Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9bd6363

Browse files
erik-krogherik-krogh
committed
Merge remote-tracking branch 'upstream/master' into promiseAll
2 parents 2f08ee9 + 0f91139 commit 9bd6363

179 files changed

Lines changed: 4849 additions & 1150 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This open source repository contains the standard CodeQL libraries and queries t
55
## How do I learn CodeQL and run queries?
66

77
There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
8-
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open source project that's currently being analyzed.
8+
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any open source project that's currently being analyzed.
99

1010
## Contributing
1111

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ The following changes in version 1.23 affect C# analysis in all applications.
44

55
## New queries
66

7-
## New queries
8-
97
| **Query** | **Tags** | **Purpose** |
108
|-----------------------------|-----------|--------------------------------------------------------------------|
119
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Improvements to JavaScript analysis
2+
3+
## General improvements
4+
5+
* Support for the following frameworks and libraries has been improved:
6+
- [react](https://www.npmjs.com/package/react)
7+
8+
## New queries
9+
10+
| **Query** | **Tags** | **Purpose** |
11+
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
12+
13+
14+
## Changes to existing queries
15+
16+
| **Query** | **Expected impact** | **Change** |
17+
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
18+
| Clear-text logging of sensitive information (`js/clear-text-logging`) | More results | More results involving `process.env` and indirect calls to logging methods are recognized. |
19+
| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false positive results | This query now recognizes additional cases where a single replacement is likely to be intentional. |
20+
| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | This query now recognizes additional ways event handler receivers can be bound. |
21+
22+
## Changes to libraries
23+

‎cpp/ql/src/Likely Bugs/Likely Typos/CompareWhereAssignMeant.ql‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,10 @@ import cpp
1515

1616
from ExprInVoidContext op
1717
where
18-
op instanceof EQExpr
19-
or
20-
op.(FunctionCall).getTarget().hasName("operator==")
18+
not op.isUnevaluated() and
19+
(
20+
op instanceof EQExpr
21+
or
22+
op.(FunctionCall).getTarget().hasName("operator==")
23+
)
2124
select op, "This '==' operator has no effect. The assignment ('=') operator was probably intended."

‎cpp/ql/src/Likely Bugs/Likely Typos/ExprHasNoEffect.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,10 @@ where
8484
not peivc.getEnclosingFunction().isDefaulted() and
8585
not exists(Macro m | peivc = m.getAnInvocation().getAnExpandedElement()) and
8686
not peivc.isFromTemplateInstantiation(_) and
87+
not peivc.isFromUninstantiatedTemplate(_) and
8788
parent = peivc.getParent() and
8889
not parent.isInMacroExpansion() and
90+
not peivc.isUnevaluated() and
8991
not parent instanceof PureExprInVoidContext and
9092
not peivc.getEnclosingFunction().isCompilerGenerated() and
9193
not peivc.getType() instanceof UnknownType and

‎cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow-bad.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
bool not_in_range(T *ptr, T *ptr_end, size_t a) {
2-
return ptr + a >= ptr_end || ptr + a < ptr; // BAD
1+
bool not_in_range(T *ptr, T *ptr_end, size_t i) {
2+
return ptr + i >= ptr_end || ptr + i < ptr; // BAD
33
}

‎cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow-good.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
bool not_in_range(T *ptr, T *ptr_end, size_t a) {
2-
return a >= ptr_end - ptr; // GOOD
1+
bool not_in_range(T *ptr, T *ptr_end, size_t i) {
2+
return i >= ptr_end - ptr; // GOOD
33
}

‎cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow.qhelp‎

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,27 @@
44
<qhelp>
55
<overview>
66
<p>
7-
The expression <code>ptr + a &lt; ptr</code> is equivalent to <code>a &lt;
8-
0</code>, and an optimizing compiler is likely to make that replacement,
9-
thereby removing a range check that might have been necessary for security.
10-
If <code>a</code> is known to be non-negative, the compiler can even replace <code>ptr +
11-
a &lt; ptr</code> with <code>false</code>.
7+
When checking for integer overflow, you may often write tests like
8+
<code>p + i &lt; p</code>. This works fine if <code>p</code> and
9+
<code>i</code> are unsigned integers, since any overflow in the addition
10+
will cause the value to simply "wrap around." However, using this pattern when
11+
<code>p</code> is a pointer is problematic because pointer overflow has
12+
undefined behavior according to the C and C++ standards. If the addition
13+
overflows and has an undefined result, the comparison will likewise be
14+
undefined; it may produce an unintended result, or may be deleted entirely by an
15+
optimizing compiler.
1216
</p>
1317

14-
<p>
15-
The reason is that pointer arithmetic overflow in C/C++ is undefined
16-
behavior. The optimizing compiler can assume that the program has no
17-
undefined behavior, which means that adding a positive number to <code>ptr</code> cannot
18-
produce a pointer less than <code>ptr</code>.
19-
</p>
2018
</overview>
2119
<recommendation>
2220
<p>
23-
To check whether an index <code>a</code> is less than the length of an array,
24-
simply compare these two numbers as unsigned integers: <code>a &lt; ARRAY_LENGTH</code>.
21+
To check whether an index <code>i</code> is less than the length of an array,
22+
simply compare these two numbers as unsigned integers: <code>i &lt; ARRAY_LENGTH</code>.
2523
If the length of the array is defined as the difference between two pointers
26-
<code>ptr</code> and <code>p_end</code>, write <code>a &lt; p_end - ptr</code>.
27-
If a is <code>signed</code>, cast it to <code>unsigned</code>
28-
in order to guard against negative <code>a</code>. For example, write
29-
<code>(size_t)a &lt; p_end - ptr</code>.
24+
<code>ptr</code> and <code>p_end</code>, write <code>i &lt; p_end - ptr</code>.
25+
If <code>i</code> is signed, cast it to unsigned
26+
in order to guard against negative <code>i</code>. For example, write
27+
<code>(size_t)i &lt; p_end - ptr</code>.
3028
</p>
3129
</recommendation>
3230
<example>
@@ -43,14 +41,14 @@ overflows and wraps around.
4341
<p>
4442
In both of these checks, the operations are performed in the wrong order.
4543
First, an expression that may cause undefined behavior is evaluated
46-
(<code>ptr + a</code>), and then the result is checked for being in range.
44+
(<code>ptr + i</code>), and then the result is checked for being in range.
4745
But once undefined behavior has happened in the pointer addition, it cannot
4846
be recovered from: it's too late to perform the range check after a possible
4947
pointer overflow.
5048
</p>
5149

5250
<p>
53-
While it's not the subject of this query, the expression <code>ptr + a &lt;
51+
While it's not the subject of this query, the expression <code>ptr + i &lt;
5452
ptr_end</code> is also an invalid range check. It's undefined behavor in
5553
C/C++ to create a pointer that points more than one past the end of an
5654
allocation.

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qhelp‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,20 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>Using TLS or SSLv23 protool from the boost::asio library, but not disabling deprecated protocols or disabling minimum-recommended protocols.</p>
6+
<p>Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols may expose the software to known vulnerabilities or permit weak encryption algorithms to be used. Disabling the minimum-recommended protocols is also flagged.</p>
77
</overview>
88

9+
<recommendation>
10+
<p>When using the TLS or SSLv23 protocol, set the <code>no_tlsv1</code> and <code>no_tlsv1_1</code> options, but do not set <code>no_tlsv1_2</code>. When using the SSLv23 protocol, also set the <code>no_sslv3</code> option.</p>
11+
</recommendation>
12+
13+
<example>
14+
<p>In the following example, the <code>no_tlsv1_1</code> option has not been set. Use of TLS 1.1 is not recommended.</p>
15+
<sample src="TlsSettingsMisconfigurationBad.cpp"/>
16+
<p>In the corrected example, the <code>no_tlsv1</code> and <code>no_tlsv1_1</code> options have both been set, ensuring the use of TLS 1.2 or later.</p>
17+
<sample src="TlsSettingsMisconfigurationGood.cpp"/>
18+
</example>
19+
920
<references>
1021
<li>
1122
<a href="https://www.boost.org/doc/libs/1_71_0/doc/html/boost_asio.html">Boost.Asio documentation</a>.

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Boost_asio TLS Settings Misconfiguration
3-
* @description Using TLS or SSLv23 protool from the boost::asio library, but not disabling deprecated protocols or disabling minimum-recommended protocols
3+
* @description Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols, or disabling minimum-recommended protocols.
44
* @kind problem
55
* @problem.severity error
66
* @id cpp/boost/tls_settings_misconfiguration

0 commit comments

Comments
 (0)