Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fd63246

Browse files
hvitvedhvitved
committed
Merge remote-tracking branch 'upstream/master' into csharp/unsafe-deserialization
2 parents 3f5ee51 + fa5388b commit fd63246

204 files changed

Lines changed: 4656 additions & 3604 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlmanifest.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{ "provide": [ "*/ql/src/qlpack.yml",
2+
"*/upgrades/qlpack.yml",
23
"misc/legacy-support/*/qlpack.yml",
34
"misc/suite-helpers/qlpack.yml",
45
"codeql/.codeqlmanifest.json" ] }

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3939
definition of `x` when `x` is a variable of pointer type. It no longer
4040
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
4141
changes are in line with the user expectations we've observed.
42+
* The data-flow library now makes it easier to specify barriers/sanitizers
43+
arising from guards by overriding the predicate
44+
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
45+
configurations respectively.
4246
* There is now a `DataFlow::localExprFlow` predicate and a
4347
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4448
common case of local data flow and taint: from one `Expr` to another.

‎change-notes/1.23/analysis-csharp.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
| Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
1112
| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security | Finds flow of untrusted input to calls to unsafe deserializers. |
1213
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
1314
| Unsafe deserializer (`cs/unsafe-deserialization`) | security | Finds calls to unsafe deserializers. |
@@ -45,5 +46,6 @@ The following changes in version 1.23 affect C# analysis in all applications.
4546
* There is now a `DataFlow::localExprFlow` predicate and a
4647
`TaintTracking::localExprTaint` predicate to make it easy to use the most
4748
common case of local data flow and taint: from one `Expr` to another.
49+
* Data is now tracked through null-coalescing expressions (`??`).
4850

4951
## Changes to autobuilder

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
| Stored cross-site scripting (`js/stored-xss`) | Fewer false-positive results | The query now recognizes more sanitizers. |
4545
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now treats responses from servers as untrusted. |
4646
| Uncontrolled data used in path expression (`js/path-injection`) | Fewer false-positive results | This query now recognizes calls to Express `sendFile` as safe in some cases. |
47+
| Unknown directive (`js/unknown-directive`) | Fewer false positive results | This query no longer flags uses of ":", which is sometimes used like a directive. |
4748

4849
## Changes to QL libraries
4950

‎cpp/ql/src/Best Practices/Unused Entities/UnusedStaticVariables.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ from Variable v
2121
where
2222
v.isStatic() and
2323
v.hasDefinition() and
24+
not v.isConstexpr() and
2425
not exists(VariableAccess a | a.getTarget() = v) and
2526
not v instanceof MemberVariable and
2627
not declarationHasSideEffects(v) and

‎cpp/ql/src/semmle/code/cpp/PrintAST.ql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,15 @@
77

88
import cpp
99
import PrintAST
10+
11+
/**
12+
* Temporarily tweak this class or make a copy to control which functions are
13+
* printed.
14+
*/
15+
class Cfg extends PrintASTConfiguration {
16+
/**
17+
* TWEAK THIS PREDICATE AS NEEDED.
18+
* Holds if the AST for `func` should be printed.
19+
*/
20+
override predicate shouldPrintFunction(Function func) { any() }
21+
}

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
private import cpp
66
private import semmle.code.cpp.dataflow.internal.FlowVar
77
private import semmle.code.cpp.models.interfaces.DataFlow
8+
private import semmle.code.cpp.controlflow.Guards
9+
private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
810

911
cached
1012
private newtype TNode =
@@ -680,12 +682,16 @@ VariableAccess getAnAccessToAssignedVariable(Expr assign) {
680682
*
681683
* It is important that all extending classes in scope are disjoint.
682684
*/
683-
class BarrierGuard extends Expr {
684-
/** NOT YET SUPPORTED. Holds if this guard validates `e` upon evaluating to `branch`. */
685-
abstract deprecated predicate checks(Expr e, boolean branch);
685+
class BarrierGuard extends GuardCondition {
686+
/** Override this predicate to hold if this guard validates `e` upon evaluating to `b`. */
687+
abstract predicate checks(Expr e, boolean b);
686688

687689
/** Gets a node guarded by this guard. */
688-
final Node getAGuardedNode() {
689-
none() // stub
690+
final ExprNode getAGuardedNode() {
691+
exists(GVN value, boolean branch |
692+
result.getExpr() = value.getAnExpr() and
693+
this.checks(value.getAnExpr(), branch) and
694+
this.controls(result.getExpr().getBasicBlock(), branch)
695+
)
690696
}
691697
}

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
3737
}
3838

3939
private predicate accessesVariable(CopyInstruction copy, Variable var) {
40-
exists(VariableAddressInstruction va | va.getVariable().getAST() = var |
40+
exists(VariableAddressInstruction va | va.getASTVariable() = var |
4141
copy.(StoreInstruction).getDestinationAddress() = va
4242
or
4343
copy.(LoadInstruction).getSourceAddress() = va

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
private import cpp
66
private import semmle.code.cpp.ir.IR
77
private import semmle.code.cpp.controlflow.IRGuards
8+
private import semmle.code.cpp.ir.ValueNumbering
89

910
/**
1011
* A newtype wrapper to prevent accidental casts between `Node` and
@@ -220,7 +221,7 @@ predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
220221
predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
221222

222223
/**
223-
* A guard that validates some expression.
224+
* A guard that validates some instruction.
224225
*
225226
* To use this in a configuration, extend the class and provide a
226227
* characteristic predicate precisely specifying the guard, and override
@@ -229,11 +230,15 @@ predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)
229230
* It is important that all extending classes in scope are disjoint.
230231
*/
231232
class BarrierGuard extends IRGuardCondition {
232-
/** NOT YET SUPPORTED. Holds if this guard validates `e` upon evaluating to `b`. */
233-
abstract deprecated predicate checks(Instruction e, boolean b);
233+
/** Override this predicate to hold if this guard validates `instr` upon evaluating to `b`. */
234+
abstract predicate checks(Instruction instr, boolean b);
234235

235236
/** Gets a node guarded by this guard. */
236237
final Node getAGuardedNode() {
237-
none() // stub
238+
exists(ValueNumber value, boolean edge |
239+
result.asInstruction() = value.getAnInstruction() and
240+
this.checks(value.getAnInstruction(), edge) and
241+
this.controls(result.asInstruction().getBlock(), edge)
242+
)
238243
}
239244
}

‎cpp/ql/src/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ private newtype TMemoryAccessKind =
55
TBufferMayMemoryAccess() or
66
TEscapedMemoryAccess() or
77
TEscapedMayMemoryAccess() or
8+
TNonLocalMayMemoryAccess() or
89
TPhiMemoryAccess() or
910
TUnmodeledMemoryAccess() or
1011
TChiTotalMemoryAccess() or
@@ -80,6 +81,14 @@ class EscapedMayMemoryAccess extends MemoryAccessKind, TEscapedMayMemoryAccess {
8081
override string toString() { result = "escaped(may)" }
8182
}
8283

84+
/**
85+
* The operand or result may access all memory whose address has escaped, other than data on the
86+
* stack frame of the current function.
87+
*/
88+
class NonLocalMayMemoryAccess extends MemoryAccessKind, TNonLocalMayMemoryAccess {
89+
override string toString() { result = "nonlocal(may)" }
90+
}
91+
8392
/**
8493
* The operand is a Phi operand, which accesses the same memory as its
8594
* definition.

0 commit comments

Comments
 (0)