Skip to content

Commit 0743c42

Browse files
committed
Merge remote-tracking branch 'upstream/master' into dataflow-indirect-args
Accepted test results that were in semantic merge conflict between these branches. The changed results are due to a bug that that's part of github/codeql-c-team#35.
2 parents e37aab5 + e5d3286 commit 0743c42

912 files changed

Lines changed: 16182 additions & 15558 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
.vs/*
1515
!.vs/VSWorkspaceSettings.json
1616

17+
# Byte-compiled python files
18+
*.pyc
19+
1720
# It's useful (though not required) to be able to unpack codeql in the ql checkout itself
1821
/codeql/
1922
.vscode/settings.json

change-notes/1.24/analysis-cpp.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
2020
| Memory may not be freed (`cpp/memory-may-not-be-freed`) | More true positive results | This query now identifies a wider variety of buffer allocations using the `semmle.code.cpp.models.interfaces.Allocation` library. |
2121
| Mismatching new/free or malloc/delete (`cpp/new-free-mismatch`) | Fewer false positive results | Fixed false positive results in template code. |
2222
| Missing return statement (`cpp/missing-return`) | Fewer false positive results | Functions containing `asm` statements are no longer highlighted by this query. |
23+
| Missing return statement (`cpp/missing-return`) | More accurate locations | Locations reported by this query are now more accurate in some cases. |
2324
| No space for zero terminator (`cpp/no-space-for-terminator`) | More correct results | String arguments to formatting functions are now (usually) expected to be null terminated strings. |
2425
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | | This query is no longer run on LGTM. |
2526
| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings. This approach produces fewer, more accurate results. |
@@ -45,6 +46,7 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
4546
`StackVariableReachability`. The functionality is the same.
4647
* The models library models `strlen` in more detail, and includes common variations such as `wcslen`.
4748
* The models library models `gets` and similar functions.
49+
* The models library now partially models `std::string`.
4850
* The taint tracking library (`semmle.code.cpp.dataflow.TaintTracking`) has had
4951
the following improvements:
5052
* The library now models data flow through `strdup` and similar functions.

change-notes/1.24/analysis-csharp.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ The following changes in version 1.24 affect C# analysis in all applications.
2222
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | More results | Results are reported from parameters with a default value of `null`. |
2323
| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the value assigned is an (implicitly or explicitly) cast default-like value. For example, `var s = (string)null` and `string s = default`. |
2424
| XPath injection (`cs/xml/xpath-injection`) | More results | The query now recognizes calls to methods on `System.Xml.XPath.XPathNavigator` objects. |
25+
| Information exposure through transmitted data (`cs/sensitive-data-transmission`) | More results | The query now recognizes writes to cookies and writes to ASP.NET (`Inner`)`Text` properties as additional sinks. |
26+
| Information exposure through an exception (`cs/information-exposure-through-exception`) | More results | The query now recognizes writes to cookies, writes to ASP.NET (`Inner`)`Text` properties, and email contents as additional sinks. |
2527

2628
## Removal of old queries
2729

@@ -42,5 +44,6 @@ The following changes in version 1.24 affect C# analysis in all applications.
4244
* [Code contracts](https://docs.microsoft.com/en-us/dotnet/framework/debug-trace-profile/code-contracts) are now recognized, and are treated like any other assertion methods.
4345
* Expression nullability flow state is given by the predicates `Expr.hasNotNullFlowState()` and `Expr.hasMaybeNullFlowState()`.
4446
* `stackalloc` array creations are now represented by the QL class `Stackalloc`. Previously they were represented by the class `ArrayCreation`.
47+
* A new class `RemoteFlowSink` has been added to model sinks where data might be exposed to external users. Examples include web page output, e-mails, and cookies.
4548

4649
## Changes to autobuilder

change-notes/1.24/analysis-javascript.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
- [ncp](https://www.npmjs.com/package/ncp)
4343
- [node-dir](https://www.npmjs.com/package/node-dir)
4444
- [path-exists](https://www.npmjs.com/package/path-exists)
45+
- [pg](https://www.npmjs.com/package/pg)
4546
- [react](https://www.npmjs.com/package/react)
4647
- [recursive-readdir](https://www.npmjs.com/package/recursive-readdir)
4748
- [request](https://www.npmjs.com/package/request)
@@ -85,6 +86,7 @@
8586
| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes escapes in strings and regular expression literals. |
8687
| Identical operands (`js/redundant-operation`) | Fewer results | This query now recognizes cases where the operands change a value using ++/-- expressions. |
8788
| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now recognizes cases where a function uses the `Function.arguments` value to process a variable number of parameters. |
89+
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes more variations of URL scheme checks. |
8890

8991
## Changes to libraries
9092

config/identical-files.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@
3939
"java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
4040
"java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll"
4141
],
42+
"DataFlow Java/C++/C# Consistency checks": [
43+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
44+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
45+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
46+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll"
47+
],
4248
"C++ SubBasicBlocks": [
4349
"cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
4450
"cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
@@ -236,6 +242,13 @@
236242
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/ValueNumbering.qll",
237243
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
238244
],
245+
"C++ IR PrintValueNumbering": [
246+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
247+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
248+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
249+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
250+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
251+
],
239252
"C++ IR ConstantAnalysis": [
240253
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
241254
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",

config/sync-files.py

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#!/usr/bin/env python3
2+
3+
# Due to various technical limitations, we sometimes have files that need to be
4+
# kept identical in the repository. This script loads a database of such
5+
# files and can perform two functions: check whether they are still identical,
6+
# and overwrite the others with a master copy if needed.
7+
8+
import hashlib
9+
import shutil
10+
import os
11+
import sys
12+
import json
13+
import re
14+
path = os.path
15+
16+
file_groups = {}
17+
18+
def add_prefix(prefix, relative):
19+
result = path.join(prefix, relative)
20+
if path.commonprefix((path.realpath(result), path.realpath(prefix))) != \
21+
path.realpath(prefix):
22+
raise Exception("Path {} is not below {}".format(
23+
result, prefix))
24+
return result
25+
26+
def load_if_exists(prefix, json_file_relative):
27+
json_file_name = path.join(prefix, json_file_relative)
28+
if path.isfile(json_file_name):
29+
print("Loading file groups from", json_file_name)
30+
with open(json_file_name, 'r', encoding='utf-8') as fp:
31+
raw_groups = json.load(fp)
32+
prefixed_groups = {
33+
name: [
34+
add_prefix(prefix, relative)
35+
for relative in relatives
36+
]
37+
for name, relatives in raw_groups.items()
38+
}
39+
file_groups.update(prefixed_groups)
40+
41+
# Generates a list of C# test files that should be in sync
42+
def csharp_test_files():
43+
test_file_re = re.compile('.*(Bad|Good)[0-9]*\\.cs$')
44+
csharp_doc_files = {
45+
file:os.path.join(root, file)
46+
for root, dirs, files in os.walk("csharp/ql/src")
47+
for file in files
48+
if test_file_re.match(file)
49+
}
50+
return {
51+
"C# test '" + file + "'" : [os.path.join(root, file), csharp_doc_files[file]]
52+
for root, dirs, files in os.walk("csharp/ql/test")
53+
for file in files
54+
if file in csharp_doc_files
55+
}
56+
57+
def file_checksum(filename):
58+
with open(filename, 'rb') as file_handle:
59+
return hashlib.sha1(file_handle.read()).hexdigest()
60+
61+
def check_group(group_name, files, master_file_picker, emit_error):
62+
checksums = {file_checksum(f) for f in files}
63+
64+
if len(checksums) == 1:
65+
return
66+
67+
master_file = master_file_picker(files)
68+
if master_file is None:
69+
emit_error(__file__, 0,
70+
"Files from group '"+ group_name +"' not in sync.")
71+
emit_error(__file__, 0,
72+
"Run this script with a file-name argument among the "
73+
"following to overwrite the remaining files with the contents "
74+
"of that file or run with the --latest switch to update each "
75+
"group of files from the most recently modified file in the group.")
76+
for filename in files:
77+
emit_error(__file__, 0, " " + filename)
78+
else:
79+
print(" Syncing others from", master_file)
80+
for filename in files:
81+
if filename == master_file:
82+
continue
83+
print(" " + filename)
84+
os.replace(filename, filename + '~')
85+
shutil.copy(master_file, filename)
86+
print(" Backups written with '~' appended to file names")
87+
88+
def chdir_repo_root():
89+
root_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..')
90+
os.chdir(root_path)
91+
92+
def choose_master_file(master_file, files):
93+
if master_file in files:
94+
return master_file
95+
else:
96+
return None
97+
98+
def choose_latest_file(files):
99+
latest_time = None
100+
latest_file = None
101+
for filename in files:
102+
file_time = os.path.getmtime(filename)
103+
if (latest_time is None) or (latest_time < file_time):
104+
latest_time = file_time
105+
latest_file = filename
106+
return latest_file
107+
108+
local_error_count = 0
109+
def emit_local_error(path, line, error):
110+
print('ERROR: ' + path + ':' + line + " - " + error)
111+
global local_error_count
112+
local_error_count += 1
113+
114+
# This function is invoked directly by a CI script, which passes a different error-handling
115+
# callback.
116+
def sync_identical_files(emit_error):
117+
if len(sys.argv) == 1:
118+
master_file_picker = lambda files: None
119+
elif len(sys.argv) == 2:
120+
if sys.argv[1] == "--latest":
121+
master_file_picker = choose_latest_file
122+
elif os.path.isfile(sys.argv[1]):
123+
master_file_picker = lambda files: choose_master_file(sys.argv[1], files)
124+
else:
125+
raise Exception("File not found")
126+
else:
127+
raise Exception("Bad command line or file not found")
128+
chdir_repo_root()
129+
load_if_exists('.', 'config/identical-files.json')
130+
file_groups.update(csharp_test_files())
131+
for group_name, files in file_groups.items():
132+
check_group(group_name, files, master_file_picker, emit_error)
133+
134+
def main():
135+
sync_identical_files(emit_local_error)
136+
if local_error_count > 0:
137+
exit(1)
138+
139+
if __name__ == "__main__":
140+
main()
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
- description: Standard Code Scanning queries for C and C++
2+
- qlpack: codeql-cpp
3+
- apply: code-scanning-selectors.yml
4+
from: codeql-suite-helpers

cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,13 @@ predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
3030
) and
3131
exists(ReturnStmt s |
3232
f.getAPredecessor() = s and
33-
blame = s.getAPredecessor()
33+
(
34+
blame = s.getAPredecessor() and
35+
count(blame.getASuccessor()) = 1
36+
or
37+
blame = s and
38+
exists(ControlFlowNode pred | pred = s.getAPredecessor() | count(pred.getASuccessor()) != 1)
39+
)
3440
)
3541
}
3642

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,7 @@ private predicate throughFlowNodeCand(Node node, Configuration config) {
548548
}
549549

550550
/** Holds if flow may return from `callable`. */
551+
pragma[nomagic]
551552
private predicate returnFlowCallableCand(
552553
DataFlowCallable callable, ReturnKindExt kind, Configuration config
553554
) {
@@ -2088,6 +2089,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
20882089

20892090
SummaryCtxSome() { this = TSummaryCtxSome(p, ap) }
20902091

2092+
int getParameterPos() { p.isParameterOf(_, result) }
2093+
20912094
override string toString() { result = p + ": " + ap }
20922095

20932096
predicate hasLocationInfo(
@@ -2481,13 +2484,15 @@ pragma[nomagic]
24812484
private predicate paramFlowsThrough(
24822485
ReturnKindExt kind, CallContextCall cc, SummaryCtxSome sc, AccessPath ap, Configuration config
24832486
) {
2484-
exists(PathNodeMid mid, ReturnNodeExt ret |
2487+
exists(PathNodeMid mid, ReturnNodeExt ret, int pos |
24852488
mid.getNode() = ret and
24862489
kind = ret.getKind() and
24872490
cc = mid.getCallContext() and
24882491
sc = mid.getSummaryCtx() and
24892492
config = mid.getConfiguration() and
2490-
ap = mid.getAp()
2493+
ap = mid.getAp() and
2494+
pos = sc.getParameterPos() and
2495+
not kind.(ParamUpdateReturnKind).getPosition() = pos
24912496
)
24922497
}
24932498

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,7 @@ private predicate throughFlowNodeCand(Node node, Configuration config) {
548548
}
549549

550550
/** Holds if flow may return from `callable`. */
551+
pragma[nomagic]
551552
private predicate returnFlowCallableCand(
552553
DataFlowCallable callable, ReturnKindExt kind, Configuration config
553554
) {
@@ -2088,6 +2089,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
20882089

20892090
SummaryCtxSome() { this = TSummaryCtxSome(p, ap) }
20902091

2092+
int getParameterPos() { p.isParameterOf(_, result) }
2093+
20912094
override string toString() { result = p + ": " + ap }
20922095

20932096
predicate hasLocationInfo(
@@ -2481,13 +2484,15 @@ pragma[nomagic]
24812484
private predicate paramFlowsThrough(
24822485
ReturnKindExt kind, CallContextCall cc, SummaryCtxSome sc, AccessPath ap, Configuration config
24832486
) {
2484-
exists(PathNodeMid mid, ReturnNodeExt ret |
2487+
exists(PathNodeMid mid, ReturnNodeExt ret, int pos |
24852488
mid.getNode() = ret and
24862489
kind = ret.getKind() and
24872490
cc = mid.getCallContext() and
24882491
sc = mid.getSummaryCtx() and
24892492
config = mid.getConfiguration() and
2490-
ap = mid.getAp()
2493+
ap = mid.getAp() and
2494+
pos = sc.getParameterPos() and
2495+
not kind.(ParamUpdateReturnKind).getPosition() = pos
24912496
)
24922497
}
24932498

0 commit comments

Comments
 (0)