Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3459370

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/ir-callee-side-effects
2 parents ae47eab + 403899e commit 3459370

379 files changed

Lines changed: 29499 additions & 20129 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CODEOWNERS‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1+
/cpp/ @Semmle/cpp-analysis
12
/csharp/ @Semmle/cs
23
/java/ @Semmle/java
34
/javascript/ @Semmle/js
4-
/cpp/ @Semmle/cpp-analysis
5+
/python/ @Semmle/python
56
/cpp/**/*.qhelp @hubwriter
67
/csharp/**/*.qhelp @jf205
78
/java/**/*.qhelp @felicitymay

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This open source repository contains the standard CodeQL libraries and queries t
55
## How do I learn CodeQL and run queries?
66

77
There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
8-
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open source project that's currently being analyzed.
8+
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any open source project that's currently being analyzed.
99

1010
## Contributing
1111

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
1111
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail. This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
12-
| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | Finds overflow checks that rely on signed integer addition to overflow, which has undefined behavior. Example: `a + b < a`. |
12+
| Signed overflow check (`cpp/signed-overflow-check`) | correctness, security | Finds overflow checks that rely on signed integer addition to overflow, which has undefined behavior. Example: `a + b < a`. |
13+
| Pointer overflow check (`cpp/pointer-overflow-check`) | correctness, security | Finds overflow checks that rely on pointer addition to overflow, which has undefined behavior. Example: `ptr + a < ptr`. |
1314

1415
## Changes to existing queries
1516

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,14 @@
88

99
* Support for the following frameworks and libraries has been improved:
1010
- [firebase](https://www.npmjs.com/package/firebase)
11+
- [get-them-args](https://www.npmjs.com/package/get-them-args)
12+
- [minimist](https://www.npmjs.com/package/minimist)
1113
- [mongodb](https://www.npmjs.com/package/mongodb)
1214
- [mongoose](https://www.npmjs.com/package/mongoose)
15+
- [optimist](https://www.npmjs.com/package/optimist)
16+
- [parse-torrent](https://www.npmjs.com/package/parse-torrent)
1317
- [rate-limiter-flexible](https://www.npmjs.com/package/rate-limiter-flexible)
18+
- [yargs](https://www.npmjs.com/package/yargs)
1419

1520
* The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
1621

@@ -20,14 +25,15 @@
2025

2126
| **Query** | **Tags** | **Purpose** |
2227
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
23-
| Unused index variable (`js/unused-index-variable`) | correctness | Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default. |
28+
| Ignoring result from pure array method (`js/ignore-array-result`) | maintainability, correctness | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
29+
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | security, correctness, external/cwe/cwe-020 | Highlights checks for `javascript:` URLs that do not take `data:` or `vbscript:` URLs into account. Results are shown on LGTM by default. |
2430
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are shown on LGTM by default. |
25-
| Suspicious method name (`js/suspicious-method-name-declaration`) | correctness, typescript, methods | Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default. |
2631
| Shell command built from environment values (`js/shell-command-injection-from-environment`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-088 | Highlights shell commands that may change behavior inadvertently depending on the execution environment, indicating a possible violation of [CWE-78](https://cwe.mitre.org/data/definitions/78.html). Results are shown on LGTM by default.|
32+
| Suspicious method name (`js/suspicious-method-name-declaration`) | correctness, typescript, methods | Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default. |
33+
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
34+
| Unused index variable (`js/unused-index-variable`) | correctness | Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default. |
2735
| Use of returnless function (`js/use-of-returnless-function`) | maintainability, correctness | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
2836
| Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
29-
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
30-
| Ignoring result from pure array method (`js/ignore-array-result`) | maintainability, correctness | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
3137

3238
## Changes to existing queries
3339

@@ -51,6 +57,11 @@
5157
## Changes to libraries
5258

5359
* `Expr.getDocumentation()` now handles chain assignments.
60+
* String literals are now parsed as regular expressions.
61+
Consequently, a `RegExpTerm` may occur as part of a string literal or
62+
as a regular expression literal. Queries that search for regular expressions may need to
63+
use `RegExpTerm.isPartOfRegExpLiteral` or `RegExpTerm.isUsedAsRegExp` to restrict the search.
64+
A regular expression AST can be obtained from a string literal using `StringLiteral.asRegExp`.
5465

5566
## Removal of deprecated queries
5667

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Improvements to JavaScript analysis
2+
3+
## General improvements
4+
5+
6+
## New queries
7+
8+
| **Query** | **Tags** | **Purpose** |
9+
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
10+
11+
12+
## Changes to existing queries
13+
14+
| **Query** | **Expected impact** | **Change** |
15+
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
16+
| Clear-text logging of sensitive information (`js/clear-text-logging`) | More results | More results involving `process.env` and indirect calls to logging methods are recognized. |
17+
18+
## Changes to libraries
19+

‎cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,13 @@
1313

1414
import cpp
1515
import PointlessSelfComparison
16+
import semmle.code.cpp.commons.Exclusions
1617

1718
from ComparisonOperation cmp
1819
where
1920
pointlessSelfComparison(cmp) and
2021
not nanTest(cmp) and
2122
not overflowTest(cmp) and
2223
not cmp.isFromTemplateInstantiation(_) and
23-
not exists(MacroInvocation mi |
24-
// cmp is in mi
25-
mi.getAnExpandedElement() = cmp and
26-
// and cmp was apparently not passed in as a macro parameter
27-
cmp.getLocation().getStartLine() = mi.getLocation().getStartLine() and
28-
cmp.getLocation().getStartColumn() = mi.getLocation().getStartColumn()
29-
)
24+
not isFromMacroDefinition(cmp)
3025
select cmp, "Self comparison."

‎cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
/**
2-
* @name Undefined result of signed test for overflow
2+
* @name Signed overflow check
33
* @description Testing for overflow by adding a value to a variable
44
* to see if it "wraps around" works only for
55
* unsigned integer values.
66
* @kind problem
77
* @problem.severity warning
88
* @precision high
99
* @id cpp/signed-overflow-check
10-
* @tags reliability
10+
* @tags correctness
1111
* security
1212
*/
1313

‎cpp/ql/src/Likely Bugs/Likely Typos/CompareWhereAssignMeant.ql‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,10 @@ import cpp
1515

1616
from ExprInVoidContext op
1717
where
18-
op instanceof EQExpr
19-
or
20-
op.(FunctionCall).getTarget().hasName("operator==")
18+
not op.isUnevaluated() and
19+
(
20+
op instanceof EQExpr
21+
or
22+
op.(FunctionCall).getTarget().hasName("operator==")
23+
)
2124
select op, "This '==' operator has no effect. The assignment ('=') operator was probably intended."

‎cpp/ql/src/Likely Bugs/Likely Typos/ExprHasNoEffect.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ where
8686
not peivc.isFromTemplateInstantiation(_) and
8787
parent = peivc.getParent() and
8888
not parent.isInMacroExpansion() and
89+
not peivc.isUnevaluated() and
8990
not parent instanceof PureExprInVoidContext and
9091
not peivc.getEnclosingFunction().isCompilerGenerated() and
9192
not peivc.getType() instanceof UnknownType and

‎cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow-bad.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
bool not_in_range(T *ptr, T *ptr_end, size_t i) {
2+
return ptr + i >= ptr_end || ptr + i < ptr; // BAD
3+
}

0 commit comments

Comments
 (0)