Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b3efa28

Browse files
RasmusWLRasmusWL
committed
Merge branch 'main' into python-command-execution-modeling
2 parents 6cb2ca6 + 8d4f7e2 commit b3efa28

51 files changed

Lines changed: 712 additions & 121 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.26/analysis-javascript.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
- [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
1515
- [json3](https://www.npmjs.com/package/json3)
1616
- [lodash](https://www.npmjs.com/package/lodash)
17+
- [needle](https://www.npmjs.com/package/needle)
1718
- [object-inspect](https://www.npmjs.com/package/object-inspect)
1819
- [pretty-format](https://www.npmjs.com/package/pretty-format)
1920
- [stringify-object](https://www.npmjs.com/package/stringify-object)
@@ -39,6 +40,7 @@
3940
| Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
4041
| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
4142
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
43+
| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
4244

4345

4446
## Changes to libraries

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
7979
}
8080

8181
/**
82-
* A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
82+
* An operand of an `Instruction`. The operand represents a use of the result of one instruction
83+
* (the defining instruction) in another instruction (the use instruction)
8384
*/
8485
class Operand extends TOperand {
8586
/** Gets a textual representation of this element. */

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,12 @@ abstract class MemoryLocation extends TMemoryLocation {
133133
predicate isAlwaysAllocatedOnStack() { none() }
134134
}
135135

136+
/**
137+
* Represents a set of `MemoryLocation`s that cannot overlap with
138+
* `MemoryLocation`s outside of the set. The `VirtualVariable` will be
139+
* represented by a `MemoryLocation` that totally overlaps all other
140+
* `MemoryLocations` in the set.
141+
*/
136142
abstract class VirtualVariable extends MemoryLocation { }
137143

138144
abstract class AllocationMemoryLocation extends MemoryLocation {

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
7979
}
8080

8181
/**
82-
* A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
82+
* An operand of an `Instruction`. The operand represents a use of the result of one instruction
83+
* (the defining instruction) in another instruction (the use instruction)
8384
*/
8485
class Operand extends TOperand {
8586
/** Gets a textual representation of this element. */

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
7979
}
8080

8181
/**
82-
* A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
82+
* An operand of an `Instruction`. The operand represents a use of the result of one instruction
83+
* (the defining instruction) in another instruction (the use instruction)
8384
*/
8485
class Operand extends TOperand {
8586
/** Gets a textual representation of this element. */

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ class MemoryLocation extends TMemoryLocation {
5959
final string getUniqueId() { result = var.getUniqueId() }
6060
}
6161

62+
/**
63+
* Represents a set of `MemoryLocation`s that cannot overlap with
64+
* `MemoryLocation`s outside of the set. The `VirtualVariable` will be
65+
* represented by a `MemoryLocation` that totally overlaps all other
66+
* `MemoryLocations` in the set.
67+
*/
6268
class VirtualVariable extends MemoryLocation { }
6369

6470
/** A virtual variable that groups all escaped memory within a function. */

‎cpp/ql/src/semmle/code/cpp/ir/internal/Overlap.qll‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,33 @@ private newtype TOverlap =
33
TMustTotallyOverlap() or
44
TMustExactlyOverlap()
55

6+
/**
7+
* Represents a possible overlap between two memory ranges.
8+
*/
69
abstract class Overlap extends TOverlap {
710
abstract string toString();
811
}
912

13+
/**
14+
* Represents a partial overlap between two memory ranges, which may or may not
15+
* actually occur in practice.
16+
*/
1017
class MayPartiallyOverlap extends Overlap, TMayPartiallyOverlap {
1118
final override string toString() { result = "MayPartiallyOverlap" }
1219
}
1320

21+
/**
22+
* Represents an overlap in which the first memory range is known to include all
23+
* bits of the second memory range, but may be larger or have a different type.
24+
*/
1425
class MustTotallyOverlap extends Overlap, TMustTotallyOverlap {
1526
final override string toString() { result = "MustTotallyOverlap" }
1627
}
1728

29+
/**
30+
* Represents an overlap between two memory ranges that have the same extent and
31+
* the same type.
32+
*/
1833
class MustExactlyOverlap extends Overlap, TMustExactlyOverlap {
1934
final override string toString() { result = "MustExactlyOverlap" }
2035
}

‎cpp/ql/test/library-tests/special_members/generated_copy/functions.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,6 @@
7878
| copy.cpp:111:9:111:9 | MoveAssign | deleted | |
7979
| copy.cpp:111:9:111:9 | operator= | deleted | |
8080
| copy.cpp:113:17:113:25 | operator= | | |
81-
| copy.cpp:120:9:120:9 | OnlyCtor | | |
82-
| copy.cpp:120:9:120:9 | OnlyCtor | | |
8381
| copy.cpp:120:9:120:9 | OnlyCtor | deleted | |
8482
| copy.cpp:120:9:120:9 | operator= | deleted | |
8583
| copy.cpp:126:11:126:19 | operator= | | |

‎cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -539,8 +539,6 @@ uniqueNodeLocation
539539
| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
540540
| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
541541
| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
542-
| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
543-
| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
544542
| file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
545543
| file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
546544
| file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
@@ -1418,7 +1416,7 @@ uniqueNodeLocation
14181416
| whilestmt.c:39:6:39:11 | ReturnVoid | Node should have one location but has 4. |
14191417
| whilestmt.c:39:6:39:11 | SideEffect | Node should have one location but has 4. |
14201418
missingLocation
1421-
| Nodes without location: 36 |
1419+
| Nodes without location: 34 |
14221420
uniqueNodeToString
14231421
| break_labels.c:2:11:2:11 | i | Node should have one toString but has 2. |
14241422
| break_labels.c:2:11:2:11 | i | Node should have one toString but has 2. |

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,13 +68,12 @@ public override void Populate(TextWriter trapFile)
6868
Context.PopulateLater(() =>
6969
{
7070
var loc = Context.Create(initializer.GetLocation());
71-
var simpleAssignExpr = new Expression(new ExpressionInfo(Context, Type, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, null));
72-
Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer.Initializer.Value, simpleAssignExpr, 0));
73-
var access = new Expression(new ExpressionInfo(Context, Type, Location, ExprKind.FIELD_ACCESS, simpleAssignExpr, 1, false, null));
74-
trapFile.expr_access(access, this);
71+
72+
var fieldAccess = AddInitializerAssignment(trapFile, initializer.Initializer.Value, loc, null, ref child);
73+
7574
if (!symbol.IsStatic)
7675
{
77-
This.CreateImplicit(Context, Entities.Type.Create(Context, symbol.ContainingType), Location, access, -1);
76+
This.CreateImplicit(Context, Entities.Type.Create(Context, symbol.ContainingType), Location, fieldAccess, -1);
7877
}
7978
});
8079
}
@@ -85,8 +84,13 @@ public override void Populate(TextWriter trapFile)
8584
Where(n => n.EqualsValue != null))
8685
{
8786
// Mark fields that have explicit initializers.
88-
var expr = new Expression(new ExpressionInfo(Context, Type, Context.Create(initializer.EqualsValue.Value.FixedLocation()), Kinds.ExprKind.FIELD_ACCESS, this, child++, false, null));
89-
trapFile.expr_access(expr, this);
87+
var constValue = symbol.HasConstantValue
88+
? Expression.ValueAsString(symbol.ConstantValue)
89+
: null;
90+
91+
var loc = Context.Create(initializer.GetLocation());
92+
93+
AddInitializerAssignment(trapFile, initializer.EqualsValue.Value, loc, constValue, ref child);
9094
}
9195

9296
if (IsSourceDeclaration)
@@ -96,6 +100,16 @@ public override void Populate(TextWriter trapFile)
96100
TypeMention.Create(Context, syntax.Type, this, Type);
97101
}
98102

103+
private Expression AddInitializerAssignment(TextWriter trapFile, ExpressionSyntax initializer, Extraction.Entities.Location loc,
104+
string constValue, ref int child)
105+
{
106+
var simpleAssignExpr = new Expression(new ExpressionInfo(Context, Type, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, constValue));
107+
Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer, simpleAssignExpr, 0));
108+
var access = new Expression(new ExpressionInfo(Context, Type, Location, ExprKind.FIELD_ACCESS, simpleAssignExpr, 1, false, constValue));
109+
trapFile.expr_access(access, this);
110+
return access;
111+
}
112+
99113
readonly Lazy<AnnotatedType> type;
100114
public AnnotatedType Type => type.Value;
101115

0 commit comments

Comments
 (0)