From 84c3073c2a14c8dc730956781edbf11024ef3df6 Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Thu, 14 Mar 2019 10:36:01 +0100 Subject: [PATCH] C#: Fix performance regression in `cs/user-controlled-bypass` --- .../code/csharp/security/dataflow/ConditionalBypass.qll | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/csharp/ql/src/semmle/code/csharp/security/dataflow/ConditionalBypass.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/ConditionalBypass.qll index dd51d2eb699d..f6e30bf0bf38 100644 --- a/csharp/ql/src/semmle/code/csharp/security/dataflow/ConditionalBypass.qll +++ b/csharp/ql/src/semmle/code/csharp/security/dataflow/ConditionalBypass.qll @@ -57,11 +57,18 @@ module UserControlledBypassOfSensitiveMethod { } } + pragma[noinline] + private predicate conditionControlsCall0( + SensitiveExecutionMethodCall call, Expr e, ControlFlow::SuccessorTypes::BooleanSuccessor s + ) { + forex(BasicBlock bb | bb = call.getAControlFlowNode().getBasicBlock() | e.controlsBlock(bb, s)) + } + private predicate conditionControlsCall( SensitiveExecutionMethodCall call, SensitiveExecutionMethod def, Expr e, boolean cond ) { exists(ControlFlow::SuccessorTypes::BooleanSuccessor s | cond = s.getValue() | - e.controlsElement(call, s) + conditionControlsCall0(call, e, s) ) and def = call.getTarget() }