Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5f269b2

Browse files
hvitvedhvitved
authored
Merge branch 'master' into cs/extractor/for-is
2 parents f0fb47c + b8877f1 commit 5f269b2

110 files changed

Lines changed: 1669 additions & 798 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.20/analysis-csharp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
## Changes to code extraction
1919

2020
* Fix extraction of `for` statements where the condition declares new variables using `is`.
21+
* Initializers of `stackalloc` arrays are now extracted.
2122

2223
## Changes to QL libraries
2324

‎change-notes/1.20/analysis-javascript.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@
44

55
* Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
66
- client-side code, for example [React](https://reactjs.org/)
7+
- cookies and webstorage, for example [js-cookie](https://github.com/js-cookie/js-cookie)
78
- server-side code, for example [hapi](https://hapijs.com/)
9+
* File classification has been improved to recognize additional generated files, for example files from [HTML Tidy](html-tidy.org).
10+
11+
* The taint tracking library now recognizes flow through persistent storage, this may give more results for the security queries.
812

913
## New queries
1014

@@ -20,6 +24,8 @@
2024
| **Query** | **Expected impact** | **Change** |
2125
|--------------------------------------------|------------------------------|------------------------------------------------------------------------------|
2226
| Client-side cross-site scripting | More results | This rule now recognizes WinJS functions that are vulnerable to HTML injection. |
23-
| Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements. |
27+
| Insecure randomness | More results | This rule now flags insecure uses of `crypto.pseudoRandomBytes`. |
28+
| Unused parameter | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
29+
| Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |
2430

2531
## Changes to QL libraries

‎cpp/ql/src/Metrics/queries.xml‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎cpp/ql/src/semmle/code/cpp/commons/Environment.qll‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,5 @@ private predicate readsEnvironment(Expr read, string sourceDescription) {
3434
read = call and
3535
call.getTarget().hasGlobalName(name) and
3636
(name = "getenv" or name = "secure_getenv" or name = "_wgetenv") and
37-
sourceDescription = name) or
38-
exists(MessageExpr getObjectKey, MessageExpr getEnviron |
39-
read = getObjectKey and
40-
getObjectKey.getTarget().getQualifiedName().matches("NSDictionary%::-objectForKey:") and
41-
getObjectKey.getQualifier() = getEnviron and
42-
getEnviron.getTarget().getQualifiedName().matches("NSProcessInfo%:-environment") and
43-
sourceDescription = "NSProcessInfo")
37+
sourceDescription = name)
4438
}

‎cpp/ql/src/semmle/code/cpp/security/CommandExecution.qll‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -159,17 +159,6 @@ predicate shellCommandPreface(string cmd, string flag) {
159159
)
160160
}
161161

162-
/**
163-
* An array element. This supports multiple kinds of array syntax.
164-
*/
165-
private predicate arrayElement(Expr arrayLit, int idx, Expr element) {
166-
exists (ArrayLiteral lit | lit = arrayLit |
167-
lit.getElement(idx) = element)
168-
or exists (MessageExpr arrayWithObjects | arrayWithObjects = arrayLit |
169-
arrayWithObjects.getStaticTarget().getQualifiedName().matches("NSArray%::+arrayWithObjects:") and
170-
arrayWithObjects.getArgument(idx) = element)
171-
}
172-
173162
/**
174163
* A command that is used as a command, or component of a command,
175164
* that will be executed by a general-purpose command interpreter
@@ -203,18 +192,5 @@ predicate shellCommand(Expr command, string callChain) {
203192
and arrayInitializer.getChild(idx) = command
204193
and shellCommandPreface(commandInterpreter.getValue(), flag.getValue())
205194
and idx > 1)
206-
207-
// Creation of NSTask
208-
or exists(
209-
MessageExpr launchedTaskCall, TextLiteral commandInterpreter,
210-
Expr arrayLiteral, TextLiteral flag
211-
|
212-
launchedTaskCall.getStaticTarget().getQualifiedName().matches("NSTask%::+launchedTaskWithLaunchPath:arguments:")
213-
and commandInterpreter = launchedTaskCall.getArgument(0)
214-
and arrayLiteral = launchedTaskCall.getArgument(1)
215-
and arrayElement(arrayLiteral, 0, flag)
216-
and arrayElement(arrayLiteral, 1, command)
217-
and shellCommandPreface(commandInterpreter.getValue(), flag.getValue())
218-
and callChain = "NSTask")
219195
}
220196

‎cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -35,25 +35,3 @@ class SensitiveCall extends SensitiveExpr {
3535
)
3636
}
3737
}
38-
39-
class SensitivePropAccess extends SensitiveExpr {
40-
SensitivePropAccess() {
41-
exists (PropertyAccess acc, string name |
42-
acc = this and
43-
name = acc.getProperty().getName().toLowerCase() and
44-
name.matches(suspicious()) and
45-
not name.matches(nonSuspicious()))
46-
}
47-
}
48-
49-
/**
50-
* A read from the value of a text widget.
51-
*/
52-
class SensitiveTextRead extends SensitiveExpr {
53-
SensitiveTextRead() {
54-
exists (PropertyAccess facc |
55-
facc = this and
56-
facc.getReceiver() instanceof SensitiveExpr and
57-
facc.getProperty().getName() = "text")
58-
}
59-
}

‎cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll‎

Lines changed: 0 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -238,21 +238,12 @@ predicate insideFunctionValueMoveTo(Element src, Element dest)
238238
returnArgument(c.getTarget(), sourceArg)
239239
and src = c.getArgument(sourceArg)
240240
and dest = c)
241-
or exists (MessageExpr send |
242-
methodReturningAnyArgument(send.getStaticTarget())
243-
and not send instanceof FormattingFunctionCall
244-
and src = send.getAnArgument()
245-
and dest = send)
246241
or exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format, string argFormat |
247242
dest = formattingSend
248243
and formattingSend.getArgument(arg) = src
249244
and format = formattingSend.getFormat()
250245
and format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) = argFormat
251246
and (argFormat = "s" or argFormat = "S" or argFormat = "@"))
252-
or exists (ExprMessageExpr send |
253-
methodReturningReceiver(send.getStaticTarget())
254-
and src = send.getReceiver()
255-
and dest = send)
256247
// Expressions computed from tainted data are also tainted
257248
or (exists (FunctionCall call | dest = call and isPureFunction(call.getTarget().getName()) |
258249
call.getAnArgument() = src
@@ -457,60 +448,6 @@ private predicate returnArgument(Function f, int sourceArg)
457448
or (f.hasGlobalName("gethostbyaddr") and sourceArg = 0)
458449
}
459450

460-
/** A method where if any argument is tainted, the return value should be, too */
461-
private predicate methodReturningAnyArgument(MemberFunction method) {
462-
method.getQualifiedName().matches("NS%Array%::+array%") or
463-
method.getQualifiedName().matches("NS%Array%::-arrayBy%") or
464-
method.getQualifiedName().matches("NS%Array%::-componentsJoinedByString:") or
465-
method.getQualifiedName().matches("NS%Array%::-init%") or
466-
method.getQualifiedName().matches("NS%Data%::+dataWith%") or
467-
method.getQualifiedName().matches("NS%Data%::-initWith%") or
468-
method.getQualifiedName().matches("NS%String%::+pathWithComponents:") or
469-
method.getQualifiedName().matches("NS%String%::+stringWith%") or
470-
method.getQualifiedName().matches("NS%String%::-initWithCString:") or
471-
method.getQualifiedName().matches("NS%String%::-initWithCString:length:") or
472-
method.getQualifiedName().matches("NS%String%::-initWithCStringNoCopy:length:") or
473-
method.getQualifiedName().matches("NS%String%::-initWithCharacters:length:") or
474-
method.getQualifiedName().matches("NS%String%::-initWithCharactersNoCopy:length:freeWhenDone:") or
475-
method.getQualifiedName().matches("NS%String%::-initWithFormat:") or
476-
method.getQualifiedName().matches("NS%String%::-initWithFormat:arguments:") or
477-
method.getQualifiedName().matches("NS%String%::-initWithString:") or
478-
method.getQualifiedName().matches("NS%String%::-initWithUTF8String:") or
479-
method.getQualifiedName().matches("NS%String%::-stringByAppendingFormat:") or
480-
method.getQualifiedName().matches("NS%String%::-stringByAppendingString:") or
481-
method.getQualifiedName().matches("NS%String%::-stringByPaddingToLength:withString:startingAtIndex:") or
482-
method.getQualifiedName().matches("NS%String%::-stringByReplacing%") or
483-
method.getQualifiedName().matches("NS%String%::-stringsByAppendingPaths:")
484-
}
485-
486-
/** A method where if the receiver is tainted, the return value should be, too */
487-
private predicate methodReturningReceiver(MemberFunction method) {
488-
method.getQualifiedName().matches("NS%Array%::-arrayBy%") or
489-
method.getQualifiedName().matches("NS%Array%::-componentsJoinedByString:") or
490-
method.getQualifiedName().matches("NS%Array%::-firstObject") or
491-
method.getQualifiedName().matches("NS%Array%::-lastObject") or
492-
method.getQualifiedName().matches("NS%Array%::-objectAt%") or
493-
method.getQualifiedName().matches("NS%Array%::-pathsMatchingExtensions:") or
494-
method.getQualifiedName().matches("NS%Array%::-sortedArray%") or
495-
method.getQualifiedName().matches("NS%Array%::-subarrayWithRange:") or
496-
method.getQualifiedName().matches("NS%Data%::-bytes") or
497-
method.getQualifiedName().matches("NS%Data%::-subdataWithRange:") or
498-
method.getQualifiedName().matches("NS%String%::-capitalizedString%") or
499-
method.getQualifiedName().matches("NS%String%::-componentsSeparatedByCharactersInSet:") or
500-
method.getQualifiedName().matches("NS%String%::-componentsSeparatedByString:") or
501-
method.getQualifiedName().matches("NS%String%::-cStringUsingEncoding:") or
502-
method.getQualifiedName().matches("NS%String%::-dataUsingEncoding:%") or
503-
method.getQualifiedName().matches("NS%String%::-lowercaseString%") or
504-
method.getQualifiedName().matches("NS%String%::-pathComponents") or
505-
method.getQualifiedName().matches("NS%String%::-stringBy%") or
506-
method.getQualifiedName().matches("NS%String%::-stringsByAppendingPaths:") or
507-
method.getQualifiedName().matches("NS%String%::-substringFromIndex:") or
508-
method.getQualifiedName().matches("NS%String%::-substringToIndex:") or
509-
method.getQualifiedName().matches("NS%String%::-substringWithRange:") or
510-
method.getQualifiedName().matches("NS%String%::-uppercaseString%") or
511-
method.getQualifiedName().matches("NS%String%::-UTF8String")
512-
}
513-
514451
/**
515452
* Resolve potential target function(s) for `call`.
516453
*

‎cpp/ql/test/library-tests/sideEffects/functions/error.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// semmle-extractor-options: --expect_errors
2+
3+
void functionBeforeError()
4+
{
5+
}
6+
7+
void functionWithError1()
8+
{
9+
aaaaaaaaaa(); // error
10+
}
11+
12+
void functionWithError2()
13+
{
14+
int i = aaaaaaaaaa(); // error
15+
}
16+
17+
void functionAfterError()
18+
{
19+
}

‎cpp/ql/test/library-tests/sideEffects/functions/sideEffects.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@
4343
| cpp.cpp:87:5:87:26 | functionAccessesStatic | int | false |
4444
| cpp.cpp:93:6:93:14 | increment | int & -> void | false |
4545
| cpp.cpp:97:6:97:16 | doIncrement | void | false |
46+
| error.cpp:3:6:3:24 | functionBeforeError | void | true |
47+
| error.cpp:7:6:7:23 | functionWithError1 | void | false |
48+
| error.cpp:12:6:12:23 | functionWithError2 | void | false |
49+
| error.cpp:17:6:17:23 | functionAfterError | void | true |
4650
| file://:0:0:0:0 | operator= | __va_list_tag & | false |
4751
| file://:0:0:0:0 | operator= | __va_list_tag & | false |
4852
| sideEffects.c:4:5:4:6 | f1 | int | true |

‎cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/ExprHasNoEffect.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
| calls.cpp:8:5:8:5 | 1 | This expression has no effect. | calls.cpp:8:5:8:5 | 1 | |
22
| calls.cpp:12:5:12:16 | call to thingy | This expression has no effect (because $@ has no external side effects). | calls.cpp:7:15:7:20 | thingy | thingy |
3+
| expr.cpp:8:2:8:2 | 0 | This expression has no effect. | expr.cpp:8:2:8:2 | 0 | |
4+
| expr.cpp:9:7:9:7 | 0 | This expression has no effect. | expr.cpp:9:7:9:7 | 0 | |
5+
| expr.cpp:10:2:10:5 | ... , ... | This expression has no effect. | expr.cpp:10:2:10:5 | ... , ... | |
36
| preproc.c:89:2:89:4 | call to fn4 | This expression has no effect (because $@ has no external side effects). | preproc.c:33:5:33:7 | fn4 | fn4 |
47
| preproc.c:94:2:94:4 | call to fn9 | This expression has no effect (because $@ has no external side effects). | preproc.c:78:5:78:7 | fn9 | fn9 |
58
| template.cpp:19:3:19:3 | call to operator++ | This expression has no effect (because $@ has no external side effects). | template.cpp:9:10:9:19 | operator++ | operator++ |

0 commit comments

Comments
 (0)