generic BDEX deserialization ===
177-
# Free function template; `InStreamFunctions` is a namespace, so `type` is empty.
138+
# bslx::InStreamFunctions::bdexStreamIn
178139
- ["BloombergLP::bslx::InStreamFunctions", "", false, "bdexStreamIn", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
179140
- ["BloombergLP::bslx::InStreamFunctions", "", false, "bdexStreamIn", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]

0 commit comments

Comments
 (0)