Skip to content

Commit 35510a5

Browse files
geoffw0geoffw0
authored
Merge pull request #22820 from github/copilot/bmqa-models-merge-main
cpp: Model BlazingMQ bmqa message and property taint flow
2 parents b25c458 + b76f38d commit 35510a5

10 files changed

Lines changed: 1939 additions & 818 deletions

File tree

‎cpp/ql/lib/change-notes/2026-09-09-bmqa-models.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added flow summaries for the BlazingMQ `BloombergLP::bmqa::Message` and `MessageProperties` classes and their iterators.

‎cpp/ql/lib/ext/bmqa.model.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Model of the BlazingMQ client API (BloombergLP::bmqa). Scalar property getters are not modelled.
2+
extensions:
3+
- addsTo:
4+
pack: codeql/cpp-all
5+
extensible: summaryModel
6+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
7+
# Message payload
8+
- ["BloombergLP::bmqa", "Message", true, "getData", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
9+
- ["BloombergLP::bmqa", "Message", true, "setData", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
10+
- ["BloombergLP::bmqa", "Message", true, "setData", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
11+
- ["BloombergLP::bmqa", "Message", true, "setData", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
12+
- ["BloombergLP::bmqa", "Message", true, "setDataRef", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
13+
- ["BloombergLP::bmqa", "Message", true, "setDataRef", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
14+
- ["BloombergLP::bmqa", "Message", true, "setDataRef", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
15+
- ["BloombergLP::bmqa", "Message", true, "clone", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
16+
# Message properties
17+
- ["BloombergLP::bmqa", "Message", true, "loadProperties", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
18+
- ["BloombergLP::bmqa", "Message", true, "setPropertiesRef", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
19+
- ["BloombergLP::bmqa", "Message", true, "setPropertiesRef", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
20+
- ["BloombergLP::bmqa", "Message", true, "setPropertiesRef", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
21+
- ["BloombergLP::bmqa", "MessageProperties", true, "MessageProperties", "(const MessageProperties &,Allocator *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
22+
- ["BloombergLP::bmqa", "MessageProperties", true, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
23+
- ["BloombergLP::bmqa", "MessageProperties", true, "operator=", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
24+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
25+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsBinary", "", "", "Argument[-1]", "ReturnValue[*].Element", "taint", "manual"]
26+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsStringOr", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
27+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsStringOr", "", "", "Argument[*1]", "ReturnValue[*]", "value", "manual"]
28+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsBinaryOr", "", "", "Argument[-1]", "ReturnValue[*].Element", "taint", "manual"]
29+
- ["BloombergLP::bmqa", "MessageProperties", true, "getPropertyAsBinaryOr", "", "", "Argument[*1].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
30+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsString", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
31+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsBinary", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
32+
# Property names are stored and exposed by MessagePropertiesIterator::name
33+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsBool", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
34+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsChar", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
35+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsShort", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
36+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsInt32", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
37+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsInt64", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
38+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsString", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
39+
- ["BloombergLP::bmqa", "MessageProperties", true, "setPropertyAsBinary", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
40+
- ["BloombergLP::bmqa", "MessageProperties", true, "streamIn", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
41+
- ["BloombergLP::bmqa", "MessageProperties", true, "streamOut", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
42+
# Property iteration
43+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "MessagePropertiesIterator", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
44+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
45+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "operator=", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
46+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "name", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
47+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "getAsString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
48+
- ["BloombergLP::bmqa", "MessagePropertiesIterator", true, "getAsBinary", "", "", "Argument[-1]", "ReturnValue[*].Element", "taint", "manual"]
49+
# Event -> iterator -> message
50+
- ["BloombergLP::bmqa", "MessageEvent", true, "messageIterator", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
51+
- ["BloombergLP::bmqa", "MessageIterator", true, "message", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]

‎cpp/ql/test/library-tests/dataflow/external-models/bal.cpp‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,7 @@
1+
#include "bsl.h"
12

23
// --- stub library headers ---
34

4-
namespace bsl {
5-
typedef unsigned long size_t;
6-
class streambuf {};
7-
class istream {};
8-
class ostream {};
9-
template <class T> class allocator {};
10-
template<class charT> struct char_traits {};
11-
template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
12-
class basic_string {
13-
public:
14-
basic_string();
15-
basic_string(const charT* s, const Allocator& a = Allocator());
16-
const charT* data() const;
17-
size_t size() const;
18-
};
19-
typedef basic_string<char> string;
20-
}
21-
225
namespace BloombergLP {
236
namespace bdlar {
247
class AnyRef {};

‎cpp/ql/test/library-tests/dataflow/external-models/bdlbb.cpp‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,7 @@
1+
#include "bsl.h"
12

23
// --- stub library headers ---
34

4-
namespace bsl {
5-
typedef unsigned long size_t;
6-
template <class T> class allocator {};
7-
template<class charT> struct char_traits {};
8-
template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
9-
class basic_string {
10-
public:
11-
basic_string(const charT* s, const Allocator& a = Allocator());
12-
const charT* data() const;
13-
size_t size() const;
14-
};
15-
typedef basic_string<char> string;
16-
template <class T> class shared_ptr {
17-
public:
18-
T *get() const;
19-
};
20-
}
21-
225
namespace BloombergLP {
236
namespace bdlbb {
247
class BlobBuffer {

0 commit comments

Comments
 (0)