hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sync shared library changes across languages.

Browse Source
This commit is contained in:
Joe Farebrother
2022-03-08 16:57:36 +00:00
parent bb562643c6
commit 0a5268aeb4
6 changed files with 39 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll
View File

@@ -610,10 +610,15 @@ State after(RegExpTerm t) {
or or
exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp)) exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp))
or or
exists(EffectivelyStar star | t = star.getAChild() | result = before(star)) exists(EffectivelyStar star | t = star.getAChild() |
not isPossessive(star) and
result = before(star)
)
or or
exists(EffectivelyPlus plus | t = plus.getAChild() | exists(EffectivelyPlus plus | t = plus.getAChild() |
result = before(plus) or not isPossessive(plus) and
result = before(plus)
or
result = after(plus) result = after(plus)
) )
or or

6
javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtilSpecific.qll
View File

@@ -12,6 +12,12 @@ predicate isEscapeClass(RegExpTerm term, string clazz) {
exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz) exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz)
} }
/**
* Holds if `term` is a possessive quantifier.
* As javascript's regexes do not support possessive quantifiers, this never holds, but is used by the shared library.
*/
predicate isPossessive(RegExpQuantifier term) { none() }
/** /**
* Holds if the regular expression should not be considered. * Holds if the regular expression should not be considered.
* *

9
python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll
View File

@@ -610,10 +610,15 @@ State after(RegExpTerm t) {
or or
exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp)) exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp))
or or
exists(EffectivelyStar star | t = star.getAChild() | result = before(star)) exists(EffectivelyStar star | t = star.getAChild() |
not isPossessive(star) and
result = before(star)
)
or or
exists(EffectivelyPlus plus | t = plus.getAChild() | exists(EffectivelyPlus plus | t = plus.getAChild() |
result = before(plus) or not isPossessive(plus) and
result = before(plus)
or
result = after(plus) result = after(plus)
) )
or or

6
python/ql/lib/semmle/python/security/performance/ReDoSUtilSpecific.qll
View File

@@ -13,6 +13,12 @@ predicate isEscapeClass(RegExpTerm term, string clazz) {
exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz) exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz)
} }
/**
* Holds if `term` is a possessive quantifier.
* As python's regexes do not support possessive quantifiers, this never holds, but is used by the shared library.
*/
predicate isPossessive(RegExpQuantifier term) { none() }
/** /**
* Holds if the regular expression should not be considered. * Holds if the regular expression should not be considered.
* *

9
ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll
View File

@@ -610,10 +610,15 @@ State after(RegExpTerm t) {
or or
exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp)) exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp))
or or
exists(EffectivelyStar star | t = star.getAChild() | result = before(star)) exists(EffectivelyStar star | t = star.getAChild() |
not isPossessive(star) and
result = before(star)
)
or or
exists(EffectivelyPlus plus | t = plus.getAChild() | exists(EffectivelyPlus plus | t = plus.getAChild() |
result = before(plus) or not isPossessive(plus) and
result = before(plus)
or
result = after(plus) result = after(plus)
) )
or or

6
ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtilSpecific.qll
View File

@@ -33,6 +33,12 @@ predicate isExcluded(RegExpParent parent) {
parent.(RegExpTerm).getRegExp().(AST::RegExpLiteral).hasFreeSpacingFlag() // exclude free-spacing mode regexes parent.(RegExpTerm).getRegExp().(AST::RegExpLiteral).hasFreeSpacingFlag() // exclude free-spacing mode regexes
} }
/**
* Holds if `term` is a possessive quantifier.
* Not currently implemented, but is used by the shared library.
*/
predicate isPossessive(RegExpQuantifier term) { none() }
/** /**
* A module containing predicates for determining which flags a regular expression have. * A module containing predicates for determining which flags a regular expression have.
*/ */