Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 56ee5ff

Browse files
adityasharadadityasharad
committed
Merge master into next.
`master` up to and including cfe0b88.
2 parents 121596d + cfe0b88 commit 56ee5ff

122 files changed

Lines changed: 4157 additions & 1299 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.lgtm.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
path_classifiers:
2+
library:
3+
- javascript/externs
4+
5+
test:
6+
- csharp/ql/src
7+
- csharp/ql/test
8+
- javascript/ql/src
9+
- javascript/ql/test
10+
11+
queries:
12+
- include: "*"
13+
14+
extraction:
15+
python:
16+
python_setup:
17+
version: 3

‎change-notes/1.19/analysis-cpp.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,18 @@
66

77
| **Query** | **Tags** | **Purpose** |
88
|-----------------------------|-----------|--------------------------------------------------------------------|
9-
| Cast between HRESULT and a Boolean type (`cpp/hresult-boolean-conversion`) | external/cwe/cwe-253 | Finds logic errors caused by mistakenly treating the Windows `HRESULT` type as a Boolean instead of testing it with the appropriate macros. Enabled by default. |
9+
| Cast between `HRESULT` and a Boolean type (`cpp/hresult-boolean-conversion`) | external/cwe/cwe-253 | Finds logic errors caused by mistakenly treating the Windows `HRESULT` type as a Boolean instead of testing it with the appropriate macros. Enabled by default. |
1010
| Setting a DACL to `NULL` in a `SECURITY_DESCRIPTOR` (`cpp/unsafe-dacl-security-descriptor`) | external/cwe/cwe-732 | This query finds code that creates world-writable objects on Windows by setting their DACL to `NULL`. Enabled by default. |
11-
| Cast from char* to wchar_t* | security, external/cwe/cwe-704 | Detects potentially dangerous casts from char* to wchar_t*. Enabled by default on LGTM. |
11+
| Cast from `char*` to `wchar_t*` | security, external/cwe/cwe-704 | Detects potentially dangerous casts from `char*` to `wchar_t*`. Enabled by default on LGTM. |
12+
| Dead code due to `goto` or `break` statement (`cpp/dead-code-goto`) | maintainability, external/cwe/cwe-561 | Detects dead code following a goto or break statement. Enabled by default on LGTM. |
1213

1314
## Changes to existing queries
1415

1516
| **Query** | **Expected impact** | **Change** |
1617
|----------------------------|------------------------|------------------------------------------------------------------|
17-
| Resource not released in destructor | Fewer false positive results | Placement new is now excluded from the query. |
18+
| Resource not released in destructor | Fewer false positive results | Placement new is now excluded from the query. Also fixed an issue where false positives could occur if the destructor body was not in the snapshot. |
1819
| Missing return statement (`cpp/missing-return`) | Visible by default | The precision of this query has been increased from 'medium' to 'high', which makes it visible by default in LGTM. It was 'medium' in release 1.17 and 1.18 because it had false positives due to an extractor bug that was fixed in 1.18. |
20+
| Missing return statement | Fewer false positive results | The query is now produces correct results when a function returns a template-dependent type. |
1921
| Call to memory access function may overflow buffer | More correct results | Array indexing with a negative index is now detected by this query. |
2022
| Suspicious add with sizeof | Fewer false positive results | Arithmetic with void pointers (where allowed) is now excluded from this query. |
2123
| Wrong type of arguments to formatting function | Fewer false positive results | False positive results involving typedefs have been removed. Expected argument types are determined more accurately, especially for wide string and pointer types. Custom (non-standard) formatting functions are also identified more accurately. |

‎change-notes/1.19/analysis-csharp.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212

1313
## Changes to existing queries
1414

15-
| **Query** | **Expected impact** | **Change** |
16-
|----------------------------|------------------------|------------------------------------------------------------------|
15+
| Inconsistent lock sequence (`cs/inconsistent-lock-sequence`) | More results | This query now finds inconsistent lock sequences globally across calls. |
16+
1717
| *@name of query (Query ID)*| *Impact on results* | *How/why the query has changed* |
1818

1919

‎change-notes/1.19/analysis-java.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,18 @@
44

55
## New queries
66

7-
| **Query** | **Tags** | **Purpose** |
8-
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
99

1010
## Changes to existing queries
1111

12-
| **Query** | **Expected impact** | **Change** |
13-
| Unreachable catch clause (`java/unreachable-catch-clause`) | Fewer false-positive results | This rule now accounts for calls to generic methods that throw generic exceptions. |
12+
| **Query** | **Expected impact** | **Change** |
13+
|----------------------------|------------------------|------------------------------------------------------------------|
14+
| Array index out of bounds (`java/index-out-of-bounds`) | Fewer false positive results | False positives involving arrays with a length evenly divisible by 3 or some greater number and an index being increased with a similar stride length are no longer reported. |
15+
| Unreachable catch clause (`java/unreachable-catch-clause`) | Fewer false positive results | This rule now accounts for calls to generic methods that throw generic exceptions. |
16+
| Useless comparison test (`java/constant-comparison`) | Fewer false positive results | Constant comparisons guarding `java.util.ConcurrentModificationException` are no longer reported, as they are intended to always be false in the absence of API misuse. |
1417

1518
## Changes to QL libraries
1619

20+
* The `ParityAnalysis` library is replaced with the more general `ModulusAnalysis` library, which improves the range analysis.
21+

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
| Remote property injection | Fewer results | The precision of this rule has been revised to "medium". Results are no longer shown on LGTM by default. |
3636
| Missing CSRF middleware | Fewer false-positive results | This rule now recognizes additional CSRF protection middlewares. |
3737
| Server-side URL redirect | More results | This rule now recognizes redirection calls in more cases. |
38+
| Unused variable, import, function or class | Fewer results | This rule now flags import statements with multiple unused imports once. |
3839
| User-controlled bypass of security check | Fewer results | This rule no longer flags conditions that guard early returns. The precision of this rule has been revised to "medium". Results are no longer shown on LGTM by default. |
3940
| Whitespace contradicts operator precedence | Fewer false-positive results | This rule no longer flags operators with asymmetric whitespace. |
4041

‎cpp/config/suites/security/cwe-428‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# CWE-428: Unquoted Search Path or Element
2+
+ semmlecode-cpp-queries/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql: /CWE/CWE-428
3+
@name NULL application name with an unquoted path in call to CreateProcess (CWE-428)

‎cpp/config/suites/security/default‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
@import "cwe-327"
2020
@import "cwe-367"
2121
@import "cwe-416"
22+
@import "cwe-428"
2223
@import "cwe-457"
2324
@import "cwe-468"
2425
@import "cwe-676"

‎cpp/ql/src/Critical/DeadCodeGoto.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
goto err1;
2+
free(pointer); // BAD: this line is unreachable
3+
err1: return -1;
4+
5+
free(pointer); // GOOD: this line is reachable
6+
goto err2;
7+
err2: return -1;

‎cpp/ql/src/Critical/DeadCodeGoto.qhelp‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
7+
<overview>
8+
<p>
9+
Code immediately following a <code>goto</code> or <code>break</code> statement will not be executed,
10+
unless there is a label or switch case. When the code is necessary, this leads to logical errors or
11+
resource leaks. If the code is unnecessary, it may confuse readers.
12+
</p>
13+
</overview>
14+
<recommendation>
15+
<p>
16+
If the unreachable code is necessary, move the <code>goto</code> or <code>break</code> statement to
17+
after the code. Otherwise, delete the unreachable code.
18+
</p>
19+
20+
</recommendation>
21+
<example><sample src="DeadCodeGoto.cpp" />
22+
</example>
23+
<references>
24+
<li>
25+
The CERT C Secure Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/c/MSC12-C.+Detect+and+remove+code+that+has+no+effect+or+is+never+executed">MSC12-C. Detect and remove code that has no effect or is never executed</a>.
26+
</li>
27+
</references>
28+
</qhelp>

‎cpp/ql/src/Critical/DeadCodeGoto.ql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* @name Dead code due to goto or break statement
3+
* @description A goto or break statement is followed by unreachable code.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @precision high
7+
* @id cpp/dead-code-goto
8+
* @tags maintainability
9+
* external/cwe/cwe-561
10+
*/
11+
12+
import cpp
13+
14+
Stmt getNextRealStmt(Block b, int i) {
15+
result = b.getStmt(i + 1) and
16+
not result instanceof EmptyStmt
17+
or
18+
b.getStmt(i + 1) instanceof EmptyStmt and
19+
result = getNextRealStmt(b, i + 1)
20+
}
21+
22+
from JumpStmt js, Block b, int i, Stmt s
23+
where b.getStmt(i) = js
24+
and s = getNextRealStmt(b, i)
25+
// the next statement isn't jumped to
26+
and not s instanceof LabelStmt
27+
and not s instanceof SwitchCase
28+
// the next statement isn't breaking out of a switch
29+
and not s.(BreakStmt).getBreakable() instanceof SwitchStmt
30+
// the next statement isn't a loop that can be jumped into
31+
and not exists (LabelStmt ls | s.(Loop).getStmt().getAChild*() = ls)
32+
and not exists (SwitchCase sc | s.(Loop).getStmt().getAChild*() = sc)
33+
select js, "This statement makes $@ unreachable.", s, s.toString()

0 commit comments

Comments
 (0)