Skip to content

Commit c8ad9bd

Browse files
kumarakkumarak
committed
C++: Model BDE bal codec taint flow
Add flow summaries for the balber, baljsn and balxml codecs. decode and decodeAny move taint from the stream into the decoded object; encode and encodeAny move it from the object into the stream. balber and baljsn have a uniform argument layout across overloads and return an int status, so their rows carry no signature. balxml overloads differ in layout and two of them return the stream they were given, so each balxml row names its overload and the istream/ostream forms also get ReturnValue[*] rows. Not modelled: balxml::Decoder::decode(const char *filename, TYPE *), the two-step open() + decode(TYPE *) form, and the Formatter overloads of balxml::Encoder.
1 parent 401a516 commit c8ad9bd

9 files changed

Lines changed: 1291 additions & 70 deletions

File tree

‎cpp/ql/lib/change-notes/2026-09-09-bal-codec-models.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added flow summaries for the BDE codecs `BloombergLP::balber::BerDecoder`/`BerEncoder`, `BloombergLP::baljsn::Decoder`/`Encoder` and `BloombergLP::balxml::Decoder`/`Encoder`.

‎cpp/ql/lib/ext/balber.model.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Model of the BDE balber BER codec (BloombergLP::balber).
2+
# All overloads take the stream at argument 0 and the object at argument 1 and return int.
3+
extensions:
4+
- addsTo:
5+
pack: codeql/cpp-all
6+
extensible: summaryModel
7+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
8+
# Decoding: stream -> object
9+
- ["BloombergLP::balber", "BerDecoder", true, "decode", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
10+
- ["BloombergLP::balber", "BerDecoder", true, "decodeAny", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
11+
# Encoding: object -> stream
12+
- ["BloombergLP::balber", "BerEncoder", true, "encode", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
13+
- ["BloombergLP::balber", "BerEncoder", true, "encodeAny", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]

‎cpp/ql/lib/ext/baljsn.model.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Model of the BDE baljsn JSON codec (BloombergLP::baljsn).
2+
# All overloads, including those taking DecoderOptions/EncoderOptions, take the stream at
3+
# argument 0 and the object at argument 1 and return int.
4+
extensions:
5+
- addsTo:
6+
pack: codeql/cpp-all
7+
extensible: summaryModel
8+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
9+
# Decoding: stream -> object
10+
- ["BloombergLP::baljsn", "Decoder", true, "decode", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
11+
- ["BloombergLP::baljsn", "Decoder", true, "decodeAny", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
12+
# Encoding: object -> stream
13+
- ["BloombergLP::baljsn", "Encoder", true, "encode", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
14+
- ["BloombergLP::baljsn", "Encoder", true, "encodeAny", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]

‎cpp/ql/lib/ext/balxml.model.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Model of the BDE balxml XML codec (BloombergLP::balxml).
2+
# Overloads differ in argument layout, so each row names its overload. Not modelled:
3+
# decode(const char *filename, TYPE *), the two-step open() + decode(TYPE *) form, and the
4+
# Formatter overloads.
5+
extensions:
6+
- addsTo:
7+
pack: codeql/cpp-all
8+
extensible: summaryModel
9+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
10+
# Decoding: stream -> object; the istream overloads also return the stream
11+
- ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
12+
- ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
13+
- ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(streambuf *,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
14+
- ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(const char *,size_t,TYPE *,const char *)", "", "Argument[*0]", "Argument[*2]", "taint", "manual"]
15+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
16+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
17+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(streambuf *,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
18+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(istream &,AnyRef *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
19+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(istream &,AnyRef *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
20+
- ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(streambuf *,AnyRef *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
21+
# Encoding: object -> stream; the ostream overloads also return the stream
22+
- ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(streambuf *,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
23+
- ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
24+
- ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
25+
- ["BloombergLP::balxml", "Encoder", true, "encodeToStream<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
26+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(streambuf *,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
27+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
28+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
29+
- ["BloombergLP::balxml", "Encoder", true, "encodeAnyToStream<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
30+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(streambuf *,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
31+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(ostream &,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
32+
- ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(ostream &,const AnyConstRef &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
33+
- ["BloombergLP::balxml", "Encoder", true, "encodeAnyToStream", "(ostream &,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]

0 commit comments

Comments
 (0)