Skip to content

Commit c7509c4

Browse files
erik-krogherik-krogh
committed
Merge branch 'main' into deadCode
2 parents 548e50c + d89c52f commit c7509c4

245 files changed

Lines changed: 5325 additions & 814 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/check-qldoc.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: "Check QLdoc coverage"
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "*/ql/lib/**"
7+
- .github/workflows/check-qldoc.yml
8+
branches:
9+
- main
10+
- "rc/*"
11+
12+
jobs:
13+
qldoc:
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Install CodeQL
18+
run: |
19+
gh extension install github/gh-codeql
20+
gh codeql set-channel nightly
21+
gh codeql version
22+
env:
23+
GITHUB_TOKEN: ${{ github.token }}
24+
25+
- uses: actions/checkout@v2
26+
with:
27+
fetch-depth: 2
28+
29+
- name: Check QLdoc coverage
30+
shell: bash
31+
run: |
32+
EXIT_CODE=0
33+
changed_lib_packs="$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD | { grep -o '^[a-z]*/ql/lib' || true; } | sort -u)"
34+
for pack_dir in ${changed_lib_packs}; do
35+
lang="${pack_dir%/ql/lib}"
36+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-current.txt" --dir="${pack_dir}"
37+
done
38+
git checkout HEAD^
39+
for pack_dir in ${changed_lib_packs}; do
40+
lang="${pack_dir%/ql/lib}"
41+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-baseline.txt" --dir="${pack_dir}"
42+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-current.txt" | sort -u > "${RUNNER_TEMP}/current-undocumented.txt"
43+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-baseline.txt" | sort -u > "${RUNNER_TEMP}/baseline-undocumented.txt"
44+
UNDOCUMENTED="$(grep -f <(comm -13 "${RUNNER_TEMP}/baseline-undocumented.txt" "${RUNNER_TEMP}/current-undocumented.txt") "${RUNNER_TEMP}/${lang}-current.txt" || true)"
45+
if [ -n "$UNDOCUMENTED" ]; then
46+
echo "$UNDOCUMENTED" | awk -F, '{gsub(/"/,""); print "::warning file='"${pack_dir}"'/"$1",line="$2"::Missing QLdoc for "$5, $3 }'
47+
EXIT_CODE=1
48+
fi
49+
done
50+
exit "${EXIT_CODE}"

‎config/identical-files.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,14 @@
7373
"java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
7474
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
7575
],
76+
"Model as Data Generation Java/C# - Utils": [
77+
"java/ql/src/utils/model-generator/ModelGeneratorUtils.qll",
78+
"csharp/ql/src/utils/model-generator/ModelGeneratorUtils.qll"
79+
],
80+
"Model as Data Generation Java/C# - SummaryModels": [
81+
"java/ql/src/utils/model-generator/CaptureSummaryModels.qll",
82+
"csharp/ql/src/utils/model-generator/CaptureSummaryModels.qll"
83+
],
7684
"Sign Java/C#": [
7785
"java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
7886
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
@@ -508,4 +516,4 @@
508516
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
509517
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
510518
]
511-
}
519+
}

‎cpp/ql/lib/CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 0.0.11
2+
3+
### Minor Analysis Improvements
4+
5+
* Many queries now support structured bindings, as structured bindings are now handled in the IR translation.
6+
17
## 0.0.10
28

39
### New Features
@@ -6,6 +12,7 @@
612

713
## 0.0.9
814

15+
916
## 0.0.8
1017

1118
### Deprecated APIs

‎cpp/ql/lib/change-notes/2022-03-14-taint-interface-cleanup.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: breaking
3+
---
4+
* The flow state variants of `isBarrier` and `isAdditionalFlowStep` are no longer exposed in the taint tracking library. The `isSanitizer` and `isAdditionalTaintStep` predicates should be used instead.

cpp/ql/lib/change-notes/2022-02-24-structured-bindings-in-ir.md renamed to cpp/ql/lib/change-notes/released/0.0.11.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
---
2-
category: minorAnalysis
3-
---
1+
## 0.0.11
2+
3+
### Minor Analysis Improvements
4+
45
* Many queries now support structured bindings, as structured bindings are now handled in the IR translation.

‎cpp/ql/lib/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.0.10
2+
lastReleaseVersion: 0.0.11

‎cpp/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 0.0.11-dev
2+
version: 0.0.12-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,4 @@ import semmle.code.cpp.dataflow.DataFlow2
2020

2121
module TaintTracking {
2222
import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
23-
private import semmle.code.cpp.dataflow.TaintTracking2
2423
}

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,30 @@ abstract class Configuration extends DataFlow::Configuration {
6464
override predicate isSource(DataFlow::Node source) { none() }
6565

6666
/**
67-
* Holds if `sink` is a relevant taint sink.
67+
* Holds if `source` is a relevant taint source with the given initial
68+
* `state`.
69+
*
70+
* The smaller this predicate is, the faster `hasFlow()` will converge.
71+
*/
72+
// overridden to provide taint-tracking specific qldoc
73+
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
74+
75+
/**
76+
* Holds if `sink` is a relevant taint sink
6877
*
6978
* The smaller this predicate is, the faster `hasFlow()` will converge.
7079
*/
7180
// overridden to provide taint-tracking specific qldoc
7281
override predicate isSink(DataFlow::Node sink) { none() }
7382

83+
/**
84+
* Holds if `sink` is a relevant taint sink accepting `state`.
85+
*
86+
* The smaller this predicate is, the faster `hasFlow()` will converge.
87+
*/
88+
// overridden to provide taint-tracking specific qldoc
89+
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
90+
7491
/** Holds if the node `node` is a taint sanitizer. */
7592
predicate isSanitizer(DataFlow::Node node) { none() }
7693

@@ -79,6 +96,16 @@ abstract class Configuration extends DataFlow::Configuration {
7996
defaultTaintSanitizer(node)
8097
}
8198

99+
/**
100+
* Holds if the node `node` is a taint sanitizer when the flow state is
101+
* `state`.
102+
*/
103+
predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
104+
105+
final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
106+
this.isSanitizer(node, state)
107+
}
108+
82109
/** Holds if taint propagation into `node` is prohibited. */
83110
predicate isSanitizerIn(DataFlow::Node node) { none() }
84111

@@ -107,6 +134,25 @@ abstract class Configuration extends DataFlow::Configuration {
107134
defaultAdditionalTaintStep(node1, node2)
108135
}
109136

137+
/**
138+
* Holds if the additional taint propagation step from `node1` to `node2`
139+
* must be taken into account in the analysis. This step is only applicable
140+
* in `state1` and updates the flow state to `state2`.
141+
*/
142+
predicate isAdditionalTaintStep(
143+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
144+
DataFlow::FlowState state2
145+
) {
146+
none()
147+
}
148+
149+
final override predicate isAdditionalFlowStep(
150+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
151+
DataFlow::FlowState state2
152+
) {
153+
this.isAdditionalTaintStep(node1, state1, node2, state2)
154+
}
155+
110156
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
111157
(this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
112158
defaultImplicitTaintRead(node, c)

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,30 @@ abstract class Configuration extends DataFlow::Configuration {
6464
override predicate isSource(DataFlow::Node source) { none() }
6565

6666
/**
67-
* Holds if `sink` is a relevant taint sink.
67+
* Holds if `source` is a relevant taint source with the given initial
68+
* `state`.
69+
*
70+
* The smaller this predicate is, the faster `hasFlow()` will converge.
71+
*/
72+
// overridden to provide taint-tracking specific qldoc
73+
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
74+
75+
/**
76+
* Holds if `sink` is a relevant taint sink
6877
*
6978
* The smaller this predicate is, the faster `hasFlow()` will converge.
7079
*/
7180
// overridden to provide taint-tracking specific qldoc
7281
override predicate isSink(DataFlow::Node sink) { none() }
7382

83+
/**
84+
* Holds if `sink` is a relevant taint sink accepting `state`.
85+
*
86+
* The smaller this predicate is, the faster `hasFlow()` will converge.
87+
*/
88+
// overridden to provide taint-tracking specific qldoc
89+
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
90+
7491
/** Holds if the node `node` is a taint sanitizer. */
7592
predicate isSanitizer(DataFlow::Node node) { none() }
7693

@@ -79,6 +96,16 @@ abstract class Configuration extends DataFlow::Configuration {
7996
defaultTaintSanitizer(node)
8097
}
8198

99+
/**
100+
* Holds if the node `node` is a taint sanitizer when the flow state is
101+
* `state`.
102+
*/
103+
predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
104+
105+
final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
106+
this.isSanitizer(node, state)
107+
}
108+
82109
/** Holds if taint propagation into `node` is prohibited. */
83110
predicate isSanitizerIn(DataFlow::Node node) { none() }
84111

@@ -107,6 +134,25 @@ abstract class Configuration extends DataFlow::Configuration {
107134
defaultAdditionalTaintStep(node1, node2)
108135
}
109136

137+
/**
138+
* Holds if the additional taint propagation step from `node1` to `node2`
139+
* must be taken into account in the analysis. This step is only applicable
140+
* in `state1` and updates the flow state to `state2`.
141+
*/
142+
predicate isAdditionalTaintStep(
143+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
144+
DataFlow::FlowState state2
145+
) {
146+
none()
147+
}
148+
149+
final override predicate isAdditionalFlowStep(
150+
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
151+
DataFlow::FlowState state2
152+
) {
153+
this.isAdditionalTaintStep(node1, state1, node2, state2)
154+
}
155+
110156
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
111157
(this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
112158
defaultImplicitTaintRead(node, c)

0 commit comments

Comments
 (0)