Merge branch 'main' into threat-models

2026-05-04 21:25:44 +02:00 · 2024-09-23 11:19:58 +02:00
parent e11bfc27bd e48e18af20
commit 4a21a85e73
6529 changed files with 233607 additions and 131008 deletions
--- a/python/ql/lib/semmle/python/RegexTreeView.qll
+++ b/python/ql/lib/semmle/python/RegexTreeView.qll
@@ -1,6 +0,0 @@
-/**
- * Deprecated. Use `semmle.python.regexp.RegexTreeView` instead.
- */
-
-deprecated import regexp.RegexTreeView as Dep
-import Dep
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
@@ -168,14 +168,6 @@ abstract deprecated class Configuration extends string {
   */
  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }

-  /**
-   * DEPRECATED: Use `FlowExploration<explorationLimit>` instead.
-   *
-   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
-   * measured in approximate number of interprocedural steps.
-   */
-  deprecated int explorationLimit() { none() }
-
  /**
   * Holds if hidden nodes should be included in the data flow graph.
   *
@@ -290,14 +282,6 @@ deprecated private module Config implements FullStateConfigSig {

  FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }

-  predicate sourceGrouping(Node source, string sourceGroup) {
-    any(Configuration config).sourceGrouping(source, sourceGroup)
-  }
-
-  predicate sinkGrouping(Node sink, string sinkGroup) {
-    any(Configuration config).sinkGrouping(sink, sinkGroup)
-  }
-
  predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
 }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -168,14 +168,6 @@ abstract deprecated class Configuration extends string {
   */
  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }

-  /**
-   * DEPRECATED: Use `FlowExploration<explorationLimit>` instead.
-   *
-   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
-   * measured in approximate number of interprocedural steps.
-   */
-  deprecated int explorationLimit() { none() }
-
  /**
   * Holds if hidden nodes should be included in the data flow graph.
   *
@@ -290,14 +282,6 @@ deprecated private module Config implements FullStateConfigSig {

  FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }

-  predicate sourceGrouping(Node source, string sourceGroup) {
-    any(Configuration config).sourceGrouping(source, sourceGroup)
-  }
-
-  predicate sinkGrouping(Node sink, string sinkGroup) {
-    any(Configuration config).sinkGrouping(sink, sinkGroup)
-  }
-
  predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
 }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -168,14 +168,6 @@ abstract deprecated class Configuration extends string {
   */
  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }

-  /**
-   * DEPRECATED: Use `FlowExploration<explorationLimit>` instead.
-   *
-   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
-   * measured in approximate number of interprocedural steps.
-   */
-  deprecated int explorationLimit() { none() }
-
  /**
   * Holds if hidden nodes should be included in the data flow graph.
   *
@@ -290,14 +282,6 @@ deprecated private module Config implements FullStateConfigSig {

  FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }

-  predicate sourceGrouping(Node source, string sourceGroup) {
-    any(Configuration config).sourceGrouping(source, sourceGroup)
-  }
-
-  predicate sinkGrouping(Node sink, string sinkGroup) {
-    any(Configuration config).sinkGrouping(sink, sinkGroup)
-  }
-
  predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
 }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -168,14 +168,6 @@ abstract deprecated class Configuration extends string {
   */
  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }

-  /**
-   * DEPRECATED: Use `FlowExploration<explorationLimit>` instead.
-   *
-   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
-   * measured in approximate number of interprocedural steps.
-   */
-  deprecated int explorationLimit() { none() }
-
  /**
   * Holds if hidden nodes should be included in the data flow graph.
   *
@@ -290,14 +282,6 @@ deprecated private module Config implements FullStateConfigSig {

  FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }

-  predicate sourceGrouping(Node source, string sourceGroup) {
-    any(Configuration config).sourceGrouping(source, sourceGroup)
-  }
-
-  predicate sinkGrouping(Node sink, string sinkGroup) {
-    any(Configuration config).sinkGrouping(sink, sinkGroup)
-  }
-
  predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
 }

--- a/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll
+++ b/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll
@@ -664,14 +664,6 @@ module DataFlow {
  }
 }

-deprecated private class DataFlowType extends TaintKind {
-  // this only exists to avoid an empty recursion error in the type checker
-  DataFlowType() {
-    this = "Data flow" and
-    1 = 2
-  }
-}
-
 pragma[noinline]
 private predicate dict_construct(ControlFlowNode itemnode, ControlFlowNode dictnode) {
  dictnode.(DictNode).getAValue() = itemnode
--- a/python/ql/lib/semmle/python/regex.qll
+++ b/python/ql/lib/semmle/python/regex.qll
@@ -14,8 +14,3 @@ RegExpTerm getTermForExecution(Concepts::RegexExecution exec) {
    result.isRootTerm()
  )
 }
-
-/** A StringLiteral used as a regular expression */
-deprecated class RegexString extends Regex {
-  RegexString() { this = RegExpTracking::regExpSource(_).asExpr() }
-}
--- a/python/ql/lib/semmle/python/regexp/internal/ParseRegExp.qll
+++ b/python/ql/lib/semmle/python/regexp/internal/ParseRegExp.qll
@@ -100,11 +100,6 @@ private module FindRegexMode {
  private string mode_from_node(DataFlow::Node node) { node = re_flag_tracker(result) }
 }

-/**
- * DEPRECATED: Use `RegExp` instead.
- */
-deprecated class Regex = RegExp;
-
 /** A StringLiteral used as a regular expression */
 class RegExp extends Expr instanceof StringLiteral {
  DataFlow::Node use;
--- a/python/ql/lib/semmle/python/security/SQL.qll
+++ b/python/ql/lib/semmle/python/security/SQL.qll
@@ -1,4 +0,0 @@
-import python
-import semmle.python.dataflow.TaintTracking
-
-abstract deprecated class SqlInjectionSink extends TaintSink { }
--- a/python/ql/lib/semmle/python/security/dataflow/CleartextLoggingCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/CleartextLoggingCustomizations.qll
@@ -41,7 +41,9 @@ module CleartextLogging {
   */
  class SensitiveDataSourceAsSource extends Source, SensitiveDataSource {
    SensitiveDataSourceAsSource() {
-      not SensitiveDataSource.super.getClassification() = SensitiveDataClassification::id()
+      not SensitiveDataSource.super.getClassification() in [
+          SensitiveDataClassification::id(), SensitiveDataClassification::certificate()
+        ]
    }

    override SensitiveDataClassification getClassification() {
--- a/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll
@@ -40,7 +40,9 @@ module CleartextStorage {
   */
  class SensitiveDataSourceAsSource extends Source, SensitiveDataSource {
    SensitiveDataSourceAsSource() {
-      not SensitiveDataSource.super.getClassification() = SensitiveDataClassification::id()
+      not SensitiveDataSource.super.getClassification() in [
+          SensitiveDataClassification::id(), SensitiveDataClassification::certificate()
+        ]
    }

    override SensitiveDataClassification getClassification() {