Rb: add some more flow through splat parameters #11398
Open
+40
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hvitved
reviewed
Nov 24, 2022
| args = taint(26) | ||
| def splatstuff(*x) | ||
| sink x # $ hasValueFlow=26 |
There was a problem hiding this comment.
I don't think we want flow in this case; we only want flow to x[n].
There was a problem hiding this comment.
I've made it similar to how we handle hash-splat, except I still restrict it to the first argument/parameter.
It still gives me the flow I want in the second-order-command-injection PR.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
This was something I needed in my second-order-command-injection WIP branch.
Precise flow through splat parameters is hard in the general case.
But if we special-case to the situration where both the argument and the parameter are in the first position, then it's easy.
Evaluation looks OK.
The easiest way to see the impact is to look at the new call-edges. Those new edges mostly appear from the receiver being tracked more precisely.
E.g. here where
argsis a splat parameter that is tracked more precisely with this change.This is my first venture into the inner workings of the dataflow library, so I hope I got it right.