mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
Autoformat docs ql files
This commit is contained in:
@@ -5,4 +5,4 @@ where
|
||||
a.getAnOperand() = v.getAnAccess() and
|
||||
cmp.getAnOperand() = a and
|
||||
cmp.getAnOperand() = v.getAnAccess()
|
||||
select cmp, "Overflow check."
|
||||
select cmp, "Overflow check."
|
||||
|
||||
@@ -6,4 +6,4 @@ where
|
||||
cmp.getAnOperand() = a and
|
||||
cmp.getAnOperand() = v.getAnAccess() and
|
||||
forall(Expr op | op = a.getAnOperand() | isSmall(op))
|
||||
select cmp, "Bad overflow check."
|
||||
select cmp, "Bad overflow check."
|
||||
|
||||
@@ -9,4 +9,4 @@ where
|
||||
cmp.getAnOperand() = v.getAnAccess() and
|
||||
forall(Expr op | op = a.getAnOperand() | isSmall(op)) and
|
||||
not isSmall(a.getExplicitlyConverted())
|
||||
select cmp, "Bad overflow check"
|
||||
select cmp, "Bad overflow check"
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
import cpp
|
||||
|
||||
|
||||
from FunctionCall alloc, FunctionCall free, LocalScopeVariable v
|
||||
where allocationCall(alloc)
|
||||
and alloc = v.getAnAssignedValue()
|
||||
and freeCall(free, v.getAnAccess())
|
||||
and alloc.getASuccessor+() = free
|
||||
where
|
||||
allocationCall(alloc) and
|
||||
alloc = v.getAnAssignedValue() and
|
||||
freeCall(free, v.getAnAccess()) and
|
||||
alloc.getASuccessor+() = free
|
||||
select alloc, free
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
import cpp
|
||||
|
||||
|
||||
from FunctionCall free, LocalScopeVariable v, VariableAccess u
|
||||
where freeCall(free, v.getAnAccess())
|
||||
and u = v.getAnAccess()
|
||||
and u.isRValue()
|
||||
and free.getASuccessor+() = u
|
||||
select free, u
|
||||
where
|
||||
freeCall(free, v.getAnAccess()) and
|
||||
u = v.getAnAccess() and
|
||||
u.isRValue() and
|
||||
free.getASuccessor+() = u
|
||||
select free, u
|
||||
|
||||
@@ -7,4 +7,4 @@ where
|
||||
use = lv.getAnAccess() and
|
||||
use = def.getASuccessor+()
|
||||
)
|
||||
select lv, def
|
||||
select lv, def
|
||||
|
||||
@@ -7,4 +7,4 @@ predicate isReachable(BasicBlock bb) {
|
||||
|
||||
from BasicBlock bb
|
||||
where not isReachable(bb)
|
||||
select bb
|
||||
select bb
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
import cpp
|
||||
|
||||
from ExprCall c, PointerDereferenceExpr deref, VariableAccess va,
|
||||
Access fnacc
|
||||
where c.getLocation().getFile().getBaseName() = "cjpeg.c" and
|
||||
c.getLocation().getStartLine() = 640 and
|
||||
deref = c.getExpr() and
|
||||
va = deref.getOperand() and
|
||||
fnacc = va.getTarget().getAnAssignedValue()
|
||||
select c, fnacc.getTarget()
|
||||
from ExprCall c, PointerDereferenceExpr deref, VariableAccess va, Access fnacc
|
||||
where
|
||||
c.getLocation().getFile().getBaseName() = "cjpeg.c" and
|
||||
c.getLocation().getStartLine() = 640 and
|
||||
deref = c.getExpr() and
|
||||
va = deref.getOperand() and
|
||||
fnacc = va.getTarget().getAnAssignedValue()
|
||||
select c, fnacc.getTarget()
|
||||
|
||||
@@ -2,7 +2,8 @@ import cpp
|
||||
import semmle.code.cpp.commons.Printf
|
||||
|
||||
from Call c, FormattingFunction ff, Expr format
|
||||
where c.getTarget() = ff and
|
||||
format = c.getArgument(ff.getFormatParameterIndex()) and
|
||||
not format instanceof StringLiteral
|
||||
select format, "Non-constant format string."
|
||||
where
|
||||
c.getTarget() = ff and
|
||||
format = c.getArgument(ff.getFormatParameterIndex()) and
|
||||
not format instanceof StringLiteral
|
||||
select format, "Non-constant format string."
|
||||
|
||||
@@ -5,8 +5,9 @@ import semmle.code.cpp.commons.Printf
|
||||
class SourceNode extends DataFlow::Node { /* ... */ }
|
||||
|
||||
from FormattingFunction f, Call c, SourceNode src, DataFlow::Node arg
|
||||
where c.getTarget() = f and
|
||||
arg.asExpr() = c.getArgument(f.getFormatParameterIndex()) and
|
||||
DataFlow::localFlow(src, arg) and
|
||||
not src.asExpr() instanceof StringLiteral
|
||||
where
|
||||
c.getTarget() = f and
|
||||
arg.asExpr() = c.getArgument(f.getFormatParameterIndex()) and
|
||||
DataFlow::localFlow(src, arg) and
|
||||
not src.asExpr() instanceof StringLiteral
|
||||
select arg, "Non-constant format string."
|
||||
|
||||
@@ -1,11 +1,9 @@
|
||||
import cpp
|
||||
|
||||
class EmptyBlock extends Block {
|
||||
EmptyBlock() {
|
||||
this.isEmpty()
|
||||
}
|
||||
EmptyBlock() { this.isEmpty() }
|
||||
}
|
||||
|
||||
from IfStmt ifStmt
|
||||
where ifstmt.getThen() instanceof EmptyBlock
|
||||
select ifstmt
|
||||
select ifstmt
|
||||
|
||||
@@ -8,4 +8,4 @@ from IfStmt ifstmt
|
||||
where
|
||||
ifstmt.getThen() instanceof EmptyBlock and
|
||||
not exists(ifstmt.getElse())
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
import cpp
|
||||
|
||||
predicate isEmpty(Block block) {
|
||||
block.isEmpty()
|
||||
}
|
||||
predicate isEmpty(Block block) { block.isEmpty() }
|
||||
|
||||
from IfStmt ifstmt
|
||||
where isEmpty(ifstmt.getThen())
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import cpp
|
||||
|
||||
import cpp
|
||||
|
||||
from IfStmt ifstmt, Block block
|
||||
where
|
||||
block = ifstmt.getThen() and
|
||||
block.isEmpty()
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
|
||||
@@ -3,11 +3,12 @@ import semmle.code.cpp.dataflow.TaintTracking
|
||||
|
||||
class TaintedFormatConfig extends TaintTracking::Configuration {
|
||||
TaintedFormatConfig() { this = "TaintedFormatConfig" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { /* TBD */ }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { /* TBD */ }
|
||||
}
|
||||
|
||||
from TaintedFormatConfig cfg, DataFlow::Node source, DataFlow::Node sink
|
||||
where cfg.hasFlow(source, sink)
|
||||
select sink, "This format string may be derived from a $@.",
|
||||
source, "user-controlled value"
|
||||
select sink, "This format string may be derived from a $@.", source, "user-controlled value"
|
||||
|
||||
@@ -8,4 +8,4 @@ where
|
||||
TaintTracking::localTaint(source, sink) and
|
||||
source.asExpr() = call and
|
||||
sink.asExpr() = call.getArgument(1)
|
||||
select call
|
||||
select call
|
||||
|
||||
@@ -8,4 +8,4 @@ from MethodAccess ma
|
||||
where
|
||||
ma.getMethod().getName().matches("sparql%Query") and
|
||||
ma.getArgument(0) instanceof StringConcat
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
|
||||
@@ -5,4 +5,4 @@ from MethodAccess ma, StringConcat stringConcat
|
||||
where
|
||||
ma.getMethod().getName().matches("sparql%Query") and
|
||||
localFlow(exprNode(stringConcat), exprNode(ma.getArgument(0)))
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
import java
|
||||
|
||||
class EmptyBlock extends Block {
|
||||
EmptyBlock() {
|
||||
this.getNumStmt() = 0
|
||||
}
|
||||
EmptyBlock() { this.getNumStmt() = 0 }
|
||||
}
|
||||
|
||||
from IfStmt ifstmt
|
||||
where ifstmt.getThen() instanceof
|
||||
EmptyBlock
|
||||
where ifstmt.getThen() instanceof EmptyBlock
|
||||
select ifstmt
|
||||
|
||||
@@ -8,4 +8,4 @@ from IfStmt ifstmt
|
||||
where
|
||||
ifstmt.getThen() instanceof EmptyBlock and
|
||||
not exists(ifstmt.getElse())
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
import java
|
||||
|
||||
predicate isEmpty(Block block) {
|
||||
block.getNumStmt() = 0
|
||||
}
|
||||
predicate isEmpty(Block block) { block.getNumStmt() = 0 }
|
||||
|
||||
from IfStmt ifstmt
|
||||
where isEmpty(ifstmt.getThen())
|
||||
select ifstmt
|
||||
select ifstmt
|
||||
|
||||
@@ -4,4 +4,4 @@ from IfStmt ifstmt, Block block
|
||||
where
|
||||
block = ifstmt.getThen() and
|
||||
block.getNumStmt() = 0
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
select ifstmt, "This if-statement is redundant."
|
||||
|
||||
@@ -3,12 +3,12 @@ import semmle.code.java.dataflow.TaintTracking
|
||||
|
||||
class TaintedOGNLConfig extends TaintTracking::Configuration {
|
||||
TaintedOGNLConfig() { this = "TaintedOGNLConfig" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { /* TBD */ }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) { /* TBD */ }
|
||||
}
|
||||
|
||||
from TaintedOGNLConfig cfg, DataFlow::Node source, DataFlow::Node sink
|
||||
where cfg.hasFlow(source, sink)
|
||||
select source,
|
||||
"This untrusted input is evaluated as an OGNL expression $@.",
|
||||
sink, "here"
|
||||
select source, "This untrusted input is evaluated as an OGNL expression $@.", sink, "here"
|
||||
|
||||
@@ -4,4 +4,4 @@ from Method m, MethodAccess ma
|
||||
where
|
||||
m.getName().matches("sparql%Query") and
|
||||
ma.getMethod() = m
|
||||
select ma, m
|
||||
select ma, m
|
||||
|
||||
@@ -5,4 +5,4 @@ where
|
||||
m.getName().matches("sparql%Query") and
|
||||
ma.getMethod() = m and
|
||||
isStringConcat(ma.getArgument(0))
|
||||
select ma, m
|
||||
select ma, m
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
import java
|
||||
|
||||
predicate isStringConcat(AddExpr ae) {
|
||||
ae.getType() instanceof TypeString
|
||||
}
|
||||
predicate isStringConcat(AddExpr ae) { ae.getType() instanceof TypeString }
|
||||
|
||||
from Method m, MethodAccess ma
|
||||
where
|
||||
m.getName().matches("sparql%Query") and
|
||||
ma.getMethod() = m and
|
||||
isStringConcat(ma.getArgument(0))
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
select ma, "SPARQL query vulnerable to injection."
|
||||
|
||||
@@ -5,9 +5,7 @@
|
||||
|
||||
/** A possible cargo item. */
|
||||
class Cargo extends string {
|
||||
Cargo() {
|
||||
this = ["Nothing", "Goat", "Cabbage", "Wolf"]
|
||||
}
|
||||
Cargo() { this = ["Nothing", "Goat", "Cabbage", "Wolf"] }
|
||||
}
|
||||
|
||||
/** A shore, named either `Left` or `Right`. */
|
||||
|
||||
@@ -119,18 +119,16 @@ string onRight(Man man, Goat goat, Cabbage cabbage, Wolf wolf) {
|
||||
|
||||
/** Renders the state as a string, using unicode symbols. */
|
||||
string render(Man man, Goat goat, Cabbage cabbage, Wolf wolf) {
|
||||
result = onLeft(man, goat, cabbage, wolf) + "___🌊🌊🌊🌊🌊🌊🌊🌊🌊🌊___" +
|
||||
result =
|
||||
onLeft(man, goat, cabbage, wolf) + "___🌊🌊🌊🌊🌊🌊🌊🌊🌊🌊___" +
|
||||
onRight(man, goat, cabbage, wolf)
|
||||
}
|
||||
|
||||
/** A record of where everything is. */
|
||||
class State extends string {
|
||||
Man man;
|
||||
|
||||
Goat goat;
|
||||
|
||||
Cabbage cabbage;
|
||||
|
||||
Wolf wolf;
|
||||
|
||||
State() { this = render(man, goat, cabbage, wolf) }
|
||||
|
||||
@@ -90,11 +90,8 @@ newtype TState = Currently(Man man, Goat goat, Cabbage cabbage, Wolf wolf)
|
||||
/** A record of where everything is. */
|
||||
class State extends TState {
|
||||
Man man;
|
||||
|
||||
Goat goat;
|
||||
|
||||
Cabbage cabbage;
|
||||
|
||||
Wolf wolf;
|
||||
|
||||
State() { this = Currently(man, goat, cabbage, wolf) }
|
||||
|
||||
@@ -99,4 +99,3 @@ class GoalState extends State {
|
||||
from string path
|
||||
where any(InitialState i).reachesVia(path, _) = any(GoalState g)
|
||||
select path
|
||||
|
||||
|
||||
Reference in New Issue
Block a user