Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 51e543a

Browse files
zlaski-semmlezlaski-semmle
authored
Merge branch 'master' into zlaski/cpp370
2 parents 46b6eac + 813e1e7 commit 51e543a

543 files changed

Lines changed: 24840 additions & 6456 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ You can use the [interactive query console](https://lgtm.com/help/lgtm/using-que
99

1010
## Contributing
1111

12-
We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md) and [QL style guide](docs/ql-style-guide.md).
12+
We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/Semmle/ql/tree/master/docs) to learn how to format your QL for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
1313

1414
## License
1515

‎change-notes/1.21/analysis-cpp.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
| `()`-declared function called with too few arguments (`cpp/too-few-arguments`) | Correctness | Find all cases where the number of arguments is less than the number of parameters of the function, provided the function is also properly declared/defined elsewhere. |
1010
| `()`-declared function called with mismatched arguments (`cpp/mismatched-function-arguments`) | Correctness | Find all cases where the types of arguments do not match the types of parameters of the function, provided the function is also properly declared/defined elsewhere. |
1111
| Call to alloca in a loop (`cpp/alloca-in-loop`) | reliability, correctness, external/cwe/cwe-770 | Finds calls to `alloca` in loops, which can lead to stack overflow if the number of iterations is large. Newly displayed on LGTM. |
12+
| Use of dangerous function (`dangerous-function-overflow`) | reliability, security, external/cwe/cwe-242 | Finds calls to `gets`, which does not guard against buffer overflow. These results were previously detected by the `cpp/potentially-dangerous-function` query. |
1213

1314
## Changes to existing queries
1415

@@ -28,11 +29,14 @@
2829
| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | More correct results and fewer false positive results | This query now more accurately identifies wide and non-wide string/character format arguments on different platforms. Platform detection has also been made more accurate for the purposes of this query. |
2930
| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | Fewer false positive results | Non-standard uses of %L are now understood. |
3031
| `()`-declared function called with too many arguments (`cpp/futile-params`) | Improved coverage | Query has been generalized to find all cases where the number of arguments exceedes the number of parameters of the function, provided the function is also properly declared/defined elsewhere. |
32+
| Use of potentially dangerous function (`cpp/potentially-dangerous-function`) | Fewer results | Results relating to the standard library `gets` function have been moved into a new query (`dangerous-function-overflow`). |
33+
| Constructor with default arguments will be used as a copy constructor (`cpp/constructor-used-as-copy-constructor`) | Lowered severity and precision | The severity and precision of this query have been reduced to "warning" and "low", respectively, due to this coding pattern being used intentionally and safely in a number of real-world projects. |
3134

3235
## Changes to QL libraries
3336
- The predicate `Declaration.hasGlobalName` now only holds for declarations that are not nested in a class. For example, it no longer holds for a member function `MyClass::myFunction` or a constructor `MyClass::MyClass`, whereas previously it would classify those two declarations as global names.
34-
- In class `Declaration`, predicates `getQualifiedName/0` and `hasQualifiedName/1` are no longer recommended for finding functions by name. Instead, use `hasGlobalName/1` and the new `hasQualifiedName/2` and `hasQualifiedName/3` predicates. This improves performance and makes it more reliable to identify names involving templates.
37+
- In class `Declaration`, predicates `getQualifiedName/0` and `hasQualifiedName/1` are no longer recommended for finding functions by name. Instead, use `hasGlobalName/1` and the new `hasQualifiedName/2` and `hasQualifiedName/3` predicates. This improves performance and makes it more reliable to identify names involving templates and inline namespaces.
3538
- Additional support for definition by reference has been added to the `semmle.code.cpp.dataflow.TaintTracking` library.
3639
- The taint tracking library now includes taint-specific edges for functions modeled in `semmle.code.cpp.models.interfaces.DataFlow`.
3740
- The taint tracking library adds flow through library functions that are modeled in `semmle.code.cpp.models.interfaces.Taint`. Queries can add subclasses of `TaintFunction` to specify additional flow.
3841
- There is a new `FoldExpr` class, representing C++17 fold expressions.
42+
- The member predicates `DeclarationEntry.getUnspecifiedType`, `Expr.getUnspecifiedType`, and `Variable.getUnspecifiedType` have been added. These should be preferred over the existing `getUnderlyingType` predicates.

‎change-notes/1.21/analysis-csharp.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,30 @@
66
|------------------------------|------------------------|-----------------------------------|
77
| Class defines a field that uses an ICryptoTransform class in a way that would be unsafe for concurrent threads (`cs/thread-unsafe-icryptotransform-field-in-class`) | Fewer false positive results | The criteria for a result has changed to include nested properties, nested fields and collections. The format of the alert message has changed to highlight the static field. |
88
| Constant condition (`cs/constant-condition`) | Fewer false positive results | Results have been removed where the `null` value is in a conditional expression on the left hand side of a null-coalescing expression. For example, in `(a ? b : null) ?? c`, `null` is not considered to be a constant condition. |
9+
| Useless upcast (`cs/useless-upcast`) | Fewer false positive results | Results have been removed where the upcast is used to disambiguate the target of a constructor call. |
910

1011
## Changes to code extraction
1112

12-
* Named attribute arguments are now extracted.
13+
* The following C# 8 features are now extracted:
14+
- Range expressions
15+
- Recursive patterns
16+
* The `unmanaged` type parameter constraint is now extracted.
1317

1418
## Changes to QL libraries
1519

1620
* The class `Attribute` has two new predicates: `getConstructorArgument()` and `getNamedArgument()`. The first predicate returns arguments to the underlying constructor call and the latter returns named arguments for initializing fields and properties.
21+
* The class `TypeParameterConstraints` has a new predicate `hasUnmanagedTypeConstraint()`, indicating that the type parameter has the `unmanaged` constraint.
22+
* The following QL classes have been added to model C# 8 features:
23+
- Class `IndexExpr` models from-end index expressions, for example `^1`
24+
- Class `PatternExpr` is an `Expr` that appears in a pattern. It has the new subclasses `DiscardPatternExpr`, `LabeledPatternExpr`, `RecursivePatternExpr`, `TypeAccessPatternExpr`, `TypePatternExpr`, and `VariablePatternExpr`.
25+
- Class `PatternMatch` models a pattern being matched. It has the subclasses `Case` and `IsExpr`.
26+
- Class `PositionalPatternExpr` models position patterns, for example `(int x, int y)`
27+
- Class `PropertyPatternExpr` models property patterns, for example `Length: int len`
28+
- Class `RangeExpr` models range expressions, for example `1..^1`
29+
- Class `SwitchCaseExpr` models the arm of a switch expression, for example `(false, false) => true`
30+
- Class `SwitchExpr` models `switch` expressions, for example `(a, b) switch { ... }`
31+
- Classes `IsConstantExpr`, `IsTypeExpr` and `IsPatternExpr` are deprecated in favour of `IsExpr`
32+
- Class `Switch` models both `SwitchExpr` and `SwitchStmt`
33+
- Class `Case` models both `CaseStmt` and `SwitchCaseExpr`
1734

1835
## Changes to autobuilder

‎change-notes/1.21/analysis-java.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@
2222
methods. This means that more guards are recognized yielding precision
2323
improvements in a number of queries including `java/index-out-of-bounds`,
2424
`java/dereferenced-value-may-be-null`, and `java/useless-null-check`.
25+
* The default sanitizer in taint tracking has been made more precise. The
26+
sanitizer works by looking for guards that inspect tainted strings, and it
27+
used to work at the level of individual variables. This has been changed to
28+
use the `Guards` library, such that only guarded variable accesses are
29+
sanitized. This may give additional results in the security queries.
2530
* Spring framework support is enhanced by taking into account additional
2631
annotations that indicate remote user input. This affects all security
2732
queries, which may yield additional results.

‎change-notes/1.21/analysis-javascript.md‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,18 @@
1717

1818
* The security queries now treat comparisons with symbolic constants as sanitizers, resulting in fewer false positives.
1919

20-
* TypeScript 3.4 features are now supported.
20+
* TypeScript 3.5 is now supported.
21+
22+
* On LGTM, TypeScript projects now have static type information extracted by default, resulting in more security results.
23+
Users of the command-line tools must still pass `--typescript-full` to the extractor to enable this.
2124

2225

2326
## New queries
2427

2528
| **Query** | **Tags** | **Purpose** |
2629
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
30+
| Missing regular expression anchor (`js/regex/missing-regexp-anchor`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression patterns that may be missing an anchor, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are not shown on LGTM by default. |
31+
| Prototype pollution (`js/prototype-pollution`) | security, external/cwe-250, external/cwe-400 | Highlights code that allows an attacker to modify a built-in prototype object through an unsanitized recursive merge function. The results are shown on LGTM by default. |
2732

2833
## Changes to existing queries
2934

@@ -42,10 +47,15 @@
4247
| Useless assignment to property | Fewer false-positive results | This rule now ignore reads of additional getters. |
4348
| Unreachable statement | Unreachable throws no longer give an alert | This ignores unreachable throws, as they could be intentional (for example, to placate the TS compiler). |
4449
| Incorrect suffix check | Fewer false-positive results | This rule now recognizes valid checks in more cases. |
50+
| Tainted path | More results and fewer false-positive results | This rule now analyses path manipulation code more precisely. |
4551

4652
## Changes to QL libraries
4753

4854
* `RegExpLiteral` is now a `DataFlow::SourceNode`.
4955
* `JSDocTypeExpr` now has source locations and is a subclass of `Locatable` and `TypeAnnotation`.
56+
* The two-parameter versions of predicate `isBarrier` in `DataFlow::Configuration` and of predicate `isSanitizer` in `TaintTracking::Configuration` have been renamed to `isBarrierEdge` and `isSanitizerEdge`, respectively. The old names are maintained for backwards-compatibility in this version, but will be deprecated in the next version and subsequently removed.
5057
* Various predicates named `getTypeAnnotation()` now return `TypeAnnotation` instead of `TypeExpr`.
51-
In rare cases, this may cause compilation errors. Cast the result to `TypeExpr` if this happens.
58+
In rare cases, this may cause compilation errors in existing code. Cast the result to `TypeExpr` if this happens.
59+
* The `getALabel` predicate in `LabeledBarrierGuardNode` and `LabeledSanitizerGuardNode`
60+
has been deprecated and overriding it no longer has any effect.
61+
Instead use the 3-parameter version of `blocks` or `sanitizes`.

‎change-notes/1.21/analysis-python.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
| **Query** | **Tags** | **Purpose** |
1111
|-----------|----------|-------------|
1212
| Accepting unknown SSH host keys when using Paramiko (`py/paramiko-missing-host-key-validation`) | security, external/cwe/cwe-295 | Finds instances where Paramiko is configured to accept unknown host keys. Results are shown on LGTM by default. |
13-
13+
| Use of 'return' or 'yield' outside a function (`py/return-or-yield-outside-function`) | reliability, correctness | Finds instances where `return`, `yield`, and `yield from` are used outside a function. Results are not shown on LGTM by default. |
1414

1515
## Changes to existing queries
1616

‎change-notes/1.21/extractor-javascript.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44

55
## Changes to code extraction
66

7+
* Custom file types can now be specified using the `filetypes` property in the `extraction/javascript/index` section of `lgtm.yml`. The property should be a map from file extensions (including the dot) to file types. Valid file types are `html`, `js`, `json`, `typescript`, `xml` and `yaml`.
8+
79
* ECMAScript 2019 support is now enabled by default.
810

11+
* On LGTM, JavaScript extraction for projects that do not contain any JavaScript or TypeScript code will now fail, even if the project contains other file types (such as HTML or YAML) recognized by the JavaScript extractor.
12+
13+
* XML files can now be extracted on LGTM. To enable XML extraction, set the `xml_mode` property in the `extraction/javascript/index` section of your `lgtm.yml` file to `all`. The default value of this property is `disabled`, meaning that XML files will not be extracted. (Note, however, that files with an extension that is associated with file type `xml` in the `filetypes` property are still extracted.)
14+
915
* YAML files are now extracted by default on LGTM. You can specify exclusion filters in your `lgtm.yml` file to override this behavior.

‎change-notes/support/versions-compilers.csv‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ Java,"Java 6 to 11 [2]_.","javac (OpenJDK and Oracle JDK)
1313
Eclipse compiler for Java (ECJ) batch compiler",``.java``
1414
JavaScript,ECMAScript 2019 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhm``, ``.xhtml``, ``.vue``, ``.json``, ``.yaml``, ``.yml``, ``.raml`` [3]_."
1515
Python,"2.7, 3.5, 3.6, 3.7",Not applicable,``.py``
16-
TypeScript [4]_.,"2.6-3.4",Standard TypeScript compiler,"``.ts``, ``.tsx``"
16+
TypeScript [4]_.,"2.6-3.5",Standard TypeScript compiler,"``.ts``, ``.tsx``"

‎cpp/config/suites/security/cwe-676‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,5 @@
33
@name Dangerous use of 'cin' (CWE-676)
44
+ semmlecode-cpp-queries/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql: /CWE/CWE-676
55
@name Use of potentially dangerous function (CWE-676)
6+
+ semmlecode-cpp-queries/Security/CWE/CWE-676/DangerousFunctionOverflow.ql: /CWE/CWE-676
7+
@name Use of dangerous function (CWE-676)

‎cpp/ql/src/Best Practices/Exceptions/CatchingByValue.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@
1313
import cpp
1414

1515
from CatchBlock cb, Class caughtType
16-
where caughtType = cb.getParameter().getType().getUnderlyingType().getUnspecifiedType()
16+
where caughtType = cb.getParameter().getUnspecifiedType()
1717
select cb,
1818
"This should catch a " + caughtType.getName() + " by (const) reference rather than by value."

0 commit comments

Comments
 (0)