Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2798771

Browse files
RasmusWLRasmusWL
committed
Merge branch 'main' into crypto
2 parents fd18fd8 + 2b54c33 commit 2798771

151 files changed

Lines changed: 13301 additions & 3429 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/check-change-note.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
on:
2+
pull_request_target:
3+
types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
4+
paths:
5+
- "*/ql/src/**/*.ql"
6+
- "*/ql/src/**/*.qll"
7+
- "!**/experimental/**"
8+
9+
jobs:
10+
check-change-note:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
14+
if: |
15+
github.event.pull_request.draft == false &&
16+
!contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
17+
env:
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
19+
run: |
20+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
21+
jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@ on:
55
branches:
66
- main
77
- 'rc/*'
8+
paths:
9+
- 'csharp/**'
810
pull_request:
911
branches:
1012
- main
1113
- 'rc/*'
14+
paths:
15+
- 'csharp/**'
1216
schedule:
1317
- cron: '0 9 * * 1'
1418

‎CODEOWNERS‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,3 @@
33
/java/ @github/codeql-java
44
/javascript/ @github/codeql-javascript
55
/python/ @github/codeql-python
6-
7-
# Assign query help for docs review
8-
/cpp/**/*.qhelp @hubwriter
9-
/csharp/**/*.qhelp @jf205
10-
/java/**/*.qhelp @felicitymay
11-
/javascript/**/*.qhelp @mchammer01
12-
/python/**/*.qhelp @felicitymay
13-
/docs/language/ @shati-patel @jf205
14-
15-
# Exclude help for experimental queries from docs review
16-
/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
17-
/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
18-
/java/**/experimental/**/*.qhelp @github/codeql-java
19-
/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
20-
/python/**/experimental/**/*.qhelp @github/codeql-python

cpp/change-notes/2020-02-04-unsigned-difference-expression-compared-zero.md renamed to cpp/change-notes/2021-02-04-unsigned-difference-expression-compared-zero.md

File renamed without changes.

‎cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
* @tags reliability
99
* security
1010
* external/cwe/cwe-242
11+
* external/cwe/cwe-676
1112
*/
1213

1314
import cpp

‎cpp/ql/src/semmle/code/cpp/Function.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -467,7 +467,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
467467
// ... and likewise for destructors.
468468
this.(Destructor).getADestruction().mayBeGloballyImpure()
469469
else
470-
// Unless it's a function that we know is side-effect-free, it may
470+
// Unless it's a function that we know is side-effect free, it may
471471
// have side-effects.
472472
not this.hasGlobalOrStdName([
473473
"strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",

‎cpp/ql/src/semmle/code/cpp/models/Models.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,6 @@ private import implementations.SmartPointer
3030
private import implementations.Sscanf
3131
private import implementations.Send
3232
private import implementations.Recv
33+
private import implementations.Accept
34+
private import implementations.Poll
35+
private import implementations.Select

‎cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/**
2+
* Provides implementation classes modeling `accept` and various similar
3+
* functions. See `semmle.code.cpp.models.Models` for usage information.
4+
*/
5+
6+
import semmle.code.cpp.Function
7+
import semmle.code.cpp.models.interfaces.ArrayFunction
8+
import semmle.code.cpp.models.interfaces.Taint
9+
import semmle.code.cpp.models.interfaces.Alias
10+
import semmle.code.cpp.models.interfaces.SideEffect
11+
12+
/**
13+
* The function `accept` and its assorted variants
14+
*/
15+
private class Accept extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
16+
Accept() { this.hasGlobalName(["accept", "accept4", "WSAAccept"]) }
17+
18+
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
19+
bufParam = 1 and countParam = 2
20+
}
21+
22+
override predicate hasArrayInput(int bufParam) { bufParam = 1 }
23+
24+
override predicate hasArrayOutput(int bufParam) { bufParam = 1 }
25+
26+
override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
27+
28+
override predicate parameterEscapesOnlyViaReturn(int index) { none() }
29+
30+
override predicate parameterIsAlwaysReturned(int index) { none() }
31+
32+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
33+
(input.isParameter(0) or input.isParameterDeref(1)) and
34+
(output.isReturnValue() or output.isParameterDeref(1))
35+
}
36+
37+
override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
38+
i = 1 and buffer = true and mustWrite = false
39+
or
40+
i = 2 and buffer = false and mustWrite = false
41+
}
42+
43+
override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
44+
i = 0 and buffer = true
45+
or
46+
i = 1 and buffer = false
47+
}
48+
49+
override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
50+
51+
// NOTE: We implement thse two predicates as none because we can't model the low-level changes made to
52+
// the structure pointed to by the file-descriptor argument.
53+
override predicate hasOnlySpecificReadSideEffects() { none() }
54+
55+
override predicate hasOnlySpecificWriteSideEffects() { none() }
56+
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Poll.qll‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Provides implementation classes modeling `poll` and various similar
3+
* functions. See `semmle.code.cpp.models.Models` for usage information.
4+
*/
5+
6+
import semmle.code.cpp.Function
7+
import semmle.code.cpp.models.interfaces.ArrayFunction
8+
import semmle.code.cpp.models.interfaces.Alias
9+
import semmle.code.cpp.models.interfaces.SideEffect
10+
11+
/**
12+
* The function `poll` and its assorted variants
13+
*/
14+
private class Poll extends ArrayFunction, AliasFunction, SideEffectFunction {
15+
Poll() { this.hasGlobalName(["poll", "ppoll", "WSAPoll"]) }
16+
17+
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
18+
bufParam = 0 and countParam = 1
19+
}
20+
21+
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
22+
23+
override predicate hasArrayOutput(int bufParam) { bufParam = 0 }
24+
25+
override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
26+
27+
override predicate parameterEscapesOnlyViaReturn(int index) { none() }
28+
29+
override predicate parameterIsAlwaysReturned(int index) { none() }
30+
31+
override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
32+
i = 0 and buffer = true and mustWrite = false
33+
}
34+
35+
override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
36+
i = 0 and buffer = true
37+
or
38+
this.hasGlobalName("ppoll") and i = [2, 3] and buffer = false
39+
}
40+
41+
override predicate hasOnlySpecificReadSideEffects() { any() }
42+
43+
override predicate hasOnlySpecificWriteSideEffects() { any() }
44+
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ import semmle.code.cpp.models.interfaces.Taint
33
import semmle.code.cpp.models.interfaces.Alias
44
import semmle.code.cpp.models.interfaces.SideEffect
55

6-
/** Pure string functions. */
6+
/**
7+
* A function that operates on strings and is pure. That is, its evaluation is
8+
* guaranteed to be side-effect free.
9+
*/
710
private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction,
811
SideEffectFunction {
912
PureStrFunction() {
@@ -89,7 +92,9 @@ private string strcmp() {
8992
]
9093
}
9194

92-
/** String standard `strlen` function, and related functions for computing string lengths. */
95+
/**
96+
* A function such as `strlen` that returns the length of the given string.
97+
*/
9398
private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
9499
StrLenFunction() {
95100
hasGlobalOrStdOrBslName(["strlen", "strnlen", "wcslen"])
@@ -123,7 +128,10 @@ private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFun
123128
}
124129
}
125130

126-
/** Pure functions. */
131+
/**
132+
* A function that is pure, that is, its evaluation is guaranteed to be
133+
* side-effect free. Excludes functions modeled by `PureStrFunction` and `PureMemFunction`.
134+
*/
127135
private class PureFunction extends TaintFunction, SideEffectFunction {
128136
PureFunction() { hasGlobalOrStdOrBslName(["abs", "labs"]) }
129137

@@ -140,7 +148,10 @@ private class PureFunction extends TaintFunction, SideEffectFunction {
140148
override predicate hasOnlySpecificWriteSideEffects() { any() }
141149
}
142150

143-
/** Pure raw-memory functions. */
151+
/**
152+
* A function that operates on memory buffers and is pure. That is, its
153+
* evaluation is guaranteed to be side-effect free.
154+
*/
144155
private class PureMemFunction extends AliasFunction, ArrayFunction, TaintFunction,
145156
SideEffectFunction {
146157
PureMemFunction() {

0 commit comments

Comments
 (0)