Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7f0209f

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into modelclasses
2 parents 79f32b0 + b794fcb commit 7f0209f

940 files changed

Lines changed: 108541 additions & 60335 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/generate-query-help-docs.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Generate CodeQL query help documentation using Sphinx
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
description:
7+
description: A description of the purpose of this job. For human consumption.
8+
required: false
9+
push:
10+
branches:
11+
- 'lgtm.com'
12+
pull_request:
13+
paths:
14+
- '.github/workflows/generate-query-help-docs.yml'
15+
- 'docs/codeql/query-help/**'
16+
17+
jobs:
18+
build:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Clone github/codeql
22+
uses: actions/checkout@v2
23+
with:
24+
path: codeql
25+
- name: Clone github/codeql-go
26+
uses: actions/checkout@v2
27+
with:
28+
repository: 'github/codeql-go'
29+
path: codeql-go
30+
- name: Set up Python 3.8
31+
uses: actions/setup-python@v2
32+
with:
33+
python-version: 3.8
34+
- name: Download CodeQL CLI
35+
uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
36+
with:
37+
repo: "github/codeql-cli-binaries"
38+
version: "latest"
39+
file: "codeql-linux64.zip"
40+
token: ${{ secrets.GITHUB_TOKEN }}
41+
- name: Unzip CodeQL CLI
42+
run: unzip -d codeql-cli codeql-linux64.zip
43+
- name: Set up query help docs folder
44+
run: |
45+
cp -r codeql/docs/codeql/** .
46+
- name: Query help to markdown
47+
run: |
48+
PATH="$PATH:codeql-cli/codeql" python codeql/docs/codeql/query-help-markdown.py
49+
- name: Run Sphinx for query help
50+
uses: ammaraskar/sphinx-action@8b4f60114d7fd1faeba1a712269168508d4750d2 # v0.4
51+
with:
52+
docs-folder: "query-help/"
53+
pre-build-command: "python -m pip install --upgrade recommonmark"
54+
build-command: "sphinx-build -b dirhtml . _build"
55+
- name: Upload HTML artifacts
56+
uses: actions/upload-artifact@v2
57+
with:
58+
name: query-help-html
59+
path: query-help/_build
60+

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ If you have an idea for a query that you would like to share with other CodeQL u
3838

3939
- The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
4040

41+
If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/install-pre-commit-hook.md) for instructions on how to install the hook.
42+
4143
4. **Compilation**
4244

4345
- Compilation of the query and any associated libraries and tests must be resilient to future development of the [supported](docs/supported-queries.md) libraries. This means that the functionality cannot use internal libraries, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.

‎change-notes/1.26/analysis-python.md‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,34 @@ The following changes in version 1.26 affect Python analysis in all applications
44

55
## General improvements
66

7-
8-
## New queries
9-
10-
| **Query** | **Tags** | **Purpose** |
11-
|-----------------------------|-----------|--------------------------------------------------------------------|
12-
13-
147
## Changes to existing queries
158

169
| **Query** | **Expected impact** | **Change** |
1710
|----------------------------|------------------------|------------------------------------------------------------------|
18-
19-
11+
|`py/unsafe-deserialization` | Different results. | The underlying data flow library has been changed. See below for more details. |
12+
|`py/path-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
13+
|`py/command-line-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
14+
|`py/reflective-xss` | Different results. | The underlying data flow library has been changed. See below for more details. |
15+
|`py/sql-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
16+
|`py/code-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
2017
## Changes to libraries
21-
18+
* Some of the security queries now use the shared data flow library for data flow and taint tracking. This has resulted in an overall more robust and accurate analysis. The libraries mentioned below have been modelled in this new framework. Other libraries (e.g. the web framework `CherryPy`) have not been modelled yet, and this may lead to a temporary loss of results for these frameworks.
19+
* Improved modelling of the following serialization libraries:
20+
- `PyYAML`
21+
- `dill`
22+
- `pickle`
23+
- `marshal`
24+
* Improved modelling of the following web frameworks:
25+
- `Django` (Note that modelling of class-based response handlers is currently incomplete.)
26+
- `Flask`
27+
* Support for Werkzeug `MultiDict`.
28+
* Support for the [Python Database API Specification v2.0 (PEP-249)](https://www.python.org/dev/peps/pep-0249/), including the following libraries:
29+
- `MySQLdb`
30+
- `mysql-connector-python`
31+
- `django.db`
32+
* Improved modelling of the following command execution libraries:
33+
- `Fabric`
34+
- `Invoke`
35+
* Improved modelling of security-related standard library modules, such as `os`, `popen2`, `platform`, and `base64`.
36+
* The original versions of the updated queries have been preserved [here](https://github.com/github/codeql/tree/main/python/ql/src/experimental/Security-old-dataflow).
2237
* Added taint tracking support for string formatting through f-strings.

‎cpp/change-notes/2020-11-05-formatting-function.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* `FormattingFunction.getOutputParameterIndex` now has a parameter identifying whether the output at that index is a buffer or a stream.
3+
* `FormattingFunction` now has a predicate `isOutputGlobal` indicating when the output is to a global stream.
4+
* The `primitiveVariadicFormatter` and `variadicFormatter` predicates have more parameters exposing information about the function.

‎cpp/ql/src/Best Practices/Magic Constants/MagicConstants.qll‎

Lines changed: 37 additions & 168 deletions
Original file line numberDiff line numberDiff line change
@@ -8,168 +8,41 @@ import semmle.code.cpp.AutogeneratedFile
88
predicate trivialPositiveIntValue(string s) {
99
// Small numbers
1010
s = [0 .. 20].toString() or
11-
// Popular powers of two (decimal)
12-
s = "16" or
13-
s = "24" or
14-
s = "32" or
15-
s = "64" or
16-
s = "128" or
17-
s = "256" or
18-
s = "512" or
19-
s = "1024" or
20-
s = "2048" or
21-
s = "4096" or
22-
s = "16384" or
23-
s = "32768" or
24-
s = "65536" or
25-
s = "1048576" or
26-
s = "2147483648" or
27-
s = "4294967296" or
28-
// Popular powers of two, minus one (decimal)
29-
s = "15" or
30-
s = "31" or
31-
s = "63" or
32-
s = "127" or
33-
s = "255" or
34-
s = "511" or
35-
s = "1023" or
36-
s = "2047" or
37-
s = "4095" or
38-
s = "16383" or
39-
s = "32767" or
40-
s = "65535" or
41-
s = "1048577" or
42-
s = "2147483647" or
43-
s = "4294967295" or
44-
// Popular powers of two (32-bit hex)
45-
s = "0x00000001" or
46-
s = "0x00000002" or
47-
s = "0x00000004" or
48-
s = "0x00000008" or
49-
s = "0x00000010" or
50-
s = "0x00000020" or
51-
s = "0x00000040" or
52-
s = "0x00000080" or
53-
s = "0x00000100" or
54-
s = "0x00000200" or
55-
s = "0x00000400" or
56-
s = "0x00000800" or
57-
s = "0x00001000" or
58-
s = "0x00002000" or
59-
s = "0x00004000" or
60-
s = "0x00008000" or
61-
s = "0x00010000" or
62-
s = "0x00020000" or
63-
s = "0x00040000" or
64-
s = "0x00080000" or
65-
s = "0x00100000" or
66-
s = "0x00200000" or
67-
s = "0x00400000" or
68-
s = "0x00800000" or
69-
s = "0x01000000" or
70-
s = "0x02000000" or
71-
s = "0x04000000" or
72-
s = "0x08000000" or
73-
s = "0x10000000" or
74-
s = "0x20000000" or
75-
s = "0x40000000" or
76-
s = "0x80000000" or
77-
// Popular powers of two, minus one (32-bit hex)
78-
s = "0x00000001" or
79-
s = "0x00000003" or
80-
s = "0x00000007" or
81-
s = "0x0000000f" or
82-
s = "0x0000001f" or
83-
s = "0x0000003f" or
84-
s = "0x0000007f" or
85-
s = "0x000000ff" or
86-
s = "0x000001ff" or
87-
s = "0x000003ff" or
88-
s = "0x000007ff" or
89-
s = "0x00000fff" or
90-
s = "0x00001fff" or
91-
s = "0x00003fff" or
92-
s = "0x00007fff" or
93-
s = "0x0000ffff" or
94-
s = "0x0001ffff" or
95-
s = "0x0003ffff" or
96-
s = "0x0007ffff" or
97-
s = "0x000fffff" or
98-
s = "0x001fffff" or
99-
s = "0x003fffff" or
100-
s = "0x007fffff" or
101-
s = "0x00ffffff" or
102-
s = "0x01ffffff" or
103-
s = "0x03ffffff" or
104-
s = "0x07ffffff" or
105-
s = "0x0fffffff" or
106-
s = "0x1fffffff" or
107-
s = "0x3fffffff" or
108-
s = "0x7fffffff" or
109-
s = "0xffffffff" or
110-
// Popular powers of two (16-bit hex)
111-
s = "0x0001" or
112-
s = "0x0002" or
113-
s = "0x0004" or
114-
s = "0x0008" or
115-
s = "0x0010" or
116-
s = "0x0020" or
117-
s = "0x0040" or
118-
s = "0x0080" or
119-
s = "0x0100" or
120-
s = "0x0200" or
121-
s = "0x0400" or
122-
s = "0x0800" or
123-
s = "0x1000" or
124-
s = "0x2000" or
125-
s = "0x4000" or
126-
s = "0x8000" or
127-
// Popular powers of two, minus one (16-bit hex)
128-
s = "0x0001" or
129-
s = "0x0003" or
130-
s = "0x0007" or
131-
s = "0x000f" or
132-
s = "0x001f" or
133-
s = "0x003f" or
134-
s = "0x007f" or
135-
s = "0x00ff" or
136-
s = "0x01ff" or
137-
s = "0x03ff" or
138-
s = "0x07ff" or
139-
s = "0x0fff" or
140-
s = "0x1fff" or
141-
s = "0x3fff" or
142-
s = "0x7fff" or
143-
s = "0xffff" or
144-
// Popular powers of two (8-bit hex)
145-
s = "0x01" or
146-
s = "0x02" or
147-
s = "0x04" or
148-
s = "0x08" or
149-
s = "0x10" or
150-
s = "0x20" or
151-
s = "0x40" or
152-
s = "0x80" or
153-
// Popular powers of two, minus one (8-bit hex)
154-
s = "0x01" or
155-
s = "0x03" or
156-
s = "0x07" or
157-
s = "0x0f" or
158-
s = "0x1f" or
159-
s = "0x3f" or
160-
s = "0x7f" or
161-
s = "0xff" or
162-
s = "0x00" or
163-
// Powers of ten
164-
s = "10" or
165-
s = "100" or
166-
s = "1000" or
167-
s = "10000" or
168-
s = "100000" or
169-
s = "1000000" or
170-
s = "10000000" or
171-
s = "100000000" or
172-
s = "1000000000"
11+
s =
12+
[
13+
// Popular powers of two (decimal)
14+
"16", "24", "32", "64", "128", "256", "512", "1024", "2048", "4096", "16384", "32768",
15+
"65536", "1048576", "2147483648", "4294967296",
16+
// Popular powers of two, minus one (decimal)
17+
"15", "31", "63", "127", "255", "511", "1023", "2047", "4095", "16383", "32767", "65535",
18+
"1048577", "2147483647", "4294967295",
19+
// Popular powers of two (32-bit hex)
20+
"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020",
21+
"0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800",
22+
"0x00001000", "0x00002000", "0x00004000", "0x00008000", "0x00010000", "0x00020000",
23+
"0x00040000", "0x00080000", "0x00100000", "0x00200000", "0x00400000", "0x00800000",
24+
"0x01000000", "0x02000000", "0x04000000", "0x08000000", "0x10000000", "0x20000000",
25+
"0x40000000", "0x80000000",
26+
// Popular powers of two, minus one (32-bit hex)
27+
"0x00000001", "0x00000003", "0x00000007", "0x0000000f", "0x0000001f", "0x0000003f",
28+
"0x0000007f", "0x000000ff", "0x000001ff", "0x000003ff", "0x000007ff", "0x00000fff",
29+
"0x00001fff", "0x00003fff", "0x00007fff", "0x0000ffff", "0x0001ffff", "0x0003ffff",
30+
"0x0007ffff", "0x000fffff", "0x001fffff", "0x003fffff", "0x007fffff", "0x00ffffff",
31+
"0x01ffffff", "0x03ffffff", "0x07ffffff", "0x0fffffff", "0x1fffffff", "0x3fffffff",
32+
"0x7fffffff", "0xffffffff",
33+
// Popular powers of two (16-bit hex)
34+
"0x0001", "0x0002", "0x0004", "0x0008", "0x0010", "0x0020", "0x0040", "0x0080", "0x0100",
35+
"0x0200", "0x0400", "0x0800", "0x1000", "0x2000", "0x4000", "0x8000",
36+
// Popular powers of two, minus one (16-bit hex)
37+
"0x0001", "0x0003", "0x0007", "0x000f", "0x001f", "0x003f", "0x007f", "0x00ff", "0x01ff",
38+
"0x03ff", "0x07ff", "0x0fff", "0x1fff", "0x3fff", "0x7fff", "0xffff",
39+
// Popular powers of two (8-bit hex)
40+
"0x01", "0x02", "0x04", "0x08", "0x10", "0x20", "0x40", "0x80",
41+
// Popular powers of two, minus one (8-bit hex)
42+
"0x01", "0x03", "0x07", "0x0f", "0x1f", "0x3f", "0x7f", "0xff", "0x00",
43+
// Powers of ten
44+
"10", "100", "1000", "10000", "100000", "1000000", "10000000", "100000000", "1000000000"
45+
]
17346
}
17447

17548
predicate trivialIntValue(string s) {
@@ -235,10 +108,7 @@ predicate joiningStringTrivial(Literal lit) {
235108
// understand (which is against the spirit of these queries).
236109
stringLiteral(lit) and
237110
exists(FunctionCall fc |
238-
(
239-
fc.getTarget().getName() = "operator+" or
240-
fc.getTarget().getName() = "operator<<"
241-
) and
111+
fc.getTarget().getName() = ["operator+", "operator<<"] and
242112
fc.getAnArgument().getAChild*() = lit
243113
) and
244114
lit.getValue().length() < 16
@@ -291,8 +161,7 @@ predicate arrayInitializerChild(AggregateLiteral parent, Expr e) {
291161

292162
// i.e. not a constant folded expression
293163
predicate literallyLiteral(Literal lit) {
294-
lit
295-
.getValueText()
164+
lit.getValueText()
296165
.regexpMatch(".*\".*|\\s*+[-+]?+\\s*+(0[xob][0-9a-fA-F]|[0-9])[0-9a-fA-F,._]*+([eE][-+]?+[0-9,._]*+)?+\\s*+[a-zA-Z]*+\\s*+")
297166
}
298167

‎cpp/ql/src/DefaultOptions.qll‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,9 @@ class Options extends string {
5959
predicate exits(Function f) {
6060
f.getAnAttribute().hasName("noreturn")
6161
or
62-
exists(string name | f.hasGlobalOrStdName(name) |
63-
name = "exit" or
64-
name = "_exit" or
65-
name = "abort" or
66-
name = "__assert_fail" or
67-
name = "longjmp" or
68-
name = "__builtin_unreachable"
69-
)
62+
f.hasGlobalOrStdName([
63+
"exit", "_exit", "abort", "__assert_fail", "longjmp", "__builtin_unreachable"
64+
])
7065
or
7166
CustomOptions::exits(f) // old Options.qll
7267
}

‎cpp/ql/src/JPL_C/LOC-2/Rule 05/HeapMemory.ql‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,7 @@ class Initialization extends Function {
2121
}
2222

2323
class Allocation extends FunctionCall {
24-
Allocation() {
25-
exists(string name | name = this.getTarget().getName() |
26-
name = "malloc" or
27-
name = "calloc" or
28-
name = "alloca" or
29-
name = "sbrk" or
30-
name = "valloc"
31-
)
32-
}
24+
Allocation() { this.getTarget().getName() = ["malloc", "calloc", "alloca", "sbrk", "valloc"] }
3325
}
3426

3527
from Function f, Allocation a

‎cpp/ql/src/JPL_C/LOC-2/Rule 07/ThreadSafety.ql‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,8 @@ import cpp
1313

1414
class ForbiddenCall extends FunctionCall {
1515
ForbiddenCall() {
16-
exists(string name | name = this.getTarget().getName() |
17-
name = "task_delay" or
18-
name = "taskDelay" or
19-
name = "sleep" or
20-
name = "nanosleep" or
21-
name = "clock_nanosleep"
22-
)
16+
this.getTarget().getName() =
17+
["task_delay", "taskDelay", "sleep", "nanosleep", "clock_nanosleep"]
2318
}
2419
}
2520

0 commit comments

Comments
 (0)