Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 43a0d4c

Browse files
MathiasVPMathiasVP
committed
Merge branch 'master' into flat-structs
2 parents b890b16 + 9c50acc commit 43a0d4c

72 files changed

Lines changed: 2098 additions & 357 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.25/analysis-cpp.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,4 @@ The following changes in version 1.25 affect C/C++ analysis in all applications.
4141
};
4242
```
4343
* The security pack taint tracking library (`semmle.code.cpp.security.TaintTracking`) now considers that equality checks may block the flow of taint. This results in fewer false positive results from queries that use this library.
44-
44+
* The length of a tainted string (such as the return value of a call to `strlen` or `strftime` with tainted parameters) is no longer itself considered tainted by the `models` library. This leads to fewer false positive results in queries that use any of our taint libraries.

‎change-notes/1.25/analysis-javascript.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323

2424
* TypeScript 3.9 is now supported.
2525

26+
* The analysis of sanitizers has improved, leading to more accurate
27+
results from the security queries.
28+
2629
## New queries
2730

2831
| **Query** | **Tags** | **Purpose** |
@@ -36,15 +39,13 @@
3639

3740
| **Query** | **Expected impact** | **Change** |
3841
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
39-
| Client-side cross-site scripting (`js/xss`) | Fewer results | This query no longer flags optionally sanitized values. |
40-
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Fewer results | This query now recognizes additional safe patterns of doing URL redirects. |
4142
| Client-side cross-site scripting (`js/xss`) | Fewer results | This query now recognizes additional safe patterns of constructing HTML. |
43+
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Fewer results | This query now recognizes additional safe patterns of doing URL redirects. |
4244
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving NoSQL code operators are now recognized. |
4345
| Expression has no effect (`js/useless-expression`) | Fewer results | This query no longer flags an expression when that expression is the only content of the containing file. |
4446
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional url scheme checks. |
4547
| Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
4648
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes additional utility functions as vulnerable to prototype polution. |
47-
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes more coding patterns that are vulnerable to prototype pollution. |
4849
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
4950
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
5051
| Unknown directive (`js/unknown-directive`) | Fewer results | This query no longer flags directives generated by the Babel compiler. |

‎cpp/ql/src/semmle/code/cpp/AutogeneratedFile.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
/**
2+
* Provides a class and predicate for recognizing files that are likely to have been generated
3+
* automatically.
4+
*/
5+
16
import semmle.code.cpp.Comments
27
import semmle.code.cpp.File
38
import semmle.code.cpp.Preprocessor

‎cpp/ql/src/semmle/code/cpp/Class.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides classes representing C++ classes, including structs, unions, and template classes.
3+
*/
4+
15
import semmle.code.cpp.Type
26
import semmle.code.cpp.UserType
37
import semmle.code.cpp.metrics.MetricClass

‎cpp/ql/src/semmle/code/cpp/Comments.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides classes representing C and C++ comments.
3+
*/
4+
15
import semmle.code.cpp.Location
26
import semmle.code.cpp.Element
37

‎cpp/ql/src/semmle/code/cpp/Compilation.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides a class representing individual compiler invocations that occurred during the build.
3+
*/
4+
15
import semmle.code.cpp.File
26

37
/*

‎cpp/ql/src/semmle/code/cpp/Declaration.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides classes for working with C and C++ declarations.
3+
*/
4+
15
import semmle.code.cpp.Element
26
import semmle.code.cpp.Specifier
37
import semmle.code.cpp.Namespace

‎cpp/ql/src/semmle/code/cpp/Diagnostics.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides classes representing warnings generated during compilation.
3+
*/
4+
15
import semmle.code.cpp.Location
26

37
/** A compiler-generated error, warning or remark. */

‎cpp/ql/src/semmle/code/cpp/Element.qll‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
/**
2+
* Provides the `Element` class, which is the base class for all classes representing C or C++
3+
* program elements.
4+
*/
5+
16
import semmle.code.cpp.Location
27
private import semmle.code.cpp.Enclosing
38
private import semmle.code.cpp.internal.ResolveClass
@@ -261,8 +266,14 @@ private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
261266
class StaticAssert extends Locatable, @static_assert {
262267
override string toString() { result = "static_assert(..., \"" + getMessage() + "\")" }
263268

269+
/**
270+
* Gets the expression which this static assertion ensures is true.
271+
*/
264272
Expr getCondition() { static_asserts(underlyingElement(this), unresolveElement(result), _, _) }
265273

274+
/**
275+
* Gets the message which will be reported by the compiler if this static assertion fails.
276+
*/
266277
string getMessage() { static_asserts(underlyingElement(this), _, result, _) }
267278

268279
override Location getLocation() { static_asserts(underlyingElement(this), _, _, result) }

‎cpp/ql/src/semmle/code/cpp/Enclosing.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
/**
2+
* Provides predicates for finding the smallest element that encloses an expression or statement.
3+
*/
4+
15
import cpp
26

37
/**

0 commit comments

Comments
 (0)