Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d1a58f1

Browse files
erik-krogherik-krogh
committed
Merge remote-tracking branch 'upstream/master' into CVE74
2 parents b07f3d3 + 23ed2bc commit d1a58f1

122 files changed

Lines changed: 1756 additions & 992 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlmanifest.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,4 @@
22
"*/ql/test/qlpack.yml",
33
"*/upgrades/qlpack.yml",
44
"misc/legacy-support/*/qlpack.yml",
5-
"misc/suite-helpers/qlpack.yml",
6-
"codeql/.codeqlmanifest.json" ] }
5+
"misc/suite-helpers/qlpack.yml" ] }

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# editor and OS artifacts
22
*~
33
.DS_STORE
4+
*.swp
45

56
# query compilation caches
67
.cache

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,26 @@
99

1010
* Imports that rely on path-mappings from a `tsconfig.json` file can now be resolved.
1111

12+
* Export declarations of the form `export * as ns from "x"` are now analyzed more precisely.
13+
1214
* The analysis of sanitizer guards has improved, leading to fewer false-positive results from the security queries.
1315

1416
* Support for the following frameworks and libraries has been improved:
15-
- [react](https://www.npmjs.com/package/react)
16-
- [typeahead.js](https://www.npmjs.com/package/typeahead.js)
17-
- [Handlebars](https://www.npmjs.com/package/handlebars)
1817
- [Electron](https://electronjs.org/)
18+
- [Handlebars](https://www.npmjs.com/package/handlebars)
19+
- [Koa](https://www.npmjs.com/package/koa)
1920
- [Node.js](https://nodejs.org/)
2021
- [Socket.IO](https://socket.io/)
21-
- [ws](https://github.com/websockets/ws)
2222
- [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
23-
- [Koa](https://www.npmjs.com/package/koa)
24-
- [lazy-cache](https://www.npmjs.com/package/lazy-cache)
23+
- [chrome-remote-interface](https://www.npmjs.com/package/chrome-remote-interface)
2524
- [for-in](https://www.npmjs.com/package/for-in)
2625
- [for-own](https://www.npmjs.com/package/for-own)
26+
- [http2](https://nodejs.org/api/http2.html)
27+
- [lazy-cache](https://www.npmjs.com/package/lazy-cache)
28+
- [react](https://www.npmjs.com/package/react)
2729
- [send](https://www.npmjs.com/package/send)
30+
- [typeahead.js](https://www.npmjs.com/package/typeahead.js)
31+
- [ws](https://github.com/websockets/ws)
2832

2933
## New queries
3034

@@ -47,6 +51,7 @@
4751
| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
4852
| Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
4953
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed. |
54+
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. |
5055

5156
## Changes to libraries
5257

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,12 @@
33
*/
44

55
private import cpp
6+
// The `ValueNumbering` library has to be imported right after `cpp` to ensure
7+
// that the cached IR gets the same checksum here as it does in queries that use
8+
// `ValueNumbering` without `DataFlow`.
9+
private import semmle.code.cpp.ir.ValueNumbering
610
private import semmle.code.cpp.ir.IR
711
private import semmle.code.cpp.controlflow.IRGuards
8-
private import semmle.code.cpp.ir.ValueNumbering
912
private import semmle.code.cpp.models.interfaces.DataFlow
1013

1114
private newtype TIRDataFlowNode =

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll‎

Lines changed: 45 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,18 @@ newtype TValueNumber =
1919
fieldAddressValueNumber(_, irFunc, field, objectAddress)
2020
} or
2121
TBinaryValueNumber(
22-
IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
23-
TValueNumber rightOperand
22+
IRFunction irFunc, Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand
2423
) {
25-
binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
24+
binaryValueNumber(_, irFunc, opcode, leftOperand, rightOperand)
2625
} or
2726
TPointerArithmeticValueNumber(
28-
IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
27+
IRFunction irFunc, Opcode opcode, int elementSize, TValueNumber leftOperand,
2928
TValueNumber rightOperand
3029
) {
31-
pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
30+
pointerArithmeticValueNumber(_, irFunc, opcode, elementSize, leftOperand, rightOperand)
3231
} or
33-
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
34-
unaryValueNumber(_, irFunc, opcode, type, operand)
32+
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, TValueNumber operand) {
33+
unaryValueNumber(_, irFunc, opcode, operand)
3534
} or
3635
TInheritanceConversionValueNumber(
3736
IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
@@ -99,14 +98,28 @@ private predicate numberableInstruction(Instruction instr) {
9998
instr instanceof LoadTotalOverlapInstruction
10099
}
101100

101+
private predicate filteredNumberableInstruction(Instruction instr) {
102+
// count rather than strictcount to handle missing AST elements
103+
// separate instanceof and inline casts to avoid failed casts with a count of 0
104+
instr instanceof VariableAddressInstruction and
105+
count(instr.(VariableAddressInstruction).getIRVariable().getAST()) != 1
106+
or
107+
instr instanceof ConstantInstruction and
108+
count(instr.getResultIRType()) != 1
109+
or
110+
instr instanceof FieldAddressInstruction and
111+
count(instr.(FieldAddressInstruction).getField()) != 1
112+
}
113+
102114
private predicate variableAddressValueNumber(
103115
VariableAddressInstruction instr, IRFunction irFunc, Language::AST ast
104116
) {
105117
instr.getEnclosingIRFunction() = irFunc and
106118
// The underlying AST element is used as value-numbering key instead of the
107119
// `IRVariable` to work around a problem where a variable or expression with
108120
// multiple types gives rise to multiple `IRVariable`s.
109-
instr.getIRVariable().getAST() = ast
121+
instr.getIRVariable().getAST() = ast and
122+
strictcount(instr.getIRVariable().getAST()) = 1
110123
}
111124

112125
private predicate initializeParameterValueNumber(
@@ -123,10 +136,11 @@ private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRF
123136
instr.getEnclosingIRFunction() = irFunc
124137
}
125138

126-
private predicate constantValueNumber(
139+
predicate constantValueNumber(
127140
ConstantInstruction instr, IRFunction irFunc, IRType type, string value
128141
) {
129142
instr.getEnclosingIRFunction() = irFunc and
143+
strictcount(instr.getResultIRType()) = 1 and
130144
instr.getResultIRType() = type and
131145
instr.getValue() = value
132146
}
@@ -145,42 +159,40 @@ private predicate fieldAddressValueNumber(
145159
) {
146160
instr.getEnclosingIRFunction() = irFunc and
147161
instr.getField() = field and
162+
strictcount(instr.getField()) = 1 and
148163
tvalueNumber(instr.getObjectAddress()) = objectAddress
149164
}
150165

151166
private predicate binaryValueNumber(
152-
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
167+
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber leftOperand,
153168
TValueNumber rightOperand
154169
) {
155170
instr.getEnclosingIRFunction() = irFunc and
156171
not instr instanceof PointerArithmeticInstruction and
157172
instr.getOpcode() = opcode and
158-
instr.getResultIRType() = type and
159173
tvalueNumber(instr.getLeft()) = leftOperand and
160174
tvalueNumber(instr.getRight()) = rightOperand
161175
}
162176

163177
private predicate pointerArithmeticValueNumber(
164-
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
165-
int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
178+
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, int elementSize,
179+
TValueNumber leftOperand, TValueNumber rightOperand
166180
) {
167181
instr.getEnclosingIRFunction() = irFunc and
168182
instr.getOpcode() = opcode and
169-
instr.getResultIRType() = type and
170183
instr.getElementSize() = elementSize and
171184
tvalueNumber(instr.getLeft()) = leftOperand and
172185
tvalueNumber(instr.getRight()) = rightOperand
173186
}
174187

175188
private predicate unaryValueNumber(
176-
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
189+
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber operand
177190
) {
178191
instr.getEnclosingIRFunction() = irFunc and
179192
not instr instanceof InheritanceConversionInstruction and
180193
not instr instanceof CopyInstruction and
181194
not instr instanceof FieldAddressInstruction and
182195
instr.getOpcode() = opcode and
183-
instr.getResultIRType() = type and
184196
tvalueNumber(instr.getUnary()) = operand
185197
}
186198

@@ -200,9 +212,9 @@ private predicate loadTotalOverlapValueNumber(
200212
TValueNumber operand
201213
) {
202214
instr.getEnclosingIRFunction() = irFunc and
203-
instr.getResultIRType() = type and
204215
tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
205-
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
216+
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand and
217+
instr.getResultIRType() = type
206218
}
207219

208220
/**
@@ -212,7 +224,11 @@ private predicate loadTotalOverlapValueNumber(
212224
private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
213225
instr.getEnclosingIRFunction() = irFunc and
214226
not instr.getResultIRType() instanceof IRVoidType and
215-
not numberableInstruction(instr)
227+
(
228+
not numberableInstruction(instr)
229+
or
230+
filteredNumberableInstruction(instr)
231+
)
216232
}
217233

218234
/**
@@ -255,7 +271,7 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
255271
initializeThisValueNumber(instr, irFunc) and
256272
result = TInitializeThisValueNumber(irFunc)
257273
or
258-
exists(IRType type, string value |
274+
exists(string value, IRType type |
259275
constantValueNumber(instr, irFunc, type, value) and
260276
result = TConstantValueNumber(irFunc, type, value)
261277
)
@@ -270,14 +286,14 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
270286
result = TFieldAddressValueNumber(irFunc, field, objectAddress)
271287
)
272288
or
273-
exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
274-
binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
275-
result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
289+
exists(Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand |
290+
binaryValueNumber(instr, irFunc, opcode, leftOperand, rightOperand) and
291+
result = TBinaryValueNumber(irFunc, opcode, leftOperand, rightOperand)
276292
)
277293
or
278-
exists(Opcode opcode, IRType type, TValueNumber operand |
279-
unaryValueNumber(instr, irFunc, opcode, type, operand) and
280-
result = TUnaryValueNumber(irFunc, opcode, type, operand)
294+
exists(Opcode opcode, TValueNumber operand |
295+
unaryValueNumber(instr, irFunc, opcode, operand) and
296+
result = TUnaryValueNumber(irFunc, opcode, operand)
281297
)
282298
or
283299
exists(
@@ -287,14 +303,10 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
287303
result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
288304
)
289305
or
290-
exists(
291-
Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
292-
TValueNumber rightOperand
293-
|
294-
pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
295-
rightOperand) and
306+
exists(Opcode opcode, int elementSize, TValueNumber leftOperand, TValueNumber rightOperand |
307+
pointerArithmeticValueNumber(instr, irFunc, opcode, elementSize, leftOperand, rightOperand) and
296308
result =
297-
TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
309+
TPointerArithmeticValueNumber(irFunc, opcode, elementSize, leftOperand, rightOperand)
298310
)
299311
or
300312
exists(IRType type, TValueNumber memOperand, TValueNumber operand |

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ private module Cached {
9696
}
9797

9898
cached
99-
Instruction getMemoryOperandDefinition(
99+
private Instruction getMemoryOperandDefinition0(
100100
Instruction instruction, MemoryOperandTag tag, Overlap overlap
101101
) {
102102
exists(OldInstruction oldInstruction, OldIR::NonPhiMemoryOperand oldOperand |
@@ -142,6 +142,19 @@ private module Cached {
142142
overlap instanceof MustExactlyOverlap
143143
}
144144

145+
cached
146+
Instruction getMemoryOperandDefinition(
147+
Instruction instruction, MemoryOperandTag tag, Overlap overlap
148+
) {
149+
// getMemoryOperandDefinition0 currently has a bug where it can match with multiple overlaps.
150+
// This predicate ensures that the chosen overlap is the most conservative if there's any doubt.
151+
result = getMemoryOperandDefinition0(instruction, tag, overlap) and
152+
not (
153+
overlap instanceof MustExactlyOverlap and
154+
exists(MustTotallyOverlap o | exists(getMemoryOperandDefinition0(instruction, tag, o)))
155+
)
156+
}
157+
145158
/**
146159
* Holds if `instr` is part of a cycle in the operand graph that doesn't go
147160
* through a phi instruction and therefore should be impossible.

0 commit comments

Comments
 (0)