Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 761e5ef

Browse files
adityasharadadityasharad
committed
Merge master into next.
JavaScript semantic conflicts fixed by referring to the `LegacyLanguage` enum. C++ conflicts fixed by accepting Qltest output.
2 parents 992a015 + 0e9c7fc commit 761e5ef

1,273 files changed

Lines changed: 138506 additions & 2405 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.lgtm.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
path_classifiers:
22
library:
33
- javascript/externs
4+
- javascript/extractor/lib
45

56
test:
67
- csharp/ql/src
78
- csharp/ql/test
9+
- javascript/extractor/parser-tests
10+
- javascript/extractor/tests
811
- javascript/ql/src
912
- javascript/ql/test
1013

‎change-notes/1.19/analysis-cpp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@
2828

2929
* Added a hash consing library for structural comparison of expressions.
3030
* `getBufferSize` now detects variable size structs more reliably.
31+
* Buffer.qll now treats arrays of zero size as a special case.

‎change-notes/1.19/analysis-csharp.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
## General improvements
44

55
* Control flow graph improvements:
6-
* The control flow graph construction now takes simple Boolean conditions on local scope variables into account. For example, in `if (b) x = 0; if (b) x = 1;`, the control flow graph will reflect that taking the `true` (resp. `false`) branch in the first condition implies taking the same branch in the second condition. In effect, the first assignment to `x` will now be identified as being dead.
6+
* The control flow graph construction now takes simple Boolean conditions on local scope variables into account. For example, in `if (b) x = 0; if (b) x = 1;`, the control flow graph will reflect that taking the `true` (resp. `false`) branch in the first condition implies taking the same branch in the second condition. In effect, the first assignment to `x` will now be identified as being dead.
77
* Code that is only reachable from a constant failing assertion, such as `Debug.Assert(false)`, is considered to be unreachable.
88

99
## New queries
@@ -21,3 +21,5 @@
2121

2222

2323
## Changes to QL libraries
24+
25+
* `getArgument()` on `AccessorCall` has been improved so it now takes tuple assignments into account. For example, the argument for the implicit `value` parameter in the setter of property `P` is `0` in `(P, x) = (0, 1)`. Additionally, the argument for the `value` parameter in compound assignments is now only the expanded value, for example, in `P += 7` the argument is `P + 7` and not `7`.

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@
99
* Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
1010
- file system access, for example through [fs-extra](https://github.com/jprichardson/node-fs-extra) or [globby](https://www.npmjs.com/package/globby)
1111
- outbound network access, for example through the [fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API)
12-
- the [Google Cloud Spanner](https://cloud.google.com/spanner), [lodash](https://lodash.com) and [underscore](https://underscorejs.org/) libraries
12+
- the [lodash](https://lodash.com), [underscore](https://underscorejs.org/), [async](https://www.npmjs.com/package/async) and [async-es](https://www.npmjs.com/package/async-es) libraries
1313

14-
* The type inference now handles nested imports (that is, imports not appearing at the toplevel). This may yield fewer false-positive results on projects that use this non-standard language feature.
14+
* Type inference for function calls has been improved. This may give additional results for queries that rely on type inference.
1515

1616
## New queries
1717

@@ -37,9 +37,10 @@
3737
| Server-side URL redirect | More results | This rule now recognizes redirection calls in more cases. |
3838
| Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that may be used by `eval` calls. |
3939
| Unused variable, import, function or class | Fewer results | This rule now flags import statements with multiple unused imports once. |
40-
| User-controlled bypass of security check | Fewer results | This rule no longer flags conditions that guard early returns. The precision of this rule has been revised to "medium". Results are no longer shown on LGTM by default. |
4140
| Whitespace contradicts operator precedence | Fewer false-positive results | This rule no longer flags operators with asymmetric whitespace. |
4241
| Unused import | Fewer false-positive results | This rule no longer flags imports used by the `transform-react-jsx` Babel plugin. |
42+
| Self assignment | Fewer false-positive results | This rule now ignores self-assignments preceded by a JSDoc comment with a `@type` tag. |
43+
| Client side cross-site scripting | More results | This rule now also flags HTML injection in the body of an email. |
4344

4445
## Changes to QL libraries
4546

@@ -48,3 +49,5 @@
4849
* The `DataFlow::ThisNode` class now corresponds to the implicit receiver parameter of a function, as opposed to an indivdual `this` expression. This means `getALocalSource` now maps all `this` expressions within a given function to the same source. The data-flow node associated with a `ThisExpr` can no longer be cast to `DataFlow::SourceNode` or `DataFlow::ThisNode` - it is recomended to use `getALocalSource` before casting or instead of casting.
4950

5051
* `ReactComponent::getAThisAccess` has been renamed to `getAThisNode`. The old name is still usable but is deprecated. It no longer gets individual `this` expressions, but the `ThisNode` mentioned above.
52+
53+
* A `DataFlow::ParameterNode` instance now exists for all function parameters. Previously, unused parameters did not have a corresponding dataflow node.

‎change-notes/1.19/extractor-javascript.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[[ condition: enterprise-only ]]
2+
3+
# Improvements to JavaScript analysis
4+
5+
> NOTES
6+
>
7+
> Please describe your changes in terms that are suitable for
8+
> customers to read. These notes will have only minor tidying up
9+
> before they are published as part of the release notes.
10+
>
11+
> This file is written for lgtm users and should contain *only*
12+
> notes about changes that affect lgtm enterprise users. Add
13+
> any other customer-facing changes to the `studio-java.md`
14+
> file.
15+
>
16+
17+
## General improvements
18+
19+
> Changes that affect alerts in many files or from many queries
20+
> For example, changes to file classification
21+
22+
## Changes to code extraction
23+
24+
* The TypeScript compiler is now bundled with the distribution, and no longer needs to be installed manually.
25+
Should the compiler version need to be overridden, set the `SEMMLE_TYPESCRIPT_HOME` environment variable to
26+
point to an installation of the `typescript` NPM package.

‎cpp/ql/src/Architecture/Refactoring Opportunities/FunctionsWithManyParameters.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@ void fillRect(int x, int y, int w, int h,
44
int r2, int g2, int b2, int a2,
55
gradient_type grad, unsigned int flags, bool border)
66
{
7-
// ...
7+
// ...
88
}

‎cpp/ql/src/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
int find(int start, char *str, char goal)
22
{
33
int len = strlen(str);
4-
//Potential buffer overflow
4+
//Potential buffer overflow
55
for (int i = start; str[i] != 0 && i < len; i++) {
66
if (str[i] == goal)
77
return i;
@@ -12,7 +12,7 @@ int find(int start, char *str, char goal)
1212
int findRangeCheck(int start, char *str, char goal)
1313
{
1414
int len = strlen(str);
15-
//Range check protects against buffer overflow
15+
//Range check protects against buffer overflow
1616
for (int i = start; i < len && str[i] != 0 ; i++) {
1717
if (str[i] == goal)
1818
return i;

‎cpp/ql/src/Best Practices/Magic Constants/MagicConstantsNumbers.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
void sanitize(Fields[] record) {
22
//The number of fields here can be put in a const
3-
for (fieldCtr = 0; field < 7; field++) {
4-
sanitize(fields[fieldCtr]);
5-
}
3+
for (fieldCtr = 0; field < 7; field++) {
4+
sanitize(fields[fieldCtr]);
5+
}
66
}
77

88
#define NUM_FIELDS 7
99

1010
void process(Fields[] record) {
11-
//This avoids using a magic constant by using the macro instead
12-
for (fieldCtr = 0; field < NUM_FIELDS; field++) {
13-
process(fields[fieldCtr]);
14-
}
11+
//This avoids using a magic constant by using the macro instead
12+
for (fieldCtr = 0; field < NUM_FIELDS; field++) {
13+
process(fields[fieldCtr]);
14+
}
1515
}
1616

‎cpp/ql/src/Best Practices/Unused Entities/UnusedStaticFunctions.cpp‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
//start of file
22
static void f() { //static function f() is unused in the file
3-
//...
3+
//...
44
}
55
static void g() {
6-
//...
6+
//...
77
}
88
void public_func() { //non-static function public_func is not called in file,
99
//but could be visible in other files
10-
//...
11-
g(); //call to g()
12-
//...
10+
//...
11+
g(); //call to g()
12+
//...
1313
}
1414
//end of file

‎cpp/ql/src/Critical/LargeParameter.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
typedef struct Names {
2-
char first[100];
3-
char last[100];
2+
char first[100];
3+
char last[100];
44
} Names;
55

66
int doFoo(Names n) { //wrong: n is passed by value (meaning the entire structure
77
//is copied onto the stack, instead of just a pointer)
8-
...
8+
...
99
}
1010

1111
int doBar(Names &n) { //better, only a reference is passed
12-
...
12+
...
1313
}

0 commit comments

Comments
 (0)