Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bfe9ae2

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow
2 parents b1dcb01 + 508027e commit bfe9ae2

94 files changed

Lines changed: 1685 additions & 449 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,10 @@ postWithInFlow
101101
| test.cpp:531:40:531:40 | e [inner post update] | PostUpdateNode should not be the target of local flow. |
102102
| test.cpp:537:5:537:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
103103
| test.cpp:537:6:537:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
104-
| test.cpp:542:23:542:23 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
104+
| test.cpp:542:5:542:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
105+
| test.cpp:542:6:542:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
106+
| test.cpp:548:25:548:25 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
107+
| test.cpp:552:25:552:25 | y [inner post update] | PostUpdateNode should not be the target of local flow. |
105108
viableImplInCallContextTooLarge
106109
uniqueParameterNodeAtPosition
107110
uniqueParameterNodePosition

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -532,12 +532,23 @@ void test_set_through_const_pointer(int *e)
532532
sink(*e); // $ ir MISSING: ast
533533
}
534534

535-
void sink_then_source(int* p) {
536-
sink(*p);
537-
*p = source(); // $ SPURIOUS: ir=537:10 ir=541:9
535+
void sink_then_source_1(int* p) {
536+
sink(*p); // $ SPURIOUS: ir=537:10 ir=547:9
537+
*p = source();
538+
}
539+
540+
void sink_then_source_2(int* p, int y) {
541+
sink(y); // $ SPURIOUS: ast ir=542:10 ir=551:9
542+
*p = source();
538543
}
539544

540545
void test_sink_then_source() {
546+
{
541547
int x;
542-
sink_then_source(&x);
548+
sink_then_source_1(&x);
549+
}
550+
{
551+
int y;
552+
sink_then_source_2(&y, y);
553+
}
543554
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@
3737
| test.cpp:517:7:517:16 | stackArray | test.cpp:519:3:519:12 | stackArray |
3838
| test.cpp:517:7:517:16 | stackArray | test.cpp:520:3:520:12 | stackArray |
3939
| test.cpp:517:7:517:16 | stackArray | test.cpp:521:8:521:17 | stackArray |
40-
| test.cpp:541:9:541:9 | x | test.cpp:542:23:542:23 | x |
40+
| test.cpp:547:9:547:9 | x | test.cpp:548:25:548:25 | x |
41+
| test.cpp:551:9:551:9 | y | test.cpp:552:25:552:25 | y |
42+
| test.cpp:551:9:551:9 | y | test.cpp:552:28:552:28 | y |

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 100 additions & 100 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ class int_iterator_by_trait {
2727
template<>
2828
struct std::iterator_traits<int_iterator_by_trait> {
2929
typedef input_iterator_tag iterator_category;
30+
typedef int value_type;
31+
typedef size_t difference_type;
32+
typedef int* pointer;
33+
typedef int& reference;
3034
};
3135

3236
class non_iterator {
@@ -69,6 +73,10 @@ class insert_iterator_by_trait {
6973
template<>
7074
struct std::iterator_traits<insert_iterator_by_trait> {
7175
typedef output_iterator_tag iterator_category;
76+
typedef int value_type;
77+
typedef size_t difference_type;
78+
typedef int* pointer;
79+
typedef int& reference;
7280
};
7381

7482
class container {
@@ -84,7 +92,7 @@ void test_insert_iterator() {
8492

8593
insert_iterator_by_trait i1 = c1.begin();
8694
*i1-- = source();
87-
sink(c1); // $ ast MISSING: ir
95+
sink(c1); // $ ast,ir
8896

8997
insert_iterator_by_trait i2 = c2.begin();
9098
*i2-- = 0;
@@ -101,12 +109,12 @@ void test_assign_through_iterator() {
101109
a = c1.begin();
102110
b = c1.begin();
103111
*a = source();
104-
sink(a); // $ ast MISSING: ir
112+
sink(a); // $ ast,ir
105113

106114
c = c1.begin();
107115
sink(b); // MISSING: ast,ir
108-
sink(c); // $ ast MISSING: ir
109-
sink(c1); // $ ast MISSING: ir
116+
sink(c); // $ ast,ir
117+
sink(c1); // $ ast,ir
110118
}
111119

112120
void test_nonmember_iterator() {

‎docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ The `CodeQL repository <https://github.com/github/codeql>`__ on GitHub contains
4646
If you have that folder (or a different CodeQL pack) available in your workspace, you can access existing queries under ``<language>/ql/src/<category>``, for example ``java/ql/src/Likely Bugs``.
4747

4848
#. Open a query (``.ql``) file. It is displayed in the editor, with IntelliSense features such as syntax highlighting and autocomplete suggestions.
49-
#. Right-click in the query window and select **CodeQL: Run Query**. (Alternatively, run the command from the Command Palette.)
49+
#. Right-click in the query window and select **CodeQL: Run Query on Selected Database**. (Alternatively, run the command from the Command Palette.)
5050

5151
The CodeQL extension runs the query on the current database and reports progress in the bottom right corner of the application.
5252
When the results are ready, they're displayed in the Results view.
@@ -73,7 +73,7 @@ Running a quick query
7373

7474
When working on a new query, you can open a "quick query" tab to easily execute your code and view the results, without having to save a ``.ql`` file in your workspace.
7575
Open a quick query editing tab by selecting **CodeQL: Quick Query** from the Command Palette.
76-
To run the query, use **CodeQL: Run Query**.
76+
To run the query, use **CodeQL: Run Query on Selected Database**.
7777

7878
You can see all quick queries that you've run in the current session in the Query History view. Click an entry to see the exact text of the quick query that produced the results.
7979

@@ -85,7 +85,7 @@ Running a specific part of a query or library
8585
----------------------------------------------
8686

8787
This is helpful if you're debugging a query or library and you want to locate the part that is wrong.
88-
Instead of using **CodeQL: Run Query** to run the whole query (the :ref:`select clause <select-clauses>` and any :ref:`query predicates <query-predicates>`), you can use **CodeQL: Quick Evaluation** to run a specific part of a ``.ql`` or ``.qll`` file.
88+
Instead of using **CodeQL: Run Query on Selected Database** to run the whole query (the :ref:`select clause <select-clauses>` and any :ref:`query predicates <query-predicates>`), you can use **CodeQL: Quick Evaluation** to run a specific part of a ``.ql`` or ``.qll`` file.
8989

9090
**CodeQL: Quick Evaluation** evaluates a code snippet (instead of the whole query) and displays results of that selection in the Results view.
9191
Possible targets for quick evaluation include:

‎docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Running path queries in VS Code
2424
-----------------------------------
2525

2626
#. Open a path query in the editor.
27-
#. Right-click in the query window and select **CodeQL: Run Query**. (Alternatively, run the command from the Command Palette.)
27+
#. Right-click in the query window and select **CodeQL: Run Query on Selected Database**. (Alternatively, run the command from the Command Palette.)
2828
#. Once the query has finished running, you can see the results in the Results view as usual (under ``alerts`` in the dropdown menu). Each query result describes the flow of information between a source and a sink.
2929
#. Expand the result to see the individual steps that the data follows.
3030
#. Click each step to jump to it in the source code and investigate the problem further.

‎docs/codeql/reusables/vs-code-basic-instructions/run-quick-query-2.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
4. Save the query in its default location (a temporary "Quick Queries" directory under the workspace for ``GitHub.vscode-codeql/quick-queries``).
22

3-
#. Right-click in the query tab and select **CodeQL: Run Query**. (Alternatively, run the command from the Command Palette.)
3+
#. Right-click in the query tab and select **CodeQL: Run Query on Selected Database**. (Alternatively, run the command from the Command Palette.)
44

55
The query will take a few moments to return results. When the query completes, the results are displayed in a CodeQL Query Results view, next to the main editor view.
66

‎javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,13 @@ File tryExtensions(Folder dir, string basename, int priority) {
8787
* Or `name`, if `name` has no file extension.
8888
*/
8989
bindingset[name]
90-
private string getStem(string name) { result = name.regexpCapture("(.+?)(?:\\.([^.]+))?", 1) }
90+
private string getStem(string name) {
91+
// everything before the last dot
92+
result = name.regexpCapture("(.+?)(?:\\.([^.]+))?", 1)
93+
or
94+
// everything before the first dot
95+
result = name.regexpCapture("^([^.]*)\\..*$", 1)
96+
}
9197

9298
/**
9399
* Gets a file that a main module from `pkg` exported as `mainPath` with the given `priority`.

‎javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,12 @@ nodes
117117
| lib.js:128:9:128:20 | obj[path[0]] |
118118
| lib.js:128:13:128:16 | path |
119119
| lib.js:128:13:128:19 | path[0] |
120+
| otherlib/src/otherlibimpl.js:1:37:1:40 | path |
121+
| otherlib/src/otherlibimpl.js:1:37:1:40 | path |
122+
| otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] |
123+
| otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] |
124+
| otherlib/src/otherlibimpl.js:2:7:2:10 | path |
125+
| otherlib/src/otherlibimpl.js:2:7:2:13 | path[0] |
120126
| sublib/other.js:5:28:5:31 | path |
121127
| sublib/other.js:5:28:5:31 | path |
122128
| sublib/other.js:6:7:6:18 | obj[path[0]] |
@@ -295,6 +301,11 @@ edges
295301
| lib.js:128:13:128:16 | path | lib.js:128:13:128:19 | path[0] |
296302
| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
297303
| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
304+
| otherlib/src/otherlibimpl.js:1:37:1:40 | path | otherlib/src/otherlibimpl.js:2:7:2:10 | path |
305+
| otherlib/src/otherlibimpl.js:1:37:1:40 | path | otherlib/src/otherlibimpl.js:2:7:2:10 | path |
306+
| otherlib/src/otherlibimpl.js:2:7:2:10 | path | otherlib/src/otherlibimpl.js:2:7:2:13 | path[0] |
307+
| otherlib/src/otherlibimpl.js:2:7:2:13 | path[0] | otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] |
308+
| otherlib/src/otherlibimpl.js:2:7:2:13 | path[0] | otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] |
298309
| sublib/other.js:5:28:5:31 | path | sublib/other.js:6:11:6:14 | path |
299310
| sublib/other.js:5:28:5:31 | path | sublib/other.js:6:11:6:14 | path |
300311
| sublib/other.js:6:11:6:14 | path | sublib/other.js:6:11:6:17 | path[0] |
@@ -367,6 +378,7 @@ edges
367378
| lib.js:108:3:108:10 | obj[one] | lib.js:104:13:104:21 | arguments | lib.js:108:3:108:10 | obj[one] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:104:13:104:21 | arguments | library input |
368379
| lib.js:119:13:119:24 | obj[path[0]] | lib.js:118:29:118:32 | path | lib.js:119:13:119:24 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:118:29:118:32 | path | library input |
369380
| lib.js:128:9:128:20 | obj[path[0]] | lib.js:127:14:127:17 | path | lib.js:128:9:128:20 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:127:14:127:17 | path | library input |
381+
| otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] | otherlib/src/otherlibimpl.js:1:37:1:40 | path | otherlib/src/otherlibimpl.js:2:3:2:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | otherlib/src/otherlibimpl.js:1:37:1:40 | path | library input |
370382
| sublib/other.js:6:7:6:18 | obj[path[0]] | sublib/other.js:5:28:5:31 | path | sublib/other.js:6:7:6:18 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/other.js:5:28:5:31 | path | library input |
371383
| sublib/sub.js:2:3:2:14 | obj[path[0]] | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:3:2:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/sub.js:1:37:1:40 | path | library input |
372384
| tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |

0 commit comments

Comments
 (0)