Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7e8a67a

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/hasGlobalOrStdName
2 parents 7fa367d + 717490b commit 7e8a67a

1,110 files changed

Lines changed: 55098 additions & 17666 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlmanifest.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{ "provide": [ "*/ql/src/qlpack.yml",
2+
"*/upgrades/qlpack.yml",
3+
"misc/legacy-support/*/qlpack.yml",
4+
"misc/suite-helpers/qlpack.yml",
5+
"codeql/.codeqlmanifest.json" ] }

‎.github/ISSUE_TEMPLATE/ql---general.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
name: General issue
3+
about: Tell us if you think something is wrong or if you have a question
4+
title: General issue
5+
labels: question
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the issue**
11+
12+
<!-- Please explain briefly what is the problem.
13+
If it is about an LGTM project, please include its URL.-->
14+

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,6 @@
1212
# Visual studio temporaries, except a file used by QL4VS
1313
.vs/*
1414
!.vs/VSWorkspaceSettings.json
15+
16+
# It's useful (though not required) to be able to unpack codeql in the ql checkout itself
17+
/codeql/

‎CODEOWNERS‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
/java/ @Semmle/java
33
/javascript/ @Semmle/js
44
/cpp/ @Semmle/cpp-analysis
5-
/cpp/**/*.qhelp @semmledocs-ac
5+
/cpp/**/*.qhelp @hubwriter
66
/csharp/**/*.qhelp @jf205
7-
/java/**/*.qhelp @felicity-semmle
8-
/javascript/**/*.qhelp @mc-semmle
9-
/python/**/*.qhelp @felicity-semmle
10-
/docs/language/ @felicity-semmle @jf205
7+
/java/**/*.qhelp @felicitymay
8+
/javascript/**/*.qhelp @mchammer01
9+
/python/**/*.qhelp @felicitymay
10+
/docs/language/ @shati-patel @jf205

‎change-notes/1.22/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
| Shift out of range (`js/shift-out-of-range`| Fewer false positive results | This rule now correctly handles BigInt shift operands. |
3737
| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer false-positive results. | This rule no longer flags calls to placeholder functions that trivially throw an exception. |
3838
| Undocumented parameter (`js/jsdoc/missing-parameter`) | No changes to results | This rule is now run on LGTM, although its results are still not shown by default. |
39+
| Missing space in string concatenation (`js/missing-space-in-concatenation`) | Fewer false positive results | The rule now requires a word-like part exists in the string concatenation. |
3940

4041
## Changes to QL libraries
4142

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,11 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
1818
| Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
1919
| Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
2020
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | More correct results | This query now checks for the beginning date of the Reiwa era (1st May 2019). |
21+
| Sign check of bitwise operation (`cpp/bitwise-sign-check`) | Fewer false positive results | Results involving `>=` or `<=` are no longer reported. |
2122
| Too few arguments to formatting function (`cpp/wrong-number-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
2223
| Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
24+
| Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
25+
| Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
2326

2427
## Changes to QL libraries
2528

@@ -30,11 +33,16 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3033
picture of the partial flow paths from a given source. The feature is
3134
disabled by default and can be enabled for individual configurations by
3235
overriding `int explorationLimit()`.
36+
* The data-flow library now supports flow out of C++ reference parameters.
3337
* The data-flow library now allows flow through the address-of operator (`&`).
3438
* The `DataFlow::DefinitionByReferenceNode` class now considers `f(x)` to be a
3539
definition of `x` when `x` is a variable of pointer type. It no longer
3640
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
3741
changes are in line with the user expectations we've observed.
42+
* The data-flow library now makes it easier to specify barriers/sanitizers
43+
arising from guards by overriding the predicate
44+
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
45+
configurations respectively.
3846
* There is now a `DataFlow::localExprFlow` predicate and a
3947
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4048
common case of local data flow and taint: from one `Expr` to another.
@@ -44,3 +52,12 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
4452
predicates should be updated to use the corresponding new member predicate.
4553
* The predicates `Declaration.hasStdName()` and `Declaration.hasGlobalOrStdName`
4654
have been added, simplifying handling of C++ standard library functions.
55+
* The control-flow graph is now computed in QL, not in the extractor. This can
56+
lead to regressions (or improvements) in how queries are optimized because
57+
optimization in QL relies on static size estimates, and the control-flow edge
58+
relations will now have different size estimates than before.
59+
* Support has been added for non-type template arguments. This means that the
60+
return type of `Declaration::getTemplateArgument()` and
61+
`Declaration::getATemplateArgument` have changed to `Locatable`. See the
62+
documentation for `Declaration::getTemplateArgument()` and
63+
`Declaration::getTemplateArgumentKind()` for details.

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
1112
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
1213
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
1314

@@ -16,6 +17,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
1617
| **Query** | **Expected impact** | **Change** |
1718
|------------------------------|------------------------|-----------------------------------|
1819
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | Fewer false positive results | More `null` checks are now taken into account, including `null` checks for `dynamic` expressions and `null` checks such as `object alwaysNull = null; if (x != alwaysNull) ...`. |
20+
| Missing Dispose call on local IDisposable (`cs/local-not-disposed`) | Fewer false positive results | The query has been rewritten in order to identify more dispose patterns. For example, a local `IDisposable` that is disposed of by passing through a fluent API is no longer reported. |
1921

2022
## Removal of old queries
2123

@@ -38,5 +40,10 @@ The following changes in version 1.23 affect C# analysis in all applications.
3840
disabled by default and can be enabled for individual configurations by
3941
overriding `int explorationLimit()`.
4042
* `foreach` statements where the body is guaranteed to be executed at least once, such as `foreach (var x in new string[]{ "a", "b", "c" }) { ... }`, are now recognized by all analyses based on the control flow graph (such as SSA, data flow and taint tracking).
43+
* Fixed the control flow graph for `switch` statements where the `default` case was not the last case. This had caused the remaining cases to be unreachable. `SwitchStmt.getCase(int i)` now puts the `default` case last.
44+
* There is now a `DataFlow::localExprFlow` predicate and a
45+
`TaintTracking::localExprTaint` predicate to make it easy to use the most
46+
common case of local data flow and taint: from one `Expr` to another.
47+
* Data is now tracked through null-coalescing expressions (`??`).
4148

4249
## Changes to autobuilder

‎change-notes/1.23/analysis-java.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,22 @@
22

33
The following changes in version 1.23 affect Java analysis in all applications.
44

5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
| Continue statement that does not continue (`java/continue-in-false-loop`) | correctness | Finds `continue` statements in `do { ... } while (false)` loops. |
10+
511
## Changes to existing queries
612

713
| **Query** | **Expected impact** | **Change** |
814
|------------------------------|------------------------|-----------------------------------|
915
| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positives | Certain indirect null guards involving two auxiliary variables known to be equal can now be detected. |
16+
| Non-synchronized override of synchronized method (`java/non-sync-override`) | Fewer false positives | Results are now only reported if the immediately overridden method is synchronized. |
1017
| Query built from user-controlled sources (`java/sql-injection`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
1118
| Query built from local-user-controlled sources (`java/sql-injection-local`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
1219
| Query built without neutralizing special characters (`java/concatenated-sql-query`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
20+
| Useless comparison test (`java/constant-comparison`) | Fewer false positives | Additional overflow check patterns are now recognized and no longer reported. |
1321

1422
## Changes to QL libraries
1523

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## General improvements
44

5+
* Support for `globalThis` has been added.
6+
57
* Support for the following frameworks and libraries has been improved:
68
- [firebase](https://www.npmjs.com/package/firebase)
79
- [mongodb](https://www.npmjs.com/package/mongodb)
@@ -10,17 +12,28 @@
1012

1113
* The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
1214

15+
* TypeScript 3.6 and 3.7 features are now supported.
16+
17+
* Automatic classification of generated files has been improved, in particular files generated by Doxygen are now recognized.
18+
1319
## New queries
1420

1521
| **Query** | **Tags** | **Purpose** |
1622
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
1723
| Unused index variable (`js/unused-index-variable`) | correctness | Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default. |
18-
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are not shown on LGTM by default. |
24+
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are shown on LGTM by default. |
25+
| Suspicious method name (`js/suspicious-method-name-declaration`) | correctness, typescript, methods | Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default. |
26+
| Shell command built from environment values (`js/shell-command-injection-from-environment`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-088 | Highlights shell commands that may change behavior inadvertently depending on the execution environment, indicating a possible violation of [CWE-78](https://cwe.mitre.org/data/definitions/78.html). Results are shown on LGTM by default.|
27+
| Use of returnless function (`js/use-of-returnless-function`) | maintainability, correctness | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
28+
| Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
29+
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
30+
| Ignoring result from pure array method (`js/ignore-array-result`) | maintainability, correctness | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
1931

2032
## Changes to existing queries
2133

2234
| **Query** | **Expected impact** | **Change** |
2335
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
36+
| Double escaping or unescaping (`js/double-escaping`) | More results | This rule now detects additional escaping and unescaping functions. |
2437
| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false-positive results | This rule now recognizes additional ways delimiters can be stripped away. |
2538
| Client-side cross-site scripting (`js/xss`) | More results, fewer false-positive results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected. |
2639
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized. |
@@ -33,7 +46,27 @@
3346
| Reflected cross-site scripting (`js/reflected-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
3447
| Stored cross-site scripting (`js/stored-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
3548
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now treats responses from servers as untrusted. |
49+
| Uncontrolled data used in path expression (`js/path-injection`) | Fewer false-positive results | This query now recognizes calls to Express `sendFile` as safe in some cases. |
50+
| Unknown directive (`js/unknown-directive`) | Fewer false positive results | This query no longer flags uses of ":", which is sometimes used like a directive. |
3651

3752
## Changes to QL libraries
3853

3954
* `Expr.getDocumentation()` now handles chain assignments.
55+
56+
## Removal of deprecated queries
57+
58+
The following queries (deprecated since 1.17) are no longer available in the distribution:
59+
60+
* Builtin redefined (js/builtin-redefinition)
61+
* Inefficient method definition (js/method-definition-in-constructor)
62+
* Bad parity check (js/incomplete-parity-check)
63+
* Potentially misspelled property or variable name (js/wrong-capitalization)
64+
* Unknown JSDoc tag (js/jsdoc/unknown-tag-type)
65+
* Invalid JSLint directive (js/jslint/invalid-directive)
66+
* Malformed JSLint directive (js/jslint/malformed-directive)
67+
* Use of HTML comments (js/html-comment)
68+
* Multi-line string literal (js/multi-line-string)
69+
* Octal literal (js/octal-literal)
70+
* Reserved word used as variable name (js/use-of-reserved-word)
71+
* Trailing comma in array or object expressions (js/trailing-comma-in-array-or-object)
72+
* Call to parseInt without radix (js/parseint-without-radix)

‎change-notes/1.23/analysis-python.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,17 @@
1111
|-----------|----------|-------------|
1212
| Clear-text logging of sensitive information (`py/clear-text-logging-sensitive-data`) | security, external/cwe/cwe-312 | Finds instances where sensitive information is logged without encryption or hashing. Results are shown on LGTM by default. |
1313
| Clear-text storage of sensitive information (`py/clear-text-storage-sensitive-data`) | security, external/cwe/cwe-312 | Finds instances where sensitive information is stored without encryption or hashing. Results are shown on LGTM by default. |
14+
| Binding a socket to all network interfaces (`py/bind-socket-all-network-interfaces`) | security | Finds instances where a socket is bound to all network interfaces. Results are shown on LGTM by default. |
1415

16+
17+
## Changes to existing queries
18+
19+
| **Query** | **Expected impact** | **Change** |
20+
|----------------------------|------------------------|------------|
21+
| Unreachable code | Fewer false positives | Analysis now accounts for uses of `contextlib.suppress` to suppress exceptions. |
22+
| `__iter__` method returns a non-iterator | Better alert message | Alert now highlights which class is expected to be an iterator. |
23+
24+
25+
## Changes to QL libraries
26+
27+
* Django library now recognizes positional arguments from a `django.conf.urls.url` regex (Django version 1.x)

0 commit comments

Comments
 (0)