Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bba6b23

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
2 parents 4333fe7 + 11b5c54 commit bba6b23

477 files changed

Lines changed: 9252 additions & 4690 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CONTRIBUTING.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,12 @@ Follow the steps below to help other users understand what your query does, and
4646
Query help files explain the purpose of your query to other users. Write your query help in a `.qhelp` file and save it in the same directory as your new query.
4747
For more information on writing query help, see the [Query help style guide](https://github.com/Semmle/ql/blob/master/docs/query-help-style-guide.md).
4848

49+
7. **Maintain backwards compatibility**
50+
51+
The standard CodeQL libraries must evolve in a backwards compatible manner. If any backwards incompatible changes need to be made, the existing API must first be marked as deprecated. This is done by adding a `deprecated` annotation along with a QLDoc reference to the replacement API. Only after at least one full release cycle has elapsed may the old API be removed.
52+
53+
In addition to contributions to our standard queries and libraries, we also welcome contributions of a more experimental nature, which do not need to fulfill all the requirements listed above. See the guidelines for [experimental queries and libraries](docs/experimental.md) for details.
54+
4955
## Using your personal data
5056

5157
If you contribute to this project, we will record your name and email

‎change-notes/1.24/analysis-java.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ The following changes in version 1.24 affect Java analysis in all applications.
55
## General improvements
66

77
* Alert suppression can now be done with single-line block comments (`/* ... */`) as well as line comments (`// ...`).
8+
* A `Customizations.qll` file has been added to allow customizations of the standard library that apply to all queries.
89

910
## New queries
1011

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
- Calls can now be resolved to indirectly-defined class members in more cases.
2020
- Calls through partial invocations such as `.bind` can now be resolved in more cases.
2121

22+
* Support for flow summaries has been more clearly marked as being experimental and moved to the new `experimental` folder.
23+
2224
* Support for the following frameworks and libraries has been improved:
2325
- [Electron](https://electronjs.org/)
2426
- [Handlebars](https://www.npmjs.com/package/handlebars)
@@ -32,6 +34,7 @@
3234
- [http2](https://nodejs.org/api/http2.html)
3335
- [lazy-cache](https://www.npmjs.com/package/lazy-cache)
3436
- [react](https://www.npmjs.com/package/react)
37+
- [request](https://www.npmjs.com/package/request)
3538
- [send](https://www.npmjs.com/package/send)
3639
- [typeahead.js](https://www.npmjs.com/package/typeahead.js)
3740
- [ws](https://github.com/websockets/ws)
@@ -43,8 +46,11 @@
4346
| Cross-site scripting through exception (`js/xss-through-exception`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights potential XSS vulnerabilities where an exception is written to the DOM. Results are not shown on LGTM by default. |
4447
| Regular expression always matches (`js/regex/always-matches`) | correctness, regular-expressions | Highlights regular expression checks that trivially succeed by matching an empty substring. Results are shown on LGTM by default. |
4548
| Missing await (`js/missing-await`) | correctness | Highlights expressions that operate directly on a promise object in a nonsensical way, instead of awaiting its result. Results are shown on LGTM by default. |
46-
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | security, external/cwe/cwe-400, external/cwe/cwe-471 | Highlights recursive copying operations that are susceptible to prototype pollution. Results are shown on LGTM by default. |
49+
| Polynomial regular expression used on uncontrolled data (`js/polynomial-redos`) | security, external/cwe/cwe-730, external/cwe/cwe-400 | Highlights expensive regular expressions that may be used on malicious input. Results are shown on LGTM by default. |
50+
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | security, external/cwe/cwe-400, external/cwe/cwe-471 | Highlights recursive assignment operations that are susceptible to prototype pollution. Results are shown on LGTM by default. |
4751
| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | Highlights potential XSS vulnerabilities in unsafely designed jQuery plugins. Results are shown on LGTM by default. |
52+
| Unnecessary use of `cat` process (`js/unnecessary-use-of-cat`) | correctness, security, maintainability | Highlights command executions of `cat` where the fs API should be used instead. Results are shown on LGTM by default. |
53+
4854

4955
## Changes to existing queries
5056

@@ -57,8 +63,10 @@
5763
| Expression has no effect (`js/useless-expression`) | Fewer false positive results | The query now recognizes block-level flow type annotations and ignores the first statement of a try block. |
5864
| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
5965
| Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
60-
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed. |
66+
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. |
6167
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. |
68+
| Syntax error (`js/syntax-error`) | Lower severity | This results of this query are now displayed with lower severity. |
69+
| Use of password hash with insufficient computational effort (`js/insufficient-password-hash`) | Fewer false positive results | This query now recognizes additional cases that do not require secure hashing. |
6270

6371
## Changes to libraries
6472

‎cpp/ql/src/Likely Bugs/Arithmetic/UnsignedGEZero.qll‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,33 @@ class ConstantZero extends Expr {
1515
}
1616
}
1717

18+
/**
19+
* Holds if `candidate` is an expression such that if it's unsigned then we
20+
* want an alert at `ge`.
21+
*/
22+
private predicate lookForUnsignedAt(GEExpr ge, Expr candidate) {
23+
// Base case: `candidate >= 0`
24+
ge.getRightOperand() instanceof ConstantZero and
25+
candidate = ge.getLeftOperand().getFullyConverted() and
26+
// left operand was a signed or unsigned IntegralType before conversions
27+
// (not a pointer, checking a pointer >= 0 is an entirely different mistake)
28+
// (not an enum, as the fully converted type of an enum is compiler dependent
29+
// so checking an enum >= 0 is always reasonable)
30+
ge.getLeftOperand().getUnderlyingType() instanceof IntegralType
31+
or
32+
// Recursive case: `...(largerType)candidate >= 0`
33+
exists(Conversion conversion |
34+
lookForUnsignedAt(ge, conversion) and
35+
candidate = conversion.getExpr() and
36+
conversion.getType().getSize() > candidate.getType().getSize()
37+
)
38+
}
39+
1840
class UnsignedGEZero extends GEExpr {
1941
UnsignedGEZero() {
20-
this.getRightOperand() instanceof ConstantZero and
21-
// left operand was a signed or unsigned IntegralType before conversions
22-
// (not a pointer, checking a pointer >= 0 is an entirely different mistake)
23-
// (not an enum, as the fully converted type of an enum is compiler dependent
24-
// so checking an enum >= 0 is always reasonable)
25-
getLeftOperand().getUnderlyingType() instanceof IntegralType and
2642
exists(Expr ue |
27-
// ue is some conversion of the left operand
28-
ue = getLeftOperand().getConversion*() and
29-
// ue is unsigned
30-
ue.getUnderlyingType().(IntegralType).isUnsigned() and
31-
// ue may be converted to zero or more strictly larger possibly signed types
32-
// before it is fully converted
33-
forall(Expr following | following = ue.getConversion+() |
34-
following.getType().getSize() > ue.getType().getSize()
35-
)
43+
lookForUnsignedAt(this, ue) and
44+
ue.getUnderlyingType().(IntegralType).isUnsigned()
3645
)
3746
}
3847
}

‎cpp/ql/src/experimental/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This directory contains [experimental](../../../../docs/experimental.md) CodeQL queries and libraries.

‎cpp/ql/src/semmle/code/cpp/Field.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ import semmle.code.cpp.exprs.Access
1919
class Field extends MemberVariable {
2020
Field() { fieldoffsets(underlyingElement(this), _, _) }
2121

22+
override string getCanonicalQLClass() { result = "Field" }
23+
2224
/**
2325
* Gets the offset of this field in bytes from the start of its declaring
2426
* type (on the machine where facts were extracted).
@@ -84,6 +86,8 @@ class Field extends MemberVariable {
8486
class BitField extends Field {
8587
BitField() { bitfield(underlyingElement(this), _, _) }
8688

89+
override string getCanonicalQLClass() { result = "BitField" }
90+
8791
/**
8892
* Gets the size of this bitfield in bits (on the machine where facts
8993
* were extracted).

‎cpp/ql/src/semmle/code/cpp/Variable.qll‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ private import semmle.code.cpp.internal.ResolveClass
2828
* can have multiple declarations.
2929
*/
3030
class Variable extends Declaration, @variable {
31+
override string getCanonicalQLClass() { result = "Variable" }
32+
3133
/** Gets the initializer of this variable, if any. */
3234
Initializer getInitializer() { result.getDeclaration() = this }
3335

@@ -351,6 +353,8 @@ class StackVariable extends LocalScopeVariable {
351353
* A local variable can be declared by a `DeclStmt` or a `ConditionDeclExpr`.
352354
*/
353355
class LocalVariable extends LocalScopeVariable, @localvariable {
356+
override string getCanonicalQLClass() { result = "LocalVariable" }
357+
354358
override string getName() { localvariables(underlyingElement(this), _, result) }
355359

356360
override Type getType() { localvariables(underlyingElement(this), unresolveElement(result), _) }
@@ -396,6 +400,8 @@ class NamespaceVariable extends GlobalOrNamespaceVariable {
396400
NamespaceVariable() {
397401
exists(Namespace n | namespacembrs(unresolveElement(n), underlyingElement(this)))
398402
}
403+
404+
override string getCanonicalQLClass() { result = "NamespaceVariable" }
399405
}
400406

401407
/**
@@ -415,6 +421,8 @@ class NamespaceVariable extends GlobalOrNamespaceVariable {
415421
*/
416422
class GlobalVariable extends GlobalOrNamespaceVariable {
417423
GlobalVariable() { not this instanceof NamespaceVariable }
424+
425+
override string getCanonicalQLClass() { result = "GlobalVariable" }
418426
}
419427

420428
/**
@@ -434,6 +442,8 @@ class GlobalVariable extends GlobalOrNamespaceVariable {
434442
class MemberVariable extends Variable, @membervariable {
435443
MemberVariable() { this.isMember() }
436444

445+
override string getCanonicalQLClass() { result = "MemberVariable" }
446+
437447
/** Holds if this member is private. */
438448
predicate isPrivate() { this.hasSpecifier("private") }
439449

0 commit comments

Comments
 (0)