Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7f5330d

Browse files
MathiasVPMathiasVP
committed
Merge branch 'master' into ir-flow-fields
2 parents d65c52d + 6e88b6d commit 7f5330d

131 files changed

Lines changed: 4296 additions & 1629 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols, or disabling minimum-recommended protocols.
44
* @kind problem
55
* @problem.severity error
6-
* @id cpp/boost/tls_settings_misconfiguration
6+
* @id cpp/boost/tls-settings-misconfiguration
77
* @tags security
88
*/
99

‎cpp/ql/src/Likely Bugs/ReturnConstTypeMember.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@ struct S {
88

99
// Whereas here it does make a semantic difference.
1010
auto getValCorrect() const -> int {
11-
return val
11+
return val;
1212
}
1313
};

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,22 @@ private predicate instructionTaintStep(Instruction i1, Instruction i2) {
201201
or
202202
i2.(UnaryInstruction).getUnary() = i1
203203
or
204-
i2.(ChiInstruction).getPartial() = i1 and
204+
// Flow out of definition-by-reference
205+
i2.(ChiInstruction).getPartial() = i1.(WriteSideEffectInstruction) and
205206
not i2.isResultConflated()
206207
or
208+
// Flow from an element to an array or union that contains it.
209+
i2.(ChiInstruction).getPartial() = i1 and
210+
not i2.isResultConflated() and
211+
exists(Type t | i2.getResultLanguageType().hasType(t, false) |
212+
t instanceof Union
213+
or
214+
t instanceof ArrayType
215+
or
216+
// Buffers or unknown size
217+
t instanceof UnknownType
218+
)
219+
or
207220
exists(BinaryInstruction bin |
208221
bin = i2 and
209222
predictableInstruction(i2.getAnOperand().getDef()) and

docs/language/learn-ql/beginner/fire-1.rst renamed to docs/language/learn-ql/beginner/catch-the-fire-starter.rst

Lines changed: 50 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1-
Catch the fire starter: Classes and predicates
2-
==============================================
1+
Catch the fire starter
2+
======================
3+
4+
Learn about QL predicates and classes to solve your second mystery as a QL detective.
35

46
Just as you've successfully found the thief and returned the golden crown to the castle, another terrible crime is committed. Early in the morning, a few people start a fire in a field in the north of the village and destroy all the crops!
57

@@ -101,6 +103,50 @@ Now try applying ``isAllowedIn(string region)`` to a person ``p``. If ``p`` is n
101103

102104
You know that the fire starters live in the south *and* that they must have been able to travel to the north. Write a query to find the possible suspects. You could also extend the ``select`` clause to list the age of the suspects. That way you can clearly see that all the children have been excluded from the list.
103105

104-
➤ `See the answer in the query console <https://lgtm.com/query/2551838470440192723/>`__
106+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/2551838470440192723/>`__
107+
108+
You can now continue to gather more clues and find out which of your suspects started the fire...
109+
110+
Identify the bald bandits
111+
-------------------------
112+
113+
You ask the northerners if they have any more information about the fire starters. Luckily, you have a witness! The farmer living next to the field saw two people run away just after the fire started. He only saw the tops of their heads, and noticed that they were both bald.
114+
115+
This is a very helpful clue. Remember that you wrote a QL query to select all bald people:
116+
117+
.. code-block:: ql
118+
119+
from Person p
120+
where not exists (string c | p.getHairColor() = c)
121+
select p
122+
123+
To avoid having to type ``not exists (string c | p.getHairColor() = c)`` every time you want to select a bald person, you can instead define another new predicate ``isBald``.
124+
125+
.. code-block:: ql
126+
127+
predicate isBald(Person p) {
128+
not exists (string c | p.getHairColor() = c)
129+
}
130+
131+
The property ``isBald(p)`` holds whenever ``p`` is bald, so you can replace the previous query with:
132+
133+
.. code-block:: ql
134+
135+
from Person p
136+
where isBald(p)
137+
select p
138+
139+
The predicate ``isBald`` is defined to take a ``Person``, so it can also take a ``Southerner``, as ``Southerner`` is a subtype of ``Person``. It can't take an ``int`` for example—that would cause an error.
140+
141+
You can now write a query to select the bald southerners who are allowed into the north.
142+
143+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/2572701606358725253/>`__
144+
145+
You have found the two fire starters! They are arrested and the villagers are once again impressed with your work.
146+
147+
Further reading
148+
---------------
105149

106-
Continue to the :doc:`next page <fire-2>` to gather more clues and find out which of your suspects started the fire...
150+
- Find out who will be the new ruler of the village in the :doc:`next tutorial <crown-the-rightful-heir>`.
151+
- Learn more about predicates and classes in the `QL language reference <https://help.semmle.com/QL/ql-handbook/index.html>`__.
152+
- Explore the libraries that help you get data about code in :doc:`Learning CodeQL <../../index>`.

docs/language/learn-ql/ql-etudes/river-crossing.rst renamed to docs/language/learn-ql/beginner/cross-the-river.rst

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
1-
River crossing puzzle
2-
#####################
1+
Cross the river
2+
===============
33

4-
The aim of this tutorial is to write a query that finds a solution to the following classical logic puzzle:
4+
Use common QL features to write a query that finds a solution to the "River crossing" logic puzzle.
5+
6+
Introduction
7+
------------
58

69
.. pull-quote::
710

@@ -248,15 +251,15 @@ Here are some more example queries that solve the river crossing puzzle:
248251
#. This query uses a modified ``path`` variable to describe the resulting path in
249252
more detail.
250253

251-
➤ `See solution in the query console <https://lgtm.com/query/659603593702729237/>`__
254+
➤ `See solution in the query console on LGTM.com <https://lgtm.com/query/659603593702729237/>`__
252255

253256
#. This query models the man and the cargo items in a different way, using an
254257
`abstract <https://help.semmle.com/QL/ql-handbook/annotations.html#abstract>`__
255258
class and predicate. It also displays the resulting path in a more visual way.
256259

257-
➤ `See solution in the query console <https://lgtm.com/query/1025323464423811143/>`__
260+
➤ `See solution in the query console on LGTM.com <https://lgtm.com/query/1025323464423811143/>`__
258261

259262
#. This query introduces `algebraic datatypes <https://help.semmle.com/QL/ql-handbook/types.html#algebraic-datatypes>`__
260263
to model the situation, instead of defining everything as a subclass of ``string``.
261264

262-
➤ `See solution in the query console <https://lgtm.com/query/7260748307619718263/>`__
265+
➤ `See solution in the query console on LGTM.com <https://lgtm.com/query/7260748307619718263/>`__

docs/language/learn-ql/beginner/heir.rst renamed to docs/language/learn-ql/beginner/crown-the-rightful-heir.rst

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
Crown the rightful heir
22
=======================
33

4+
This is a QL detective puzzle that shows you how to use recursion in QL to write more complex queries.
5+
6+
King Basil's heir
7+
-----------------
8+
49
Phew! No more crimes in the village—you can finally leave the village and go home.
510

611
But then... During your last night in the village, the old king—the great King Basil—dies in his sleep and there is chaos everywhere!
@@ -9,9 +14,6 @@ The king never married and he had no children, so nobody knows who should inheri
914

1015
Eventually you decide to stay in the village to resolve the argument and find the true heir to the throne.
1116

12-
King Basil's heir
13-
-----------------
14-
1517
You want to find out if anyone in the village is actually related to the king. This seems like a difficult task at first, but you start work confidently. You know the villagers quite well by now, and you have a list of all the parents in the village and their children.
1618

1719
To find out more about the king and his family, you get access to the castle and find some old family trees. You also include these relations in your database to see if anyone in the king's family is still alive.
@@ -125,7 +127,7 @@ Here is one way to define ``relativeOf()``:
125127
126128
Don't forget to use the predicate ``isDeceased()`` to find relatives that are still alive.
127129

128-
➤ `See the answer in the query console <https://lgtm.com/query/6710025057257064639/>`__
130+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/6710025057257064639/>`__
129131

130132
Select the true heir
131133
--------------------
@@ -136,9 +138,9 @@ To decide who should inherit the king's fortune, the villagers carefully read th
136138

137139
*"The heir to the throne is the closest living relative of the king. Any person with a criminal record will not be considered. If there are multiple candidates, the oldest person is the heir."*
138140

139-
As your final challenge, define a predicate ``hasCriminalRecord`` so that ``hasCriminalRecord(p)`` holds if ``p`` is any of the criminals you unmasked earlier (in the :doc:`Find the thief <find-thief-1>` and :doc:`Catch the fire starter <fire-1>` tutorials).
141+
As your final challenge, define a predicate ``hasCriminalRecord`` so that ``hasCriminalRecord(p)`` holds if ``p`` is any of the criminals you unmasked earlier (in the :doc:`Find the thief <find-the-thief>` and :doc:`Catch the fire starter <catch-the-fire-starter>` tutorials).
140142

141-
➤ `See the answer in the query console <https://lgtm.com/query/1820692755164273290/>`__
143+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/1820692755164273290/>`__
142144

143145
Experimental explorations
144146
-------------------------
@@ -156,9 +158,9 @@ You could also try writing more of your own QL queries to find interesting facts
156158
- Do all villagers live in the same region of the village as their parents?
157159
- Find out whether there are any time travelers in the village! (Hint: Look for "impossible" family relations.)
158160

159-
What next?
160-
----------
161+
Further reading
162+
---------------
161163

162-
- Learn more about recursion in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__.
163-
- Put your QL skills to the test and solve the :doc:`River crossing puzzle <../ql-etudes/river-crossing>`.
164+
- Learn more about recursion in the `QL language reference <https://help.semmle.com/QL/ql-handbook/index.html>`__.
165+
- Put your QL skills to the test and solve the :doc:`River crossing puzzle <cross-the-river>`.
164166
- Start using QL to analyze projects. See :doc:`Learning CodeQL <../../index>` for a summary of the available languages and resources.

0 commit comments

Comments
 (0)