Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dbd0c7e

Browse files
calumgrantcalumgrant
authored
Merge pull request #674 from hvitved/csharp/cache-get-label
C#: Cache `NamedElement::getLabel()`
2 parents f50d0e3 + 74167e4 commit dbd0c7e

10 files changed

Lines changed: 32 additions & 35 deletions

File tree

‎csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@ import semmle.code.csharp.commons.ComparisonTest
2020
class IndexGuard extends ComparisonTest {
2121
VariableAccess indexAccess;
2222
Variable array;
23-
23+
2424
IndexGuard() {
2525
this.getFirstArgument() = indexAccess and
26-
this.getSecondArgument() = any(PropertyAccess lengthAccess |
26+
this.getSecondArgument() = any(PropertyAccess lengthAccess |
2727
lengthAccess.getQualifier() = array.getAnAccess() and
2828
lengthAccess.getTarget().hasName("Length")
2929
)
@@ -50,7 +50,7 @@ from IndexGuard incorrectGuard, Variable array, Variable index, ElementAccess ea
5050
where
5151
// Look for `index <= array.Length` or `array.Length >= index`
5252
incorrectGuard.controls(array, index) and
53-
incorrectGuard.isIncorrect() and
53+
incorrectGuard.isIncorrect() and
5454
// Look for `array[index]`
5555
ea.getQualifier() = array.getAnAccess() and
5656
ea.getIndex(0) = indexAccess and

‎csharp/ql/src/Security Features/CWE-730/ReDoS.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode
1919
where
2020
c.hasFlowPath(source, sink) and
2121
// No global timeout set
22-
not exists(RegexGlobalTimeout r) and
22+
not exists(RegexGlobalTimeout r) and
2323
(
2424
sink.getNode() instanceof Sink
2525
or

‎csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* Provides a list of NuGet packages with known vulnerabilities.
3-
*
3+
*
44
* To add a new vulnerability follow the existing pattern.
55
* Create a new class that extends the abstract class `Vulnerability`,
66
* supplying the name and the URL, and override one (or both) of
@@ -73,9 +73,9 @@ class MicrosoftAdvisory4021279 extends Vulnerability {
7373

7474
class CVE_2017_8700 extends Vulnerability {
7575
CVE_2017_8700() { this = "CVE-2017-8700" }
76-
76+
7777
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/279" }
78-
78+
7979
override predicate matchesRange(string name, Version affected, Version fixed) {
8080
(
8181
name = "Microsoft.AspNetCore.Mvc.Core"
@@ -91,9 +91,9 @@ class CVE_2017_8700 extends Vulnerability {
9191

9292
class CVE_2018_0765 extends Vulnerability {
9393
CVE_2018_0765() { this = "CVE-2018-0765" }
94-
94+
9595
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/67" }
96-
96+
9797
override predicate matchesRange(string name, Version affected, Version fixed) {
9898
name = "System.Security.Cryptography.Xml" and
9999
affected = "0.0.0" and
@@ -103,7 +103,7 @@ class CVE_2018_0765 extends Vulnerability {
103103

104104
class AspNetCore_Mar18 extends Vulnerability {
105105
AspNetCore_Mar18() { this = "ASPNETCore-Mar18" }
106-
106+
107107
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/300" }
108108

109109
override predicate matchesRange(string name, Version affected, Version fixed) {
@@ -125,9 +125,9 @@ class AspNetCore_Mar18 extends Vulnerability {
125125

126126
class CVE_2018_8409 extends Vulnerability {
127127
CVE_2018_8409() { this = "CVE-2018-8409" }
128-
128+
129129
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/316" }
130-
130+
131131
override predicate matchesRange(string name, Version affected, Version fixed) {
132132
name = "System.IO.Pipelines" and affected = "4.5.0" and fixed = "4.5.1"
133133
or
@@ -138,9 +138,9 @@ class CVE_2018_8409 extends Vulnerability {
138138

139139
class CVE_2018_8171 extends Vulnerability {
140140
CVE_2018_8171() { this = "CVE-2018-8171" }
141-
141+
142142
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/310" }
143-
143+
144144
override predicate matchesRange(string name, Version affected, Version fixed) {
145145
name = "Microsoft.AspNetCore.Identity" and (
146146
affected = "1.0.0" and fixed = "1.0.6"
@@ -204,7 +204,7 @@ class CVE_2018_8356 extends Vulnerability {
204204

205205
class ASPNETCore_Jul18 extends Vulnerability {
206206
ASPNETCore_Jul18() { this = "ASPNETCore-July18" }
207-
207+
208208
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/311" }
209209

210210
override predicate matchesRange(string name, Version affected, Version fixed) {

‎csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ class DereferenceableExpr extends Expr {
286286
ie = any(IsTypeExpr ite | ite.getCheckedType() = ite.getExpr().getType()) and
287287
branch = false and
288288
isNull = true
289-
)
289+
)
290290
)
291291
or
292292
this.hasNullableType() and
@@ -1189,7 +1189,7 @@ module Internal {
11891189
g1 = cond and
11901190
v1 = v.getDualValue() and
11911191
(
1192-
// g1 === g2 ? e : ...;
1192+
// g1 === g2 ? e : ...;
11931193
g2 = cond.getCondition() and
11941194
v2 = TBooleanValue(branch.booleanNot())
11951195
or

‎csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ module DataFlow {
9090
localFlowStep*(source, sink)
9191
}
9292

93-
predicate localFlowStep = localFlowStepCached/2;
93+
predicate localFlowStep = Internal::LocalFlow::step/2;
9494

9595
/**
9696
* A data flow node augmented with a call context and a configuration. Only
@@ -690,12 +690,14 @@ module DataFlow {
690690
/**
691691
* Provides predicates related to local data flow.
692692
*/
693-
private module LocalFlow {
693+
module LocalFlow {
694694
/**
695695
* Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
696696
* (intra-procedural) step.
697697
*/
698-
predicate localFlowStepNonCached(Node nodeFrom, Node nodeTo) {
698+
cached
699+
predicate step(Node nodeFrom, Node nodeTo) {
700+
forceCachingInSameStage() and
699701
localFlowStepExpr(nodeFrom.asExpr(), nodeTo.asExpr())
700702
or
701703
// Flow from source to SSA definition
@@ -1119,6 +1121,8 @@ module DataFlow {
11191121
* same stage.
11201122
*/
11211123
cached module Cached {
1124+
cached predicate forceCachingInSameStage() { any() }
1125+
11221126
cached newtype TNode =
11231127
TExprNode(DotNet::Expr e)
11241128
or
@@ -1137,14 +1141,6 @@ module DataFlow {
11371141
)
11381142
}
11391143

1140-
/**
1141-
* Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
1142-
* (intra-procedural) step.
1143-
*/
1144-
cached predicate localFlowStepCached(Node nodeFrom, Node nodeTo) {
1145-
LocalFlow::localFlowStepNonCached(nodeFrom, nodeTo)
1146-
}
1147-
11481144
/**
11491145
* Holds if `pred` can flow to `succ`, by jumping from one callable to
11501146
* another.

‎csharp/ql/src/semmle/code/dotnet/Element.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ class NamedElement extends Element, @dotnet_named_element {
8080
}
8181

8282
/** Gets a unique string label for this element. */
83+
cached
8384
string getLabel() { none() }
8485

8586
/**

‎csharp/ql/test/library-tests/cil/regressions/Methods.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* This tests the correct extraction of F<T>, and we should end up with
44
* 2 constructed methods of F<T>.
55
*/
6-
6+
77
// semmle-extractor-options: --cil
88

99
namespace Methods

‎csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ void Test2(string[] args)
4848
}
4949

5050
void Test3(string[] args)
51-
{
51+
{
5252
// GOOD: Guarded by ternary operator.
5353
for (int i = 0; i <= args.Length; i++)
5454
{
@@ -68,7 +68,7 @@ void Test4(string[] args)
6868
}
6969

7070
void Test5(string[] args)
71-
{
71+
{
7272
// GOOD: A valid test of Length.
7373
for (int i = 0; i != args.Length; i++)
7474
{
@@ -94,6 +94,6 @@ void Test7(string[] args)
9494
for (int i = 0; i <= args.Length; i++)
9595
{
9696
bool b = i == args.Length || args[i] == "x";
97-
}
97+
}
9898
}
9999
}

‎csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@
55
<PackageReference Include="System.Net.Http" Version="4.3.4" />
66
<PackageReference Include="System.Text.Encodings.Web" Version="4.2.9" />
77
<PackageReference Include="System.Text.Encodings.Web" Version="4.3.1" />
8-
8+
99
<!-- These are BAD -->
1010
<PackageReference Include="System.Text.Encodings.Web" Version="4.3.0" />
1111
<PackageReference Include="system.text.encodings.web" Version="4.3" />
1212
<PackageReference Include="System.Net.Http" Version="4.1.1" />
1313
<PackageReference Include="System.Net.Http" Version="4.1.2" />
14-
14+
1515
</ItemGroup>
1616
</Project>

‎csharp/ql/test/query-tests/Security Features/CWE-937/packages.config‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<package id="System.IO.Pipelines" version="4.5.1" targetFramework="net45" />
55
<package id="System.IO.Pipelines" version="4.5.1.0" targetFramework="net45" />
66
<package id="Microsoft.AspNetCore.All" version="2.0.9" targetFramework="net45" />
7-
7+
88
<!-- These are BAD -->
99
<package id="System.IO.Pipelines" version="4.5.0" targetFramework="net45" />
1010
<package id="System.IO.Pipelines" version="4.5.0.0" targetFramework="net45" />

0 commit comments

Comments
 (0)