-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
C#: Restrict multi-body dataflow dispatch based on file-system distance #16817
C#: Restrict multi-body dataflow dispatch based on file-system distance #16817
Conversation
f522b6f
to
eea8d46
Compare
84d4f77
to
187a1bb
Compare
09b4672
to
0f85287
Compare
|
||
bindingset[l1, l2] | ||
pragma[inline_late] | ||
private predicate inSameFile0(Location l1, Location l2) { l1.getFile() = l2.getFile() } |
Check warning
Code scanning / CodeQL
Candidate predicate not marked as `nomagic` Warning
inSameFile
8be274e
to
beaa1ac
Compare
beaa1ac
to
fd696ef
Compare
41d9b46
to
27a3f34
Compare
e0a0a9b
to
44b4eb3
Compare
44b4eb3
to
d1a24df
Compare
d1a24df
to
0459422
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks plausible to me
(1) There are some issues with the doc comments.
(2) Why does DCA show a large alert discrepancy (have you tried to run with the cached DB?)
Those can be ignored.
That is expected; calls to methods with multiple bodies would previously dispatch to all possible implementations, but now we only dispatch to the nearest implementation(s). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks plausible to me!
Methods with multiple implementations such as
give rise to a single CFG, where flow splits immediately following the special entry node:
For data flow, this means that each of the two calls to
M2
above will be able to target both bodies ofM2
.This PR prevents this kind of combinatorial explosion by ranking the bodies of a method based on their file-system distance to the calling method, and only allowing flow into those bodies with the lowest rank. In order to do this, we need to track which version of a method (body) is being called, which is done by augmenting
DataFlowCallable
s (as well as parameters) with the location of the implementation.