Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 23b508c

Browse files
haby0haby0
committed
Merge remote-tracking branch 'upstream/main' into UseOfLessTrustedSource
2 parents 86ef258 + 36abf87 commit 23b508c

378 files changed

Lines changed: 10405 additions & 3934 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/close-stale.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mark stale issues
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 1 * * *"
7+
8+
jobs:
9+
stale:
10+
if: github.repository == 'github/codeql'
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/stale@v3
16+
with:
17+
repo-token: ${{ secrets.GITHUB_TOKEN }}
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `stale` label in order to avoid having this issue closed in 7 days.'
19+
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
20+
days-before-stale: 14
21+
days-before-close: 7
22+
only-labels: question
23+
24+
# do not mark PRs as stale
25+
days-before-pr-stale: -1
26+
days-before-pr-close: -1
27+
28+
# Uncomment for dry-run
29+
# debug-only: true
30+
# operations-per-run: 1000

‎config/identical-files.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@
5656
"csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
5757
"python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
5858
],
59+
"DataFlow Java/C# Flow Summaries": [
60+
"java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
61+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
62+
],
5963
"SsaReadPosition Java/C#": [
6064
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
6165
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"

‎cpp/change-notes/2021-04-13-arithmetic-queries.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

‎cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
if(len>0 & memset(buf,0,len)) return 1; // BAD: `memset` will be called regardless of the value of the `len` variable. moreover, one cannot be sure that it will happen after verification
2+
...
3+
if(len>0 && memset(buf,0,len)) return 1; // GOOD: `memset` will be called after the `len` variable has been checked.
4+
...

‎cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>Using bitwise operations can be a mistake in some situations. For example, if parameters are evaluated in an expression and the function should be called only upon certain test results. These bitwise operations look suspicious and require developer attention.</p>
7+
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>We recommend that you evaluate the correctness of using the specified bit operations.</p>
13+
14+
</recommendation>
15+
<example>
16+
<p>The following example demonstrates the erroneous and fixed use of bit and logical operations.</p>
17+
<sample src="InsufficientControlFlowManagementWhenUsingBitOperations.c" />
18+
19+
</example>
20+
<references>
21+
22+
<li>
23+
CWE Common Weakness Enumeration:
24+
<a href="https://cwe.mitre.org/data/definitions/691.html"> CWE-691: Insufficient Control Flow Management</a>.
25+
</li>
26+
27+
</references>
28+
</qhelp>

‎cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
/**
2+
* @name Errors When Using Bit Operations
3+
* @description Unlike the binary operations `||` and `&&`, there is no sequence point after evaluating an
4+
* operand of a bitwise operation like `|` or `&`. If left-to-right evaluation is expected this may be confusing.
5+
* @kind problem
6+
* @id cpp/errors-when-using-bit-operations
7+
* @problem.severity warning
8+
* @precision medium
9+
* @tags correctness
10+
* security
11+
* external/cwe/cwe-691
12+
*/
13+
14+
import cpp
15+
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
16+
17+
/**
18+
* Dangerous uses of bit operations.
19+
* For example: `if(intA>0 & intA<10 & charBuf&myFunc(charBuf[intA]))`.
20+
* In this case, the function will be called in any case, and even the sequence of the call is not guaranteed.
21+
*/
22+
class DangerousBitOperations extends BinaryBitwiseOperation {
23+
FunctionCall bfc;
24+
25+
/**
26+
* The assignment indicates the conscious use of the bit operator.
27+
* Use in comparison, conversion, or return value indicates conscious use of the bit operator.
28+
* The use of shifts and bitwise operations on any element of an expression indicates a conscious use of the bitwise operator.
29+
*/
30+
DangerousBitOperations() {
31+
bfc = this.getRightOperand() and
32+
not this.getParent*() instanceof Assignment and
33+
not this.getParent*() instanceof Initializer and
34+
not this.getParent*() instanceof ReturnStmt and
35+
not this.getParent*() instanceof EqualityOperation and
36+
not this.getParent*() instanceof UnaryLogicalOperation and
37+
not this.getParent*() instanceof BinaryLogicalOperation and
38+
not this.getAChild*() instanceof BitwiseXorExpr and
39+
not this.getAChild*() instanceof LShiftExpr and
40+
not this.getAChild*() instanceof RShiftExpr
41+
}
42+
43+
/** Holds when part of a bit expression is used in a logical operation. */
44+
predicate useInLogicalOperations() {
45+
exists(BinaryLogicalOperation blop, Expr exp |
46+
blop.getAChild*() = exp and
47+
exp.(FunctionCall).getTarget() = bfc.getTarget() and
48+
not exp.getParent() instanceof ComparisonOperation and
49+
not exp.getParent() instanceof BinaryBitwiseOperation
50+
)
51+
}
52+
53+
/** Holds when part of a bit expression is used as part of another supply. For example, as an argument to another function. */
54+
predicate useInOtherCalls() {
55+
bfc.hasQualifier() or
56+
bfc.getTarget() instanceof Operator or
57+
exists(FunctionCall fc | fc.getAnArgument().getAChild*() = this) or
58+
bfc.getTarget() instanceof BuiltInFunction
59+
}
60+
61+
/** Holds when the bit expression contains both arguments and a function call. */
62+
predicate dangerousArgumentChecking() {
63+
not this.getLeftOperand() instanceof Call and
64+
globalValueNumber(this.getLeftOperand().getAChild*()) = globalValueNumber(bfc.getAnArgument())
65+
}
66+
67+
/** Holds when function calls are present in the bit expression. */
68+
predicate functionCallsInBitsExpression() {
69+
this.getLeftOperand().getAChild*() instanceof FunctionCall
70+
}
71+
}
72+
73+
from DangerousBitOperations dbo
74+
where
75+
not dbo.useInOtherCalls() and
76+
dbo.useInLogicalOperations() and
77+
(not dbo.functionCallsInBitsExpression() or dbo.dangerousArgumentChecking())
78+
select dbo, "This bitwise operation appears in a context where a Boolean operation is expected."

‎cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
if(len=funcReadData()==0) return 1; // BAD: variable `len` will not equal the value returned by function `funcReadData()`
2+
...
3+
if((len=funcReadData())==0) return 1; // GOOD: variable `len` equal the value returned by function `funcReadData()`
4+
...
5+
bool a=true;
6+
a++;// BAD: variable `a` does not change its meaning
7+
bool b;
8+
b=-a;// BAD: variable `b` equal `true`
9+
...
10+
a=false;// GOOD: variable `a` equal `false`
11+
b=!a;// GOOD: variable `b` equal `false`

‎cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>Finding places of confusing use of boolean type. For example, a unary minus does not work before a boolean type and an increment always gives true.</p>
7+
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>we recommend making the code simpler.</p>
13+
14+
</recommendation>
15+
<example>
16+
<p>The following example demonstrates erroneous and fixed methods for using a boolean data type.</p>
17+
<sample src="OperatorPrecedenceLogicErrorWhenUseBoolType.c" />
18+
19+
</example>
20+
<references>
21+
22+
<li>
23+
CERT C Coding Standard:
24+
<a href="https://wiki.sei.cmu.edu/confluence/display/c/EXP00-C.+Use+parentheses+for+precedence+of+operation">EXP00-C. Use parentheses for precedence of operation</a>.
25+
</li>
26+
27+
</references>
28+
</qhelp>

‎cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* @name Operator Precedence Logic Error When Use Bool Type
3+
* @description --Finding places of confusing use of boolean type.
4+
* --For example, a unary minus does not work before a boolean type and an increment always gives true.
5+
* @kind problem
6+
* @id cpp/operator-precedence-logic-error-when-use-bool-type
7+
* @problem.severity warning
8+
* @precision medium
9+
* @tags correctness
10+
* security
11+
* external/cwe/cwe-783
12+
* external/cwe/cwe-480
13+
*/
14+
15+
import cpp
16+
import semmle.code.cpp.valuenumbering.HashCons
17+
18+
/** Holds if `exp` increments a boolean value. */
19+
predicate incrementBoolType(IncrementOperation exp) {
20+
exp.getOperand().getType() instanceof BoolType
21+
}
22+
23+
/** Holds if `exp` applies the unary minus operator to a boolean type. */
24+
predicate revertSignBoolType(UnaryMinusExpr exp) {
25+
exp.getAnOperand().getType() instanceof BoolType and
26+
exp.getFullyConverted().getType() instanceof BoolType
27+
}
28+
29+
/** Holds, if this is an expression, uses comparison and assignment outside of execution precedence. */
30+
predicate assignBoolType(Expr exp) {
31+
exists(ComparisonOperation co |
32+
exp.(AssignExpr).getRValue() = co and
33+
exp.isCondition() and
34+
not co.isParenthesised() and
35+
not exp.(AssignExpr).getLValue().getType() instanceof BoolType and
36+
not exists(Expr exbl |
37+
hashCons(exbl.(AssignExpr).getLValue()) = hashCons(exp.(AssignExpr).getLValue()) and
38+
not exbl.isCondition() and
39+
exbl.(AssignExpr).getRValue().getType() instanceof BoolType and
40+
exbl.(AssignExpr).getLValue().getType() = exp.(AssignExpr).getLValue().getType()
41+
) and
42+
co.getLeftOperand() instanceof FunctionCall and
43+
not co.getRightOperand().getType() instanceof BoolType and
44+
not co.getRightOperand().getValue() = "0" and
45+
not co.getRightOperand().getValue() = "1"
46+
)
47+
}
48+
49+
from Expr exp
50+
where
51+
incrementBoolType(exp) or
52+
revertSignBoolType(exp) or
53+
assignBoolType(exp)
54+
select exp, "this expression needs attention"

‎cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description The expression `buffer [strlen (buffer)] = 0` is potentially dangerous, if the variable `buffer` does not have a terminal zero, then access beyond the bounds of the allocated memory is possible, which will lead to undefined behavior.
44
* If terminal zero is present, then the specified expression is meaningless.
55
* @kind problem
6-
* @id cpp/access-memory-location-after-end-buffer
6+
* @id cpp/access-memory-location-after-end-buffer-strlen
77
* @problem.severity warning
88
* @precision medium
99
* @tags correctness

0 commit comments

Comments
 (0)