Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 63c71b7

Browse files
bananabrbananabr
authored
Merge branch 'main' into main
2 parents 64da2ce + fac383a commit 63c71b7

52 files changed

Lines changed: 227 additions & 37 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/src/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation.ql‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,36 @@
1616
import cpp
1717
import semmle.code.cpp.commons.Exclusions
1818

19-
/** Gets the sub-expression of 'e' with the earliest-starting Location */
19+
/**
20+
* Gets a child of `e`, including conversions but excluding call arguments.
21+
*/
22+
pragma[inline]
23+
Expr getAChildWithConversions(Expr e) {
24+
result.getParentWithConversions() = e and
25+
not result = any(Call c).getAnArgument()
26+
}
27+
28+
/**
29+
* Gets the left-most column position of any transitive child of `e` (including
30+
* conversions but excluding call arguments).
31+
*/
32+
int getCandidateColumn(Expr e) {
33+
result = e.getLocation().getStartColumn() or
34+
result = getCandidateColumn(getAChildWithConversions(e))
35+
}
36+
37+
/**
38+
* Gets the transitive child of `e` (including conversions but excluding call
39+
* arguments) at the left-most column position, preferring less deeply nested
40+
* expressions if there is a choice.
41+
*/
2042
Expr normalizeExpr(Expr e) {
21-
result =
22-
min(Expr child |
23-
child.getParentWithConversions*() = e.getFullyConverted() and
24-
not child.getParentWithConversions*() = any(Call c).getAnArgument()
25-
|
26-
child order by child.getLocation().getStartColumn(), count(child.getParentWithConversions*())
27-
)
43+
e.getLocation().getStartColumn() = min(getCandidateColumn(e)) and
44+
result = e
45+
or
46+
not e.getLocation().getStartColumn() = min(getCandidateColumn(e)) and
47+
result = normalizeExpr(getAChildWithConversions(e)) and
48+
result.getLocation().getStartColumn() = min(getCandidateColumn(e))
2849
}
2950

3051
predicate isParenthesized(CommaExpr ce) {
@@ -43,8 +64,8 @@ from CommaExpr ce, Expr left, Expr right, Location leftLoc, Location rightLoc
4364
where
4465
ce.fromSource() and
4566
not isFromMacroDefinition(ce) and
46-
left = normalizeExpr(ce.getLeftOperand()) and
47-
right = normalizeExpr(ce.getRightOperand()) and
67+
left = normalizeExpr(ce.getLeftOperand().getFullyConverted()) and
68+
right = normalizeExpr(ce.getRightOperand().getFullyConverted()) and
4869
leftLoc = left.getLocation() and
4970
rightLoc = right.getLocation() and
5071
not isParenthesized(ce) and

‎docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Running path queries in VS Code
2828
#. Once the query has finished running, you can see the results in the Results view as usual (under ``alerts`` in the dropdown menu). Each query result describes the flow of information between a source and a sink.
2929
#. Expand the result to see the individual steps that the data follows.
3030
#. Click each step to jump to it in the source code and investigate the problem further.
31-
#. To navigate the path from your keyboard, you can bind shortcuts to the **CodeQL: Show Previous Step on Path** and **CodeQL: Show Next Step on Path** commands.
31+
#. To navigate the results from your keyboard, you can bind shortcuts to the **CodeQL: Navigate Up/Down/Left/Right in Result Viewer** commands.
3232

3333
Further reading
3434
-----------------

‎java/documentation/library-coverage/coverage.rst‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,20 @@ Java framework & library support
88

99
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑036` :sub:`Path traversal`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑319` :sub:`Cleartext transmission`
1010
Android,``android.*``,52,479,116,,,3,67,,,
11+
Android extensions,``androidx.*``,5,183,8,,,,,,,
1112
`Apache Commons Collections <https://commons.apache.org/proper/commons-collections/>`_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1600,,,,,,,,
1213
`Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,556,106,91,,,,,,15
1314
`Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,424,,,,,,,,
1415
`Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,,
1516
`Apache HttpComponents <https://hc.apache.org/>`_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,136,28,,,3,,,,25
17+
`Apache Log4j 2 <https://logging.apache.org/log4j/2.0/>`_,``org.apache.logging.log4j``,,8,359,,,,,,,
1618
`Google Guava <https://guava.dev/>`_,``com.google.common.*``,,728,39,,6,,,,,
19+
JBoss Logging,``org.jboss.logging``,,,324,,,,,,,
1720
`JSON-java <https://github.com/stleary/JSON-java>`_,``org.json``,,236,,,,,,,,
1821
Java Standard Library,``java.*``,3,589,130,28,,,7,,,10
1922
Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
23+
Kotlin Standard Library,``kotlin*``,,1835,12,10,,,,,,2
2024
`Spring <https://spring.io/>`_,``org.springframework.*``,29,477,101,,,,19,14,,29
21-
Others,"``androidx.core.app``, ``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.hubspot.jinjava``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``kotlin``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``",65,2326,972,10,,,14,18,,5
25+
Others,"``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.hubspot.jinjava``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``",60,300,269,,,,14,18,,3
2226
Totals,,217,8432,1524,129,6,10,107,33,1,86
2327

‎java/kotlin-extractor/src/main/java/com/semmle/extractor/java/OdasaOutput.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ private TrapFileManager getMembersWriterForDecl(File trap, File trapFileBase, Tr
277277
// Only re-write an existing trap file if we encountered a newer version of the same class.
278278
TrapClassVersion trapVersion = readVersionInfo(trap);
279279
if (!currVersion.isValid()) {
280-
log.warn("Not rewriting trap file for: " + shortName + " " + trapVersion + " " + currVersion + " " + trap);
280+
log.trace("Not rewriting trap file for: " + shortName + " " + trapVersion + " " + currVersion + " " + trap);
281281
} else if (currVersion.newerThan(trapVersion)) {
282282
log.trace("Rewriting trap file for: " + shortName + " " + trapVersion + " " + currVersion + " " + trap);
283283
deleteTrapFileAndDependencies(sym, signature);
@@ -291,7 +291,7 @@ private TrapFileManager getMembersWriterForDecl(File trap, File trapFileBase, Tr
291291
// If the TRAP file already exists then we
292292
// don't need to write it.
293293
if (trap.exists()) {
294-
log.warn("Not rewriting trap file for " + trap.toString() + " as it exists");
294+
log.trace("Not rewriting trap file for " + trap.toString() + " as it exists");
295295
return null;
296296
}
297297
// If the TRAP file was written in the past, and
@@ -301,7 +301,7 @@ private TrapFileManager getMembersWriterForDecl(File trap, File trapFileBase, Tr
301301
File trapFileDir = trap.getParentFile();
302302
File trapOld = new File(trapFileDir, trap.getName().replace(".trap.gz", ".trap-old.gz"));
303303
if (trapOld.exists()) {
304-
log.warn("Not rewriting trap file for " + trap.toString() + " as the trap-old exists");
304+
log.trace("Not rewriting trap file for " + trap.toString() + " as the trap-old exists");
305305
return null;
306306
}
307307
// Otherwise, if any newer TRAP file has already
@@ -316,7 +316,7 @@ private TrapFileManager getMembersWriterForDecl(File trap, File trapFileBase, Tr
316316
if (m.matches() && m.group(1).equals(trapFileBaseName)) {
317317
TrapClassVersion v = new TrapClassVersion(Integer.valueOf(m.group(2)), Integer.valueOf(m.group(3)), Long.valueOf(m.group(4)), m.group(5));
318318
if (v.newerThan(trapFileVersion)) {
319-
log.warn("Not rewriting trap file for " + trap.toString() + " as " + f.toString() + " exists");
319+
log.trace("Not rewriting trap file for " + trap.toString() + " as " + f.toString() + " exists");
320320
return null;
321321
}
322322
}

‎java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,7 @@ open class KotlinUsesExtractor(
12811281
}
12821282
// Look for an exact type match...
12831283
javaClass.declarations.findSubType<IrFunction> { decl ->
1284+
!decl.isFakeOverride &&
12841285
decl.name.asString() == jvmName &&
12851286
decl.valueParameters.size == f.valueParameters.size &&
12861287
decl.valueParameters.zip(f.valueParameters).all { p -> erase(p.first.type).classifierOrNull == erase(p.second.type).classifierOrNull }

‎java/ql/consistency-queries/diags.ql‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
import semmle.code.java.Diagnostics
2+
3+
/*
4+
* This query fails if any unexpected diagnostics are recorded in the
5+
* database. By putting
6+
* // Diagnostic Matches: PAT
7+
* in any source files, you can declare that diagnostics matching PAT
8+
* (in the string.matches(string) sense) are expected.
9+
*/
10+
11+
class DiagnosticException extends Top {
12+
string pattern;
13+
14+
DiagnosticException() {
15+
this.(KtComment).getText() = "// Diagnostic Matches: " + pattern
16+
or
17+
this.(Javadoc).toString() = "// Diagnostic Matches: " + pattern
18+
}
19+
20+
Diagnostic getException() { diagnosticMessage(result).matches(pattern) }
21+
}
22+
23+
string diagnosticMessage(Diagnostic d) {
24+
if d.getFullMessage() != "" then result = d.getFullMessage() else result = d.getMessage()
25+
}
26+
27+
// Check that there aren't any old DiagnosticExceptions left after
28+
// something is fixed.
29+
query predicate unusedDiagnosticException(DiagnosticException de) { not exists(de.getException()) }
30+
31+
query predicate unexpectedDiagnostic(Diagnostic d, string s) {
32+
s = diagnosticMessage(d) and
33+
not d = any(DiagnosticException de).getException()
34+
}

‎java/ql/integration-tests/linux-only/kotlin/custom_plugin/diagnostics.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1 @@
11
| CodeQL Kotlin extractor | 2 | | IrProperty without a getter | d.kt:0:0:0:0 | d.kt:0:0:0:0 |
2-
| CodeQL Kotlin extractor | 2 | | Not rewriting trap file for test-db/trap/java/classes/java/lang/Boolean.members/Boolean.members<VERSION>-<MODIFIED>-kotlin.trap.gz as it exists | file://:0:0:0:0 | file://:0:0:0:0 |
3-
| CodeQL Kotlin extractor | 2 | | Not rewriting trap file for test-db/trap/java/classes/kotlin/Boolean.members/Boolean.members<VERSION>-<MODIFIED>-null.trap.gz as it exists | file://:0:0:0:0 | file://:0:0:0:0 |

‎java/ql/test/kotlin/library-tests/annotation_classes/def.kt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11

22
annotation class SomeAnnotation
33

4+
// Diagnostic Matches: Incomplete annotation: @kotlin.Metadata(%)
5+
// Diagnostic Matches: Unknown location for kotlin.Metadata

‎java/ql/test/kotlin/library-tests/annotations/jvmName/test.kt‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,12 @@ class X {
1515

1616
annotation class Ann(
1717
val p: Int,
18-
@get:JvmName("w") val q: Int)
18+
@get:JvmName("w") val q: Int)
19+
20+
// Diagnostic Matches: Incomplete annotation: @kotlin.Metadata(%)
21+
// Diagnostic Matches: Incomplete annotation: @kotlin.jvm.JvmName(name="changeY")
22+
// Diagnostic Matches: Incomplete annotation: @kotlin.jvm.JvmName(name="getX_prop")
23+
// Diagnostic Matches: Incomplete annotation: @kotlin.jvm.JvmName(name="method")
24+
// Diagnostic Matches: Incomplete annotation: @kotlin.jvm.JvmName(name="y")
25+
// Diagnostic Matches: Unknown location for kotlin.Metadata
26+
// Diagnostic Matches: Unknown location for kotlin.jvm.JvmName

‎java/ql/test/kotlin/library-tests/arrays-with-variances/takesArrayList.kt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,3 +110,8 @@ public class TakesArrayList {
110110
fun inInArrayComparableAny(c: Comparable<Array<in Array<in Any>>>) { }
111111

112112
}
113+
114+
// Diagnostic Matches: Incomplete annotation: @kotlin.Metadata(%)
115+
// Diagnostic Matches: Unknown location for kotlin.Metadata
116+
// Diagnostic Matches: Completion failure for type: org.jetbrains.annotations.NotNull
117+
// Diagnostic Matches: Unknown location for org.jetbrains.annotations.NotNull

0 commit comments

Comments
 (0)