Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f948ef8

Browse files
yoffyoff
committed
Merge branch 'main' of github.com:github/codeql into python-dataflow-unpacking-assignment
2 parents 88db8f5 + 527c415 commit f948ef8

83 files changed

Lines changed: 4614 additions & 3115 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ import DataFlow::PathGraph
1616

1717
from WriteConfig b, DataFlow::PathNode source, DataFlow::PathNode sink
1818
where b.hasFlowPath(source, sink)
19-
select sink.getNode(),
20-
"This write into the external location '" + sink + "' may contain unencrypted data from $@",
21-
source, "this source."
19+
select sink.getNode(), source, sink,
20+
"This write into the external location '" + sink.getNode() +
21+
"' may contain unencrypted data from $@", source, "this source."

‎cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
*/
1313

1414
import cpp
15+
import semmle.code.cpp.controlflow.Guards
1516

1617
/**
1718
* A function call that potentially does not return (such as `exit`).
@@ -48,7 +49,11 @@ class ReallocCallLeak extends FunctionCall {
4849
* example a call to `exit()`.
4950
*/
5051
predicate mayHandleByTermination() {
51-
this.(ControlFlowNode).getASuccessor*() instanceof CallMayNotReturn
52+
exists(GuardCondition guard, CallMayNotReturn exit |
53+
this.(ControlFlowNode).getASuccessor*() = guard and
54+
guard.getAChild*() = v.getAnAccess() and
55+
guard.controls(exit.getBasicBlock(), _)
56+
)
5257
}
5358
}
5459

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ nodes
1313
| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
1414
| test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
1515
#select
16-
| test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:57:9:57:18 | theZipcode | this source. |
17-
| test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@ | test.cpp:74:24:74:30 | medical | this source. |
18-
| test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@ | test.cpp:77:16:77:22 | medical | this source. |
19-
| test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@ | test.cpp:81:22:81:28 | medical | this source. |
20-
| test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:96:37:96:46 | theZipcode | this source. |
21-
| test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:99:42:99:51 | theZipcode | this source. |
16+
| test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:57:9:57:18 | theZipcode | this source. |
17+
| test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@ | test.cpp:74:24:74:30 | medical | this source. |
18+
| test.cpp:78:24:78:27 | temp | test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@ | test.cpp:77:16:77:22 | medical | this source. |
19+
| test.cpp:82:24:82:28 | buff5 | test.cpp:81:22:81:28 | medical | test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@ | test.cpp:81:22:81:28 | medical | this source. |
20+
| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:96:37:96:46 | theZipcode | this source. |
21+
| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:99:42:99:51 | theZipcode | this source. |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@
44
| test.c:186:29:186:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
55
| test.c:282:29:282:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
66
| test.c:299:26:299:32 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
7+
| test.c:328:29:328:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
8+
| test.c:342:29:342:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,3 +319,28 @@ unsigned char *noBadResize_4_1(unsigned char *buffer, size_t currentSize, size_t
319319

320320
return buffer;
321321
}
322+
323+
unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
324+
{
325+
// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
326+
if (currentSize < newSize)
327+
{
328+
buffer = (unsigned char *)realloc(buffer, newSize);
329+
}
330+
if (cond)
331+
{
332+
abort(); // irrelevant
333+
}
334+
return buffer;
335+
}
336+
337+
unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
338+
{
339+
// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
340+
if (currentSize < newSize)
341+
{
342+
buffer = (unsigned char *)realloc(buffer, newSize);
343+
assert(cond); // irrelevant
344+
}
345+
return buffer;
346+
}

‎csharp/ql/src/semmle/code/csharp/Assignable.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
import csharp
6+
private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
67

78
/**
89
* An assignable, that is, an element that can be assigned to. Either a
@@ -83,7 +84,7 @@ class AssignableRead extends AssignableAccess {
8384

8485
pragma[noinline]
8586
private ControlFlow::Node getAnAdjacentReadSameVar() {
86-
Ssa::Internal::adjacentReadPairSameVar(_, this.getAControlFlowNode(), result)
87+
SsaImpl::adjacentReadPairSameVar(_, this.getAControlFlowNode(), result)
8788
}
8889

8990
/**

‎csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,10 @@ module SsaChecks {
4646
}
4747

4848
predicate notDominatedByDef(AssignableRead read, string m) {
49-
exists(Definition def, BasicBlock bb, ControlFlow::Node rnode, ControlFlow::Node dnode, int i |
49+
exists(
50+
Definition def, ControlFlow::BasicBlock bb, ControlFlow::Node rnode, ControlFlow::Node dnode,
51+
int i
52+
|
5053
def.getAReadAtNode(rnode) = read
5154
|
5255
def.definesAt(_, bb, i) and

‎csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1723,6 +1723,7 @@ module Internal {
17231723
cached
17241724
private module Cached {
17251725
private import semmle.code.csharp.Caching
1726+
private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
17261727

17271728
/**
17281729
* Holds if basic block `bb` only is reached when guard `g` has abstract value `v`.
@@ -1775,9 +1776,9 @@ module Internal {
17751776
private predicate adjacentReadPairSameVarUniquePredecessor(
17761777
Ssa::Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
17771778
) {
1778-
Ssa::Internal::adjacentReadPairSameVar(def, cfn1, cfn2) and
1779+
SsaImpl::adjacentReadPairSameVar(def, cfn1, cfn2) and
17791780
not exists(ControlFlow::Node other |
1780-
Ssa::Internal::adjacentReadPairSameVar(def, other, cfn2) and
1781+
SsaImpl::adjacentReadPairSameVar(def, other, cfn2) and
17811782
other != cfn1 and
17821783
other != cfn2
17831784
)
@@ -1831,7 +1832,7 @@ module Internal {
18311832
private predicate firstReadUniquePredecessor(Ssa::ExplicitDefinition def, ControlFlow::Node cfn) {
18321833
exists(def.getAFirstReadAtNode(cfn)) and
18331834
not exists(ControlFlow::Node other |
1834-
Ssa::Internal::adjacentReadPairSameVar(def, other, cfn) and
1835+
SsaImpl::adjacentReadPairSameVar(def, other, cfn) and
18351836
other != cfn
18361837
)
18371838
}

‎csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ private import internal.CallableReturns
2323
private import semmle.code.csharp.commons.Assertions
2424
private import semmle.code.csharp.controlflow.Guards as G
2525
private import semmle.code.csharp.controlflow.Guards::AbstractValues
26+
private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
2627
private import semmle.code.csharp.frameworks.System
2728
private import semmle.code.csharp.frameworks.Test
2829

@@ -177,7 +178,7 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
177178
exists(G::DereferenceableExpr de | de = def.getARead() |
178179
reason = de.getANullCheck(_, true) and
179180
msg = "as suggested by $@ null check" and
180-
not de = any(Ssa::PseudoDefinition pdef).getARead() and
181+
not de = any(Ssa::PhiNode phi).getARead() and
181182
strictcount(Element e | e = any(Ssa::Definition def0 | de = def0.getARead()).getElement()) = 1 and
182183
// Don't use a check as reason if there is a `null` assignment
183184
// or argument
@@ -205,7 +206,7 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
205206
// A variable of nullable type may be null
206207
exists(Dereference d | dereferenceAt(_, _, def, d) |
207208
d.hasNullableType() and
208-
not def instanceof Ssa::PseudoDefinition and
209+
not def instanceof Ssa::PhiNode and
209210
reason = def.getSourceVariable().getAssignable() and
210211
msg = "because it has a nullable type"
211212
)
@@ -236,13 +237,13 @@ private predicate defNullImpliesStep(
236237
Ssa::Definition def1, BasicBlock bb1, Ssa::Definition def2, BasicBlock bb2
237238
) {
238239
exists(Ssa::SourceVariable v | defNullImpliesStep0(v, def1, bb1, bb2) |
239-
def2.(Ssa::PseudoDefinition).getAnInput() = def1 and
240+
def2.(Ssa::PhiNode).getAnInput() = def1 and
240241
bb2 = def2.getBasicBlock()
241242
or
242243
def2 = def1 and
243-
not exists(Ssa::PseudoDefinition def |
244-
def.getSourceVariable() = v and
245-
bb2 = def.getBasicBlock()
244+
not exists(Ssa::PhiNode phi |
245+
phi.getSourceVariable() = v and
246+
bb2 = phi.getBasicBlock()
246247
)
247248
) and
248249
not exists(SuccessorTypes::ConditionalSuccessor s, NullValue nv |
@@ -426,14 +427,14 @@ module PathGraph {
426427
}
427428

428429
private Ssa::Definition getAPseudoInput(Ssa::Definition def) {
429-
result = def.(Ssa::PseudoDefinition).getAnInput()
430+
result = def.(Ssa::PhiNode).getAnInput()
430431
}
431432

432433
// `def.getAnUltimateDefinition()` includes inputs into uncertain
433434
// definitions, but we only want inputs into pseudo nodes
434435
private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
435436
result = getAPseudoInput*(def) and
436-
not result instanceof Ssa::PseudoDefinition
437+
not result instanceof Ssa::PhiNode
437438
}
438439

439440
/**
@@ -446,7 +447,7 @@ private predicate defReaches(Ssa::Definition def, ControlFlow::Node cfn, boolean
446447
(always = true or always = false)
447448
or
448449
exists(ControlFlow::Node mid | defReaches(def, mid, always) |
449-
Ssa::Internal::adjacentReadPairSameVar(_, mid, cfn) and
450+
SsaImpl::adjacentReadPairSameVar(_, mid, cfn) and
450451
not mid =
451452
any(Dereference d |
452453
if always = true

0 commit comments

Comments
 (0)