Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 76a3db9

Browse files
jbjjbj
committed
Merge remote-tracking branch 'upstream/master' into ir-copy-unloaded-result
2 parents 11da4a5 + 2bcd418 commit 76a3db9

614 files changed

Lines changed: 20010 additions & 7419 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlmanifest.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
{ "provide": [ "*/ql/src/qlpack.yml",
2+
"*/upgrades/qlpack.yml",
23
"misc/legacy-support/*/qlpack.yml",
3-
"misc/suite-helpers/qlpack.yml" ] }
4+
"misc/suite-helpers/qlpack.yml",
5+
"codeql/.codeqlmanifest.json" ] }

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
2222
| Too few arguments to formatting function (`cpp/wrong-number-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
2323
| Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
2424
| Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
25+
| Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
2526

2627
## Changes to QL libraries
2728

@@ -38,6 +39,10 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3839
definition of `x` when `x` is a variable of pointer type. It no longer
3940
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
4041
changes are in line with the user expectations we've observed.
42+
* The data-flow library now makes it easier to specify barriers/sanitizers
43+
arising from guards by overriding the predicate
44+
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
45+
configurations respectively.
4146
* There is now a `DataFlow::localExprFlow` predicate and a
4247
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4348
common case of local data flow and taint: from one `Expr` to another.

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
1112
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
1213
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
1314

@@ -43,5 +44,6 @@ The following changes in version 1.23 affect C# analysis in all applications.
4344
* There is now a `DataFlow::localExprFlow` predicate and a
4445
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4546
common case of local data flow and taint: from one `Expr` to another.
47+
* Data is now tracked through null-coalescing expressions (`??`).
4648

4749
## Changes to autobuilder

‎change-notes/1.23/analysis-java.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
The following changes in version 1.23 affect Java analysis in all applications.
44

5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
| Continue statement that does not continue (`java/continue-in-false-loop`) | correctness | Finds `continue` statements in `do { ... } while (false)` loops. |
10+
511
## Changes to existing queries
612

713
| **Query** | **Expected impact** | **Change** |

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## General improvements
44

5-
* Suppor for `globalThis` has been added.
5+
* Support for `globalThis` has been added.
66

77
* Support for the following frameworks and libraries has been improved:
88
- [firebase](https://www.npmjs.com/package/firebase)
@@ -12,22 +12,28 @@
1212

1313
* The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
1414

15+
* TypeScript 3.6 and 3.7 features are now supported.
16+
17+
* Automatic classification of generated files has been improved, in particular files generated by Doxygen are now recognized.
18+
1519
## New queries
1620

1721
| **Query** | **Tags** | **Purpose** |
1822
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
1923
| Unused index variable (`js/unused-index-variable`) | correctness | Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default. |
20-
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are not shown on LGTM by default. |
24+
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are shown on LGTM by default. |
2125
| Suspicious method name (`js/suspicious-method-name-declaration`) | correctness, typescript, methods | Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default. |
2226
| Shell command built from environment values (`js/shell-command-injection-from-environment`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-088 | Highlights shell commands that may change behavior inadvertently depending on the execution environment, indicating a possible violation of [CWE-78](https://cwe.mitre.org/data/definitions/78.html). Results are shown on LGTM by default.|
2327
| Use of returnless function (`js/use-of-returnless-function`) | maintainability, correctness | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
2428
| Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
2529
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
30+
| Ignoring result from pure array method (`js/ignore-array-result`) | maintainability, correctness | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
2631

2732
## Changes to existing queries
2833

2934
| **Query** | **Expected impact** | **Change** |
3035
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
36+
| Double escaping or unescaping (`js/double-escaping`) | More results | This rule now detects additional escaping and unescaping functions. |
3137
| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false-positive results | This rule now recognizes additional ways delimiters can be stripped away. |
3238
| Client-side cross-site scripting (`js/xss`) | More results, fewer false-positive results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected. |
3339
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized. |
@@ -40,6 +46,8 @@
4046
| Reflected cross-site scripting (`js/reflected-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
4147
| Stored cross-site scripting (`js/stored-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
4248
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now treats responses from servers as untrusted. |
49+
| Uncontrolled data used in path expression (`js/path-injection`) | Fewer false-positive results | This query now recognizes calls to Express `sendFile` as safe in some cases. |
50+
| Unknown directive (`js/unknown-directive`) | Fewer false positive results | This query no longer flags uses of ":", which is sometimes used like a directive. |
4351

4452
## Changes to QL libraries
4553

‎change-notes/1.23/analysis-python.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,9 @@
1919
| **Query** | **Expected impact** | **Change** |
2020
|----------------------------|------------------------|------------|
2121
| Unreachable code | Fewer false positives | Analysis now accounts for uses of `contextlib.suppress` to suppress exceptions. |
22+
| `__iter__` method returns a non-iterator | Better alert message | Alert now highlights which class is expected to be an iterator. |
2223

24+
25+
## Changes to QL libraries
26+
27+
* Django library now recognizes positional arguments from a `django.conf.urls.url` regex (Django version 1.x)

‎change-notes/1.23/extractor-javascript.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,17 @@
55
## Changes to code extraction
66

77
* Asynchronous generator methods are now parsed correctly and no longer cause a spurious syntax error.
8+
* Files in `node_modules` and `bower_components` folders are no longer extracted by default. If you still want to extract files from these folders, you can add the following filters to your `lgtm.yml` file (or add them to existing filters):
9+
10+
```yaml
11+
extraction:
12+
javascript:
13+
index:
14+
filters:
15+
- include: "**/node_modules"
16+
- include: "**/bower_components"
17+
```
18+
819
* Recognition of CommonJS modules has improved. As a result, some files that were previously extracted as
920
global scripts are now extracted as modules.
1021
* Top-level `await` is now supported.

‎config/identical-files.json‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@
7676
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
7777
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
7878
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Operand.qll",
79-
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Operand.qll"
79+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Operand.qll"
80+
],
81+
"IR IRType": [
82+
"cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll",
83+
"csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll"
8084
],
8185
"IR Operand Tag": [
8286
"cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
@@ -169,22 +173,39 @@
169173
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
170174
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
171175
],
176+
"C++ SSA SSAConstructionImports": [
177+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
178+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
179+
],
172180
"C++ SSA AliasAnalysis": [
173181
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
174182
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll"
175183
],
176-
"C++ SSA SSAConstruction": [
184+
"C++ IR ValueNumberingImports": [
185+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
186+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
187+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
188+
],
189+
"IR SSA SimpleSSA": [
190+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
191+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll"
192+
],
193+
"IR SSA SSAConstruction": [
177194
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
178-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
195+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
196+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll"
179197
],
180-
"C++ SSA PrintSSA": [
198+
"IR SSA PrintSSA": [
181199
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
182-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll"
200+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
201+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
183202
],
184-
"C++ IR ValueNumber": [
203+
"IR ValueNumber": [
185204
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
186205
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
187-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
206+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
207+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/ValueNumbering.qll",
208+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
188209
],
189210
"C++ IR ConstantAnalysis": [
190211
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
@@ -235,5 +256,9 @@
235256
"C# IR PrintIRImports": [
236257
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/PrintIRImports.qll",
237258
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll"
259+
],
260+
"C# IR ValueNumberingImports": [
261+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
262+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll"
238263
]
239264
}

‎cpp/ql/src/Best Practices/Unused Entities/UnusedStaticVariables.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ from Variable v
2121
where
2222
v.isStatic() and
2323
v.hasDefinition() and
24+
not v.isConstexpr() and
2425
not exists(VariableAccess a | a.getTarget() = v) and
2526
not v instanceof MemberVariable and
2627
not declarationHasSideEffects(v) and

‎cpp/ql/src/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.qhelp‎

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,39 @@
22
"-//Semmle//qhelp//EN"
33
"qhelp.dtd">
44
<qhelp>
5-
<overview>
6-
<p>
7-
Checking for overflow of integer addition needs to be done with
8-
care, because automatic type promotion can prevent the check
9-
from working correctly.
10-
</p>
11-
</overview>
12-
<recommendation>
13-
<p>
14-
Use an explicit cast to make sure that the result of the addition is
15-
not implicitly converted to a larger type.
16-
</p>
17-
</recommendation>
18-
<example>
19-
<sample src="BadAdditionOverflowCheckExample1.cpp" />
20-
<p>
21-
On a typical architecture where <tt>short</tt> is 16 bits
22-
and <tt>int</tt> is 32 bits, the operands of the addition are
23-
automatically promoted to <tt>int</tt>, so it cannot overflow
24-
and the result of the comparison is always false.
25-
</p>
26-
<p>
27-
The code below implements the check correctly, by using an
28-
explicit cast to make sure that the result of the addition
29-
is <tt>unsigned short</tt>.
30-
</p>
31-
<sample src="BadAdditionOverflowCheckExample2.cpp" />
32-
</example>
33-
<references>
34-
<li><a href="http://c-faq.com/expr/preservingrules.html">Preserving Rules</a></li>
35-
<li><a href="https://www.securecoding.cert.org/confluence/plugins/servlet/mobile#content/view/20086942">Understand integer conversion rules</a></li>
36-
</references>
5+
6+
<overview>
7+
<p>
8+
Checking for overflow of integer addition needs to be done with
9+
care, because automatic type promotion can prevent the check
10+
from working as intended, with the same value (<code>true</code>
11+
or <code>false</code>) always being returned.
12+
</p>
13+
</overview>
14+
<recommendation>
15+
<p>
16+
Use an explicit cast to make sure that the result of the addition is
17+
not implicitly converted to a larger type.
18+
</p>
19+
</recommendation>
20+
<example>
21+
<sample src="BadAdditionOverflowCheckExample1.cpp" />
22+
<p>
23+
On a typical architecture where <code>short</code> is 16 bits
24+
and <code>int</code> is 32 bits, the operands of the addition are
25+
automatically promoted to <code>int</code>, so it cannot overflow
26+
and the result of the comparison is always false.
27+
</p>
28+
<p>
29+
The code below implements the check correctly, by using an
30+
explicit cast to make sure that the result of the addition
31+
is <code>unsigned short</code> (which may overflow, in which case
32+
the comparison would evaluate to <code>true</code>).
33+
</p>
34+
<sample src="BadAdditionOverflowCheckExample2.cpp" />
35+
</example>
36+
<references>
37+
<li><a href="http://c-faq.com/expr/preservingrules.html">Preserving Rules</a></li>
38+
<li><a href="https://www.securecoding.cert.org/confluence/plugins/servlet/mobile#content/view/20086942">Understand integer conversion rules</a></li>
39+
</references>
3740
</qhelp>

0 commit comments

Comments
 (0)