You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CONTRIBUTING.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,4 +1,4 @@
1
-
# Contributing to QL
1
+
# Contributing to CodeQL
2
2
3
3
We welcome contributions to our standard library and standard checks. Got an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request!
4
4
@@ -9,13 +9,13 @@ Before we accept your pull request, we require that you have agreed to our Contr
9
9
If you have an idea for a query that you would like to share with other Semmle users, please open a pull request to add it to this repository.
10
10
Follow the steps below to help other users understand what your query does, and to ensure that your query is consistent with the other Semmle queries.
11
11
12
-
1.**Consult the QL documentation for query writers**
12
+
1.**Consult the documentation for query writers**
13
13
14
-
There is lots of useful documentation to help you write QL, ranging from information about query file structure to language-specific tutorials. For more information on the documentation available, see [Writing QL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
14
+
There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [Writing CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
15
15
16
-
2.**Format your QL correctly**
16
+
2.**Format your code correctly**
17
17
18
-
All of Semmle's standard QL queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all QL contributions follow the same formatting guidelines. If you use QL for Eclipse, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html). For more information, see the [QL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md).
18
+
All of Semmle's standard queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all contributions follow the same formatting guidelines. If you use QL for Eclipse, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html). For more information, see the [CodeQL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md).
19
19
20
20
3.**Make sure your query has the correct metadata**
21
21
@@ -29,7 +29,7 @@ Follow the steps below to help other users understand what your query does, and
29
29
The `select` statement of your query must be compatible with the query type (determined by the `@kind` metadata property) for alert or path results to be displayed correctly in LGTM and QL for Eclipse.
30
30
For more information on `select` statement format, see [Introduction to query files](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
31
31
32
-
5.**Save your query in a `.ql` file in correct language directory in this repository**
32
+
5.**Save your query in a `.ql` file in the correct language directory in this repository**
33
33
34
34
There are five language-specific directories in this repository:
35
35
@@ -54,7 +54,7 @@ repositories, which might be made public. We might also use this information
54
54
to contact you in relation to your contributions, as well as in the
55
55
normal course of software development. We also store records of your
56
56
CLA agreements. Under GDPR legislation, we do this
57
-
on the basis of our legitimate interest in creating the QL product.
57
+
on the basis of our legitimate interest in creating the CodeQL product.
58
58
59
59
Please do get in touch (privacy@semmle.com) if you have any questions about
This open source repository contains the standard QL libraries and queries that power [LGTM](https://lgtm.com), and the other products that [Semmle](https://semmle.com) makes available to its customers worldwide.
3
+
This open source repository contains the standard CodeQL libraries and queries that power [LGTM](https://lgtm.com), and the other products that [Semmle](https://semmle.com) makes available to its customers worldwide.
4
4
5
-
## How do I learn QL and run queries?
5
+
## How do I learn CodeQL and run queries?
6
6
7
-
There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing QL.
8
-
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open-source project that's currently being analyzed.
7
+
There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
8
+
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any opensource project that's currently being analyzed.
9
9
10
10
## Contributing
11
11
12
-
We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/Semmle/ql/tree/master/docs) to learn how to format your QL for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
12
+
We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/Semmle/ql/tree/master/docs) to learn how to format your code for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
13
13
14
14
## License
15
15
16
-
The QL queries in this repository are licensed under [Apache License 2.0](LICENSE) by [Semmle](https://semmle.com).
16
+
The code in this repository is licensed under [Apache License 2.0](LICENSE) by [Semmle](https://semmle.com).
Copy file name to clipboardExpand all lines: change-notes/1.22/analysis-javascript.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,6 +36,7 @@
36
36
| Shift out of range (`js/shift-out-of-range`| Fewer false positive results | This rule now correctly handles BigInt shift operands. |
37
37
| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer false-positive results. | This rule no longer flags calls to placeholder functions that trivially throw an exception. |
38
38
| Undocumented parameter (`js/jsdoc/missing-parameter`) | No changes to results | This rule is now run on LGTM, although its results are still not shown by default. |
39
+
| Missing space in string concatenation (`js/missing-space-in-concatenation`) | Fewer false positive results | The rule now requires a word-like part exists in the string concatenation. |
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail. This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
12
+
| Signed overflow check (`cpp/signed-overflow-check`) | correctness, security | Finds overflow checks that rely on signed integer addition to overflow, which has undefined behavior. Example: `a + b < a`. |
13
+
| Pointer overflow check (`cpp/pointer-overflow-check`) | correctness, security | Finds overflow checks that rely on pointer addition to overflow, which has undefined behavior. Example: `ptr + a < ptr`. |
12
14
13
15
## Changes to existing queries
14
16
@@ -18,8 +20,15 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
18
20
| Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
19
21
| Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
20
22
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | More correct results | This query now checks for the beginning date of the Reiwa era (1st May 2019). |
23
+
| Sign check of bitwise operation (`cpp/bitwise-sign-check`) | Fewer false positive results | Results involving `>=` or `<=` are no longer reported. |
24
+
| Too few arguments to formatting function (`cpp/wrong-number-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
25
+
| Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
26
+
| Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
27
+
| Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
28
+
| Non-constant format string (`cpp/non-constant-format`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
29
+
| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | More correct results and fewer false positive results | This query now understands explicitly specified argument numbers in format strings, such as the `1$` in `%1$s`. |
21
30
22
-
## Changes to QL libraries
31
+
## Changes to libraries
23
32
24
33
* The data-flow library has been extended with a new feature to aid debugging.
25
34
Instead of specifying `isSink(Node n) { any() }` on a configuration to
@@ -28,10 +37,31 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
28
37
picture of the partial flow paths from a given source. The feature is
29
38
disabled by default and can be enabled for individual configurations by
30
39
overriding `int explorationLimit()`.
40
+
* The data-flow library now supports flow out of C++ reference parameters.
41
+
* The data-flow library now allows flow through the address-of operator (`&`).
31
42
* The `DataFlow::DefinitionByReferenceNode` class now considers `f(x)` to be a
32
43
definition of `x` when `x` is a variable of pointer type. It no longer
33
44
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
34
45
changes are in line with the user expectations we've observed.
46
+
* The data-flow library now makes it easier to specify barriers/sanitizers
47
+
arising from guards by overriding the predicate
48
+
`isBarrierGuard`/`isSanitizerGuard` on data-flow and taint-tracking
49
+
configurations respectively.
35
50
* There is now a `DataFlow::localExprFlow` predicate and a
36
51
`TaintTracking::localExprTaint` predicate to make it easy to use the most
37
52
common case of local data flow and taint: from one `Expr` to another.
53
+
* The member predicates of the `FunctionInput` and `FunctionOutput` classes have been renamed for
54
+
clarity (e.g. `isOutReturnPointer()` to `isReturnValueDeref()`). The existing member predicates
55
+
have been deprecated, and will be removed in a future release. Code that uses the old member
56
+
predicates should be updated to use the corresponding new member predicate.
57
+
* The predicates `Declaration.hasStdName()` and `Declaration.hasGlobalOrStdName`
58
+
have been added, simplifying handling of C++ standard library functions.
59
+
* The control-flow graph is now computed in QL, not in the extractor. This can
60
+
lead to regressions (or improvements) in how queries are optimized because
61
+
optimization in QL relies on static size estimates, and the control-flow edge
62
+
relations will now have different size estimates than before.
63
+
* Support has been added for non-type template arguments. This means that the
64
+
return type of `Declaration::getTemplateArgument()` and
65
+
`Declaration::getATemplateArgument` have changed to `Locatable`. See the
66
+
documentation for `Declaration::getTemplateArgument()` and
67
+
`Declaration::getTemplateArgumentKind()` for details.
| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security, external/cwe/cwe-502 | Finds flow of untrusted input to calls to unsafe deserializers. |
11
13
| Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
| Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
| Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | Fewer false positive results | More `null` checks are now taken into account, including `null` checks for `dynamic` expressions and `null` checks such as `object alwaysNull = null; if (x != alwaysNull) ...`. |
22
+
| Missing Dispose call on local IDisposable (`cs/local-not-disposed`) | Fewer false positive results | The query has been rewritten in order to identify more dispose patterns. For example, a local `IDisposable` that is disposed of by passing through a fluent API is no longer reported. |
18
23
19
24
## Removal of old queries
20
25
21
26
## Changes to code extraction
22
27
23
28
*`nameof` expressions are now extracted correctly when the name is a namespace.
24
29
25
-
## Changes to QL libraries
30
+
## Changes to libraries
26
31
27
32
* The new class `NamespaceAccess` models accesses to namespaces, for example in `nameof` expressions.
28
33
* The data-flow library now makes it easier to specify barriers/sanitizers
@@ -37,5 +42,11 @@ The following changes in version 1.23 affect C# analysis in all applications.
37
42
disabled by default and can be enabled for individual configurations by
38
43
overriding `int explorationLimit()`.
39
44
*`foreach` statements where the body is guaranteed to be executed at least once, such as `foreach (var x in new string[]{ "a", "b", "c" }) { ... }`, are now recognized by all analyses based on the control flow graph (such as SSA, data flow and taint tracking).
45
+
* Fixed the control flow graph for `switch` statements where the `default` case was not the last case. This had caused the remaining cases to be unreachable. `SwitchStmt.getCase(int i)` now puts the `default` case last.
46
+
* There is now a `DataFlow::localExprFlow` predicate and a
47
+
`TaintTracking::localExprTaint` predicate to make it easy to use the most
48
+
common case of local data flow and taint: from one `Expr` to another.
49
+
* Data is now tracked through null-coalescing expressions (`??`).
50
+
* A new library `semmle.code.csharp.Unification` has been added. This library exposes two predicates `unifiable` and `subsumes` for calculating type unification and type subsumption, respectively.
| Continue statement that does not continue (`java/continue-in-false-loop`) | correctness | Finds `continue` statements in `do { ... } while (false)` loops. |
| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positives | Certain indirect null guards involving two auxiliary variables known to be equal can now be detected. |
16
+
| Non-synchronized override of synchronized method (`java/non-sync-override`) | Fewer false positives | Results are now only reported if the immediately overridden method is synchronized. |
9
17
| Query built from user-controlled sources (`java/sql-injection`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
10
18
| Query built from local-user-controlled sources (`java/sql-injection-local`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
11
19
| Query built without neutralizing special characters (`java/concatenated-sql-query`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
20
+
| Useless comparison test (`java/constant-comparison`) | Fewer false positives | Additional overflow check patterns are now recognized and no longer reported. |
12
21
13
-
## Changes to QL libraries
22
+
## Changes to libraries
14
23
15
24
* The data-flow library has been extended with a new feature to aid debugging.
16
25
Instead of specifying `isSink(Node n) { any() }` on a configuration to
0 commit comments