wip

Author: hvitved

csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.ql

@@ -21,10 +21,10 @@ class IncludeFilteredSummarizedCallable extends IncludeSummarizedCallable {
   override predicate relevantSummary(
     SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue, Provenance p
   ) {
-    this.propagatesFlow(input, output, preservesValue, p, _) and
+    this.propagatesFlow(input, output, preservesValue, p, _, _) and
     not exists(IncludeSummarizedCallable rsc |
       isBaseCallableOrPrototype(rsc) and
-      rsc.propagatesFlow(input, output, preservesValue, _, _) and
+      rsc.propagatesFlow(input, output, preservesValue, _, _, _) and
       this.(UnboundCallable).overridesOrImplementsUnbound(rsc)
     )
   }

javascript/ql/lib/semmle/javascript/dataflow/FlowSummary.qll

@@ -8,6 +8,8 @@ private import semmle.javascript.dataflow.internal.FlowSummaryPrivate
 private import semmle.javascript.dataflow.internal.sharedlib.DataFlowImplCommon as DataFlowImplCommon
 private import semmle.javascript.dataflow.internal.DataFlowPrivate
 
+class Provenance = Impl::Public::Provenance;
+
 /**
  * A model for a function that can propagate data flow.
  *
@@ -67,9 +69,13 @@ abstract class SummarizedCallable extends LibraryCallable, Impl::Public::Summari
   predicate propagatesFlow(string input, string output, boolean preservesValue) { none() }
 
   override predicate propagatesFlow(
-    string input, string output, boolean preservesValue, string model
+    string input, string output, boolean preservesValue, Provenance provenance, boolean isExact,
+    string model
   ) {
-    this.propagatesFlow(input, output, preservesValue) and model = this
+    this.propagatesFlow(input, output, preservesValue) and
+    provenance = "manual" and
+    model = this and
+    isExact = true
   }
 
   /**

javascript/ql/lib/semmle/javascript/dataflow/internal/sharedlib/SummaryTypeTracker.qll

@@ -69,7 +69,7 @@ private module SummaryFlowConfig implements Input {
     predicate propagatesFlow(
       SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
-      super.propagatesFlow(input, output, preservesValue, _)
+      super.propagatesFlow(input, output, preservesValue, _, _, _)
     }
 
     string toString() { result = super.toString() }

javascript/ql/lib/semmle/javascript/frameworks/data/ModelsAsData.qll

@@ -62,9 +62,14 @@ private class SummarizedCallableFromModel extends DataFlow::SummarizedCallable {
   override DataFlow::InvokeNode getACall() { ModelOutput::resolvedSummaryBase(type, path, result) }
 
   override predicate propagatesFlow(
-    string input, string output, boolean preservesValue, string model
+    string input, string output, boolean preservesValue, DataFlow::Provenance provenance,
+    boolean isExact, string model
   ) {
-    exists(string kind | ModelOutput::relevantSummaryModel(type, path, input, output, kind, model) |
+    exists(string kind |
+      ModelOutput::relevantSummaryModel(type, path, input, output, kind, model) and
+      provenance = "manual" and
+      isExact = true
+    |
       kind = "value" and
       preservesValue = true
       or