Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b8eb2ef

Browse files
max-schaefermax-schaefer
authored
Merge branch 'main' into max-schaefer/improve-command-injection-qhelp
2 parents ae23724 + 60af9b0 commit b8eb2ef

542 files changed

Lines changed: 13110 additions & 2303 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CONTRIBUTING.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,16 @@ If you have an idea for a query that you would like to share with other CodeQL u
1414

1515
1. **Directory structure**
1616

17-
There are six language-specific query directories in this repository:
17+
There are eight language-specific query directories in this repository:
1818

1919
* C/C++: `cpp/ql/src`
2020
* C#: `csharp/ql/src`
21-
* Java: `java/ql/src`
21+
* Go: `go/ql/src`
22+
* Java/Kotlin: `java/ql/src`
2223
* JavaScript: `javascript/ql/src`
2324
* Python: `python/ql/src`
2425
* Ruby: `ruby/ql/src`
26+
* Swift: `swift/ql/src`
2527

2628
Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
2729
- Experimental queries and libraries are stored in the `experimental` subdirectory within each language-specific directory in the [CodeQL repository](https://github.com/github/codeql). For example, experimental Java queries and libraries are stored in `java/ql/src/experimental` and any corresponding tests in `java/ql/test/experimental`.

‎cpp/ql/lib/CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
## 0.8.0
2+
3+
### New Features
4+
5+
* The `ProductFlow::StateConfigSig` signature now includes default predicates for `isBarrier1`, `isBarrier2`, `isAdditionalFlowStep1`, and `isAdditionalFlowStep1`. Hence, it is no longer needed to provide `none()` implementations of these predicates if they are not needed.
6+
7+
### Minor Analysis Improvements
8+
9+
* Deleted the deprecated `getURL` predicate from the `Container`, `Folder`, and `File` classes. Use the `getLocation` predicate instead.
10+
11+
## 0.7.4
12+
13+
No user-facing changes.
14+
115
## 0.7.3
216

317
### Minor Analysis Improvements

‎cpp/ql/lib/change-notes/2023-06-19-delete-container-url.md‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/change-notes/2023-07-07-irguards-compares-pointers.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `IRGuards` library has improved handling of pointer addition and subtraction operations.

‎cpp/ql/lib/change-notes/2023-07-12-default-stateconfigsig-predicates.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
category: feature
3+
---
4+
* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`.
5+
Hence it is no longer needed to provide `none()` implementations of these predicates if they are not needed.
6+

‎cpp/ql/lib/change-notes/released/0.7.4.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.7.4
2+
3+
No user-facing changes.

‎cpp/ql/lib/change-notes/released/0.8.0.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## 0.8.0
2+
3+
### New Features
4+
5+
* The `ProductFlow::StateConfigSig` signature now includes default predicates for `isBarrier1`, `isBarrier2`, `isAdditionalFlowStep1`, and `isAdditionalFlowStep1`. Hence, it is no longer needed to provide `none()` implementations of these predicates if they are not needed.
6+
7+
### Minor Analysis Improvements
8+
9+
* Deleted the deprecated `getURL` predicate from the `Container`, `Folder`, and `File` classes. Use the `getLocation` predicate instead.

‎cpp/ql/lib/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.7.3
2+
lastReleaseVersion: 0.8.0

‎cpp/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 0.7.4-dev
2+
version: 0.8.1-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -627,6 +627,20 @@ private predicate sub_lt(
627627
x = int_value(rhs.getRight()) and
628628
k = c - x
629629
)
630+
or
631+
exists(PointerSubInstruction lhs, int c, int x |
632+
compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
633+
left = lhs.getLeftOperand() and
634+
x = int_value(lhs.getRight()) and
635+
k = c + x
636+
)
637+
or
638+
exists(PointerSubInstruction rhs, int c, int x |
639+
compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
640+
right = rhs.getLeftOperand() and
641+
x = int_value(rhs.getRight()) and
642+
k = c - x
643+
)
630644
}
631645

632646
// left + x < right + c => left < right + (c-x)
@@ -653,6 +667,26 @@ private predicate add_lt(
653667
) and
654668
k = c + x
655669
)
670+
or
671+
exists(PointerAddInstruction lhs, int c, int x |
672+
compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
673+
(
674+
left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
675+
or
676+
left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
677+
) and
678+
k = c - x
679+
)
680+
or
681+
exists(PointerAddInstruction rhs, int c, int x |
682+
compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
683+
(
684+
right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
685+
or
686+
right = rhs.getRightOperand() and x = int_value(rhs.getLeft())
687+
) and
688+
k = c + x
689+
)
656690
}
657691

658692
// left - x == right + c => left == right + (c+x)
@@ -673,6 +707,20 @@ private predicate sub_eq(
673707
x = int_value(rhs.getRight()) and
674708
k = c - x
675709
)
710+
or
711+
exists(PointerSubInstruction lhs, int c, int x |
712+
compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
713+
left = lhs.getLeftOperand() and
714+
x = int_value(lhs.getRight()) and
715+
k = c + x
716+
)
717+
or
718+
exists(PointerSubInstruction rhs, int c, int x |
719+
compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
720+
right = rhs.getLeftOperand() and
721+
x = int_value(rhs.getRight()) and
722+
k = c - x
723+
)
676724
}
677725

678726
// left + x == right + c => left == right + (c-x)
@@ -699,6 +747,26 @@ private predicate add_eq(
699747
) and
700748
k = c + x
701749
)
750+
or
751+
exists(PointerAddInstruction lhs, int c, int x |
752+
compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
753+
(
754+
left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
755+
or
756+
left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
757+
) and
758+
k = c - x
759+
)
760+
or
761+
exists(PointerAddInstruction rhs, int c, int x |
762+
compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
763+
(
764+
right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
765+
or
766+
right = rhs.getRightOperand() and x = int_value(rhs.getLeft())
767+
) and
768+
k = c + x
769+
)
702770
}
703771

704772
/** The int value of integer constant expression. */

0 commit comments

Comments
 (0)