Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 61e23be

Browse files
jbjjbj
authored
Merge branch 'master' into strcpy-fixups
2 parents 2478d44 + 0a4f2e8 commit 61e23be

1,074 files changed

Lines changed: 32821 additions & 32737 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.20/analysis-cpp.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,25 @@
22

33
## General improvements
44

5-
* The logic for identifying auto-generated files via `#line` directives has been improved.
5+
* The logic for identifying auto-generated files via comments and `#line` directives has been improved.
66

77
## New queries
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
1111
| Use of string copy function in a condition (`cpp/string-copy-return-value-as-boolean`) | correctness | This query identifies calls to string copy functions used in conditions, where it's likely that a different function was intended to be called. |
12+
| Lossy function result cast (`cpp/lossy-function-result-cast`) | correctness | Finds function calls whose result type is a floating point type, which are implicitly cast to an integral type. Newly available but not displayed by default on LGTM. |
1213

1314
## Changes to existing queries
1415

1516
| **Query** | **Expected impact** | **Change** |
1617
|----------------------------|------------------------|------------------------------------------------------------------|
18+
| Suspicious add with sizeof (`cpp/suspicious-add-sizeof`) | Fewer false positives | Pointer arithmetic on `char * const` expressions (and other variations of `char *`) are now correctly excluded from the results. |
1719
| Suspicious pointer scaling (`cpp/suspicious-pointer-scaling`) | Fewer false positives | False positives involving types that are not uniquely named in the snapshot have been fixed. |
20+
| Lossy function result cast (`cpp/lossy-function-result-cast`) | Fewer false positive results | The whitelist of rounding functions built into this query has been expanded. |
1821
| Unused static variable (`cpp/unused-static-variable`) | Fewer false positive results | Variables with the attribute `unused` are now excluded from the query. |
19-
| Resource not released in destructor (`cpp/resource-not-released-in-destructor`) | Fewer false positive results | Fix false positives where a resource is released via a virtual method call. |
22+
| Resource not released in destructor (`cpp/resource-not-released-in-destructor`) | Fewer false positive results | Fix false positives where a resource is released via a virtual method call, function pointer, or lambda. |
2023

2124
## Changes to QL libraries
25+
26+
There is a new `Namespace.isInline()` predicate, which holds if the namespace was declared as `inline namespace`.

‎change-notes/1.20/analysis-csharp.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
| Off-by-one comparison against container length (cs/index-out-of-bounds) | Fewer false positives | Results have been removed when there are additional guards on the index. |
1515
| Dereferenced variable is always null (cs/dereferenced-value-is-always-null) | Improved results | The query has been rewritten from scratch, and the analysis is now based on static single assignment (SSA) forms. The query is now enabled by default in LGTM. |
1616
| Dereferenced variable may be null (cs/dereferenced-value-may-be-null) | Improved results | The query has been rewritten from scratch, and the analysis is now based on static single assignment (SSA) forms. The query is now enabled by default in LGTM. |
17+
| SQL query built from user-controlled sources (cs/sql-injection), Improper control of generation of code (cs/code-injection), Uncontrolled format string (cs/uncontrolled-format-string), Clear text storage of sensitive information (cs/cleartext-storage-of-sensitive-information), Exposure of private information (cs/exposure-of-sensitive-information) | More results | Data sources have been added from user controls in `System.Windows.Forms`. |
18+
| Use of default ToString() (cs/call-to-object-tostring) | Fewer false positives | Results have been removed for `char` arrays passed to `StringBuilder.Append()`, which were incorrectly marked as using `ToString`. |
1719

1820
## Changes to code extraction
1921

‎change-notes/1.20/analysis-java.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414

1515
| **Query** | **Expected impact** | **Change** |
1616
|----------------------------|------------------------|------------------------------------------------------------------|
17+
| Double-checked locking is not thread-safe (`java/unsafe-double-checked-locking`) | Fewer false positive results and more true positive results | Results that use safe publication through a `final` field are no longer reported. Results that initialize immutable types like `String` incorrectly are now reported. |
1718
| Result of multiplication cast to wider type (`java/integer-multiplication-cast-to-long`) | Fewer results | Results involving conversions to `float` or `double` are no longer reported, as they were almost exclusively false positives. |
1819

1920
## Changes to QL libraries

‎change-notes/1.20/analysis-javascript.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- server-side code, for example [hapi](https://hapijs.com/)
99
* File classification has been improved to recognize additional generated files, for example files from [HTML Tidy](html-tidy.org).
1010

11-
* The taint tracking library now recognizes flow through persistent storage, this may give more results for the security queries.
11+
* The taint tracking library now recognizes flow through persistent storage, class fields, and callbacks in certain cases. This may give more results for the security queries.
1212

1313
## New queries
1414

@@ -19,6 +19,7 @@
1919
| Incomplete URL substring sanitization | correctness, security, external/cwe/cwe-020 | Highlights URL sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results shown on LGTM by default. |
2020
| Incorrect suffix check (`js/incorrect-suffix-check`) | correctness, security, external/cwe/cwe-020 | Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
2121
| Loop iteration skipped due to shifting (`js/loop-iteration-skipped-due-to-shifting`) | correctness | Highlights code that removes an element from an array while iterating over it, causing the loop to skip over some elements. Results are shown on LGTM by default. |
22+
| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | Additional ways that class methods can be bound are recognized. |
2223
| Useless comparison test (`js/useless-comparison-test`) | correctness | Highlights code that is unreachable due to a numeric comparison that is always true or always false. Results are shown on LGTM by default. |
2324

2425
## Changes to existing queries
@@ -31,9 +32,13 @@
3132
| Unused parameter | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
3233
| Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |
3334
| Uncontrolled data used in path expression | Fewer false-positive results | This rule now recognizes the Express `root` option, which prevents path traversal. |
35+
| Useless assignment to property. | Fewer false-positive results | This rule now treats assignments with complex right-hand sides correctly. |
36+
| Unsafe dynamic method access | Fewer false-positive results | This rule no longer flags concatenated strings as unsafe method names. |
37+
| Unvalidated dynamic method call | More true-positive results | This rule now flags concatenated strings as unvalidated method names in more cases. |
3438

3539
## Changes to QL libraries
3640

3741
* `DataFlow::SourceNode` is no longer an abstract class; to add new source nodes, extend `DataFlow::SourceNode::Range` instead.
3842
* Subclasses of `DataFlow::PropRead` are no longer automatically made source nodes; you now need to additionally define a corresponding subclass of `DataFlow::SourceNode::Range` to achieve this.
3943
* The deprecated libraries `semmle.javascript.DataFlow` and `semmle.javascript.dataflow.CallGraph` have been removed; they are both superseded by `semmle.javascript.dataflow.DataFlow`.
44+
* The predicate `DataFlow::returnedPropWrite` was intended for internal use only and is no longer available.

‎change-notes/1.20/analysis-python.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Improvements to Python analysis
2+
3+
4+
## General improvements
5+
6+
> Changes that affect alerts in many files or from many queries
7+
> For example, changes to file classification
8+
9+
The constants `MULTILINE` and `VERBOSE` in `re` module, are now understood for Python 3.6 and upward.
10+
Removes false positives seen when using Python 3.6, but not when using earlier versions.
11+
12+
## New queries
13+
14+
| **Query** | **Tags** | **Purpose** |
15+
|-----------------------------|-----------|--------------------------------------------------------------------|
16+
| Default version of SSL/TLS may be insecure (`py/insecure-default-protocol`) | security, external/cwe/cwe-327 | Finds instances where an insecure default protocol may be used. Results are shown on LGTM by default. |
17+
| Use of insecure SSL/TLS version (`py/insecure-protocol`) | security, external/cwe/cwe-327 | Finds instances where a known insecure protocol has been specified. Results are shown on LGTM by default. |
18+
19+
## Changes to existing queries
20+
21+
| **Query** | **Expected impact** | **Change** |
22+
|----------------------------|------------------------|------------------------------------------------------------------|
23+
24+
## Changes to code extraction
25+
26+
* *Series of bullet points*
27+
28+
## Changes to QL libraries
29+
30+
* Added support for the `dill` pickle library.

‎change-notes/1.20/extractor-javascript.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,8 @@
1818

1919
## Changes to code extraction
2020

21+
* Extraction of JavaScript files (but not TypeScript files) on LGTM is now parallelized. By default, the extractor uses as many threads as there are processors, but this can be overridden by setting the `LGTM_INDEX_THREADS` environment variable. In particular, setting `LGTM_INDEX_THREADS` to 1 disables parallel extraction.
22+
* The extractor now supports additional [Flow](https://flow.org/) syntax.
2123
* The extractor now supports [Nullish Coalescing](https://github.com/tc39/proposal-nullish-coalescing) expressions.
24+
* The extractor now supports [TypeScript 3.2](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-3-2.html).
2225
* The TypeScript extractor now handles the control-flow of logical operators and destructuring assignments more accurately.

‎cpp/ql/src/Best Practices/Hiding/DeclarationHidesParameter.ql‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,29 +8,38 @@
88
* @tags maintainability
99
* readability
1010
*/
11-
import cpp
1211

12+
import cpp
1313

14-
/* Names of parameters in the implementation of a function.
15-
Notice that we need to exclude parameter names used in prototype
16-
declarations and only include the ones from the actual definition.
17-
We also exclude names from functions that have multiple definitions.
18-
This should not happen in a single application but since we
19-
have a system wide view it is likely to happen for instance for
20-
the main function. */
14+
/**
15+
* Gets the parameter of `f` with name `name`, which has to come from the
16+
* _definition_ of `f` and not a prototype declaration.
17+
* We also exclude names from functions that have multiple definitions.
18+
* This should not happen in a single application but since we
19+
* have a system wide view it is likely to happen for instance for
20+
* the main function.
21+
*/
2122
ParameterDeclarationEntry functionParameterNames(Function f, string name) {
2223
exists(FunctionDeclarationEntry fe |
23-
result.getFunctionDeclarationEntry() = fe
24-
and fe.getFunction() = f
25-
and fe.getLocation() = f.getDefinitionLocation()
26-
and strictcount(f.getDefinitionLocation()) = 1
27-
and result.getName() = name
24+
result.getFunctionDeclarationEntry() = fe and
25+
fe.getFunction() = f and
26+
fe.getLocation() = f.getDefinitionLocation() and
27+
result.getFile() = fe.getFile() and // Work around CPP-331
28+
strictcount(f.getDefinitionLocation()) = 1 and
29+
result.getName() = name
2830
)
2931
}
3032

31-
from Function f, LocalVariable lv, ParameterDeclarationEntry pde
32-
where f = lv.getFunction() and
33-
pde = functionParameterNames(f, lv.getName()) and
34-
not lv.isInMacroExpansion()
35-
select lv, "Local variable '"+ lv.getName() +"' hides a $@.",
36-
pde, "parameter of the same name"
33+
/** Gets a local variable in `f` with name `name`. */
34+
pragma[nomagic]
35+
LocalVariable localVariableNames(Function f, string name) {
36+
name = result.getName() and
37+
f = result.getFunction()
38+
}
39+
40+
from Function f, LocalVariable lv, ParameterDeclarationEntry pde, string name
41+
where
42+
lv = localVariableNames(f, name) and
43+
pde = functionParameterNames(f, name) and
44+
not lv.isInMacroExpansion()
45+
select lv, "Local variable '" + lv.getName() + "' hides a $@.", pde, "parameter of the same name"

‎cpp/ql/src/Critical/DeadCodeCondition.ql‎

Lines changed: 38 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -7,51 +7,64 @@
77
* @tags reliability
88
* external/cwe/cwe-561
99
*/
10+
1011
import cpp
1112

12-
predicate testAndBranch(Expr e, Stmt branch)
13-
{
14-
exists(IfStmt ifstmt | ifstmt.getCondition() = e and
15-
(ifstmt.getThen() = branch or ifstmt.getElse() = branch))
13+
predicate testAndBranch(Expr e, Stmt branch) {
14+
exists(IfStmt ifstmt |
15+
ifstmt.getCondition() = e and
16+
(ifstmt.getThen() = branch or ifstmt.getElse() = branch)
17+
)
1618
or
17-
exists(WhileStmt while | while.getCondition() = e and
18-
while.getStmt() = branch)
19+
exists(WhileStmt while |
20+
while.getCondition() = e and
21+
while.getStmt() = branch
22+
)
1923
}
2024

21-
predicate choice(LocalScopeVariable v, Stmt branch, string value)
22-
{
25+
predicate choice(LocalScopeVariable v, Stmt branch, string value) {
2326
exists(AnalysedExpr e |
2427
testAndBranch(e, branch) and
2528
(
2629
(e.getNullSuccessor(v) = branch and value = "null")
2730
or
2831
(e.getNonNullSuccessor(v) = branch and value = "non-null")
29-
))
32+
)
33+
)
3034
}
3135

32-
33-
predicate guarded(LocalScopeVariable v, Stmt loopstart, AnalysedExpr child)
34-
{
36+
predicate guarded(LocalScopeVariable v, Stmt loopstart, AnalysedExpr child) {
3537
choice(v, loopstart, _) and
3638
loopstart.getChildStmt*() = child.getEnclosingStmt() and
3739
(definition(v, child) or exists(child.getNullSuccessor(v)))
3840
}
3941

40-
predicate addressLeak(Variable v, Stmt leak)
41-
{
42+
predicate addressLeak(Variable v, Stmt leak) {
4243
exists(VariableAccess access |
4344
v.getAnAccess() = access and
4445
access.getEnclosingStmt() = leak and
45-
access.isAddressOfAccess())
46+
access.isAddressOfAccess()
47+
)
4648
}
4749

48-
from LocalScopeVariable v, Stmt branch, AnalysedExpr cond, string context, string test, string testresult
49-
where choice(v, branch, context)
50-
and forall(ControlFlowNode def | definition(v, def) and definitionReaches(def, cond) | not guarded(v, branch, def))
51-
and not cond.isDef(v)
52-
and guarded(v, branch, cond)
53-
and exists(cond.getNullSuccessor(v))
54-
and not addressLeak(v, branch.getChildStmt*())
55-
and ((cond.isNullCheck(v) and test = "null") or (cond.isValidCheck(v) and test = "non-null"))
56-
and (if context = test then testresult = "succeed" else testresult = "fail")
57-
select cond, "Variable '" + v.getName() + "' is always " + context + " here, this check will always " + testresult + "."
50+
from
51+
LocalScopeVariable v, Stmt branch, AnalysedExpr cond, string context, string test,
52+
string testresult
53+
where
54+
choice(v, branch, context) and
55+
forall(ControlFlowNode def | definition(v, def) and definitionReaches(def, cond) |
56+
not guarded(v, branch, def)
57+
) and
58+
not cond.isDef(v) and
59+
guarded(v, branch, cond) and
60+
exists(cond.getNullSuccessor(v)) and
61+
not addressLeak(v, branch.getChildStmt*()) and
62+
(
63+
(cond.isNullCheck(v) and test = "null")
64+
or
65+
(cond.isValidCheck(v) and test = "non-null")
66+
) and
67+
(if context = test then testresult = "succeed" else testresult = "fail")
68+
select cond,
69+
"Variable '" + v.getName() + "' is always " + context + " here, this check will always " +
70+
testresult + "."

‎cpp/ql/src/Critical/LargeParameter.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ where f.getAParameter() = p
1818
and t.getSize() = size
1919
and size > 64
2020
and not t.getUnderlyingType() instanceof ArrayType
21+
and not f instanceof CopyAssignmentOperator
2122
select
2223
p, "This parameter of type $@ is " + size.toString() + " bytes - consider passing a pointer/reference instead.",
2324
t, t.toString()

‎cpp/ql/src/Critical/NotInitialised.ql‎

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,46 @@
77
* @tags reliability
88
* external/cwe/cwe-457
99
*/
10+
1011
import cpp
1112

1213
// See also InitialisationNotRun.ql and GlobalUseBeforeInit.ql
1314

14-
// Holds if s defines variable v (conservative)
15+
/**
16+
* Holds if `s` defines variable `v` (conservative).
17+
*/
1518
predicate defines(ControlFlowNode s, Variable lv) {
1619
exists(VariableAccess va | va = s and va.getTarget() = lv and va.isUsedAsLValue())
1720
}
1821

19-
// Holds if s uses variable v (conservative)
22+
/**
23+
* Holds if `s` uses variable `v` (conservative).
24+
*/
2025
predicate uses(ControlFlowNode s, Variable lv) {
21-
exists(VariableAccess va | va = s and va.getTarget() = lv and va.isRValue()
22-
and not va.getParent+() instanceof SizeofOperator)
26+
exists(VariableAccess va |
27+
va = s and
28+
va.getTarget() = lv and
29+
va.isRValue() and
30+
not va.getParent+() instanceof SizeofOperator
31+
)
2332
}
2433

25-
// Holds if there is a path from the declaration of lv to n such that lv is
26-
// definitely not defined before n
34+
/**
35+
* Holds if there is a path from the declaration of `lv` to `n` such that `lv` is
36+
* definitely not defined before `n`.
37+
*/
2738
predicate noDefPath(LocalVariable lv, ControlFlowNode n) {
28-
n.(DeclStmt).getADeclaration() = lv and not exists(lv.getInitializer())
29-
or exists(ControlFlowNode p | noDefPath(lv, p) and n = p.getASuccessor() and not defines(p, lv))
39+
n.(DeclStmt).getADeclaration() = lv and not exists(lv.getInitializer())
40+
or
41+
exists(ControlFlowNode p | noDefPath(lv, p) and n = p.getASuccessor() and not defines(p, lv))
3042
}
3143

32-
predicate isAggregateType(Type t) {
33-
t instanceof Class or t instanceof ArrayType
34-
}
44+
predicate isAggregateType(Type t) { t instanceof Class or t instanceof ArrayType }
3545

36-
// Holds if va is a use of a local variable that has not been previously
37-
// defined
46+
/**
47+
* Holds if `va` is a use of a local variable that has not been previously
48+
* defined.
49+
*/
3850
predicate undefinedLocalUse(VariableAccess va) {
3951
exists(LocalVariable lv |
4052
// it is hard to tell when a struct or array has been initialized, so we
@@ -43,17 +55,21 @@ predicate undefinedLocalUse(VariableAccess va) {
4355
not lv.getType().hasName("va_list") and
4456
va = lv.getAnAccess() and
4557
noDefPath(lv, va) and
46-
uses(va, lv))
58+
uses(va, lv)
59+
)
4760
}
4861

49-
// Holds if gv is a potentially uninitialized global variable
62+
/**
63+
* Holds if `gv` is a potentially uninitialized global variable.
64+
*/
5065
predicate uninitialisedGlobal(GlobalVariable gv) {
5166
exists(VariableAccess va |
5267
not isAggregateType(gv.getUnderlyingType()) and
5368
va = gv.getAnAccess() and
5469
va.isRValue() and
5570
not gv.hasInitializer() and
56-
not gv.hasSpecifier("extern"))
71+
not gv.hasSpecifier("extern")
72+
)
5773
}
5874

5975
from Element elt

0 commit comments

Comments
 (0)