Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d1d19a7

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
Update test expectations
2 parents 2d3a742 + 3c8aeb9 commit d1d19a7

56 files changed

Lines changed: 3125 additions & 1939 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.24/analysis-csharp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ The following changes in version 1.24 affect C# analysis in all applications.
2020
| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the variable is named `_` in a `foreach` statement. |
2121
| Potentially dangerous use of non-short-circuit logic (`cs/non-short-circuit`) | Fewer false positive results | Results have been removed when the expression contains an `out` parameter. |
2222
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | More results | Results are reported from parameters with a default value of `null`. |
23+
| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the value assigned is an (implicitly or explicitly) cast default-like value. For example, `var s = (string)null` and `string s = default`. |
2324

2425
## Removal of old queries
2526

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@
2121
- [ws](https://github.com/websockets/ws)
2222
- [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
2323
- [Koa](https://www.npmjs.com/package/koa)
24+
- [lazy-cache](https://www.npmjs.com/package/lazy-cache)
25+
- [for-in](https://www.npmjs.com/package/for-in)
26+
- [for-own](https://www.npmjs.com/package/for-own)
2427

2528
## New queries
2629

‎config/identical-files.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,12 @@
222222
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
223223
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
224224
],
225-
"IR ValueNumber": [
225+
"C++ IR ValueNumberInternal": [
226+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
227+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
228+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll"
229+
],
230+
"C++ IR ValueNumber": [
226231
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
227232
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
228233
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll‎

Lines changed: 19 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
6969

7070
override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
7171

72-
override predicate isSink(DataFlow::Node sink) { any() }
72+
override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
7373

7474
override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
7575
instructionTaintStep(n1.asInstruction(), n2.asInstruction())
@@ -84,18 +84,15 @@ private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
8484
override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
8585

8686
override predicate isSink(DataFlow::Node sink) {
87-
exists(GlobalOrNamespaceVariable gv | writesVariable(sink.asInstruction(), gv))
87+
sink.asVariable() instanceof GlobalOrNamespaceVariable
8888
}
8989

9090
override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
9191
instructionTaintStep(n1.asInstruction(), n2.asInstruction())
9292
or
93-
exists(StoreInstruction i1, LoadInstruction i2, GlobalOrNamespaceVariable gv |
94-
writesVariable(i1, gv) and
95-
readsVariable(i2, gv) and
96-
i1 = n1.asInstruction() and
97-
i2 = n2.asInstruction()
98-
)
93+
writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
94+
or
95+
readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
9996
}
10097

10198
override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
@@ -105,19 +102,20 @@ private class FromGlobalVarTaintTrackingCfg extends DataFlow2::Configuration {
105102
FromGlobalVarTaintTrackingCfg() { this = "FromGlobalVarTaintTrackingCfg" }
106103

107104
override predicate isSource(DataFlow::Node source) {
108-
exists(
109-
ToGlobalVarTaintTrackingCfg other, DataFlow::Node prevSink, GlobalOrNamespaceVariable gv
110-
|
111-
other.hasFlowTo(prevSink) and
112-
writesVariable(prevSink.asInstruction(), gv) and
113-
readsVariable(source.asInstruction(), gv)
114-
)
105+
// This set of sources should be reasonably small, which is good for
106+
// performance since the set of sinks is very large.
107+
exists(ToGlobalVarTaintTrackingCfg otherCfg | otherCfg.hasFlowTo(source))
115108
}
116109

117-
override predicate isSink(DataFlow::Node sink) { any() }
110+
override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
118111

119112
override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
120113
instructionTaintStep(n1.asInstruction(), n2.asInstruction())
114+
or
115+
// Additional step for flow out of variables. There is no flow _into_
116+
// variables in this configuration, so this step only serves to take flow
117+
// out of a variable that's a source.
118+
readsVariable(n2.asInstruction(), n1.asVariable())
121119
}
122120

123121
override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
@@ -363,23 +361,12 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
363361
globalVar = ""
364362
or
365363
exists(
366-
ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg, DataFlow::Node store,
367-
GlobalOrNamespaceVariable global, DataFlow::Node load, DataFlow::Node sink
364+
ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg,
365+
DataFlow::VariableNode variableNode, GlobalOrNamespaceVariable global, DataFlow::Node sink
368366
|
369-
toCfg.hasFlow(getNodeForSource(source), store) and
370-
store
371-
.asInstruction()
372-
.(StoreInstruction)
373-
.getDestinationAddress()
374-
.(VariableAddressInstruction)
375-
.getASTVariable() = global and
376-
load
377-
.asInstruction()
378-
.(LoadInstruction)
379-
.getSourceAddress()
380-
.(VariableAddressInstruction)
381-
.getASTVariable() = global and
382-
fromCfg.hasFlow(load, sink) and
367+
global = variableNode.getVariable() and
368+
toCfg.hasFlow(getNodeForSource(source), variableNode) and
369+
fromCfg.hasFlow(variableNode, sink) and
383370
tainted = adjustedSink(sink) and
384371
global = globalVarFromId(globalVar)
385372
)

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@ private import DataFlowDispatch
77
* A data flow node that occurs as the argument of a call and is passed as-is
88
* to the callable. Instance arguments (`this` pointer) are also included.
99
*/
10-
class ArgumentNode extends Node {
11-
ArgumentNode() { exists(CallInstruction call | this.asInstruction() = call.getAnArgument()) }
10+
class ArgumentNode extends InstructionNode {
11+
ArgumentNode() { exists(CallInstruction call | this.getInstruction() = call.getAnArgument()) }
1212

1313
/**
1414
* Holds if this argument occurs at the given position in the given call.
1515
* The instance argument is considered to have index `-1`.
1616
*/
1717
predicate argumentOf(DataFlowCall call, int pos) {
18-
this.asInstruction() = call.getPositionalArgument(pos)
18+
this.getInstruction() = call.getPositionalArgument(pos)
1919
or
20-
this.asInstruction() = call.getThisArgument() and pos = -1
20+
this.getInstruction() = call.getThisArgument() and pos = -1
2121
}
2222

2323
/** Gets the call in which this node is an argument. */
@@ -50,16 +50,16 @@ private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
5050
}
5151

5252
/** A data flow node that occurs as the result of a `ReturnStmt`. */
53-
class ReturnNode extends Node {
53+
class ReturnNode extends InstructionNode {
5454
Instruction primary;
5555

5656
ReturnNode() {
5757
exists(ReturnValueInstruction ret |
58-
this.asInstruction() = ret.getReturnValue() and primary = ret
58+
instr = ret.getReturnValue() and primary = ret
5959
)
6060
or
6161
exists(ReturnIndirectionInstruction rii |
62-
this.asInstruction() = rii.getSideEffectOperand().getAnyDef() and primary = rii
62+
instr = rii.getSideEffectOperand().getAnyDef() and primary = rii
6363
)
6464
}
6565

@@ -80,7 +80,7 @@ class ReturnIndirectionNode extends ReturnNode {
8080
}
8181

8282
/** A data flow node that represents the output of a call. */
83-
class OutNode extends Node {
83+
class OutNode extends InstructionNode {
8484
OutNode() {
8585
instr instanceof CallInstruction or
8686
instr instanceof WriteSideEffectInstruction
@@ -238,11 +238,17 @@ private predicate suppressUnusedType(Type t) { any() }
238238
// Java QL library compatibility wrappers
239239
//////////////////////////////////////////////////////////////////////////////
240240
/** A node that performs a type cast. */
241-
class CastNode extends Node {
241+
class CastNode extends InstructionNode {
242242
CastNode() { none() } // stub implementation
243243
}
244244

245-
class DataFlowCallable = Function;
245+
/**
246+
* A function that may contain code or a variable that may contain itself. When
247+
* flow crosses from one _enclosing callable_ to another, the interprocedural
248+
* data-flow library discards call contexts and inserts a node in the big-step
249+
* relation used for human-readable path explanations.
250+
*/
251+
class DataFlowCallable = Declaration;
246252

247253
class DataFlowExpr = Expr;
248254

0 commit comments

Comments
 (0)