Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit cbbe9b4

Browse files
jbjjbj
committed
Merge remote-tracking branch 'upstream/master' into ir-copy-unloaded-result
Fixed conflicts by accepting new qltest output. Conflicts: cpp/ql/test/library-tests/ir/ir/raw_ir.expected cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
2 parents b75bf06 + 219fcb7 commit cbbe9b4

764 files changed

Lines changed: 47585 additions & 10914 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlmanifest.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{ "provide": [ "*/ql/src/qlpack.yml",
2+
"misc/legacy-support/*/qlpack.yml",
3+
"misc/suite-helpers/qlpack.yml" ] }

‎.github/ISSUE_TEMPLATE/ql---general.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
name: General issue
3+
about: Tell us if you think something is wrong or if you have a question
4+
title: General issue
5+
labels: question
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the issue**
11+
12+
<!-- Please explain briefly what is the problem.
13+
If it is about an LGTM project, please include its URL.-->
14+

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,6 @@
1212
# Visual studio temporaries, except a file used by QL4VS
1313
.vs/*
1414
!.vs/VSWorkspaceSettings.json
15+
16+
# It's useful (though not required) to be able to unpack codeql in the ql checkout itself
17+
/codeql/

‎CODEOWNERS‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
/java/ @Semmle/java
33
/javascript/ @Semmle/js
44
/cpp/ @Semmle/cpp-analysis
5-
/cpp/**/*.qhelp @semmledocs-ac
5+
/cpp/**/*.qhelp @hubwriter
66
/csharp/**/*.qhelp @jf205
7-
/java/**/*.qhelp @felicity-semmle
8-
/javascript/**/*.qhelp @mc-semmle
9-
/python/**/*.qhelp @felicity-semmle
10-
/docs/language/ @felicity-semmle @jf205
7+
/java/**/*.qhelp @felicitymay
8+
/javascript/**/*.qhelp @mchammer01
9+
/python/**/*.qhelp @felicitymay
10+
/docs/language/ @shati-patel @jf205

‎change-notes/1.22/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
| Shift out of range (`js/shift-out-of-range`| Fewer false positive results | This rule now correctly handles BigInt shift operands. |
3737
| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer false-positive results. | This rule no longer flags calls to placeholder functions that trivially throw an exception. |
3838
| Undocumented parameter (`js/jsdoc/missing-parameter`) | No changes to results | This rule is now run on LGTM, although its results are still not shown by default. |
39+
| Missing space in string concatenation (`js/missing-space-in-concatenation`) | Fewer false positive results | The rule now requires a word-like part exists in the string concatenation. |
3940

4041
## Changes to QL libraries
4142

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
1818
| Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
1919
| Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
2020
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | More correct results | This query now checks for the beginning date of the Reiwa era (1st May 2019). |
21+
| Sign check of bitwise operation (`cpp/bitwise-sign-check`) | Fewer false positive results | Results involving `>=` or `<=` are no longer reported. |
22+
| Too few arguments to formatting function (`cpp/wrong-number-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
23+
| Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
24+
| Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
2125

2226
## Changes to QL libraries
2327

@@ -28,6 +32,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
2832
picture of the partial flow paths from a given source. The feature is
2933
disabled by default and can be enabled for individual configurations by
3034
overriding `int explorationLimit()`.
35+
* The data-flow library now supports flow out of C++ reference parameters.
3136
* The data-flow library now allows flow through the address-of operator (`&`).
3237
* The `DataFlow::DefinitionByReferenceNode` class now considers `f(x)` to be a
3338
definition of `x` when `x` is a variable of pointer type. It no longer
@@ -36,3 +41,11 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3641
* There is now a `DataFlow::localExprFlow` predicate and a
3742
`TaintTracking::localExprTaint` predicate to make it easy to use the most
3843
common case of local data flow and taint: from one `Expr` to another.
44+
* The member predicates of the `FunctionInput` and `FunctionOutput` classes have been renamed for
45+
clarity (e.g. `isOutReturnPointer()` to `isReturnValueDeref()`). The existing member predicates
46+
have been deprecated, and will be removed in a future release. Code that uses the old member
47+
predicates should be updated to use the corresponding new member predicate.
48+
* The control-flow graph is now computed in QL, not in the extractor. This can
49+
lead to regressions (or improvements) in how queries are optimized because
50+
optimization in QL relies on static size estimates, and the control-flow edge
51+
relations will now have different size estimates than before.

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
1616
| **Query** | **Expected impact** | **Change** |
1717
|------------------------------|------------------------|-----------------------------------|
1818
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | Fewer false positive results | More `null` checks are now taken into account, including `null` checks for `dynamic` expressions and `null` checks such as `object alwaysNull = null; if (x != alwaysNull) ...`. |
19+
| Missing Dispose call on local IDisposable (`cs/local-not-disposed`) | Fewer false positive results | The query has been rewritten in order to identify more dispose patterns. For example, a local `IDisposable` that is disposed of by passing through a fluent API is no longer reported. |
1920

2021
## Removal of old queries
2122

@@ -38,5 +39,9 @@ The following changes in version 1.23 affect C# analysis in all applications.
3839
disabled by default and can be enabled for individual configurations by
3940
overriding `int explorationLimit()`.
4041
* `foreach` statements where the body is guaranteed to be executed at least once, such as `foreach (var x in new string[]{ "a", "b", "c" }) { ... }`, are now recognized by all analyses based on the control flow graph (such as SSA, data flow and taint tracking).
42+
* Fixed the control flow graph for `switch` statements where the `default` case was not the last case. This had caused the remaining cases to be unreachable. `SwitchStmt.getCase(int i)` now puts the `default` case last.
43+
* There is now a `DataFlow::localExprFlow` predicate and a
44+
`TaintTracking::localExprTaint` predicate to make it easy to use the most
45+
common case of local data flow and taint: from one `Expr` to another.
4146

4247
## Changes to autobuilder

‎change-notes/1.23/analysis-java.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,12 @@ The following changes in version 1.23 affect Java analysis in all applications.
66

77
| **Query** | **Expected impact** | **Change** |
88
|------------------------------|------------------------|-----------------------------------|
9+
| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positives | Certain indirect null guards involving two auxiliary variables known to be equal can now be detected. |
10+
| Non-synchronized override of synchronized method (`java/non-sync-override`) | Fewer false positives | Results are now only reported if the immediately overridden method is synchronized. |
911
| Query built from user-controlled sources (`java/sql-injection`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
1012
| Query built from local-user-controlled sources (`java/sql-injection-local`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
1113
| Query built without neutralizing special characters (`java/concatenated-sql-query`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
14+
| Useless comparison test (`java/constant-comparison`) | Fewer false positives | Additional overflow check patterns are now recognized and no longer reported. |
1215

1316
## Changes to QL libraries
1417

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## General improvements
44

5+
* Suppor for `globalThis` has been added.
6+
57
* Support for the following frameworks and libraries has been improved:
68
- [firebase](https://www.npmjs.com/package/firebase)
79
- [mongodb](https://www.npmjs.com/package/mongodb)
@@ -16,22 +18,47 @@
1618
|---------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
1719
| Unused index variable (`js/unused-index-variable`) | correctness | Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default. |
1820
| Loop bound injection (`js/loop-bound-injection`) | security, external/cwe/cwe-834 | Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are not shown on LGTM by default. |
21+
| Suspicious method name (`js/suspicious-method-name-declaration`) | correctness, typescript, methods | Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default. |
22+
| Shell command built from environment values (`js/shell-command-injection-from-environment`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-088 | Highlights shell commands that may change behavior inadvertently depending on the execution environment, indicating a possible violation of [CWE-78](https://cwe.mitre.org/data/definitions/78.html). Results are shown on LGTM by default.|
23+
| Use of returnless function (`js/use-of-returnless-function`) | maintainability, correctness | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
24+
| Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
25+
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
1926

2027
## Changes to existing queries
2128

2229
| **Query** | **Expected impact** | **Change** |
2330
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
2431
| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false-positive results | This rule now recognizes additional ways delimiters can be stripped away. |
25-
| Client-side cross-site scripting (`js/xss`) | More results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized. |
32+
| Client-side cross-site scripting (`js/xss`) | More results, fewer false-positive results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected. |
2633
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized. |
2734
| Hard-coded credentials (`js/hardcoded-credentials`) | Fewer false-positive results | This rule now flags fewer password examples. |
2835
| Illegal invocation (`js/illegal-invocation`) | Fewer false-positive results | This rule now correctly handles methods named `call` and `apply`. |
29-
| Incorrect suffix check (`js/incorrect-suffix-check`) | Fewer false-positive results | The query recognizes valid checks in more cases.
36+
| Incorrect suffix check (`js/incorrect-suffix-check`) | Fewer false-positive results | The query recognizes valid checks in more cases. |
3037
| Network data written to file (`js/http-to-file-access`) | Fewer false-positive results | This query has been renamed to better match its intended purpose, and now only considers network data untrusted. |
3138
| Password in configuration file (`js/password-in-configuration-file`) | Fewer false-positive results | This rule now flags fewer password examples. |
3239
| Prototype pollution (`js/prototype-pollution`) | More results | The query now highlights vulnerable uses of jQuery and Angular, and the results are shown on LGTM by default. |
40+
| Reflected cross-site scripting (`js/reflected-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
41+
| Stored cross-site scripting (`js/stored-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
3342
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now treats responses from servers as untrusted. |
3443

3544
## Changes to QL libraries
3645

3746
* `Expr.getDocumentation()` now handles chain assignments.
47+
48+
## Removal of deprecated queries
49+
50+
The following queries (deprecated since 1.17) are no longer available in the distribution:
51+
52+
* Builtin redefined (js/builtin-redefinition)
53+
* Inefficient method definition (js/method-definition-in-constructor)
54+
* Bad parity check (js/incomplete-parity-check)
55+
* Potentially misspelled property or variable name (js/wrong-capitalization)
56+
* Unknown JSDoc tag (js/jsdoc/unknown-tag-type)
57+
* Invalid JSLint directive (js/jslint/invalid-directive)
58+
* Malformed JSLint directive (js/jslint/malformed-directive)
59+
* Use of HTML comments (js/html-comment)
60+
* Multi-line string literal (js/multi-line-string)
61+
* Octal literal (js/octal-literal)
62+
* Reserved word used as variable name (js/use-of-reserved-word)
63+
* Trailing comma in array or object expressions (js/trailing-comma-in-array-or-object)
64+
* Call to parseInt without radix (js/parseint-without-radix)

‎change-notes/1.23/analysis-python.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,12 @@
1111
|-----------|----------|-------------|
1212
| Clear-text logging of sensitive information (`py/clear-text-logging-sensitive-data`) | security, external/cwe/cwe-312 | Finds instances where sensitive information is logged without encryption or hashing. Results are shown on LGTM by default. |
1313
| Clear-text storage of sensitive information (`py/clear-text-storage-sensitive-data`) | security, external/cwe/cwe-312 | Finds instances where sensitive information is stored without encryption or hashing. Results are shown on LGTM by default. |
14+
| Binding a socket to all network interfaces (`py/bind-socket-all-network-interfaces`) | security | Finds instances where a socket is bound to all network interfaces. Results are shown on LGTM by default. |
15+
16+
17+
## Changes to existing queries
18+
19+
| **Query** | **Expected impact** | **Change** |
20+
|----------------------------|------------------------|------------|
21+
| Unreachable code | Fewer false positives | Analysis now accounts for uses of `contextlib.suppress` to suppress exceptions. |
1422

0 commit comments

Comments
 (0)