Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4ba1740

Browse files
raulgarciamsftraulgarciamsft
authored
Merge branch 'main' into main
2 parents afd8980 + c68c83c commit 4ba1740

409 files changed

Lines changed: 8745 additions & 3876 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/check-change-note.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
- "*/ql/src/**/*.qll"
99
- "*/ql/lib/**/*.ql"
1010
- "*/ql/lib/**/*.qll"
11+
- "*/ql/lib/**/*.yml"
1112
- "!**/experimental/**"
1213
- "!ql/**"
1314
- "!swift/**"

‎.github/workflows/close-stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15-
- uses: actions/stale@v7
15+
- uses: actions/stale@v8
1616
with:
1717
repo-token: ${{ secrets.GITHUB_TOKEN }}
1818
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'

‎.github/workflows/ruby-build.yml‎

Lines changed: 61 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ jobs:
4848
run: |
4949
brew install gnu-tar
5050
echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
51+
- name: Install cargo-cross
52+
if: runner.os == 'Linux'
53+
run: cargo install cross --version 0.2.1
5154
- uses: ./.github/actions/os-version
5255
id: os_version
5356
- name: Cache entire extractor
@@ -78,8 +81,13 @@ jobs:
7881
- name: Run tests
7982
if: steps.cache-extractor.outputs.cache-hit != 'true'
8083
run: cd extractor && cargo test --verbose
81-
- name: Release build
82-
if: steps.cache-extractor.outputs.cache-hit != 'true'
84+
# On linux, build the extractor via cross in a centos7 container.
85+
# This ensures we don't depend on glibc > 2.17.
86+
- name: Release build (linux)
87+
if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os == 'Linux'
88+
run: cd extractor && cross build --release
89+
- name: Release build (windows and macos)
90+
if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os != 'Linux'
8391
run: cd extractor && cargo build --release
8492
- name: Generate dbscheme
8593
if: ${{ matrix.os == 'ubuntu-latest' && steps.cache-extractor.outputs.cache-hit != 'true'}}
@@ -227,3 +235,54 @@ jobs:
227235
shell: bash
228236
run: |
229237
codeql database analyze --search-path "${{ runner.temp }}/ruby-bundle" --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls
238+
239+
# This is a copy of the 'test' job that runs in a centos7 container.
240+
# This tests that the extractor works correctly on systems with an old glibc.
241+
test-centos7:
242+
defaults:
243+
run:
244+
working-directory: ${{ github.workspace }}
245+
strategy:
246+
fail-fast: false
247+
runs-on: ubuntu-latest
248+
container:
249+
image: centos:centos7
250+
env:
251+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
252+
needs: [package]
253+
steps:
254+
- name: Install gh cli
255+
run: |
256+
yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
257+
# fetch-codeql requires unzip and jq
258+
# jq is available in epel-release (https://docs.fedoraproject.org/en-US/epel/)
259+
yum install -y gh unzip epel-release
260+
yum install -y jq
261+
- uses: actions/checkout@v3
262+
- name: Fetch CodeQL
263+
uses: ./.github/actions/fetch-codeql
264+
265+
# Due to a bug in Actions, we can't use runner.temp in the run blocks here.
266+
# https://github.com/actions/runner/issues/2185
267+
268+
- name: Download Ruby bundle
269+
uses: actions/download-artifact@v3
270+
with:
271+
name: codeql-ruby-bundle
272+
path: ${{ runner.temp }}
273+
- name: Unzip Ruby bundle
274+
shell: bash
275+
run: unzip -q -d "$RUNNER_TEMP"/ruby-bundle "$RUNNER_TEMP"/codeql-ruby-bundle.zip
276+
277+
- name: Run QL test
278+
shell: bash
279+
run: |
280+
codeql test run --search-path "$RUNNER_TEMP"/ruby-bundle --additional-packs "$RUNNER_TEMP"/ruby-bundle ruby/ql/test/library-tests/ast/constants/
281+
- name: Create database
282+
shell: bash
283+
run: |
284+
codeql database create --search-path "$RUNNER_TEMP"/ruby-bundle --language ruby --source-root ruby/ql/test/library-tests/ast/constants/ ../database
285+
- name: Analyze database
286+
shell: bash
287+
run: |
288+
codeql database analyze --search-path "$RUNNER_TEMP"/ruby-bundle --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls

‎cpp/ql/lib/change-notes/2023-03-20-boost-deprecated-dataflow-configurations.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: deprecated
33
---
4-
* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallMake`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.
4+
* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.

‎cpp/ql/lib/change-notes/2023-03-23-dataflow-renaming.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
category: deprecated
3+
---
4+
* The recently introduced new data flow and taint tracking APIs have had a
5+
number of module and predicate renamings. The old APIs remain in place for
6+
now.

‎cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ExtendedRangeAnalysis.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
33
// Import each extension we want to enable
44
import extensions.SubtractSelf
55
import extensions.ConstantBitwiseAndExprRange
6+
import extensions.StrlenLiteralRangeExpr

‎cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/extensions/StrlenLiteralRangeExpr.qll‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
private import cpp
2+
private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
3+
4+
/**
5+
* Provides range analysis information for calls to `strlen` on literal strings.
6+
* For example, the range of `strlen("literal")` will be 7.
7+
*/
8+
class StrlenLiteralRangeExpr extends SimpleRangeAnalysisExpr, FunctionCall {
9+
StrlenLiteralRangeExpr() {
10+
getTarget().hasGlobalOrStdName("strlen") and getArgument(0).isConstant()
11+
}
12+
13+
override int getLowerBounds() { result = getArgument(0).getValue().length() }
14+
15+
override int getUpperBounds() { result = getArgument(0).getValue().length() }
16+
17+
override predicate dependsOnChild(Expr e) { none() }
18+
}

‎cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ module PrivateCleartextWrite {
5454
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
5555
}
5656

57-
module WriteFlow = TaintTracking::Make<WriteConfig>;
57+
module WriteFlow = TaintTracking::Global<WriteConfig>;
5858

5959
class PrivateDataSource extends Source {
6060
PrivateDataSource() { this.getExpr() instanceof PrivateDataExpr }

‎cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticType.qll‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,16 +250,26 @@ SemType getSemanticType(Specific::Type type) {
250250
Specific::unknownType(type) and result = TSemUnknownType()
251251
}
252252

253+
private class SemNumericOrBooleanType extends SemSizedType {
254+
SemNumericOrBooleanType() {
255+
this instanceof SemNumericType
256+
or
257+
this instanceof SemBooleanType
258+
}
259+
}
260+
253261
/**
254262
* Holds if the conversion from `fromType` to `toType` can never overflow or underflow.
255263
*/
256-
predicate conversionCannotOverflow(SemNumericType fromType, SemNumericType toType) {
264+
predicate conversionCannotOverflow(SemNumericOrBooleanType fromType, SemNumericOrBooleanType toType) {
257265
// Identity cast
258266
fromType = toType
259267
or
260268
// Treat any cast to an FP type as safe. It can lose precision, but not overflow.
261269
toType instanceof SemFloatingPointType and fromType = any(SemNumericType n)
262270
or
271+
fromType instanceof SemBooleanType and toType instanceof SemIntegerType
272+
or
263273
exists(SemIntegerType fromInteger, SemIntegerType toInteger, int fromSize, int toSize |
264274
fromInteger = fromType and
265275
toInteger = toType and

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlow.qll‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* Provides an implementation of global (interprocedural) data flow. This file
33
* re-exports the local (intraprocedural) data flow analysis from
44
* `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
5-
* through the `Make` and `MakeWithState` modules.
5+
* through the `Global` and `GlobalWithState` modules.
66
*/
77

88
private import DataFlowImplCommon
@@ -73,10 +73,10 @@ signature module ConfigSig {
7373
*/
7474
default FlowFeature getAFeature() { none() }
7575

76-
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
76+
/** Holds if sources should be grouped in the result of `flowPath`. */
7777
default predicate sourceGrouping(Node source, string sourceGroup) { none() }
7878

79-
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
79+
/** Holds if sinks should be grouped in the result of `flowPath`. */
8080
default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
8181

8282
/**
@@ -166,10 +166,10 @@ signature module StateConfigSig {
166166
*/
167167
default FlowFeature getAFeature() { none() }
168168

169-
/** Holds if sources should be grouped in the result of `hasFlowPath`. */
169+
/** Holds if sources should be grouped in the result of `flowPath`. */
170170
default predicate sourceGrouping(Node source, string sourceGroup) { none() }
171171

172-
/** Holds if sinks should be grouped in the result of `hasFlowPath`. */
172+
/** Holds if sinks should be grouped in the result of `flowPath`. */
173173
default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
174174

175175
/**
@@ -182,15 +182,15 @@ signature module StateConfigSig {
182182
}
183183

184184
/**
185-
* Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
185+
* Gets the exploration limit for `partialFlow` and `partialFlowRev`
186186
* measured in approximate number of interprocedural steps.
187187
*/
188188
signature int explorationLimitSig();
189189

190190
/**
191-
* The output of a data flow computation.
191+
* The output of a global data flow computation.
192192
*/
193-
signature module DataFlowSig {
193+
signature module GlobalFlowSig {
194194
/**
195195
* A `Node` augmented with a call context (except for sinks) and an access path.
196196
* Only those `PathNode`s that are reachable from a source, and which can reach a sink, are generated.
@@ -203,28 +203,28 @@ signature module DataFlowSig {
203203
* The corresponding paths are generated from the end-points and the graph
204204
* included in the module `PathGraph`.
205205
*/
206-
predicate hasFlowPath(PathNode source, PathNode sink);
206+
predicate flowPath(PathNode source, PathNode sink);
207207

208208
/**
209209
* Holds if data can flow from `source` to `sink`.
210210
*/
211-
predicate hasFlow(Node source, Node sink);
211+
predicate flow(Node source, Node sink);
212212

213213
/**
214214
* Holds if data can flow from some source to `sink`.
215215
*/
216-
predicate hasFlowTo(Node sink);
216+
predicate flowTo(Node sink);
217217

218218
/**
219219
* Holds if data can flow from some source to `sink`.
220220
*/
221-
predicate hasFlowToExpr(DataFlowExpr sink);
221+
predicate flowToExpr(DataFlowExpr sink);
222222
}
223223

224224
/**
225-
* Constructs a standard data flow computation.
225+
* Constructs a global data flow computation.
226226
*/
227-
module Make<ConfigSig Config> implements DataFlowSig {
227+
module Global<ConfigSig Config> implements GlobalFlowSig {
228228
private module C implements FullStateConfigSig {
229229
import DefaultState<Config>
230230
import Config
@@ -233,17 +233,27 @@ module Make<ConfigSig Config> implements DataFlowSig {
233233
import Impl<C>
234234
}
235235

236+
/** DEPRECATED: Use `Global` instead. */
237+
deprecated module Make<ConfigSig Config> implements GlobalFlowSig {
238+
import Global<Config>
239+
}
240+
236241
/**
237-
* Constructs a data flow computation using flow state.
242+
* Constructs a global data flow computation using flow state.
238243
*/
239-
module MakeWithState<StateConfigSig Config> implements DataFlowSig {
244+
module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
240245
private module C implements FullStateConfigSig {
241246
import Config
242247
}
243248

244249
import Impl<C>
245250
}
246251

252+
/** DEPRECATED: Use `GlobalWithState` instead. */
253+
deprecated module MakeWithState<StateConfigSig Config> implements GlobalFlowSig {
254+
import GlobalWithState<Config>
255+
}
256+
247257
signature class PathNodeSig {
248258
/** Gets a textual representation of this element. */
249259
string toString();

0 commit comments

Comments
 (0)