Skip to content

Improve localTaint predicate performance in STLContainer. #1198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MichaelRFairhurst wants to merge 2 commits into
base: main
Choose a base branch
from
+28 −16
Open

Improve localTaint predicate performance in STLContainer. #1198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e97fc9
Improve localTaint predicate performance in STLContainer.
MichaelRFairhurst Sep 16, 2026
af9a3cb
Add changenote
MichaelRFairhurst Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions change_notes/2026-09-16-improve-iterator-access-check-performance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
- All queries using `Iterators.qll` or `STLContainers.qll`:
- The means of detecting iterator and container accesses has been optimized to improve performance by avoiding construction of the full transitive closure of local taint paths.
42 changes: 26 additions & 16 deletions cpp/common/src/codingstandards/cpp/standardlibrary/STLContainers.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,9 +312,30 @@ abstract class ContainerAccess extends VariableAccess {
abstract Variable getOwningContainer();
}

pragma[noinline, nomagic]
private predicate localTaint(DataFlow::Node n1, DataFlow::Node n2) {
TaintTracking::localTaint(n1, n2)
pragma[nomagic]
private predicate containerTaintSource(FunctionCall fc, DataFlow::Node n1) {
n1 = DataFlow::exprNode(fc) and
exists(STLContainer c |
fc = c.getACallToAFunction() and
// There are a few cases where the value is tainted
// but no actual link to the underlying container is established.
// For example, calling Vector<int>.size() returns an int but the
// resulting variable doesn't depend on the underlying container
// anymore.
(
fc.getTarget().getType() instanceof ReferenceType or
fc.getTarget().getType() instanceof PointerType or
fc.getTarget().getType() instanceof IteratorType
)
)
}

pragma[nomagic]
private predicate containerTaint(FunctionCall fc, DataFlow::Node n2) {
exists(DataFlow::Node n1 |
containerTaintSource(fc, n1) and
TaintTracking::localTaint(n1, n2)
)
}

/**
Expand All @@ -326,19 +347,8 @@ class ContainerPointerOrReferenceAccess extends ContainerAccess {
Variable owningContainer;

ContainerPointerOrReferenceAccess() {
exists(STLContainer c, FunctionCall fc |
fc = c.getACallToAFunction() and
// There are a few cases where the value is tainted
// but no actual link to the underlying container is established.
// For example, calling Vector<int>.size() returns an int but the
// resulting variable doesn't depend on the underlying container
// anymore.
(
fc.getTarget().getType() instanceof ReferenceType or
fc.getTarget().getType() instanceof PointerType or
fc.getTarget().getType() instanceof IteratorType
) and
localTaint(DataFlow::exprNode(fc), DataFlow::exprNode(this)) and
exists(FunctionCall fc |
containerTaint(fc, DataFlow::exprNode(this)) and
(getUnderlyingType() instanceof ReferenceType or getUnderlyingType() instanceof PointerType) and
fc.getQualifier().(VariableAccess).getTarget() = owningContainer and
// Exclude cases where we see taint into the owning container
Expand Down
Loading