Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f8ab945

Browse files
raulgarciamsftraulgarciamsft
authored
Merge branch 'master' into users/raulga/c6324
2 parents 16f2bac + b8877f1 commit f8ab945

3,727 files changed

Lines changed: 239482 additions & 36966 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitattributes‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,4 @@
4646
*.jpg -text
4747
*.jpeg -text
4848
*.gif -text
49+
*.dll -text

‎.gitignore‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,8 @@
88
# qltest projects and artifacts
99
*/ql/test/**/*.testproj
1010
*/ql/test/**/*.actual
11-
/.vs/slnx.sqlite
12-
/.vs/ql/v15/Browse.VC.opendb
13-
/.vs/ql/v15/Browse.VC.db
14-
/.vs/ProjectSettings.json
1511

16-
/.vs/ql_6324/v15
17-
/.vs/VSWorkspaceState.json
18-
/.vs/slnx.sqlite-journal
12+
13+
# Visual studio temporaries, except a file used by QL4VS
14+
.vs/*
15+
!.vs/VSWorkspaceSettings.json

‎.lgtm.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
path_classifiers:
2+
library:
3+
- javascript/externs
4+
- javascript/extractor/lib
5+
6+
test:
7+
- csharp/ql/src
8+
- csharp/ql/test
9+
- javascript/extractor/parser-tests
10+
- javascript/extractor/tests
11+
- javascript/ql/src
12+
- javascript/ql/test
13+
14+
queries:
15+
- include: "*"
16+
17+
extraction:
18+
python:
19+
python_setup:
20+
version: 3

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
/csharp/ @Semmle/cs
22
/java/ @Semmle/java
33
/javascript/ @Semmle/js
4+
/cpp/ @Semmle/cpp-analysis

‎change-notes/1.19/analysis-cpp.md‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,39 @@
66

77
| **Query** | **Tags** | **Purpose** |
88
|-----------------------------|-----------|--------------------------------------------------------------------|
9-
| *@name of query (Query ID)* | *Tags* |*Aim of the new query and whether it is enabled by default or not* |
9+
| Cast between `HRESULT` and a Boolean type (`cpp/hresult-boolean-conversion`) | external/cwe/cwe-253 | Finds logic errors caused by mistakenly treating the Windows `HRESULT` type as a Boolean instead of testing it with the appropriate macros. Enabled by default. |
10+
| Setting a DACL to `NULL` in a `SECURITY_DESCRIPTOR` (`cpp/unsafe-dacl-security-descriptor`) | external/cwe/cwe-732 | This query finds code that creates world-writable objects on Windows by setting their DACL to `NULL`. Enabled by default. |
11+
| Cast from `char*` to `wchar_t*` | security, external/cwe/cwe-704 | Detects potentially dangerous casts from `char*` to `wchar_t*`. Enabled by default on LGTM. |
12+
| Dead code due to `goto` or `break` statement (`cpp/dead-code-goto`) | maintainability, external/cwe/cwe-561 | Detects dead code following a `goto` or `break` statement. Enabled by default on LGTM. |
13+
| Inconsistent direction of for loop | correctness, external/cwe/cwe-835 | This query detects `for` loops where the increment and guard condition don't appear to correspond. Enabled by default on LGTM. |
14+
| Incorrect Not Operator Usage | security, external/cwe/cwe-480 | This query finds uses of the logical not (`!`) operator that look like they should be bit-wise not (`~`). Available but not displayed by default on LGTM. |
15+
| NULL application name with an unquoted path in call to CreateProcess | security, external/cwe/cwe-428 | This query finds unsafe uses of the `CreateProcess` function. Available but not displayed by default on LGTM. |
1016

1117
## Changes to existing queries
1218

1319
| **Query** | **Expected impact** | **Change** |
1420
|----------------------------|------------------------|------------------------------------------------------------------|
15-
| Resource not released in destructor | Fewer false positive results | Placement new is now excluded from the query. |
16-
21+
| Array offset used before range check | More results and fewer false positive results | The query now recognizes array accesses in different positions within the expression. False positives where the range is checked before and after the array access have been fixed. |
22+
| Empty branch of conditional | Fewer false positive results | The query now recognizes commented blocks more reliably. |
23+
| Expression has no effect | Fewer false positive results | Expressions in template instantiations are now excluded from this query. |
24+
| Global could be static | Fewer false positive results | Variables with declarations in header files are now excluded from this query. |
25+
| Resource not released in destructor | Fewer false positive results | Placement new is now excluded from the query. Also fixed an issue where false positives could occur if the destructor body was not in the snapshot. |
26+
| Missing return statement (`cpp/missing-return`) | Visible by default | The precision of this query has been increased from 'medium' to 'high', which makes it visible by default in LGTM. It was 'medium' in release 1.17 and 1.18 because it had false positives due to an extractor bug that was fixed in 1.18. |
27+
| Missing return statement | Fewer false positive results | The query is now produces correct results when a function returns a template-dependent type, or makes a non-returning call to another function. |
28+
| Static array access may cause overflow | More correct results | Data flow to the size argument of a buffer operation is now checked in this query. |
29+
| Call to memory access function may overflow buffer | More correct results | Array indexing with a negative index is now detected by this query. |
30+
| Self comparison | Fewer false positive results | Code inside macro invocations is now excluded from the query. |
31+
| Suspicious call to memset | Fewer false positive results | Types involving decltype are now correctly compared. |
32+
| Suspicious add with sizeof | Fewer false positive results | Arithmetic with void pointers (where allowed) is now excluded from this query. |
33+
| Wrong type of arguments to formatting function | Fewer false positive results | False positive results involving typedefs have been removed. Expected argument types are determined more accurately, especially for wide string and pointer types. Custom (non-standard) formatting functions are also identified more accurately. |
34+
| AV Rule 164 | Fewer false positive results | This query now accounts for explicit casts. |
35+
| Negation of unsigned value | Fewer false positive results | This query now accounts for explicit casts. |
36+
| Variable scope too large | Fewer false positive results | Variables with declarations in header files, or that are used at file scope, are now excluded from this query. |
37+
| Comparison result is always the same | Fewer false positive results | Comparisons in template instantiations are now excluded from this query. |
38+
| Unsigned comparison to zero | Fewer false positive results | Comparisons in template instantiations are now excluded from this query. |
1739

1840
## Changes to QL libraries
1941

2042
* Added a hash consing library for structural comparison of expressions.
43+
* `getBufferSize` now detects variable size structs more reliably.
44+
* Buffer.qll now treats arrays of zero size as a special case.

‎change-notes/1.19/analysis-csharp.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Improvements to C# analysis
2+
3+
## General improvements
4+
5+
* Control flow graph improvements:
6+
* The control flow graph construction now takes simple Boolean conditions on local scope variables into account. For example, in `if (b) x = 0; if (b) x = 1;`, the control flow graph will reflect that taking the `true` (resp. `false`) branch in the first condition implies taking the same branch in the second condition. In effect, the first assignment to `x` will now be identified as being dead.
7+
* Code that is only reachable from a constant failing assertion, such as `Debug.Assert(false)`, is considered to be unreachable.
8+
9+
## New queries
10+
11+
| **Query** | **Tags** | **Purpose** |
12+
|-----------------------------|-----------|--------------------------------------------------------------------|
13+
| Using a package with a known vulnerability (cs/use-of-vulnerable-package) | security, external/cwe/cwe-937 | Finds project build files that import packages with known vulnerabilities. This is included by default. |
14+
15+
16+
## Changes to existing queries
17+
18+
| Inconsistent lock sequence (`cs/inconsistent-lock-sequence`) | More results | This query now finds inconsistent lock sequences globally across calls. |
19+
| Local scope variable shadows member (`cs/local-shadows-member`) | Fewer results | Results have been removed where a constructor parameter shadows a member, because the parameter is probably used to initialize the member. |
20+
| Cross-site scripting (`cs/web/xss`) | More results | This query now finds cross-site scripting vulnerabilities in ASP.NET Core applications. |
21+
| *@name of query (Query ID)*| *Impact on results* | *How/why the query has changed* |
22+
23+
## Changes to code extraction
24+
25+
* Arguments passed using `in` are now extracted.
26+
* Fix a bug where the `dynamic` type name was not extracted correctly in certain circumstances.
27+
* Fixed a bug where method type signatures were extracted incorrectly in some circumstances.
28+
29+
## Changes to QL libraries
30+
31+
* `getArgument()` on `AccessorCall` has been improved so it now takes tuple assignments into account. For example, the argument for the implicit `value` parameter in the setter of property `P` is `0` in `(P, x) = (0, 1)`. Additionally, the argument for the `value` parameter in compound assignments is now only the expanded value, for example, in `P += 7` the argument is `P + 7` and not `7`.
32+
* The predicate `isInArgument()` has been added to the `AssignableAccess` class. This holds for expressions that are passed as arguments using `in`.
33+
34+
## Changes to the autobuilder
35+
36+
* When determining the target of `msbuild` or `dotnet build`, first look for `.proj` files, then `.sln` files, and finally `.csproj`/`.vcxproj` files. In all three cases, choose the project/solution file closest to the root.

‎change-notes/1.19/analysis-java.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Improvements to Java analysis
2+
3+
## General improvements
4+
5+
* Where applicable, path explanations have been added to the security queries.
6+
7+
## New queries
8+
9+
| **Query** | **Tags** | **Purpose** |
10+
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
| Arbitrary file write during archive extraction ("Zip Slip") (`java/zipslip`) | security, external/cwe/cwe-022 | Identifies extraction routines that allow arbitrary file overwrite vulnerabilities. |
12+
| Missing catch of NumberFormatException (`java/uncaught-number-format-exception`) | reliability, external/cwe/cwe-248 | Finds calls to `Integer.parseInt` and similar string-to-number conversions that might raise a `NumberFormatException` without a corresponding `catch`-clause. |
13+
14+
## Changes to existing queries
15+
16+
| **Query** | **Expected impact** | **Change** |
17+
|----------------------------|------------------------|------------------------------------------------------------------|
18+
| Array index out of bounds (`java/index-out-of-bounds`) | Fewer false positive results | False positives involving arrays with a length evenly divisible by 3 or some greater number and an index being increased with a similar stride length are no longer reported. |
19+
| Confusing overloading of methods (`java/confusing-method-signature`) | Fewer false positive results | A bugfix in the inheritance relation ensures that spurious results on certain generic classes no longer occur. |
20+
| Query built from user-controlled sources (`java/sql-injection`) | More results | Sql injection sinks from the Spring JDBC, MyBatis, and Hibernate frameworks are now reported. |
21+
| Query built without neutralizing special characters (`java/concatenated-sql-query`) | More results | Sql injection sinks from the Spring JDBC, MyBatis, and Hibernate frameworks are now reported. |
22+
| Unreachable catch clause (`java/unreachable-catch-clause`) | Fewer false positive results | This rule now accounts for calls to generic methods that throw generic exceptions. |
23+
| Useless comparison test (`java/constant-comparison`) | Fewer false positive results | Constant comparisons guarding `java.util.ConcurrentModificationException` are no longer reported, as they are intended to always be false in the absence of API misuse. |
24+
25+
## Changes to QL libraries
26+
27+
* The default set of taint sources in the `FlowSources` library is extended to
28+
cover parameters annotated with Spring framework annotations indicating
29+
remote user input from servlets. This affects all security queries, which
30+
will yield additional results on projects using the Spring Web framework.
31+
* The `ParityAnalysis` library is replaced with the more general `ModulusAnalysis` library, which improves the range analysis.
32+

0 commit comments

Comments
 (0)