Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ccebd5e

Browse files
hvitvedhvitved
committed
Merge remote-tracking branch 'upstream/master' into mergeback-2018-10-08
2 parents 546a91e + e354694 commit ccebd5e

27 files changed

Lines changed: 391 additions & 176 deletions

File tree

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,5 @@
3434
| Whitespace contradicts operator precedence | Fewer false-positive results | This rule no longer flags operators with asymmetric whitespace. |
3535

3636
## Changes to QL libraries
37+
38+
* The flow configuration framework now supports distinguishing and tracking different kinds of taint, specified by an extensible class `FlowLabel` (which can also be referred to by its alias `TaintKind`).

‎cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ predicate stringType(Type t, Type charType) {
2525
charType = t.(ArrayType).getBaseType()
2626
) and (
2727
charType.getUnspecifiedType() instanceof CharType or
28-
charType.getUnspecifiedType() instanceof WideCharType
28+
charType.getUnspecifiedType() instanceof Wchar_t
2929
)
3030
)
3131
or

‎cpp/ql/src/Likely Bugs/UseInOwnInitializer.ql‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,21 @@
1111

1212
import cpp
1313

14-
from Initializer init, Variable v, VariableAccess va
15-
where init.getDeclaration() = v
16-
and va.getTarget() = v
17-
and va.getParent*() = init
14+
class VariableAccessInInitializer extends VariableAccess {
15+
Variable var;
16+
Initializer init;
17+
VariableAccessInInitializer() {
18+
init.getDeclaration() = var and
19+
init.getExpr().getAChild*() = this
20+
}
21+
22+
predicate initializesItself(Variable v, Initializer i) {
23+
v = var and i = init and var = this.getTarget()
24+
}
25+
}
26+
27+
from Initializer init, Variable v, VariableAccessInInitializer va
28+
where va.initializesItself(v, init)
1829
and (
1930
va.hasLValueToRValueConversion() or
2031
exists (Assignment assn | assn.getLValue() = va) or

‎cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import cpp
1919
class AnyCharPointerType extends PointerType {
2020
AnyCharPointerType() {
2121
this.getBaseType().getUnderlyingType() instanceof CharType or
22-
this.getBaseType().getUnderlyingType() instanceof WideCharType
22+
this.getBaseType().getUnderlyingType() instanceof Wchar_t
2323
}
2424
}
2525

@@ -29,7 +29,7 @@ class AnyCharPointerType extends PointerType {
2929
class AnyCharArrayType extends ArrayType {
3030
AnyCharArrayType() {
3131
this.getBaseType().getUnderlyingType() instanceof CharType or
32-
this.getBaseType().getUnderlyingType() instanceof WideCharType
32+
this.getBaseType().getUnderlyingType() instanceof Wchar_t
3333
}
3434
}
3535

‎cpp/ql/src/semmle/code/cpp/Type.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -601,6 +601,10 @@ class VoidType extends BuiltInType {
601601

602602
/**
603603
* The C/C++ wide character type.
604+
*
605+
* Note that on some platforms `wchar_t` doesn't exist as a built-in
606+
* type but a typedef is provided. Consider using the `Wchar_t` QL
607+
* class to include these types.
604608
*/
605609
class WideCharType extends IntegralType {
606610

‎cpp/ql/src/semmle/code/cpp/commons/CommonType.qll‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import semmle.code.cpp.Type
22

33
/**
4-
* The C/C++ char* type.
4+
* The C/C++ `char*` type.
55
*/
66
class CharPointerType extends PointerType {
77

@@ -10,7 +10,7 @@ class CharPointerType extends PointerType {
1010
}
1111

1212
/**
13-
* The C/C++ int* type.
13+
* The C/C++ `int*` type.
1414
*/
1515
class IntPointerType extends PointerType {
1616

@@ -20,7 +20,7 @@ class IntPointerType extends PointerType {
2020

2121

2222
/**
23-
* The C/C++ void* type.
23+
* The C/C++ `void*` type.
2424
*/
2525
class VoidPointerType extends PointerType {
2626

@@ -29,7 +29,7 @@ class VoidPointerType extends PointerType {
2929
}
3030

3131
/**
32-
* The C/C++ size_t type.
32+
* The C/C++ `size_t` type.
3333
*/
3434
class Size_t extends Type {
3535
Size_t() {
@@ -39,7 +39,7 @@ class Size_t extends Type {
3939
}
4040

4141
/**
42-
* The C/C++ ssize_t type.
42+
* The C/C++ `ssize_t` type.
4343
*/
4444
class Ssize_t extends Type {
4545
Ssize_t() {
@@ -49,7 +49,7 @@ class Ssize_t extends Type {
4949
}
5050

5151
/**
52-
* The C/C++ ptrdiff_t type.
52+
* The C/C++ `ptrdiff_t` type.
5353
*/
5454
class Ptrdiff_t extends Type {
5555
Ptrdiff_t() {
@@ -59,7 +59,7 @@ class Ptrdiff_t extends Type {
5959
}
6060

6161
/**
62-
* The C/C++ intmax_t type.
62+
* The C/C++ `intmax_t` type.
6363
*/
6464
class Intmax_t extends Type {
6565
Intmax_t() {
@@ -69,7 +69,7 @@ class Intmax_t extends Type {
6969
}
7070

7171
/**
72-
* The C/C++ uintmax_t type.
72+
* The C/C++ `uintmax_t` type.
7373
*/
7474
class Uintmax_t extends Type {
7575
Uintmax_t() {
@@ -79,7 +79,11 @@ class Uintmax_t extends Type {
7979
}
8080

8181
/**
82-
* The C/C++ wchar_t type.
82+
* The C/C++ `wchar_t` type.
83+
*
84+
* Note that on some platforms `wchar_t` doesn't exist as a built-in
85+
* type but a typedef is provided. This QL class includes both cases
86+
* (see also `WideCharType`).
8387
*/
8488
class Wchar_t extends Type {
8589
Wchar_t() {

‎cpp/ql/src/semmle/code/cpp/controlflow/internal/PrimitiveBasicBlocks.qll‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,11 @@ private cached module Cached {
3131
// or the node's predecessor has more than one successor,
3232
// then the node is the start of a new primitive basic block.
3333
or
34-
strictcount (Node pred, Node other
35-
| successors_extended(pred,node) and successors_extended(pred,other)) > 1
34+
strictcount(Node pred | successors_extended(pred, node)) > 1
35+
or
36+
exists(ControlFlowNode pred | successors_extended(pred, node) |
37+
strictcount(ControlFlowNode other | successors_extended(pred, other)) > 1
38+
)
3639

3740
// If the node has zero predecessors then it is the start of
3841
// a BB. However, the C++ AST contains many nodes with zero
@@ -63,8 +66,14 @@ private cached module Cached {
6366
/** Holds if `node` is the `pos`th control-flow node in primitive basic block `bb`. */
6467
cached
6568
predicate primitive_basic_block_member(Node node, PrimitiveBasicBlock bb, int pos) {
66-
pos = getMemberIndex(node) and
67-
member_step*(bb, node)
69+
primitive_basic_block_entry_node(bb) and
70+
(
71+
pos = 0 and
72+
node = bb
73+
or
74+
pos = getMemberIndex(node) and
75+
member_step+(bb, node)
76+
)
6877
}
6978

7079
/** Gets the number of control-flow nodes in the primitive basic block `bb`. */

‎javascript/ql/src/Expressions/UnboundEventHandlerReceiver.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,11 @@ private predicate isBoundInMethod(MethodDeclaration method) {
4545
)
4646
or
4747
exists (Expr decoration, string name |
48-
decoration = method.getADecorator().getExpression() and
48+
(
49+
decoration = method.getADecorator().getExpression()
50+
or
51+
decoration = method.getDeclaringType().(ClassDefinition).getADecorator().getExpression()
52+
) and
4953
name.regexpMatch("(?i).*(bind|bound).*") |
5054
// @autobind
5155
decoration.(Identifier).getName() = name or

‎javascript/ql/src/Security/CWE-078/CommandInjection.ql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,8 @@ import semmle.javascript.security.dataflow.CommandInjection::CommandInjection
1717

1818
from Configuration cfg, DataFlow::Node source, DataFlow::Node sink, DataFlow::Node highlight
1919
where cfg.hasFlow(source, sink) and
20-
if cfg.isSink(sink, _) then cfg.isSink(sink, highlight) else highlight = sink
20+
if cfg.isSinkWithHighlight(sink, _) then
21+
cfg.isSinkWithHighlight(sink, highlight)
22+
else
23+
highlight = sink
2124
select highlight, "This command depends on $@.", source, "a user-provided value"

0 commit comments

Comments
 (0)