Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit aa6b89d

Browse files
author
Max Schaefer
authored
Merge pull request #723 from Semmle/qlucie/master
Master-to-next merge
2 parents 6b27dca + 42cf760 commit aa6b89d

655 files changed

Lines changed: 5479 additions & 4354 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.20/analysis-csharp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
## Changes to code extraction
1919

20+
* Fix extraction of `for` statements where the condition declares new variables using `is`.
2021
* Initializers of `stackalloc` arrays are now extracted.
2122

2223
## Changes to QL libraries

‎change-notes/1.20/analysis-javascript.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## General improvements
44

5-
* Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
5+
* Support for popular libraries has been improved. Consequently, queries may produce better results on code bases that use the following features:
66
- client-side code, for example [React](https://reactjs.org/)
77
- cookies and webstorage, for example [js-cookie](https://github.com/js-cookie/js-cookie)
88
- server-side code, for example [hapi](https://hapijs.com/)
@@ -18,15 +18,18 @@
1818
| Incomplete regular expression for hostnames (`js/incomplete-hostname-regexp`) | correctness, security, external/cwe/cwe-020 | Highlights hostname sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default.|
1919
| Incomplete URL substring sanitization | correctness, security, external/cwe/cwe-020 | Highlights URL sanitizers that are likely to be incomplete, indicating a violation of [CWE-020](https://cwe.mitre.org/data/definitions/20.html). Results shown on LGTM by default. |
2020
| Incorrect suffix check (`js/incorrect-suffix-check`) | correctness, security, external/cwe/cwe-020 | Highlights error-prone suffix checks based on `indexOf`, indicating a potential violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
21+
| Loop iteration skipped due to shifting (`js/loop-iteration-skipped-due-to-shifting`) | correctness | Highlights code that removes an element from an array while iterating over it, causing the loop to skip over some elements. Results are shown on LGTM by default. |
2122
| Useless comparison test (`js/useless-comparison-test`) | correctness | Highlights code that is unreachable due to a numeric comparison that is always true or always false. Results are shown on LGTM by default. |
2223

2324
## Changes to existing queries
2425

2526
| **Query** | **Expected impact** | **Change** |
2627
|--------------------------------------------|------------------------------|------------------------------------------------------------------------------|
27-
| Client-side cross-site scripting | More results | This rule now recognizes WinJS functions that are vulnerable to HTML injection. |
28+
| Client-side cross-site scripting | More true-positive results, fewer false-positive results. | This rule now recognizes WinJS functions that are vulnerable to HTML injection, and no longer flags certain safe uses of jQuery. |
2829
| Insecure randomness | More results | This rule now flags insecure uses of `crypto.pseudoRandomBytes`. |
30+
| Uncontrolled data used in network request | More results | This rule now recognizes host values that are vulnerable to injection. |
2931
| Unused parameter | Fewer false-positive results | This rule no longer flags parameters with leading underscore. |
3032
| Unused variable, import, function or class | Fewer false-positive results | This rule now flags fewer variables that are implictly used by JSX elements, and no longer flags variables with leading underscore. |
33+
| Uncontrolled data used in path expression | Fewer false-positive results | This rule now recognizes the Express `root` option, which prevents path traversal. |
3134

3235
## Changes to QL libraries

‎cpp/ql/src/semmle/code/cpp/Macro.qll‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,18 @@ class Macro extends PreprocessorDirective, @ppd_define {
5555
}
5656

5757
/**
58-
* A macro access (macro expansion or other macro access).
58+
* A macro access. For example:
59+
* ```
60+
* #ifdef MACRO1 // this line contains a MacroAccess
61+
* int x = MACRO2; // this line contains a MacroAccess
62+
* #endif
63+
* ```
64+
*
65+
* See also `MacroInvocation`, which represents only macro accesses
66+
* that are expanded (such as in the second line of the example above).
5967
*/
6068
class MacroAccess extends Locatable, @macroinvocation {
61-
/** Gets the macro being invoked. */
69+
/** Gets the macro that is being accessed. */
6270
Macro getMacro() { macroinvocations(underlyingElement(this),unresolveElement(result),_,_) }
6371

6472
/**
@@ -73,7 +81,7 @@ class MacroAccess extends Locatable, @macroinvocation {
7381
}
7482

7583
/**
76-
* Gets the location of this macro invocation. For a nested invocation, where
84+
* Gets the location of this macro access. For a nested access, where
7785
* `exists(this.getParentInvocation())`, this yields a location either inside
7886
* a `#define` directive or inside an argument to another macro.
7987
*/
@@ -126,14 +134,22 @@ class MacroAccess extends Locatable, @macroinvocation {
126134

127135
override string toString() { result = this.getMacro().getHead() }
128136

129-
/** Gets the name of the invoked macro. */
137+
/** Gets the name of the accessed macro. */
130138
string getMacroName() {
131139
result = getMacro().getName()
132140
}
133141
}
134142

135143
/**
136-
* A macro invocation (macro expansion).
144+
* A macro invocation (macro access that is expanded). For example:
145+
* ```
146+
* #ifdef MACRO1
147+
* int x = MACRO2; // this line contains a MacroInvocation
148+
* #endif
149+
* ```
150+
*
151+
* See also `MacroAccess`, which also represents macro accesses where the macro
152+
* is checked but not expanded (such as in the first line of the example above).
137153
*/
138154
class MacroInvocation extends MacroAccess {
139155
MacroInvocation() {
@@ -174,7 +190,7 @@ class MacroInvocation extends MacroAccess {
174190
/**
175191
* Gets the top-level expression associated with this macro invocation,
176192
* if any. Note that this predicate will fail if the top-level expanded
177-
* element is a statement rather than an expression.
193+
* element is not an expression (for example if it is a statement).
178194
*/
179195
Expr getExpr() {
180196
result = getAnExpandedElement() and
@@ -185,7 +201,7 @@ class MacroInvocation extends MacroAccess {
185201
/**
186202
* Gets the top-level statement associated with this macro invocation, if
187203
* any. Note that this predicate will fail if the top-level expanded
188-
* element is an expression rather than a statement.
204+
* element is not a statement (for example if it is an expression).
189205
*/
190206
Stmt getStmt() {
191207
result = getAnExpandedElement() and

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ public override void Populate()
5858
}
5959
else
6060
{
61-
Context.ModelError(symbol, "Undhandled accessor kind");
61+
Context.ModelError(symbol, "Unhandled accessor kind");
6262
return;
6363
}
6464

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ public override IId Id
118118
if (symbol.IsStatic) tb.Append("static");
119119
tb.Append(ContainingType);
120120
AddParametersToId(Context, tb, symbol);
121-
tb.Append("; constructor");
121+
tb.Append(";constructor");
122122
});
123123
}
124124
}

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,13 @@ public override void Populate()
3030
Context.Emit(Tuples.events(this, symbol.GetName(), ContainingType, type.TypeRef, Create(Context, symbol.OriginalDefinition)));
3131

3232
var adder = symbol.AddMethod;
33-
if (adder != null)
34-
EventAccessor.Create(Context, adder);
35-
3633
var remover = symbol.RemoveMethod;
37-
if (remover != null)
38-
EventAccessor.Create(Context, remover);
34+
35+
if (!(adder is null))
36+
Method.Create(Context, adder);
37+
38+
if (!(remover is null))
39+
Method.Create(Context, remover);
3940

4041
ExtractModifiers();
4142
BindComments();

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -117,17 +117,19 @@ public static ExprKind UnaryOperatorKind(Context cx, ExprKind originalKind, Expr
117117
public void OperatorCall(ExpressionSyntax node)
118118
{
119119
var @operator = cx.GetSymbolInfo(node);
120-
var method = @operator.Symbol as IMethodSymbol;
121-
122-
if (GetCallType(cx, node) == CallType.Dynamic)
120+
if (@operator.Symbol is IMethodSymbol method)
123121
{
124-
UserOperator.OperatorSymbol(method.Name, out string operatorName);
125-
cx.Emit(Tuples.dynamic_member_name(this, operatorName));
126-
return;
127-
}
128122

129-
if (method != null)
123+
var callType = GetCallType(cx, node);
124+
if (callType == CallType.Dynamic)
125+
{
126+
UserOperator.OperatorSymbol(method.Name, out string operatorName);
127+
cx.Emit(Tuples.dynamic_member_name(this, operatorName));
128+
return;
129+
}
130+
130131
cx.Emit(Tuples.expr_call(this, Method.Create(cx, method)));
132+
}
131133
}
132134

133135
public enum CallType
@@ -148,12 +150,9 @@ public static CallType GetCallType(Context cx, ExpressionSyntax node)
148150
{
149151
var @operator = cx.GetSymbolInfo(node);
150152

151-
if (@operator.Symbol != null)
153+
if (@operator.Symbol is IMethodSymbol method)
152154
{
153-
var method = @operator.Symbol as IMethodSymbol;
154-
155-
var containingSymbol = method.ContainingSymbol as ITypeSymbol;
156-
if (containingSymbol != null && containingSymbol.TypeKind == Microsoft.CodeAnalysis.TypeKind.Dynamic)
155+
if (method.ContainingSymbol is ITypeSymbol containingSymbol && containingSymbol.TypeKind == Microsoft.CodeAnalysis.TypeKind.Dynamic)
157156
{
158157
return CallType.Dynamic;
159158
}

0 commit comments

Comments
 (0)