Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e93dcdb

Browse files
author
Robert Marsh
committed
Merge branch 'master' into rdmarsh/cpp/ir-constructor-side-effects
2 parents 31f25c8 + 717490b commit e93dcdb

299 files changed

Lines changed: 15204 additions & 6971 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3939
definition of `x` when `x` is a variable of pointer type. It no longer
4040
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
4141
changes are in line with the user expectations we've observed.
42+
* The data-flow library now makes it easier to specify barriers/sanitizers
43+
arising from guards by overriding the predicate
44+
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
45+
configurations respectively.
4246
* There is now a `DataFlow::localExprFlow` predicate and a
4347
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4448
common case of local data flow and taint: from one `Expr` to another.
@@ -50,3 +54,8 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
5054
lead to regressions (or improvements) in how queries are optimized because
5155
optimization in QL relies on static size estimates, and the control-flow edge
5256
relations will now have different size estimates than before.
57+
* Support has been added for non-type template arguments. This means that the
58+
return type of `Declaration::getTemplateArgument()` and
59+
`Declaration::getATemplateArgument` have changed to `Locatable`. See the
60+
documentation for `Declaration::getTemplateArgument()` and
61+
`Declaration::getTemplateArgumentKind()` for details.

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
1112
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
1213
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
1314

@@ -43,5 +44,6 @@ The following changes in version 1.23 affect C# analysis in all applications.
4344
* There is now a `DataFlow::localExprFlow` predicate and a
4445
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4546
common case of local data flow and taint: from one `Expr` to another.
47+
* Data is now tracked through null-coalescing expressions (`??`).
4648

4749
## Changes to autobuilder

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## General improvements
44

5-
* Suppor for `globalThis` has been added.
5+
* Support for `globalThis` has been added.
66

77
* Support for the following frameworks and libraries has been improved:
88
- [firebase](https://www.npmjs.com/package/firebase)
@@ -12,8 +12,9 @@
1212

1313
* The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
1414

15-
* TypeScript 3.6 features are supported.
15+
* TypeScript 3.6 and 3.7 features are now supported.
1616

17+
* Automatic classification of generated files has been improved, in particular files generated by Doxygen are now recognized.
1718

1819
## New queries
1920

@@ -26,11 +27,13 @@
2627
| Use of returnless function (`js/use-of-returnless-function`) | maintainability, correctness | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
2728
| Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
2829
| Unreachable method overloads (`js/unreachable-method-overloads`) | correctness, typescript | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
30+
| Ignoring result from pure array method (`js/ignore-array-result`) | maintainability, correctness | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
2931

3032
## Changes to existing queries
3133

3234
| **Query** | **Expected impact** | **Change** |
3335
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
36+
| Double escaping or unescaping (`js/double-escaping`) | More results | This rule now detects additional escaping and unescaping functions. |
3437
| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false-positive results | This rule now recognizes additional ways delimiters can be stripped away. |
3538
| Client-side cross-site scripting (`js/xss`) | More results, fewer false-positive results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected. |
3639
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized. |

‎change-notes/1.23/analysis-python.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,8 @@
2020
|----------------------------|------------------------|------------|
2121
| Unreachable code | Fewer false positives | Analysis now accounts for uses of `contextlib.suppress` to suppress exceptions. |
2222
| `__iter__` method returns a non-iterator | Better alert message | Alert now highlights which class is expected to be an iterator. |
23+
24+
25+
## Changes to QL libraries
26+
27+
* Django library now recognizes positional arguments from a `django.conf.urls.url` regex (Django version 1.x)

‎cpp/ql/src/Best Practices/Unused Entities/UnusedStaticVariables.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ from Variable v
2121
where
2222
v.isStatic() and
2323
v.hasDefinition() and
24+
not v.isConstexpr() and
2425
not exists(VariableAccess a | a.getTarget() = v) and
2526
not v instanceof MemberVariable and
2627
not declarationHasSideEffects(v) and

‎cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ byte order function, such as <code>ntohl</code>.
1414
The use of a network-to-host byte order function is therefore a good indicator that the returned
1515
value is unvalidated data retrieved from the network, and should not be used without further
1616
validation. In particular, the returned value should not be used as an array index or array length
17-
value without validation, which may result in a buffer overflow vulnerability.
17+
value without validation, as this could result in a buffer overflow vulnerability.
1818
</p>
1919
</overview>
2020

‎cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ which is then subsequently accessed to fetch properties of the device. However,
3737
check the return value from the function call to <code>initDeviceConfig</code>. If the
3838
device number passed to the <code>notify</code> function was invalid, the
3939
<code>initDeviceConfig</code> function will leave the <code>config</code> variable uninitialized,
40-
which would result in the <code>notify</code> function accessing uninitialized memory.</p>
40+
which will result in the <code>notify</code> function accessing uninitialized memory.</p>
4141

4242
<sample src="ConditionallyUninitializedVariableBad.c" />
4343

‎cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Conditionally uninitialized variable
33
* @description When an initialization function is used to initialize a local variable, but the
44
* returned status code is not checked, the variable may be left in an uninitialized
5-
* state, and reading the variable may result in undefined behaviour.
5+
* state, and reading the variable may result in undefined behavior.
66
* @kind problem
77
* @problem.severity warning
88
* @opaque-id SM02313

‎cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableBad.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ int notify(int deviceNumber) {
1919
DeviceConfig config;
2020
initDeviceConfig(&config, deviceNumber);
2121
// BAD: Using config without checking the status code that is returned
22-
if (config->isEnabled) {
23-
notifyChannel(config->channel);
22+
if (config.isEnabled) {
23+
notifyChannel(config.channel);
2424
}
25-
}
25+
}

‎cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableGood.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ void notify(int deviceNumber) {
2020
int statusCode = initDeviceConfig(&config, deviceNumber);
2121
if (statusCode == 0) {
2222
// GOOD: Status code returned by initialization function is checked, so this is safe
23-
if (config->isEnabled) {
24-
notifyChannel(config->channel);
23+
if (config.isEnabled) {
24+
notifyChannel(config.channel);
2525
}
2626
}
27-
}
27+
}

0 commit comments

Comments
 (0)