Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3c9d795

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/default-taint-tracking-sources
2 parents 57d891e + cd1a3e9 commit 3c9d795

197 files changed

Lines changed: 13548 additions & 10347 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/labeler.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
"C++":
2+
- cpp/**/*
3+
- change-notes/**/*cpp*
4+
5+
"C#":
6+
- csharp/**/*
7+
- change-notes/**/*csharp*
8+
9+
Java:
10+
- java/**/*
11+
- change-notes/**/*java.*
12+
13+
JS:
14+
- javascript/**/*
15+
- change-notes/**/*javascript*
16+
17+
Python:
18+
- python/**/*
19+
- change-notes/**/*python*
20+
21+
documentation:
22+
- "**/*.qhelp"
23+
- "**/*.md"
24+
- docs/**/*

change-notes/1.23/analysis-csharp.md

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,18 @@ The following changes in version 1.23 affect C# analysis in all applications.
66

77
| **Query** | **Tags** | **Purpose** |
88
|-----------------------------|-----------|--------------------------------------------------------------------|
9-
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
10-
| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security, external/cwe/cwe-502 | Finds flow of untrusted input to calls to unsafe deserializers. |
11-
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
12-
| Unsafe deserializer (`cs/unsafe-deserialization`) | security, external/cwe/cwe-502 | Finds calls to unsafe deserializers. |
13-
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
9+
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. Results are shown on LGTM by default. |
10+
| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security, external/cwe/cwe-502 | Finds flow of untrusted input to calls to unsafe deserializers. Results are shown on LGTM by default. |
11+
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. Results are not shown on LGTM by default. |
12+
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. Results are not shown on LGTM by default. |
13+
| Unsafe deserializer (`cs/unsafe-deserialization`) | security, external/cwe/cwe-502 | Finds calls to unsafe deserializers. By default, the query is not run on LGTM. |
1414

1515
## Changes to existing queries
1616

1717
| **Query** | **Expected impact** | **Change** |
1818
|------------------------------|------------------------|-----------------------------------|
1919
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | Fewer false positive results | More `null` checks are now taken into account, including `null` checks for `dynamic` expressions and `null` checks such as `object alwaysNull = null; if (x != alwaysNull) ...`. |
20-
| Missing Dispose call on local IDisposable (`cs/local-not-disposed`) | Fewer false positive results | The query has been rewritten in order to identify more dispose patterns. For example, a local `IDisposable` that is disposed of by passing through a fluent API is no longer reported. |
21-
22-
## Removal of old queries
20+
| Missing Dispose call on local IDisposable (`cs/local-not-disposed`) | Fewer false positive results | The query has been rewritten in order to identify more dispose patterns. For example, a local `IDisposable` that is disposed of by passing through a fluent API is no longer reported as missing a dispose call. |
2321

2422
## Changes to code extraction
2523

@@ -29,22 +27,19 @@ The following changes in version 1.23 affect C# analysis in all applications.
2927

3028
* The new class `NamespaceAccess` models accesses to namespaces, for example in `nameof` expressions.
3129
* The data-flow library now makes it easier to specify barriers/sanitizers
32-
arising from guards by overriding the predicate
30+
arising from guards. You can override the predicate
3331
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
3432
configurations respectively.
3533
* The data-flow library has been extended with a new feature to aid debugging.
36-
Instead of specifying `isSink(Node n) { any() }` on a configuration to
37-
explore the possible flow from a source, it is recommended to use the new
38-
`Configuration::hasPartialFlow` predicate, as this gives a more complete
39-
picture of the partial flow paths from a given source. The feature is
40-
disabled by default and can be enabled for individual configurations by
34+
Previously, to explore the possible flow from all sources you could specify `isSink(Node n) { any() }` on a configuration.
35+
Now you can use the new `Configuration::hasPartialFlow` predicate,
36+
which gives a more complete picture of the partial flow paths from a given source, including flow that doesn't reach any sink.
37+
The feature is disabled by default and can be enabled for individual configurations by
4138
overriding `int explorationLimit()`.
42-
* `foreach` statements where the body is guaranteed to be executed at least once, such as `foreach (var x in new string[]{ "a", "b", "c" }) { ... }`, are now recognized by all analyses based on the control flow graph (such as SSA, data flow and taint tracking).
43-
* Fixed the control flow graph for `switch` statements where the `default` case was not the last case. This had caused the remaining cases to be unreachable. `SwitchStmt.getCase(int i)` now puts the `default` case last.
39+
* `foreach` statements where the body is guaranteed to be executed at least once, such as `foreach (var x in new string[]{ "a", "b", "c" }) { ... }`, are now recognized by all analyses based on the control-flow graph (such as SSA, data flow and taint tracking).
40+
* Fixed the control-flow graph for `switch` statements where the `default` case was not the last case. This had caused the remaining cases to be unreachable. `SwitchStmt.getCase(int i)` now puts the `default` case last.
4441
* There is now a `DataFlow::localExprFlow` predicate and a
4542
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4643
common case of local data flow and taint: from one `Expr` to another.
4744
* Data is now tracked through null-coalescing expressions (`??`).
4845
* A new library `semmle.code.csharp.Unification` has been added. This library exposes two predicates `unifiable` and `subsumes` for calculating type unification and type subsumption, respectively.
49-
50-
## Changes to autobuilder

change-notes/1.24/analysis-cpp.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
1313

1414
| **Query** | **Expected impact** | **Change** |
1515
|----------------------------|------------------------|------------------------------------------------------------------|
16+
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | | This query is no longer run on LGTM. |
1617
| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings. This approach produces fewer, more accurate results. |
1718

1819
## Changes to libraries

change-notes/1.24/analysis-csharp.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ The following changes in version 1.24 affect C# analysis in all applications.
77
| **Query** | **Tags** | **Purpose** |
88
|-----------------------------|-----------|--------------------------------------------------------------------|
99
| Insecure configuration for ASP.NET requestValidationMode (`cs/insecure-request-validation-mode`) | security, external/cwe/cwe-016 | Finds where this attribute has been set to a value less than 4.5, which turns off some validation features and makes the application less secure. |
10+
| Page request validation is disabled (`cs/web/request-validation-disabled`) | security, frameworks/asp.net, external/cwe/cwe-016 | Finds where ASP.NET page request validation has been disabled, which could makes the application less secure. |
1011

1112
## Changes to existing queries
1213

@@ -20,6 +21,7 @@ The following changes in version 1.24 affect C# analysis in all applications.
2021
## Changes to libraries
2122

2223
* The taint tracking library now tracks flow through (implicit or explicit) conversion operator calls.
24+
* [Code contracts](https://docs.microsoft.com/en-us/dotnet/framework/debug-trace-profile/code-contracts) are now recognized, and are treated like any other assertion methods.
2325

2426
## Changes to autobuilder
2527

change-notes/1.24/analysis-java.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Improvements to Java analysis
2+
3+
The following changes in version 1.24 affect Java analysis in all applications.
4+
5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
10+
## Changes to existing queries
11+
12+
| **Query** | **Expected impact** | **Change** |
13+
|------------------------------|------------------------|-----------------------------------|
14+
| Expression always evaluates to the same value (`java/evaluation-to-constant`) | Fewer false positives | Expressions of the form `0 * x` are usually intended and no longer reported. |
15+
16+
## Changes to libraries
17+

cpp/config/suites/c/correctness

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/FloatComparison.ql: /Correctness/Common Errors
2424
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/BitwiseSignCheck.ql: /Correctness/Common Errors
2525
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql: /Correctness/Common Errors
26+
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/SignedOverflowCheck.ql: /Correctness/Common Errors
27+
+ semmlecode-cpp-queries/Likely Bugs/Memory Management/PointerOverflow.ql: /Correctness/Common Errors
2628
+ semmlecode-cpp-queries/Likely Bugs/NestedLoopSameVar.ql: /Correctness/Common Errors
2729
+ semmlecode-cpp-queries/Likely Bugs/UseInOwnInitializer.ql: /Correctness/Common Errors
2830
+ semmlecode-cpp-queries/Critical/NewArrayDeleteMismatch.ql: /Correctness/Common Errors

cpp/config/suites/cpp/correctness

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/FloatComparison.ql: /Correctness/Common Errors
2525
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/BitwiseSignCheck.ql: /Correctness/Common Errors
2626
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql: /Correctness/Common Errors
27+
+ semmlecode-cpp-queries/Likely Bugs/Arithmetic/SignedOverflowCheck.ql: /Correctness/Common Errors
28+
+ semmlecode-cpp-queries/Likely Bugs/Memory Management/PointerOverflow.ql: /Correctness/Common Errors
2729
+ semmlecode-cpp-queries/Likely Bugs/NestedLoopSameVar.ql: /Correctness/Common Errors
2830
+ semmlecode-cpp-queries/Likely Bugs/UseInOwnInitializer.ql: /Correctness/Common Errors
2931
+ semmlecode-cpp-queries/Critical/NewArrayDeleteMismatch.ql: /Correctness/Common Errors

cpp/ql/src/Architecture/FeatureEnvy.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description A function that uses more functions and variables from another file than functions and variables from its own file. This function might be better placed in the other file, to avoid exposing internals of the file it depends on.
44
* @kind problem
55
* @problem.severity recommendation
6-
* @precision high
6+
* @precision medium
77
* @id cpp/feature-envy
88
* @tags maintainability
99
* modularity

cpp/ql/src/Architecture/InappropriateIntimacy.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Two files share too much information about each other (accessing many operations or variables in both directions). It would be better to invert some of the dependencies to reduce the coupling between the two files.
44
* @kind problem
55
* @problem.severity recommendation
6-
* @precision high
6+
* @precision medium
77
* @id cpp/file-intimacy
88
* @tags maintainability
99
* modularity

cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Finds classes with many fields; they could probably be refactored by breaking them down into smaller classes, and using composition.
44
* @kind problem
55
* @problem.severity recommendation
6-
* @precision high
6+
* @precision medium
77
* @id cpp/class-many-fields
88
* @tags maintainability
99
* statistical

0 commit comments

Comments
 (0)