hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2673 from aschackmull/ql/autoformat-comparisonterm

Browse Source 
Java/C++/C#: Autoformat comparison terms
This commit is contained in:
Jonas Jensen
2020-01-30 08:47:50 +01:00
committed by GitHub
parent 37570c7750 743b612d0d
commit c4d2163321
365 changed files with 2199 additions and 1534 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
csharp/ql/src/API Abuse/Dispose.qll
View File

@@ -30,7 +30,8 @@ class WebPage extends RefType {
*/
predicate isAutoDisposedWebControl(Field f) {
f.getType() instanceof WebControl and
f.getDeclaringType() = any(RefType t |
f.getDeclaringType() =
any(RefType t |
t instanceof WebControl or
t instanceof WebPage
)

6
csharp/ql/src/API Abuse/NoDisposeCallOnLocalIDisposable.ql
View File

@@ -28,7 +28,8 @@ private class Conf extends DataFlow::Configuration {
Conf() { this = "NoDisposeCallOnLocalIDisposable" }
override predicate isSource(DataFlow::Node node) {
node.asExpr() = any(LocalScopeDisposableCreation disposable |
node.asExpr() =
any(LocalScopeDisposableCreation disposable |
// Only care about library types - user types often have spurious IDisposable declarations
disposable.getType().fromLibrary() and
// WebControls are usually disposed automatically
@@ -80,7 +81,8 @@ private class Conf extends DataFlow::Configuration {
}
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
node2.asExpr() = any(LocalScopeDisposableCreation other | other.getAnArgument() = node1.asExpr())
node2.asExpr() =
any(LocalScopeDisposableCreation other | other.getAnArgument() = node1.asExpr())
}
override predicate isBarrierOut(DataFlow::Node node) {

9
csharp/ql/src/API Abuse/UncheckedReturnValue.ql
View File

@@ -47,12 +47,14 @@ predicate dubious(Method m, int percentage) {
not designedForChaining(m) and
exists(int used, int total, Method target |
target = m.getSourceDeclaration() and
used = count(MethodCall mc |
used =
count(MethodCall mc |
mc.getTarget().getSourceDeclaration() = target and
not mc instanceof DiscardedMethodCall and
(methodHasGenericReturnType(m) implies m.getReturnType() = mc.getTarget().getReturnType())
) and
total = count(MethodCall mc |
total =
count(MethodCall mc |
mc.getTarget().getSourceDeclaration() = target and
(methodHasGenericReturnType(m) implies m.getReturnType() = mc.getTarget().getReturnType())
) and
@@ -64,7 +66,8 @@ predicate dubious(Method m, int percentage) {
}
int chainedUses(Method m) {
result = count(MethodCall mc, MethodCall qual |
result =
count(MethodCall mc, MethodCall qual |
m = mc.getTarget() and
hasQualifierAndTarget(mc, qual, qual.getTarget())
)

6
csharp/ql/src/Bad Practices/Implementation Hiding/StaticArray.ql
View File

@@ -14,7 +14,8 @@
import csharp
predicate nonEmptyArrayLiteralOrNull(Expr e) {
e = any(ArrayCreation arr |
e =
any(ArrayCreation arr |
exists(arr.getInitializer().getAnElement())
or
not arr.getALengthArgument().getValue() = "0"
@@ -22,7 +23,8 @@ predicate nonEmptyArrayLiteralOrNull(Expr e) {
or
e instanceof NullLiteral
or
e = any(ConditionalExpr cond |
e =
any(ConditionalExpr cond |
nonEmptyArrayLiteralOrNull(cond.getThen()) and
nonEmptyArrayLiteralOrNull(cond.getElse())
)

9
csharp/ql/src/Bad Practices/Magic Constants/MagicConstants.qll
View File

@@ -263,7 +263,8 @@ private predicate relevantLiteral(Literal literal, string value) {
}
private predicate valueOccurrenceCount(string value, int n) {
n = strictcount(Location loc |
n =
strictcount(Location loc |
exists(Literal lit | relevantLiteral(lit, value) | lit.getLocation() = loc)
) and
n > 20
@@ -289,7 +290,8 @@ private predicate check(Literal lit, string value, int n, File f) {
}
private predicate checkWithFileCount(string value, int overallCount, int fileCount, File f) {
fileCount = strictcount(Location loc |
fileCount =
strictcount(Location loc |
exists(Literal lit | check(lit, value, overallCount, f) | lit.getLocation() = loc)
)
}
@@ -322,7 +324,8 @@ predicate isNumber(Literal lit) {
predicate magicConstant(Literal e, string msg) {
exists(string value, int n |
firstOccurrence(e, value, n) and
msg = "Magic constant: literal '" + value + "' is repeated " + n.toString() +
msg =
"Magic constant: literal '" + value + "' is repeated " + n.toString() +
" times and should be encapsulated in a constant."
)
}

5
csharp/ql/src/Complexity/ComplexCondition.ql
View File

@@ -23,8 +23,7 @@ predicate logicalParent(LogicalOperation op, LogicalOperation parent) { parent =
from Expr e, int operators
where
not e.getParent() instanceof LogicalOperation and
operators = count(BinaryLogicalOperation op |
logicalParent*(op, e) and nontrivialLogicalOperator(op)
) and
operators =
count(BinaryLogicalOperation op | logicalParent*(op, e) and nontrivialLogicalOperator(op)) and
operators > 3
select e.getLocation(), "Complex condition: too many logical operations in this expression."

3
csharp/ql/src/Concurrency/Concurrency.qll
View File

@@ -81,7 +81,8 @@ class LockStmtBlock extends LockedBlock {
*/
class LockingCall extends MethodCall {
LockingCall() {
this.getTarget() = any(Method m |
this.getTarget() =
any(Method m |
m.getDeclaringType().hasQualifiedName("System.Threading", "Monitor") and
m.getName().matches("%Enter%")
) or

6
csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
View File

@@ -82,7 +82,8 @@ class RelevantDefinition extends AssignableDefinition {
// for now
//or
//this.(AssignableDefinitions::OutRefDefinition).getTargetAccess().isOutArgument()
this.(AssignableDefinitions::LocalVariableDefinition).getDeclaration() = any(LocalVariableDeclExpr lvde |
this.(AssignableDefinitions::LocalVariableDefinition).getDeclaration() =
any(LocalVariableDeclExpr lvde |
lvde = any(SpecificCatchClause scc).getVariableDeclExpr()
or
lvde = any(ForeachStmt fs).getVariableDeclExpr() and
@@ -123,7 +124,8 @@ class RelevantDefinition extends AssignableDefinition {
or
e instanceof NullLiteral
or
e = any(Field f |
e =
any(Field f |
f.isStatic() and
(f.isReadOnly() or f.isConst())
).getAnAccess()

3
csharp/ql/src/Language Abuse/CatchOfGenericException.ql
View File

@@ -18,7 +18,8 @@ class GenericCatchClause extends CatchClause {
GenericCatchClause() {
this instanceof GeneralCatchClause
or
this = any(SpecificCatchClause scc |
this =
any(SpecificCatchClause scc |
scc.getCaughtExceptionType() instanceof SystemExceptionClass and
not scc.hasFilterClause()
)

3
csharp/ql/src/Language Abuse/ForeachCapture.ql
View File

@@ -90,7 +90,8 @@ Element getCollectionAssignmentTarget(Expr e) {
e = result.(ArrayCreation).getInitializer().getAnElement()
or
// Collection initializer
e = result
e =
result
.(ObjectCreation)
.getInitializer()
.(CollectionInitializer)

6
csharp/ql/src/Language Abuse/UselessUpcast.ql
View File

@@ -53,7 +53,8 @@ predicate hasStaticCallable(ValueOrRefType t, StaticCallable c, string name) {
/** Gets the minimum number of arguments required to call `c`. */
int getMinimumArguments(Callable c) {
result = count(Parameter p |
result =
count(Parameter p |
p = c.getAParameter() and
not p.hasDefaultValue()
)
@@ -182,7 +183,8 @@ class ExplicitUpcast extends ExplicitCast {
or
this = any(OperatorCall oc).getAnArgument()
or
this = any(Operation o |
this =
any(Operation o |
not o instanceof Assignment and
not o instanceof UnaryBitwiseOperation and
not o instanceof SizeofExpr and

3
csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql
View File

@@ -23,7 +23,8 @@ class IndexGuard extends ComparisonTest {
IndexGuard() {
this.getFirstArgument() = indexAccess and
this.getSecondArgument() = any(PropertyAccess lengthAccess |
this.getSecondArgument() =
any(PropertyAccess lengthAccess |
lengthAccess.getQualifier() = array.getAnAccess() and
lengthAccess.getTarget().hasName("Length")
)

14
csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql
View File

@@ -43,11 +43,11 @@ abstract class BadDynamicCall extends DynamicExpr {
read = ssaDef.getARead() and
ultimateSsaDef = ssaDef.getAnUltimateDefinition()
|
ultimateSsaDef.getADefinition() = any(AssignableDefinition def |
source = def.getSource().stripImplicitCasts()
)
ultimateSsaDef.getADefinition() =
any(AssignableDefinition def | source = def.getSource().stripImplicitCasts())
or
ultimateSsaDef.getADefinition() = any(AssignableDefinitions::ImplicitParameterDefinition p |
ultimateSsaDef.getADefinition() =
any(AssignableDefinitions::ImplicitParameterDefinition p |
source = p.getParameter().getAnAssignedValue().stripImplicitCasts()
)
)
@@ -62,7 +62,8 @@ class BadDynamicMethodCall extends BadDynamicCall, DynamicMethodCall {
not exists(Method m | m = getARuntimeTarget() |
pt.isImplicitlyConvertibleTo(m.getDeclaringType())
) and
message = "The $@ of this dynamic method invocation can obtain (from $@) type $@, which does not have a method '"
message =
"The $@ of this dynamic method invocation can obtain (from $@) type $@, which does not have a method '"
+ getLateBoundTargetName() + "' with the appropriate signature." and
target = "target"
}
@@ -90,7 +91,8 @@ class BadDynamicOperatorCall extends BadDynamicCall, DynamicOperatorCall {
target = number + " argument"
)
) and
message = "The $@ of this dynamic operator can obtain (from $@) type $@, which does not match an operator '"
message =
"The $@ of this dynamic operator can obtain (from $@) type $@, which does not match an operator '"
+ getLateBoundTargetName() + "' with the appropriate signature."
}

6
csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.ql
View File

@@ -66,10 +66,12 @@ predicate isDateFromJapaneseCalendarCreation(ObjectCreation cr) {
from Expr expr, string message
where
isDateFromJapaneseCalendarToDateTime(expr) and
message = "'DateTime' created from Japanese calendar with explicit or current era and hard-coded year."
message =
"'DateTime' created from Japanese calendar with explicit or current era and hard-coded year."
or
isDateFromJapaneseCalendarCreation(expr) and
message = "'DateTime' constructed from Japanese calendar with explicit or current era and hard-coded year."
message =
"'DateTime' constructed from Japanese calendar with explicit or current era and hard-coded year."
or
isExactEraStartDateCreation(expr) and
message = "Hard-coded the beginning of the Japanese Heisei era."

12
csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql
View File

@@ -80,8 +80,9 @@ class NestedForLoopSameVariable extends ForStmt {
location = outer.getLocation() and
location.hasLocationInfo(_, startLine, _, _, _) and
lineStr = startLine.toString() and
result = "Nested for statement uses loop variable " + name +
" of enclosing for statement (on line " + lineStr + ")."
result =
"Nested for statement uses loop variable " + name + " of enclosing for statement (on line " +
lineStr + ")."
)
}
@@ -89,11 +90,8 @@ class NestedForLoopSameVariable extends ForStmt {
private ControlFlow::Node getAnUnguardedNode() {
result.getElement().getParent+() = getOuterForStmt().getBody() and
(
result = this
.getCondition()
.(ControlFlowElement)
.getAControlFlowExitNode()
.getAFalseSuccessor()
result =
this.getCondition().(ControlFlowElement).getAControlFlowExitNode().getAFalseSuccessor()
or
exists(ControlFlow::Node mid | mid = getAnUnguardedNode() |
mid.getASuccessor() = result and

3
csharp/ql/src/Likely Bugs/PossibleLossOfPrecision.ql
View File

@@ -82,7 +82,8 @@ class MulLossOfPrecision extends LossOfPrecision, MulExpr {
MulLossOfPrecision() { not small(this) }
override string getMessage() {
result = "Possible overflow: result of integer multiplication cast to " +
result =
"Possible overflow: result of integer multiplication cast to " +
convertedType.toStringWithTypes() + "."
}
}

3
csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql
View File

@@ -33,5 +33,6 @@ class NotThreadSafeCryptoUsageIntoParallelInvokeConfig extends TaintTracking::Co
from Expr e, string m, LambdaExpr l, NotThreadSafeCryptoUsageIntoParallelInvokeConfig config
where
config.hasFlow(DataFlow::exprNode(l), DataFlow::exprNode(e)) and
m = "A $@ seems to be used to start a new thread is capturing a local variable that either implements 'System.Security.Cryptography.ICryptoTransform' or has a field of this type."
m =
"A $@ seems to be used to start a new thread is capturing a local variable that either implements 'System.Security.Cryptography.ICryptoTransform' or has a field of this type."
select e, m, l, "lambda expression"

3
csharp/ql/src/Metrics/Callables/CNumberOfStatements.ql
View File

@@ -14,7 +14,8 @@ import csharp
from Callable c, int n
where
c.isSourceDeclaration() and
n = count(Stmt s |
n =
count(Stmt s |
s.getEnclosingCallable() = c and
s != c.getAChild() // we do not count the top-level block
)

3
csharp/ql/src/Metrics/Callables/StatementNestingDepth.ql
View File

@@ -35,5 +35,6 @@ predicate nestingDepth(Stmt s, int depth) {
from Method m, int depth
where
depth = max(Stmt s, int aDepth | s.getEnclosingCallable() = m and nestingDepth(s, aDepth) | aDepth)
depth =
max(Stmt s, int aDepth | s.getEnclosingCallable() = m and nestingDepth(s, aDepth) | aDepth)
select m, depth order by depth

3
csharp/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
View File

@@ -15,7 +15,8 @@ import csharp
from SourceFile f, int n
where
n = count(CommentLine line |
n =
count(CommentLine line |
exists(CommentBlock block |
block.getLocation().getFile() = f and
line = block.getAProbableCodeLine()

3
csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
View File

@@ -16,7 +16,8 @@ import external.CodeDuplication
from SourceFile f, int n
where
n = count(int line |
n =
count(int line |
exists(DuplicateBlock d | d.sourceFile() = f |
line in [d.sourceStartLine() .. d.sourceEndLine()] and
not whitelistedLineForDuplication(f, line)

6
csharp/ql/src/Metrics/Files/FSelfContainedness.ql
View File

@@ -16,14 +16,16 @@ import semmle.code.csharp.metrics.Coupling
// Self-containedness on file level
from File f, float selfContaindness, int efferentSourceCoupling, int efferentCoupling
where
efferentSourceCoupling = count(File g |
efferentSourceCoupling =
count(File g |
exists(RefType c |
c.fromSource() and
c.getFile() = g and
exists(RefType d | d.fromSource() and d.getFile() = f and depends(d, c))
)
) and
efferentCoupling = count(File g |
efferentCoupling =
count(File g |
exists(RefType c |
c.getFile() = g and
exists(RefType d | d.fromSource() and d.getFile() = f and depends(d, c))

3
csharp/ql/src/Metrics/RefTypes/TNumberOfCallables.ql
View File

@@ -14,7 +14,8 @@ import csharp
from ValueOrRefType t, int n
where
t.isSourceDeclaration() and
n = count(Callable c | c.getDeclaringType() = t and not c instanceof Accessor) +
n =
count(Callable c | c.getDeclaringType() = t and not c instanceof Accessor) +
count(Accessor a |
a.getDeclaringType() = t and
not a.getDeclaration().(Property).isAutoImplemented() and

3
csharp/ql/src/Metrics/RefTypes/TNumberOfNonConstFields.ql
View File

@@ -13,7 +13,8 @@ import csharp
from ValueOrRefType t, int n
where
t.isSourceDeclaration() and
n = count(Field f |
n =
count(Field f |
f.getDeclaringType() = t and
not f instanceof MemberConstant
)

3
csharp/ql/src/Metrics/RefTypes/TNumberOfStatements.ql
View File

@@ -14,7 +14,8 @@ import csharp
from ValueOrRefType t, int n
where
t.isSourceDeclaration() and
n = count(Stmt s |
n =
count(Stmt s |
s.getEnclosingCallable().getDeclaringType() = t and
s != s.getEnclosingCallable().getAChild()
) // we do not count the top-level block

3
csharp/ql/src/Metrics/RefTypes/TSizeOfAPI.ql
View File

@@ -16,7 +16,8 @@ from ValueOrRefType t, int n
where
t.isSourceDeclaration() and
t.isPublic() and
n = count(Method m | m.getDeclaringType() = t and m.isPublic()) +
n =
count(Method m | m.getDeclaringType() = t and m.isPublic()) +
count(Operator o | o.getDeclaringType() = t and o.isPublic()) +
count(Property p | p.getDeclaringType() = t and p.isPublic()) +
count(Indexer i | i.getDeclaringType() = t and i.isPublic()) +

3
csharp/ql/src/Security Features/CWE-016/ASPNetMaxRequestLength.ql
View File

@@ -15,7 +15,8 @@ import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute maxReqLength
where
maxReqLength = web
maxReqLength =
web
.getAChild(any(string s | s.toLowerCase() = "httpruntime"))
.getAttribute(any(string s | s.toLowerCase() = "maxrequestlength")) and
maxReqLength.getValue().toInt() > 4096

5
csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.ql
View File

@@ -32,9 +32,8 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
source.asExpr().(PropertyAccess).getQualifier() = exceptionExpr
or
// Writing the result of ToString is bad
source.asExpr() = any(MethodCall mc |
mc.getQualifier() = exceptionExpr and mc.getTarget().hasName("ToString")
)
source.asExpr() =
any(MethodCall mc | mc.getQualifier() = exceptionExpr and mc.getTarget().hasName("ToString"))
|
// Expr has type `System.Exception`.
exceptionExpr.getType().(RefType).getABaseType*() instanceof SystemExceptionClass and

3
csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql
View File

@@ -19,7 +19,8 @@ import semmle.code.csharp.security.cryptography.EncryptionKeyDataFlow::Encryptio
*/
class ByteArrayLiteralSource extends KeySource {
ByteArrayLiteralSource() {
this.asExpr() = any(ArrayCreation ac |
this.asExpr() =
any(ArrayCreation ac |
ac.getArrayType().getElementType() instanceof ByteType and
ac.hasInitializer()
)

3
csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.ql
View File

@@ -30,7 +30,8 @@ predicate hasWebConfigXFrameOptions() {
// </system.webServer>
// ```
exists(XMLElement element |
element = any(WebConfigXML webConfig)
element =
any(WebConfigXML webConfig)
.getARootElement()
.getAChild("system.webServer")
.getAChild("httpProtocol")

5
csharp/ql/src/Security Features/CWE-798/HardcodedConnectionString.ql
View File

@@ -36,9 +36,8 @@ class ConnectionStringTaintTrackingConfiguration extends TaintTracking::Configur
}
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(SystemDataConnectionClass connection)
.getConnectionStringProperty()
.getAnAssignedValue()
sink.asExpr() =
any(SystemDataConnectionClass connection).getConnectionStringProperty().getAnAssignedValue()
}
override predicate isSanitizer(DataFlow::Node node) {

3
csharp/ql/src/Security Features/CWE-838/InappropriateEncoding.ql
View File

@@ -100,7 +100,8 @@ module EncodingConfigurations {
or
// consider quote-replacing calls as additional sources for
// SQL expressions (e.g., `s.Replace("\"", "\"\"")`)
source.asExpr() = any(MethodCall mc |
source.asExpr() =
any(MethodCall mc |
mc.getTarget() = any(SystemStringClass c).getReplaceMethod() and
mc.getArgument(0).getValue().regexpMatch("\"|'|`")
)

3
csharp/ql/src/Security Features/InsecureRandomness.ql
View File

@@ -55,7 +55,8 @@ module Random {
/** A source of cryptographically insecure random numbers. */
class RandomSource extends Source {
RandomSource() {
this.getExpr() = any(MethodCall mc |
this.getExpr() =
any(MethodCall mc |
mc.getQualifier().getType().(RefType).hasQualifiedName("System", "Random")
)
}

6
csharp/ql/src/Security Features/WeakEncryption.ql
View File

@@ -13,7 +13,8 @@ import csharp
predicate incorrectUseOfDES(ObjectCreation e, string msg) {
e.getType().(Class).hasQualifiedName("System.Security.Cryptography", "DESCryptoServiceProvider") and
msg = "DES encryption uses keys of 56 bits only. Switch to AesCryptoServiceProvider or RijndaelManaged instead."
msg =
"DES encryption uses keys of 56 bits only. Switch to AesCryptoServiceProvider or RijndaelManaged instead."
}
predicate incorrectUseOfTripleDES(ObjectCreation e, string msg) {
@@ -21,7 +22,8 @@ predicate incorrectUseOfTripleDES(ObjectCreation e, string msg) {
.getType()
.(Class)
.hasQualifiedName("System.Security.Cryptography", "TripleDESCryptoServiceProvider") and
msg = "TripleDES encryption provides at most 112 bits of security. Switch to AesCryptoServiceProvider or RijndaelManaged instead."
msg =
"TripleDES encryption provides at most 112 bits of security. Switch to AesCryptoServiceProvider or RijndaelManaged instead."
}
from Expr e, string msg

84
csharp/ql/src/Stubs/Stubs.qll
View File

@@ -74,7 +74,8 @@ abstract private class GeneratedType extends ValueOrRefType, GeneratedElement {
}
private string stubComment() {
result = "// Generated from `" + this.getQualifiedName() + "` in `" +
result =
"// Generated from `" + this.getQualifiedName() + "` in `" +
min(this.getLocation().toString()) + "`\n"
}
@@ -87,7 +88,8 @@ abstract private class GeneratedType extends ValueOrRefType, GeneratedElement {
if this.isDuplicate()
then result = ""
else
result = this.stubComment() + this.stubAttributes() + this.stubAbstractModifier() +
result =
this.stubComment() + this.stubAttributes() + this.stubAbstractModifier() +
this.stubStaticModifier() + this.stubAccessibilityModifier() + this.stubKeyword() + " " +
this.getUndecoratedName() + stubGenericArguments(this) + stubBaseTypesString() +
stubTypeParametersConstraints(this) + "\n{\n" + stubMembers() + "}\n\n"
@@ -105,7 +107,8 @@ abstract private class GeneratedType extends ValueOrRefType, GeneratedElement {
else
if exists(getAnInterestingBaseType())
then
result = " : " +
result =
" : " +
concat(int i, ValueOrRefType t |
t = this.getAnInterestingBaseType() and
(if t instanceof Class then i = 0 else i = 1)
@@ -211,11 +214,8 @@ private class GeneratedNamespace extends Namespace, GeneratedElement {
pragma[nomagic]
final GeneratedNamespace getChildNamespace(int n) {
result.getParentNamespace() = this and
result.getName() = rank[n + 1](GeneratedNamespace g |
g.getParentNamespace() = this
|
g.getName()
)
result.getName() =
rank[n + 1](GeneratedNamespace g | g.getParentNamespace() = this | g.getName())
}
final int getChildNamespaceCount() {
@@ -228,9 +228,8 @@ private class GeneratedNamespace extends Namespace, GeneratedElement {
}
private string getTypeStubs() {
result = concat(string s |
s = any(GeneratedType gt | gt.getDeclaringNamespace() = this).getStub()
)
result =
concat(string s | s = any(GeneratedType gt | gt.getDeclaringNamespace() = this).getStub())
}
}
@@ -343,7 +342,8 @@ private string stubClassName(Type t) {
else
if t instanceof TupleType
then
result = "(" +
result =
"(" +
concat(int i, Type element |
element = t.(TupleType).getElementType(i)
|
@@ -352,7 +352,8 @@ private string stubClassName(Type t) {
else
if t instanceof ValueOrRefType
then
result = stubQualifiedNamePrefix(t) + t.getUndecoratedName() +
result =
stubQualifiedNamePrefix(t) + t.getUndecoratedName() +
stubGenericArguments(t)
else result = "<error>"
}
@@ -361,7 +362,8 @@ language[monotonicAggregates]
private string stubGenericArguments(ValueOrRefType t) {
if t instanceof UnboundGenericType
then
result = "<" +
result =
"<" +
concat(int n |
exists(t.(UnboundGenericType).getTypeParameter(n))
|
@@ -370,7 +372,8 @@ private string stubGenericArguments(ValueOrRefType t) {
else
if t instanceof ConstructedType
then
result = "<" +
result =
"<" +
concat(int n |
exists(t.(ConstructedType).getTypeArgument(n))
|
@@ -382,7 +385,8 @@ private string stubGenericArguments(ValueOrRefType t) {
private string stubGenericMethodParams(Method m) {
if m instanceof UnboundGenericMethod
then
result = "<" +
result =
"<" +
concat(int n, TypeParameter param |
param = m.(UnboundGenericMethod).getTypeParameter(n)
|
@@ -409,15 +413,16 @@ private string stubConstraints(TypeParameterConstraints tpc) {
private string stubTypeParameterConstraints(TypeParameter tp) {
exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
result = " where " + tp.getName() + ": " +
strictconcat(string s | s = stubConstraints(tpc) | s, ", ")
result =
" where " + tp.getName() + ": " + strictconcat(string s | s = stubConstraints(tpc) | s, ", ")
)
}
private string stubTypeParametersConstraints(Declaration d) {
if d instanceof UnboundGeneric
then
result = concat(TypeParameter tp |
result =
concat(TypeParameter tp |
tp = d.(UnboundGeneric).getATypeParameter()
|
stubTypeParameterConstraints(tp), " "
@@ -515,7 +520,8 @@ bindingset[s]
private string escapeIfKeyword(string s) { if isKeyword(s) then result = "@" + s else result = s }
private string stubParameters(Parameterizable p) {
result = concat(int i, Parameter param |
result =
concat(int i, Parameter param |
param = p.getParameter(i) and not param.getType() instanceof ArglistType
|
stubParameterModifiers(param) + stubClassName(param.getType()) + " " +
@@ -557,7 +563,8 @@ private string stubExplicitImplementation(Member c) {
private string stubMember(Member m) {
exists(Method c | m = c and not m.getDeclaringType() instanceof Enum |
result = " " + stubModifiers(c) + stubClassName(c.getReturnType()) + " " +
result =
" " + stubModifiers(c) + stubClassName(c.getReturnType()) + " " +
stubExplicitImplementation(c) + c.getName() + stubGenericMethodParams(c) + "(" +
stubParameters(c) + ")" + stubTypeParametersConstraints(c) + stubImplementation(c) + ";\n"
)
@@ -565,36 +572,40 @@ private string stubMember(Member m) {
exists(Operator op |
m = op and not m.getDeclaringType() instanceof Enum and not op instanceof ConversionOperator
|
result = " " + stubModifiers(op) + stubClassName(op.getReturnType()) + " operator " +
op.getName() + "(" + stubParameters(op) + ") => throw null;\n"
result =
" " + stubModifiers(op) + stubClassName(op.getReturnType()) + " operator " + op.getName() +
"(" + stubParameters(op) + ") => throw null;\n"
)
or
exists(ConversionOperator op | m = op |
result = " " + stubModifiers(op) + stubExplicit(op) + "operator " +
result =
" " + stubModifiers(op) + stubExplicit(op) + "operator " +
stubClassName(op.getReturnType()) + "(" + stubParameters(op) + ") => throw null;\n"
)
or
result = " " + m.(EnumConstant).getName() + ",\n"
or
exists(Property p | m = p |
result = " " + stubModifiers(m) + stubClassName(p.getType()) + " " +
stubExplicitImplementation(p) + p.getName() + " { " + stubGetter(p) + stubSetter(p) + "}\n"
result =
" " + stubModifiers(m) + stubClassName(p.getType()) + " " + stubExplicitImplementation(p) +
p.getName() + " { " + stubGetter(p) + stubSetter(p) + "}\n"
)
or
exists(Constructor c | m = c and not c.getDeclaringType() instanceof Enum |
result = " " + stubModifiers(m) + c.getName() + "(" + stubParameters(c) +
") => throw null;\n"
result =
" " + stubModifiers(m) + c.getName() + "(" + stubParameters(c) + ") => throw null;\n"
)
or
exists(Indexer i | m = i |
result = " " + stubModifiers(m) + stubClassName(i.getType()) + " this[" + stubParameters(i) +
"] { " + stubGetter(i) + stubSetter(i) + "}\n"
result =
" " + stubModifiers(m) + stubClassName(i.getType()) + " this[" + stubParameters(i) + "] { "
+ stubGetter(i) + stubSetter(i) + "}\n"
)
or
exists(Field f, string impl | f = m and not f instanceof EnumConstant |
(if f.isConst() then impl = " = throw null" else impl = "") and
result = " " + stubModifiers(m) + stubClassName(f.getType()) + " " + f.getName() + impl +
";\n"
result =
" " + stubModifiers(m) + stubClassName(f.getType()) + " " + f.getName() + impl + ";\n"
)
}
@@ -623,9 +634,11 @@ private string stubSetter(DeclarationWithGetSetAccessors p) {
}
private string stubSemmleExtractorOptions() {
result = concat(string s |
result =
concat(string s |
exists(CommentLine comment |
s = "// original-extractor-options:" +
s =
"// original-extractor-options:" +
comment.getText().regexpCapture("\\w*semmle-extractor-options:(.*)", 1) + "\n"
)
)
@@ -633,6 +646,7 @@ private string stubSemmleExtractorOptions() {
/** Gets the generated C# code. */
string generatedCode() {
result = "// This file contains auto-generated code.\n" + stubSemmleExtractorOptions() + "\n" +
result =
"// This file contains auto-generated code.\n" + stubSemmleExtractorOptions() + "\n" +
any(GeneratedNamespace ns | ns.isGlobalNamespace()).getStubs()
}

3
csharp/ql/src/Useless code/DefaultToString.qll
View File

@@ -52,6 +52,7 @@ class DefaultToStringType extends ValueOrRefType {
query predicate problems(Expr e, string s, DefaultToStringType t, string name) {
invokesToString(e, t) and
s = "Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing." and
s =
"Default 'ToString()': $@ inherits 'ToString()' from 'Object', and so is not suitable for printing." and
name = t.getName()
}

3
csharp/ql/src/Useless code/FutileConditional.ql
View File

@@ -14,7 +14,8 @@ import csharp
predicate emptyStmt(Stmt s) {
s instanceof EmptyStmt
or
s = any(BlockStmt bs |
s =
any(BlockStmt bs |
bs.getNumberOfStmts() = 0
or
bs.getNumberOfStmts() = 1 and

24
csharp/ql/src/external/CodeDuplication.qll vendored
View File

@@ -114,7 +114,8 @@ predicate similarLines(File f, int line) {
}
private predicate similarLinesPerEquivalenceClass(int equivClass, int lines, File f) {
lines = strictsum(SimilarBlock b, int toSum |
lines =
strictsum(SimilarBlock b, int toSum |
(b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
toSum = b.sourceLines()
|
@@ -126,7 +127,8 @@ pragma[noopt]
private predicate similarLinesCovered(File f, int coveredLines, File otherFile) {
exists(int numLines | numLines = f.getNumberOfLines() |
exists(int coveredApprox |
coveredApprox = strictsum(int num |
coveredApprox =
strictsum(int num |
exists(int equivClass |
similarLinesPerEquivalenceClass(equivClass, num, f) and
similarLinesPerEquivalenceClass(equivClass, num, otherFile) and
@@ -136,7 +138,8 @@ private predicate similarLinesCovered(File f, int coveredLines, File otherFile)
exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
) and
exists(int notCovered |
notCovered = count(int j |
notCovered =
count(int j |
j in [1 .. numLines] and
not similarLines(f, j)
) and
@@ -152,7 +155,8 @@ predicate duplicateLines(File f, int line) {
}
private predicate duplicateLinesPerEquivalenceClass(int equivClass, int lines, File f) {
lines = strictsum(DuplicateBlock b, int toSum |
lines =
strictsum(DuplicateBlock b, int toSum |
(b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
toSum = b.sourceLines()
|
@@ -164,7 +168,8 @@ pragma[noopt]
private predicate duplicateLinesCovered(File f, int coveredLines, File otherFile) {
exists(int numLines | numLines = f.getNumberOfLines() |
exists(int coveredApprox |
coveredApprox = strictsum(int num |
coveredApprox =
strictsum(int num |
exists(int equivClass |
duplicateLinesPerEquivalenceClass(equivClass, num, f) and
duplicateLinesPerEquivalenceClass(equivClass, num, otherFile) and
@@ -174,7 +179,8 @@ private predicate duplicateLinesCovered(File f, int coveredLines, File otherFile
exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
) and
exists(int notCovered |
notCovered = count(int j |
notCovered =
count(int j |
j in [1 .. numLines] and
not duplicateLines(f, j)
) and
@@ -205,7 +211,8 @@ predicate duplicateFiles(File f, File other, int percent) {
pragma[noopt]
predicate duplicateAnonymousClass(AnonymousClass c, AnonymousClass other) {
exists(int numDup |
numDup = strictcount(Method m1 |
numDup =
strictcount(Method m1 |
exists(Method m2 |
duplicateMethod(m1, m2) and
m1 = sourceMethod() and
@@ -224,7 +231,8 @@ predicate duplicateAnonymousClass(AnonymousClass c, AnonymousClass other) {
pragma[noopt]
private predicate mostlyDuplicateClassBase(Class c, Class other, int numDup, int total) {
numDup = strictcount(Method m1 |
numDup =
strictcount(Method m1 |
exists(Method m2 |
duplicateMethod(m1, m2) and
m1 = sourceMethod() and

5
csharp/ql/src/external/DefectFilter.qll vendored
View File

@@ -27,7 +27,8 @@ class DefectResult extends int {
string getMessage() { defectResults(this, _, _, _, _, _, _, result) }
string getURL() {
result = "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn()
+ ":" + getEndLine() + ":" + getEndColumn()
result =
"file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
getEndLine() + ":" + getEndColumn()
}
}

5
csharp/ql/src/external/MetricFilter.qll vendored
View File

@@ -37,7 +37,8 @@ class MetricResult extends int {
float getValue() { metricResults(this, _, _, _, _, _, _, result) }
string getURL() {
result = "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn()
+ ":" + getEndLine() + ":" + getEndColumn()
result =
"file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
getEndLine() + ":" + getEndColumn()
}
}

3
csharp/ql/src/external/tests/MetricFromExternalMetric.ql vendored
View File

@@ -11,7 +11,8 @@ import csharp
import external.ExternalArtifact
predicate numBuiltFiles(Folder fold, int i) {
i = count(File f |
i =
count(File f |
exists(ExternalMetric m |
m.getQueryPath() = "filesBuilt.ql" and
m.getValue() = 1.0 and

33
csharp/ql/src/semmle/code/cil/ConsistencyChecks.qll
View File

@@ -48,7 +48,8 @@ abstract class InstructionViolation extends CfgViolation, CfgCheck {
InstructionViolation() { this = CfgCheck(instruction) }
private string getInstructionsUpTo() {
result = concat(Instruction i |
result =
concat(Instruction i |
i.getIndex() <= instruction.getIndex() and
i.getImplementation() = instruction.getImplementation()
|
@@ -59,7 +60,8 @@ abstract class InstructionViolation extends CfgViolation, CfgCheck {
}
override string toString() {
result = instruction.getImplementation().getMethod().toStringWithTypes() + ": " +
result =
instruction.getImplementation().getMethod().toStringWithTypes() + ": " +
instruction.toString() + ", " + getInstructionsUpTo()
}
}
@@ -276,7 +278,8 @@ class InvalidStackSize extends CfgViolation, DisabledCheck {
}
override string getMessage() {
result = "Inconsistent stack sizes " + count(node.getStackSizeBefore()) + " before and " +
result =
"Inconsistent stack sizes " + count(node.getStackSizeBefore()) + " before and " +
count(node.getStackSizeAfter()) + " after"
}
}
@@ -388,14 +391,13 @@ class InconsistentTypeLocation extends TypeViolation {
*/
class TypeParameterMismatch extends TypeViolation {
TypeParameterMismatch() {
getType().(ConstructedGeneric).getNumberOfTypeArguments() != getType()
.getUnboundType()
.(UnboundGeneric)
.getNumberOfTypeParameters()
getType().(ConstructedGeneric).getNumberOfTypeArguments() !=
getType().getUnboundType().(UnboundGeneric).getNumberOfTypeParameters()
}
override string getMessage() {
result = "Constructed type (" + getType().toStringWithTypes() + ") has " +
result =
"Constructed type (" + getType().toStringWithTypes() + ") has " +
getType().(ConstructedGeneric).getNumberOfTypeArguments() +
" type arguments and unbound type (" + getType().getUnboundType().toStringWithTypes() +
") has " + getType().getUnboundType().(UnboundGeneric).getNumberOfTypeParameters() +
@@ -432,14 +434,13 @@ class InconsistentMethodLocation extends MethodViolation {
*/
class ConstructedMethodTypeParams extends MethodViolation {
ConstructedMethodTypeParams() {
getMethod().(ConstructedGeneric).getNumberOfTypeArguments() != getMethod()
.getSourceDeclaration()
.(UnboundGeneric)
.getNumberOfTypeParameters()
getMethod().(ConstructedGeneric).getNumberOfTypeArguments() !=
getMethod().getSourceDeclaration().(UnboundGeneric).getNumberOfTypeParameters()
}
override string getMessage() {
result = "The constructed method " + getMethod().toStringWithTypes() +
result =
"The constructed method " + getMethod().toStringWithTypes() +
" does not match unbound method " + getMethod().getSourceDeclaration().toStringWithTypes()
}
}
@@ -634,7 +635,8 @@ class TypeMultiplyDefined extends TypeViolation, DisabledCheck {
}
override string getMessage() {
result = "This type (" + getType().toStringWithTypes() + ") has " +
result =
"This type (" + getType().toStringWithTypes() + ") has " +
count(Type t |
not t instanceof ConstructedGeneric and
t.toStringWithTypes() = this.getType().toStringWithTypes()
@@ -656,7 +658,8 @@ class MissingCilDeclaration extends ConsistencyViolation, MissingCSharpCheck {
CS::Declaration getDeclaration() { this = MissingCSharpCheck(result) }
override string getMessage() {
result = "Cannot locate CIL for " + getDeclaration().toStringWithTypes() + " of class " +
result =
"Cannot locate CIL for " + getDeclaration().toStringWithTypes() + " of class " +
getDeclaration().getAQlClass()
}

4
csharp/ql/src/semmle/code/cil/Declaration.qll
View File

@@ -95,8 +95,8 @@ class Property extends DotNet::Property, Member, @cil_property {
override string toString() { result = "property " + getName() }
override string toStringWithTypes() {
result = getType().toStringWithTypes() + " " + getDeclaringType().toStringWithTypes() + "." +
getName()
result =
getType().toStringWithTypes() + " " + getDeclaringType().toStringWithTypes() + "." + getName()
}
}

5
csharp/ql/src/semmle/code/cil/Instruction.qll
View File

@@ -49,9 +49,8 @@ class Instruction extends Element, ControlFlowNode, DataFlowNode, @cil_instructi
*/
Handler getHandler(int i) {
result.isInScope(this) and
result.getIndex() = rank[i + 1](int hi |
exists(Handler h | h.isInScope(this) and hi = h.getIndex())
)
result.getIndex() =
rank[i + 1](int hi | exists(Handler h | h.isInScope(this) and hi = h.getIndex()))
}
override Type getType() { result = ControlFlowNode.super.getType() }

7
csharp/ql/src/semmle/code/cil/Method.qll
View File

@@ -53,11 +53,8 @@ class MethodImplementation extends EntryPoint, @cil_method_implementation {
/** Gets a string representing the disassembly of this implementation. */
string getDisassembly() {
result = concat(Instruction i |
i = this.getAnInstruction()
|
i.toString(), ", " order by i.getIndex()
)
result =
concat(Instruction i | i = this.getAnInstruction() | i.toString(), ", " order by i.getIndex())
}
}

5
csharp/ql/src/semmle/code/cil/Stubs.qll
View File

@@ -21,9 +21,8 @@ private module Cached {
predicate assemblyIsStubImpl(Assembly asm) {
exists(int totalInstructions, int totalImplementations |
totalInstructions = count(Instruction i | i.getImplementation().getLocation() = asm) and
totalImplementations = count(MethodImplementation i |
i.getImplementation().getLocation() = asm
) and
totalImplementations =
count(MethodImplementation i | i.getImplementation().getLocation() = asm) and
totalInstructions.(float) / totalImplementations.(float) < stubInstructionThreshold()
)
}

39
csharp/ql/src/semmle/code/csharp/AnnotatedType.qll
View File

@@ -72,7 +72,8 @@ private module Annotations {
private string getMemberString() {
if nullability_parent(_, _, nullability)
then
result = "<" +
result =
"<" +
concat(int i, Nullability child |
nullability_parent(getNullability(child), i, nullability)
|
@@ -112,20 +113,14 @@ private module Annotations {
/** Gets text to be displayed before the type. */
string getTypePrefix() {
result = concat(TypeAnnotation a |
a = this.getAnAnnotation()
|
a.getPrefix(), "" order by a.getBit()
)
result =
concat(TypeAnnotation a | a = this.getAnAnnotation() | a.getPrefix(), "" order by a.getBit())
}
/** Gets text to be displayed after the type. */
string getTypeSuffix() {
result = concat(TypeAnnotation a |
a = this.getAnAnnotation()
|
a.getSuffix(), "" order by a.getBit()
)
result =
concat(TypeAnnotation a | a = this.getAnAnnotation() | a.getSuffix(), "" order by a.getBit())
}
/** Gets a textual representation of this type annotation. */
@@ -299,7 +294,8 @@ class AnnotatedType extends TAnnotatedType {
/** Gets a textual representation of this annotated type. */
string toString() {
result = annotations.getTypePrefix() + getUnderlyingType().toStringWithTypes() +
result =
annotations.getTypePrefix() + getUnderlyingType().toStringWithTypes() +
annotations.getTypeSuffix()
}
@@ -353,15 +349,15 @@ class AnnotatedType extends TAnnotatedType {
/** Holds if this annotated type is the `i`th type argument of constructed generic 'g'. */
predicate appliesToTypeArgument(ConstructedGeneric g, int i) {
Annotations::getNoFlagsNullability(this.getAnnotations()) = Annotations::getChildNullability(getElementNullability(g),
i) and
Annotations::getNoFlagsNullability(this.getAnnotations()) =
Annotations::getChildNullability(getElementNullability(g), i) and
this.getType() = g.getTypeArgument(i)
}
/** Holds if this annotated type applies to type parameter constraints `constraints`. */
predicate appliesToTypeConstraint(TypeParameterConstraints constraints) {
Annotations::getNoFlagsNullability(this.getAnnotations()) = getTypeParameterNullability(constraints,
type)
Annotations::getNoFlagsNullability(this.getAnnotations()) =
getTypeParameterNullability(constraints, type)
}
}
@@ -389,8 +385,9 @@ class AnnotatedArrayType extends AnnotatedType {
override string toString() {
exists(AnnotatedType elementType |
result = annotations.getTypePrefix() + elementType.toString() +
this.getDimensionString(elementType) + annotations.getTypeSuffix()
result =
annotations.getTypePrefix() + elementType.toString() + this.getDimensionString(elementType) +
annotations.getTypeSuffix()
)
}
}
@@ -406,13 +403,15 @@ class AnnotatedConstructedType extends AnnotatedType {
}
override string toString() {
result = annotations.getTypePrefix() + type.getUnboundGeneric().getNameWithoutBrackets() + "<" +
result =
annotations.getTypePrefix() + type.getUnboundGeneric().getNameWithoutBrackets() + "<" +
this.getTypeArgumentsString() + ">" + annotations.getTypeSuffix()
}
language[monotonicAggregates]
private string getTypeArgumentsString() {
result = concat(int i |
result =
concat(int i |
exists(this.getTypeArgument(i))
|
this.getTypeArgument(i).toString(), ", " order by i

14
csharp/ql/src/semmle/code/csharp/Assignable.qll
View File

@@ -337,13 +337,13 @@ module AssignableInternal {
or
def = any(AssignableDefinitions::ImplicitParameterDefinition p | result = p.getParameter())
or
def = any(AssignableDefinitions::LocalVariableDefinition decl |
def =
any(AssignableDefinitions::LocalVariableDefinition decl |
result = decl.getDeclaration().getVariable()
)
or
def = any(AssignableDefinitions::PatternDefinition pd |
result = pd.getDeclaration().getVariable()
)
def =
any(AssignableDefinitions::PatternDefinition pd | result = pd.getDeclaration().getVariable())
or
def = any(AssignableDefinitions::InitializerDefinition init | result = init.getAssignable())
}
@@ -540,7 +540,8 @@ module AssignableDefinitions {
* orders of the definitions of `x`, `y`, and `z` are 0, 1, and 2, respectively.
*/
int getEvaluationOrder() {
leaf = rank[result + 1](Expr leaf0 |
leaf =
rank[result + 1](Expr leaf0 |
exists(TTupleAssignmentDefinition(ae, leaf0))
|
leaf0 order by leaf0.getLocation().getStartLine(), leaf0.getLocation().getStartColumn()
@@ -616,7 +617,8 @@ module AssignableDefinitions {
* the definitions of `x` and `y` are 0 and 1, respectively.
*/
int getIndex() {
this = rank[result + 1](OutRefDefinition def |
this =
rank[result + 1](OutRefDefinition def |
def.getCall() = this.getCall()
|
def order by def.getPosition()

9
csharp/ql/src/semmle/code/csharp/Comments.qll
View File

@@ -99,7 +99,8 @@ class XmlComment extends CommentLine, @xmldoccomment {
/** Gets the name of the closing tag at offset `offset`. */
string getCloseTag(int offset) {
exists(int offset1, int offset2 |
result = getText()
result =
getText()
.regexpFind(xmlTagCloseRegex(), _, offset1)
.regexpFind(xmlIdentifierRegex(), 0, offset2) and
offset = offset1 + offset2
@@ -110,10 +111,12 @@ class XmlComment extends CommentLine, @xmldoccomment {
string getEmptyTag(int offset) {
exists(int offset1, int offset2 |
(
result = getText()
result =
getText()
.regexpFind(xmlTagIntroRegex() + "\\s*/>", _, offset1)
.regexpFind(xmlIdentifierRegex(), 0, offset2) or
result = getText()
result =
getText()
.regexpFind(xmlTagIntroRegex() + "\\s*>\\s*</" + xmlIdentifierRegex() + "\\s*>", _,
offset1)
.regexpFind(xmlIdentifierRegex(), 0, offset2)

6
csharp/ql/src/semmle/code/csharp/Conversion.qll
View File

@@ -205,7 +205,8 @@ private module Identity {
* parameter at index `i` in unbound generic type `ugt`.
*/
private int getTypeArgumentCount(UnboundGenericType ugt, int i) {
result = strictcount(Type arg |
result =
strictcount(Type arg |
exists(IdentityConvertibleGenericType ct | ct.getUnboundGeneric() = ugt |
arg = ct.getTypeArgument(i)
)
@@ -813,7 +814,8 @@ private module Variance {
* parameter at index `i` in unbound generic type `ugt`.
*/
private int getTypeArgumentCount(UnboundGenericType ugt, int i) {
result = strictcount(Type arg |
result =
strictcount(Type arg |
exists(VarianceConvertibleGenericType gt | gt.getUnboundGeneric() = ugt |
arg = gt.getTypeArgument(i)
)

12
csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
View File

@@ -53,7 +53,8 @@ predicate expr_parent_top_level_adjusted(Expr child, int i, @top_level_exprorstm
private predicate expr_parent_adjusted(Expr child, int i, ControlFlowElement parent) {
if parent instanceof AssignOperation
then
parent = any(AssignOperation ao |
parent =
any(AssignOperation ao |
exists(AssignExpr ae | ae = ao.getExpandedAssignment() |
i = 0 and
exists(Expr right |
@@ -223,7 +224,8 @@ class MultiImplementationsParent extends ExprOrStmtParent {
*/
File getBestFile() {
exists(ValueOrRefType t |
result = max(this.getAnImplementationFileInTopLevelType(_, t) as file
result =
max(this.getAnImplementationFileInTopLevelType(_, t) as file
order by
getImplementationSize(t, file), file.toString()
)
@@ -277,7 +279,8 @@ private ControlFlowElement getAChild(ControlFlowElement cfe) {
}
private int getImplementationSize0(ValueOrRefType t, File f) {
result = strictcount(ControlFlowElement cfe |
result =
strictcount(ControlFlowElement cfe |
exists(MultiImplementationsParent p, ControlFlowElement child |
cfe = getAChild*(child) and
not cfe = getAChild*(any(ThrowElement te))
@@ -297,7 +300,8 @@ private int getImplementationSize0(ValueOrRefType t, File f) {
}
private int getImplementationSize1(ValueOrRefType t, File f) {
result = strictsum(MultiImplementationsParent p, int c |
result =
strictsum(MultiImplementationsParent p, int c |
// Count each auto-implemented accessor as size 4 (getter) or 5 (setter)
f = p.getAnAutoImplementationFileInTopLevelType(t) and
if p instanceof Getter then c = 4 else c = 5

18
csharp/ql/src/semmle/code/csharp/Generics.qll
View File

@@ -343,7 +343,8 @@ class UnboundGenericDelegateType extends DelegateType, UnboundGenericType {
}
override string toStringWithTypes() {
result = getNameWithoutBrackets() + "<" + this.typeParametersToString() + ">(" +
result =
getNameWithoutBrackets() + "<" + this.typeParametersToString() + ">(" +
parameterTypesToString() + ")"
}
}
@@ -371,15 +372,16 @@ class ConstructedType extends ValueOrRefType, ConstructedGeneric {
override UnboundGenericType getUnboundGeneric() { constructed_generic(this, getTypeRef(result)) }
override string toStringWithTypes() {
result = getUnboundGeneric().getNameWithoutBrackets() + "<" + this.getTypeArgumentsString() +
">"
result =
getUnboundGeneric().getNameWithoutBrackets() + "<" + this.getTypeArgumentsString() + ">"
}
final override Type getChild(int n) { result = getTypeArgument(n) }
language[monotonicAggregates]
private string getTypeArgumentsString() {
result = concat(int i |
result =
concat(int i |
exists(this.getTypeArgument(i))
|
this.getTypeArgument(i).toString(), ", " order by i
@@ -500,8 +502,8 @@ class UnboundGenericMethod extends Method, UnboundGeneric {
}
override string toStringWithTypes() {
result = getName() + "<" + this.typeParametersToString() + ">" + "(" + parameterTypesToString() +
")"
result =
getName() + "<" + this.typeParametersToString() + ">" + "(" + parameterTypesToString() + ")"
}
}
@@ -531,8 +533,8 @@ class ConstructedMethod extends Method, ConstructedGeneric {
override UnboundGenericMethod getUnboundGeneric() { constructed_generic(this, result) }
override string toStringWithTypes() {
result = getName() + "<" + this.typeArgumentsToString() + ">" + "(" + parameterTypesToString() +
")"
result =
getName() + "<" + this.typeArgumentsToString() + ">" + "(" + parameterTypesToString() + ")"
}
override UnboundGenericMethod getSourceDeclaration() {

3
csharp/ql/src/semmle/code/csharp/Implements.qll
View File

@@ -342,7 +342,8 @@ private module Gvn {
string toString() {
exists(Unification::CompoundTypeKind k, string args |
this = gvnConstructed(_, k, _) and
args = concat(int i |
args =
concat(int i |
i in [0 .. k.getNumberOfTypeParameters() - 1]
|
this.getArg(i).toString(), "," order by i

3
csharp/ql/src/semmle/code/csharp/Stmt.qll
View File

@@ -236,7 +236,8 @@ private module SwithStmtInternal {
exists(int index, int rankIndex |
result = ss.getChildStmt(index) and
rankIndex = i + 1 and
index = rank[rankIndex](int j, Stmt s |
index =
rank[rankIndex](int j, Stmt s |
// `getChild` includes both labeled statements and the targeted
// statements of labeled statement as separate children, but we
// only want the labeled statement

9
csharp/ql/src/semmle/code/csharp/Type.qll
View File

@@ -338,7 +338,8 @@ class ValueOrRefType extends DotNet::ValueOrRefType, Type, Attributable, @value_
* calls made by callables in this type, excluding member accesses.
*/
int getResponse() {
result = sum(Callable c |
result =
sum(Callable c |
c.getDeclaringType() = this
|
count(Call call |
@@ -691,7 +692,8 @@ class RefType extends ValueOrRefType, @ref_type {
*/
float getSpecialisationIndex() {
this.getNumberOfCallables() != 0 and
result = (this.getNumberOverridden() * this.getInheritanceDepth()) /
result =
(this.getNumberOverridden() * this.getInheritanceDepth()) /
this.getNumberOfCallables().(float)
}
@@ -932,7 +934,8 @@ class TupleType extends ValueType, @tuple_type {
language[monotonicAggregates]
override string toStringWithTypes() {
result = "(" +
result =
"(" +
concat(int i |
exists(getElement(i))
|

3
csharp/ql/src/semmle/code/csharp/Unification.qll
View File

@@ -154,7 +154,8 @@ module Gvn {
string toString() {
exists(CompoundTypeKind k, string args |
k = this.getKind() and
args = concat(int i |
args =
concat(int i |
i in [0 .. k.getNumberOfTypeParameters() - 1]
|
this.getArg(i).toString(), "," order by i

7
csharp/ql/src/semmle/code/csharp/XML.qll
View File

@@ -100,11 +100,8 @@ class XMLParent extends @xmlparent {
* left to right, separated by a space.
*/
string allCharactersString() {
result = concat(string chars, int pos |
xmlChars(_, chars, this, pos, _, _)
|
chars, " " order by pos
)
result =
concat(string chars, int pos | xmlChars(_, chars, this, pos, _, _) | chars, " " order by pos)
}
/** Gets the text value contained in this XML parent. */

4
csharp/ql/src/semmle/code/csharp/commons/ComparisonTest.qll
View File

@@ -116,8 +116,8 @@ private newtype TComparisonTest =
m = any(SystemCollectionsIComparerInterface i).getCompareMethod()
or
m = any(SystemCollectionsGenericIComparerTInterface i).getAConstructedGeneric().getAMethod() and
m.getSourceDeclaration() = any(SystemCollectionsGenericIComparerTInterface i)
.getCompareMethod()
m.getSourceDeclaration() =
any(SystemCollectionsGenericIComparerTInterface i).getCompareMethod()
)
} or
TComparisonOperatorCall(OperatorCall oc, ComparisonKind kind, Expr first, Expr second) {

3
csharp/ql/src/semmle/code/csharp/commons/Strings.qll
View File

@@ -32,7 +32,8 @@ class ImplicitToStringExpr extends Expr {
not p.getType() instanceof ArrayType
or
p instanceof StringFormatItemParameter and
not p.getType() = any(ArrayType at |
not p.getType() =
any(ArrayType at |
at.getElementType() instanceof ObjectType and
this.getType().isImplicitlyConvertibleTo(at)
)

6
csharp/ql/src/semmle/code/csharp/commons/StructuralComparison.qll
View File

@@ -85,7 +85,8 @@ abstract class StructuralComparisonConfiguration extends string {
private ControlFlowElement getRankedChild(ControlFlowElement cfe, int rnk, int i) {
(candidateInternal(cfe, _) or candidateInternal(_, cfe)) and
i = rank[rnk](int j |
i =
rank[rnk](int j |
exists(ControlFlowElement child | child = cfe.getChild(j) |
not (j = -1 and cfe.(MemberAccess).targetIsThisInstance())
)
@@ -210,7 +211,8 @@ module Internal {
private ControlFlowElement getRankedChild(ControlFlowElement cfe, int rnk, int i) {
(candidateInternal(cfe, _) or candidateInternal(_, cfe)) and
i = rank[rnk](int j |
i =
rank[rnk](int j |
exists(ControlFlowElement child | child = cfe.getChild(j) |
not (j = -1 and cfe.(MemberAccess).targetIsThisInstance())
)

3
csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
View File

@@ -400,7 +400,8 @@ class JoinBlock extends BasicBlock {
*/
cached
JoinBlockPredecessor getJoinBlockPredecessor(int i) {
result = rank[i + 1](JoinBlockPredecessor jbp |
result =
rank[i + 1](JoinBlockPredecessor jbp |
jbp = this.getAPredecessor()
|
jbp order by JoinBlockPredecessors::getId(jbp), JoinBlockPredecessors::getSplitString(jbp)

159
csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
View File

@@ -439,14 +439,16 @@ module ControlFlow {
or
this = any(GeneralCatchClause gcc | i = 0 and result = gcc.getBlock())
or
this = any(FixedStmt fs |
this =
any(FixedStmt fs |
result = fs.getVariableDeclExpr(i)
or
result = fs.getBody() and
i = max(int j | exists(fs.getVariableDeclExpr(j))) + 1
)
or
this = any(UsingBlockStmt us |
this =
any(UsingBlockStmt us |
if exists(us.getExpr())
then (
result = us.getExpr() and
@@ -512,13 +514,15 @@ module ControlFlow {
or
e = any(ExtensionMethodCall emc | result = emc.getArgument(i))
or
e = any(QualifiableExpr qe |
e =
any(QualifiableExpr qe |
not qe instanceof ExtensionMethodCall and
not qe.isConditional() and
result = qe.getChild(i)
)
or
e = any(Assignment a |
e =
any(Assignment a |
// The left-hand side of an assignment is evaluated before the right-hand side
i = 0 and result = a.getLValue()
or
@@ -527,7 +531,8 @@ module ControlFlow {
}
private ControlFlowElement getExprChildElement(Expr e, int i) {
result = rank[i + 1](ControlFlowElement cfe, int j |
result =
rank[i + 1](ControlFlowElement cfe, int j |
cfe = getExprChildElement0(e, j) and
not cfe instanceof NoNodeExpr
|
@@ -585,7 +590,8 @@ module ControlFlow {
* can happen in tuple assignments.
*/
StatOrDynAccessorCall getCall(int i) {
result = rank[i + 1](AssignableDefinitions::TupleAssignmentDefinition tdef |
result =
rank[i + 1](AssignableDefinitions::TupleAssignmentDefinition tdef |
tdef.getExpr() = this and tdef.getTargetAccess() instanceof StatOrDynAccessorCall
|
tdef order by tdef.getEvaluationOrder()
@@ -629,20 +635,21 @@ module ControlFlow {
result = cfe
or
// Post-order: first element of first child (or self, if no children)
cfe = any(PostOrderElement poe |
cfe =
any(PostOrderElement poe |
result = first(poe.getFirstChild())
or
not exists(poe.getFirstChild()) and
result = poe
)
or
cfe = any(AssignOperationWithExpandedAssignment a |
result = first(a.getExpandedAssignment())
)
cfe =
any(AssignOperationWithExpandedAssignment a | result = first(a.getExpandedAssignment()))
or
cfe = any(ConditionallyQualifiedExpr cqe | result = first(cqe.getChildExpr(-1)))
or
cfe = any(ArrayCreation ac |
cfe =
any(ArrayCreation ac |
if ac.isImplicitlySized()
then
// No length argument: element itself
@@ -652,7 +659,8 @@ module ControlFlow {
result = first(ac.getLengthArgument(0))
)
or
cfe = any(ForeachStmt fs |
cfe =
any(ForeachStmt fs |
// Unlike most other statements, `foreach` statements are not modelled in
// pre-order, because we use the `foreach` node itself to represent the
// emptiness test that determines whether to execute the loop body
@@ -765,7 +773,8 @@ module ControlFlow {
pragma[nomagic]
private ControlFlowElement lastNonRec(ControlFlowElement cfe, TLastComputation c) {
// Pre-order: last element of last child (or self, if no children)
cfe = any(StandardStmt ss |
cfe =
any(StandardStmt ss |
result = ss.getLastChildElement() and
c = TRec(TLastRecAnyCompletion())
or
@@ -783,7 +792,8 @@ module ControlFlow {
result = cfe.(StandardElement).getChildElement(_) and
c = TRec(TLastRecAbnormalCompletion())
or
cfe = any(LogicalNotExpr lne |
cfe =
any(LogicalNotExpr lne |
// Operand exits with a Boolean completion
result = lne.getOperand() and
c = TRec(TLastRecBooleanNegationCompletion())
@@ -793,7 +803,8 @@ module ControlFlow {
c = TRec(TLastRecNonBooleanCompletion())
)
or
cfe = any(LogicalAndExpr lae |
cfe =
any(LogicalAndExpr lae |
// Left operand exits with a false completion
result = lae.getLeftOperand() and
c = specificBoolean(false)
@@ -807,7 +818,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(LogicalOrExpr loe |
cfe =
any(LogicalOrExpr loe |
// Left operand exits with a true completion
result = loe.getLeftOperand() and
c = specificBoolean(true)
@@ -821,7 +833,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(NullCoalescingExpr nce |
cfe =
any(NullCoalescingExpr nce |
// Left operand exits with any non-`null` completion
result = nce.getLeftOperand() and
c = TRec(TLastRecSpecificNegCompletion(any(NullnessCompletion nc | nc.isNull())))
@@ -831,7 +844,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(ConditionalExpr ce |
cfe =
any(ConditionalExpr ce |
// Condition exits abnormally
result = ce.getCondition() and
c = TRec(TLastRecAbnormalCompletion())
@@ -845,12 +859,14 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(AssignOperation ao |
cfe =
any(AssignOperation ao |
result = ao.getExpandedAssignment() and
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(ConditionallyQualifiedExpr cqe |
cfe =
any(ConditionallyQualifiedExpr cqe |
// Post-order: element itself
result = cqe and
c = getValidSelfCompletion(result)
@@ -860,7 +876,8 @@ module ControlFlow {
c = TRec(TLastRecSpecificCompletion(any(NullnessCompletion nc | nc.isNull())))
)
or
cfe = any(ThrowExpr te |
cfe =
any(ThrowExpr te |
// Post-order: element itself
result = te and
c = getValidSelfCompletion(result)
@@ -870,7 +887,8 @@ module ControlFlow {
c = TRec(TLastRecAbnormalCompletion())
)
or
cfe = any(ObjectCreation oc |
cfe =
any(ObjectCreation oc |
// Post-order: element itself (when no initializer)
result = oc and
not oc.hasInitializer() and
@@ -881,7 +899,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(ArrayCreation ac |
cfe =
any(ArrayCreation ac |
// Post-order: element itself (when no initializer)
result = ac and
not ac.hasInitializer() and
@@ -892,7 +911,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(IfStmt is |
cfe =
any(IfStmt is |
// Condition exits with a false completion and there is no `else` branch
result = is.getCondition() and
c = specificBoolean(false) and
@@ -911,7 +931,8 @@ module ControlFlow {
c = TRec(TLastRecAnyCompletion())
)
or
cfe = any(Switch s |
cfe =
any(Switch s |
// Switch expression exits normally and there are no cases
result = s.getExpr() and
not exists(s.getACase()) and
@@ -926,7 +947,8 @@ module ControlFlow {
c = TRec(TLastRecAbnormalCompletion())
)
or
cfe = any(SwitchStmt ss |
cfe =
any(SwitchStmt ss |
// A statement exits with a `break` completion
result = ss.getStmt(_) and
c = TRec(TLastRecBreakCompletion())
@@ -948,7 +970,8 @@ module ControlFlow {
)
)
or
cfe = any(SwitchExpr se |
cfe =
any(SwitchExpr se |
// A matching case exists with any completion
result = se.getACase().getBody() and
c = TRec(TLastRecAnyCompletion())
@@ -965,7 +988,8 @@ module ControlFlow {
)
)
or
cfe = any(Case case |
cfe =
any(Case case |
// Condition exists with a `false` completion
result = case.getCondition() and
c = specificBoolean(false)
@@ -1007,7 +1031,8 @@ module ControlFlow {
c = TRec(TLastRecNonContinueCompletion())
)
or
cfe = any(ForeachStmt fs |
cfe =
any(ForeachStmt fs |
// Iterator expression exits abnormally
result = fs.getIterableExpr() and
c = TRec(TLastRecAbnormalCompletion())
@@ -1028,14 +1053,16 @@ module ControlFlow {
c = TRec(TLastRecLoopBodyAbnormal())
)
or
cfe = any(TryStmt ts |
cfe =
any(TryStmt ts |
// If the `finally` block completes abnormally, take the completion of
// the `finally` block itself
result = ts.getFinally() and
c = TRec(TLastRecAbnormalCompletion())
)
or
cfe = any(SpecificCatchClause scc |
cfe =
any(SpecificCatchClause scc |
// Last element of `catch` block
result = scc.getBlock() and
c = TRec(TLastRecAnyCompletion())
@@ -1052,7 +1079,8 @@ module ControlFlow {
)
)
or
cfe = any(JumpStmt js |
cfe =
any(JumpStmt js |
// Post-order: element itself
result = js and
c = getValidSelfCompletion(result)
@@ -1062,7 +1090,8 @@ module ControlFlow {
c = TRec(TLastRecAbnormalCompletion())
)
or
cfe = any(QualifiedWriteAccess qwa |
cfe =
any(QualifiedWriteAccess qwa |
// Skip the access in a qualified write access
result = getExprChildElement(qwa, getLastChildElement(qwa)) and
c = TRec(TLastRecAnyCompletion())
@@ -1072,7 +1101,8 @@ module ControlFlow {
c = TRec(TLastRecAbnormalCompletion())
)
or
cfe = any(AccessorWrite aw |
cfe =
any(AccessorWrite aw |
// Post-order: element itself
result = aw and
c = getValidSelfCompletion(result)
@@ -1083,7 +1113,8 @@ module ControlFlow {
or
// An accessor call exits abnormally
result = aw.getCall(_) and
c = TSelf(any(Completion comp |
c =
TSelf(any(Completion comp |
comp.isValidFor(result) and not comp instanceof NormalCompletion
))
)
@@ -1123,20 +1154,17 @@ module ControlFlow {
or
rec = TLastRecBooleanNegationCompletion() and
(
c = any(NestedCompletion nc |
c =
any(NestedCompletion nc |
nc.getInnerCompletion() = c0 and
nc.getOuterCompletion().(BooleanCompletion).getValue() = c0
.(BooleanCompletion)
.getValue()
.booleanNot()
nc.getOuterCompletion().(BooleanCompletion).getValue() =
c0.(BooleanCompletion).getValue().booleanNot()
)
or
c = any(BooleanCompletion bc |
bc.getValue() = c0
.(NestedCompletion)
.getInnerCompletion()
.(BooleanCompletion)
.getValue() and
c =
any(BooleanCompletion bc |
bc.getValue() =
c0.(NestedCompletion).getInnerCompletion().(BooleanCompletion).getValue() and
not bc instanceof NestedCompletion
)
)
@@ -1158,7 +1186,8 @@ module ControlFlow {
or
rec = TLastRecInvalidOperationException() and
(c0.(MatchingCompletion).isNonMatch() or c0 instanceof FalseCompletion) and
c = any(NestedCompletion nc |
c =
any(NestedCompletion nc |
nc.getInnerCompletion() = c0 and
nc
.getOuterCompletion()
@@ -1191,7 +1220,8 @@ module ControlFlow {
exists(MatchingCompletion mc |
mc.isNonMatch() and
mc.isValidFor(scc) and
c = any(NestedCompletion nc |
c =
any(NestedCompletion nc |
nc.getInnerCompletion() = mc and
nc.getOuterCompletion() = tc.getOuterCompletion()
)
@@ -1200,14 +1230,16 @@ module ControlFlow {
// Incompatible filter
exists(FalseCompletion fc |
result = lastSpecificCatchClauseFilterClause(scc, fc) and
c = any(NestedCompletion nc |
c =
any(NestedCompletion nc |
nc.getInnerCompletion() = fc and
nc.getOuterCompletion() = tc.getOuterCompletion()
)
)
)
or
cfe = any(TryStmt ts |
cfe =
any(TryStmt ts |
result = getBlockOrCatchFinallyPred(ts, c) and
(
// If there is no `finally` block, last elements are from the body, from
@@ -1222,7 +1254,8 @@ module ControlFlow {
or
// If the `finally` block completes normally, it inherits any non-normal
// completion that was current before the `finally` block was entered
c = any(NestedCompletion nc |
c =
any(NestedCompletion nc |
result = lastTryStmtFinally(ts, nc.getInnerCompletion(), nc.getOuterCompletion())
)
)
@@ -1333,7 +1366,8 @@ module ControlFlow {
pragma[nomagic]
ControlFlowElement succ(ControlFlowElement cfe, Completion c) {
// Pre-order: flow from element itself to first element of first child
cfe = any(StandardStmt ss |
cfe =
any(StandardStmt ss |
result = first(ss.getFirstChildElement()) and
c instanceof SimpleCompletion
)
@@ -1349,7 +1383,8 @@ module ControlFlow {
result = first(parent.getChildElement(i + 1))
)
or
cfe = any(LogicalNotExpr lne |
cfe =
any(LogicalNotExpr lne |
// Pre-order: flow from expression itself to first element of operand
result = first(lne.getOperand()) and
c instanceof SimpleCompletion
@@ -1546,7 +1581,8 @@ module ControlFlow {
)
or
// Pre-order: flow from statement itself to first element of statement
cfe = any(DefaultCase dc |
cfe =
any(DefaultCase dc |
result = first(dc.getStmt()) and
c instanceof SimpleCompletion
)
@@ -1564,13 +1600,15 @@ module ControlFlow {
result = first(ls.getCondition())
)
or
cfe = any(WhileStmt ws |
cfe =
any(WhileStmt ws |
// Pre-order: flow from statement itself to first element of condition
result = first(ws.getCondition()) and
c instanceof SimpleCompletion
)
or
cfe = any(DoStmt ds |
cfe =
any(DoStmt ds |
// Pre-order: flow from statement itself to first element of body
result = first(ds.getBody()) and
c instanceof SimpleCompletion
@@ -1779,7 +1817,8 @@ module ControlFlow {
or
// Flow from element with `goto` completion to first element of relevant
// target
c = any(GotoCompletion gc |
c =
any(GotoCompletion gc |
cfe = last(_, gc) and
// Special case: when a `goto` happens inside a `try` statement with a
// `finally` block, flow does not go directly to the target, but instead
@@ -1849,13 +1888,15 @@ module ControlFlow {
* callable `c`.
*/
ControlFlowElement succEntry(@top_level_exprorstmt_parent p) {
p = any(Callable c |
p =
any(Callable c |
if exists(c.(Constructor).getInitializer())
then result = first(c.(Constructor).getInitializer())
else
if InitializerSplitting::constructorInitializes(c, _)
then
result = first(any(InitializerSplitting::InitializedInstanceMember m |
result =
first(any(InitializerSplitting::InitializedInstanceMember m |
InitializerSplitting::constructorInitializeOrder(c, m, 0)
).getInitializer())
else result = first(c.getBody())

90
csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
View File

@@ -180,7 +180,8 @@ module AbstractValues {
}
override MatchValue getDualValue() {
result = any(MatchValue mv |
result =
any(MatchValue mv |
mv.getCase() = this.getCase() and
if this.isMatch() then not mv.isMatch() else mv.isMatch()
)
@@ -310,7 +311,8 @@ class DereferenceableExpr extends Expr {
isNull = false
)
or
result = any(PatternMatch pm |
result =
any(PatternMatch pm |
pm.getExpr() = this and
if pm.getPattern() instanceof NullLiteral
then
@@ -328,7 +330,8 @@ class DereferenceableExpr extends Expr {
)
or
this.hasNullableType() and
result = any(PropertyAccess pa |
result =
any(PropertyAccess pa |
pa.getQualifier() = this and
pa.getTarget().hasName("HasValue") and
if branch = true then isNull = false else isNull = true
@@ -371,7 +374,8 @@ class DereferenceableExpr extends Expr {
v.isMatch() and
isNull = false
or
case.getPattern() = any(ConstantPatternExpr cpe |
case.getPattern() =
any(ConstantPatternExpr cpe |
if cpe instanceof NullLiteral
then
// `case null`
@@ -443,25 +447,28 @@ class CollectionExpr extends Expr {
*/
private Expr getASizeExpr(boolean lowerBound) {
lowerBound = false and
result = any(PropertyRead pr |
result =
any(PropertyRead pr |
this = pr.getQualifier() and
pr.getTarget() = any(SystemArrayClass x).getLengthProperty()
)
or
lowerBound = false and
result = any(PropertyRead pr |
result =
any(PropertyRead pr |
this = pr.getQualifier() and
pr
.getTarget()
.overridesOrImplementsOrEquals(any(Property p |
p.getSourceDeclaration() = any(SystemCollectionsGenericICollectionInterface x)
.getCountProperty()
p.getSourceDeclaration() =
any(SystemCollectionsGenericICollectionInterface x).getCountProperty()
))
)
or
result = any(MethodCall mc |
mc.getTarget().getSourceDeclaration() = any(SystemLinq::SystemLinqEnumerableClass x)
.getACountMethod() and
result =
any(MethodCall mc |
mc.getTarget().getSourceDeclaration() =
any(SystemLinq::SystemLinqEnumerableClass x).getACountMethod() and
this = mc.getArgument(0) and
if mc.getNumberOfArguments() = 1 then lowerBound = false else lowerBound = true
)
@@ -469,7 +476,8 @@ class CollectionExpr extends Expr {
private Expr getABooleanEmptinessCheck(BooleanValue v, boolean isEmpty) {
exists(boolean branch | branch = v.getValue() |
result = any(ComparisonTest ct |
result =
any(ComparisonTest ct |
exists(boolean lowerBound |
ct.getAnArgument() = this.getASizeExpr(lowerBound) and
if isEmpty = true then lowerBound = false else any()
@@ -510,9 +518,10 @@ class CollectionExpr extends Expr {
)
).getExpr()
or
result = any(MethodCall mc |
mc.getTarget().getSourceDeclaration() = any(SystemLinq::SystemLinqEnumerableClass x)
.getAnAnyMethod() and
result =
any(MethodCall mc |
mc.getTarget().getSourceDeclaration() =
any(SystemLinq::SystemLinqEnumerableClass x).getAnAnyMethod() and
this = mc.getArgument(0) and
branch = isEmpty.booleanNot() and
if branch = false then mc.getNumberOfArguments() = 1 else any()
@@ -884,7 +893,8 @@ module Internal {
* and `e = x`.
*/
Expr getNullEquivParent(Expr e) {
result = any(QualifiableExpr qe |
result =
any(QualifiableExpr qe |
qe.isConditional() and
(
e = qe.getQualifier()
@@ -916,7 +926,8 @@ module Internal {
* Gets a child expression of `e` which is `null` only if `e` is `null`.
*/
Expr getANullImplyingChild(Expr e) {
e = any(QualifiableExpr qe |
e =
any(QualifiableExpr qe |
qe.isConditional() and
result = qe.getQualifier()
)
@@ -991,7 +1002,8 @@ module Internal {
}
private Expr stripConditionalExpr(Expr e) {
e = any(ConditionalExpr ce |
e =
any(ConditionalExpr ce |
result = stripConditionalExpr(ce.getThen())
or
result = stripConditionalExpr(ce.getElse())
@@ -1156,7 +1168,8 @@ module Internal {
// v = guard ? e : x;
exists(ConditionalExpr c | c = def.getDefinition().getSource() |
guard = c.getCondition() and
vGuard = any(BooleanValue bv |
vGuard =
any(BooleanValue bv |
bv.getValue() = true and
e = c.getThen()
or
@@ -1230,7 +1243,8 @@ module Internal {
ck.isInequality() and branch = false
)
or
result = any(IsExpr ie |
result =
any(IsExpr ie |
ie.getExpr() = e1 and
e2 = ie.getPattern().(ConstantPatternExpr) and
branch = true
@@ -1312,9 +1326,8 @@ module Internal {
// or
// if (de == null); vGuard = TBooleanValue(true); vDef = TNullValue(false)
exists(NullValue nv |
guard = ar
.(DereferenceableExpr)
.getANullCheck(vGuard, any(boolean b | nv = TNullValue(b)))
guard =
ar.(DereferenceableExpr).getANullCheck(vGuard, any(boolean b | nv = TNullValue(b)))
|
vDef = nv.getDualValue()
)
@@ -1471,7 +1484,8 @@ module Internal {
*/
cached
predicate preImpliesStep(Guard g1, AbstractValue v1, Guard g2, AbstractValue v2) {
g1 = any(BinaryOperation bo |
g1 =
any(BinaryOperation bo |
(
bo instanceof BitwiseAndExpr or
bo instanceof LogicalAndExpr
@@ -1481,7 +1495,8 @@ module Internal {
v2 = v1
)
or
g1 = any(BinaryOperation bo |
g1 =
any(BinaryOperation bo |
(
bo instanceof BitwiseOrExpr or
bo instanceof LogicalOrExpr
@@ -1536,7 +1551,8 @@ module Internal {
)
or
isGuard(g1, v1) and
v1 = any(MatchValue mv |
v1 =
any(MatchValue mv |
mv.isMatch() and
g2 = g1 and
v2.getAnExpr() = mv.getCase().getPattern().(ConstantPatternExpr) and
@@ -1549,9 +1565,8 @@ module Internal {
)
or
exists(boolean isEmpty | g1 = g2.(CollectionExpr).getAnEmptinessCheck(v1, isEmpty) |
v2 = any(EmptyCollectionValue ecv |
if ecv.isEmpty() then isEmpty = true else isEmpty = false
) and
v2 =
any(EmptyCollectionValue ecv | if ecv.isEmpty() then isEmpty = true else isEmpty = false) and
g1 != g2
)
or
@@ -1618,7 +1633,8 @@ module Internal {
nullValueImplied(e1) and nullValueImplied(e2) and nullValueImpliedBinary(e1, e2, e)
)
or
e = any(PreSsa::Definition def |
e =
any(PreSsa::Definition def |
forex(PreSsa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
}
@@ -1629,7 +1645,8 @@ module Internal {
or
exists(Expr e1 | nonNullValueImplied(e1) and nonNullValueImpliedUnary(e1, e))
or
e = any(PreSsa::Definition def |
e =
any(PreSsa::Definition def |
forex(PreSsa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
}
@@ -1660,8 +1677,8 @@ module Internal {
exists(PreSsa::Definition def | emptyDef(def) | firstReadSameVarUniquePredecesssor(def, e))
or
exists(MethodCall mc |
mc.getTarget().getAnUltimateImplementee().getSourceDeclaration() = any(SystemCollectionsGenericICollectionInterface c
).getClearMethod() and
mc.getTarget().getAnUltimateImplementee().getSourceDeclaration() =
any(SystemCollectionsGenericICollectionInterface c).getClearMethod() and
adjacentReadPairSameVarUniquePredecessor(mc.getQualifier(), e)
)
}
@@ -1685,8 +1702,8 @@ module Internal {
)
or
exists(MethodCall mc |
mc.getTarget().getAnUltimateImplementee().getSourceDeclaration() = any(SystemCollectionsGenericICollectionInterface c
).getAddMethod() and
mc.getTarget().getAnUltimateImplementee().getSourceDeclaration() =
any(SystemCollectionsGenericICollectionInterface c).getAddMethod() and
adjacentReadPairSameVarUniquePredecessor(mc.getQualifier(), e)
)
}
@@ -1706,7 +1723,8 @@ module Internal {
override predicate candidate(ControlFlowElement x, ControlFlowElement y) {
exists(BasicBlock bb, Declaration d |
candidateAux(x, d, bb) and
y = any(AccessOrCallExpr e |
y =
any(AccessOrCallExpr e |
e.getAControlFlowNode().getBasicBlock() = bb and
e.getTarget() = d
)

21
csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
View File

@@ -191,7 +191,8 @@ private predicate isBooleanConstant(Expr e, boolean value) {
private predicate isNullnessConstant(Expr e, boolean value) {
mustHaveNullnessCompletion(e) and
exists(Expr stripped | stripped = e.stripCasts() |
stripped.getType() = any(ValueType t |
stripped.getType() =
any(ValueType t |
not t instanceof NullableType and
// Extractor bug: the type of `x?.Length` is reported as `int`, but it should
// be `int?`
@@ -290,7 +291,8 @@ private class TriedControlFlowElement extends ControlFlowElement {
this instanceof Call and
result instanceof SystemExceptionClass
or
this = any(MemberAccess ma |
this =
any(MemberAccess ma |
not ma.isConditional() and
ma.getQualifier() = any(Expr e | not e instanceof TypeAccess) and
result instanceof SystemNullReferenceExceptionClass
@@ -302,7 +304,8 @@ private class TriedControlFlowElement extends ControlFlowElement {
this instanceof ArrayCreation and
result instanceof SystemOutOfMemoryExceptionClass
or
this = any(AddExpr ae |
this =
any(AddExpr ae |
ae.getType() instanceof StringType and
result instanceof SystemOutOfMemoryExceptionClass
or
@@ -310,17 +313,20 @@ private class TriedControlFlowElement extends ControlFlowElement {
result instanceof SystemOverflowExceptionClass
)
or
this = any(SubExpr se |
this =
any(SubExpr se |
se.getType() instanceof IntegralType and
result instanceof SystemOverflowExceptionClass
)
or
this = any(MulExpr me |
this =
any(MulExpr me |
me.getType() instanceof IntegralType and
result instanceof SystemOverflowExceptionClass
)
or
this = any(DivExpr de |
this =
any(DivExpr de |
not de.getDenominator().getValue().toFloat() != 0 and
result instanceof SystemDivideByZeroExceptionClass
)
@@ -361,7 +367,8 @@ private class TriedControlFlowElement extends ControlFlowElement {
Class getAThrownException() {
exists(string name | result = this.getAThrownExceptionFromPlausibleCoreLib(name) |
result = min(Class c |
result =
min(Class c |
c = this.getAThrownExceptionFromPlausibleCoreLib(name)
|
c order by c.getLocation().(Assembly).getFullName()

3
csharp/ql/src/semmle/code/csharp/controlflow/internal/NonReturning.qll
View File

@@ -70,7 +70,8 @@ abstract private class ExitingCallable extends NonReturningCallable { }
private class DirectlyExitingCallable extends ExitingCallable {
DirectlyExitingCallable() {
this = any(Method m |
this =
any(Method m |
m.hasQualifiedName("System.Environment", "Exit") or
m.hasQualifiedName("System.Windows.Forms.Application", "Exit")
)

3
csharp/ql/src/semmle/code/csharp/controlflow/internal/PreSsa.qll
View File

@@ -196,7 +196,8 @@ private int maxRefRank(PreBasicBlock bb, SimpleAssignable a) {
}
private int firstReadOrCertainWrite(PreBasicBlock bb, SimpleAssignable a) {
result = min(int r, RefKind k |
result =
min(int r, RefKind k |
r = refRank(bb, _, a, k) and
k != Write(false)
|

31
csharp/ql/src/semmle/code/csharp/controlflow/internal/Splitting.qll
View File

@@ -255,7 +255,8 @@ module InitializerSplitting {
*/
predicate constructorInitializeOrder(Constructor c, InitializedInstanceMember m, int i) {
constructorInitializes(c, m) and
m = rank[i + 1](InitializedInstanceMember m0 |
m =
rank[i + 1](InitializedInstanceMember m0 |
constructorInitializes(c, m0)
|
m0
@@ -377,7 +378,8 @@ module InitializerSplitting {
override predicate hasSuccessor(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
this.appliesTo(pred) and
succ = succ(pred, c) and
succ = any(InitializedInstanceMember m | constructorInitializes(this.getConstructor(), m))
succ =
any(InitializedInstanceMember m | constructorInitializes(this.getConstructor(), m))
.getAnInitializerDescendant()
}
}
@@ -651,7 +653,8 @@ module FinallySplitting {
override predicate hasSuccessor(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
this.appliesToPredecessor(pred) and
succ = succ(pred, c) and
succ = any(FinallyControlFlowElement fcfe |
succ =
any(FinallyControlFlowElement fcfe |
if fcfe.isEntryNode()
then
// entering a nested `finally` block
@@ -767,11 +770,13 @@ module ExceptionHandlerSplitting {
(
pred instanceof SpecificCatchClause
implies
pred = any(SpecificCatchClause scc |
pred =
any(SpecificCatchClause scc |
if c instanceof MatchingCompletion
then
exists(TMatch match | this.appliesToCatchClause(scc, match) |
c = any(MatchingCompletion mc |
c =
any(MatchingCompletion mc |
if mc.isMatch() then match != TNever() else match != TAlways()
)
)
@@ -998,7 +1003,8 @@ module BooleanSplitting {
private int getListOrder(BooleanSplitSubKind kind) {
exists(Callable c, int r | c = kind.getEnclosingCallable() |
result = r + ExceptionHandlerSplitting::getNextListOrder() - 1 and
kind = rank[r](BooleanSplitSubKind kind0 |
kind =
rank[r](BooleanSplitSubKind kind0 |
kind0.getEnclosingCallable() = c and
kind0.startsSplit(_)
|
@@ -1011,9 +1017,8 @@ module BooleanSplitting {
}
int getNextListOrder() {
result = max(int i |
i = getListOrder(_) + 1 or i = ExceptionHandlerSplitting::getNextListOrder()
)
result =
max(int i | i = getListOrder(_) + 1 or i = ExceptionHandlerSplitting::getNextListOrder())
}
private class BooleanSplitKind extends SplitKind, TBooleanSplitKind {
@@ -1064,9 +1069,8 @@ module BooleanSplitting {
forall(boolean inverted | bb = this.getACorrelatedCondition(inverted) |
c.getInnerCompletion() instanceof BooleanCompletion
implies
c.getInnerCompletion().(BooleanCompletion).getValue() = this
.getBranch()
.booleanXor(inverted)
c.getInnerCompletion().(BooleanCompletion).getValue() =
this.getBranch().booleanXor(inverted)
)
)
}
@@ -1193,7 +1197,8 @@ module LoopUnrollingSplitting {
private int getListOrder(UnrollableLoopStmt loop) {
exists(Callable c, int r | c = loop.getEnclosingCallable() |
result = r + BooleanSplitting::getNextListOrder() - 1 and
loop = rank[r](UnrollableLoopStmt loop0 |
loop =
rank[r](UnrollableLoopStmt loop0 |
loop0.getEnclosingCallable() = c
|
loop0 order by loop0.getLocation().getStartLine(), loop0.getLocation().getStartColumn()

7
csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
View File

@@ -132,7 +132,8 @@ private predicate hasArgumentPosition(SourceDeclarationCallable callable, int po
exists(int arity |
if callable.getAParameter().isParams()
then
arity = max(Call call |
arity =
max(Call call |
call.getTarget().getSourceDeclaration() = callable
|
call.getNumberOfArguments()
@@ -269,8 +270,8 @@ private CallableFlowSinkDelegateArg getDelegateFlowSinkArg(
/** The flow sink in a call to a library callable: parameter of a delegate argument. */
class CallableFlowSinkDelegateArg extends CallableFlowSink, TCallableFlowSinkDelegateArg {
override string toString() {
result = "parameter " + getDelegateParameterIndex() + " of argument " +
getDelegateIndex().toString()
result =
"parameter " + getDelegateParameterIndex() + " of argument " + getDelegateIndex().toString()
}
override Expr getSink(Call c) {

18
csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
View File

@@ -39,7 +39,8 @@ class MaybeNullExpr extends Expr {
or
this.(Cast).getExpr() instanceof MaybeNullExpr
or
this = any(ConditionalExpr ce |
this =
any(ConditionalExpr ce |
ce.getThen() instanceof MaybeNullExpr
or
ce.getElse() instanceof MaybeNullExpr
@@ -58,7 +59,8 @@ class AlwaysNullExpr extends Expr {
or
exists(AlwaysNullExpr e1, AlwaysNullExpr e2 | G::Internal::nullValueImpliedBinary(e1, e2, this))
or
this = any(Ssa::Definition def |
this =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
or
@@ -84,7 +86,8 @@ class NonNullExpr extends Expr {
or
this instanceof G::NullGuardedExpr
or
this = any(Ssa::Definition def |
this =
any(Ssa::Definition def |
forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
or
@@ -104,7 +107,8 @@ private predicate nonNullDef(Ssa::ExplicitDefinition def) {
exists(AssignableDefinition ad | ad = def.getADefinition() |
ad instanceof AssignableDefinitions::PatternDefinition
or
ad = any(AssignableDefinitions::LocalVariableDefinition d |
ad =
any(AssignableDefinitions::LocalVariableDefinition d |
d.getExpr() = any(SpecificCatchClause scc).getVariableDeclExpr()
or
d.getExpr() = any(ForeachStmt fs).getAVariableDeclExpr()
@@ -468,7 +472,8 @@ private predicate defReaches(Ssa::Definition def, ControlFlow::Node cfn, boolean
or
exists(ControlFlow::Node mid | defReaches(def, mid, always) |
Ssa::Internal::adjacentReadPairSameVar(_, mid, cfn) and
not mid = any(Dereference d |
not mid =
any(Dereference d |
if always = true
then d.isAlwaysNull(def.getSourceVariable())
else d.isMaybeNull(def, _, _, _, _)
@@ -542,7 +547,8 @@ class Dereference extends G::DereferenceableExpr {
this = v.getAnAccess() and
// Exclude fields, properties, and captured variables, as they may not have an
// accurate SSA representation
v.getAssignable() = any(LocalScopeVariable lsv |
v.getAssignable() =
any(LocalScopeVariable lsv |
strictcount(Callable c |
c = any(AssignableDefinition ad | ad.getTarget() = lsv).getEnclosingCallable()
) = 1

18
csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
View File

@@ -295,7 +295,8 @@ module Ssa {
* that is either a read or a certain write.
*/
private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
result = min(int r, RefKind k |
result =
min(int r, RefKind k |
r = refRank(bb, _, v, k) and
k != Write(false)
|
@@ -387,7 +388,8 @@ module Ssa {
or
// Local variable declaration without initializer
not exists(result.getTargetAccess()) and
this = any(LocalScopeSourceVariable v |
this =
any(LocalScopeSourceVariable v |
result.getTarget() = v.getAssignable() and
result.getEnclosingCallable() = v.getEnclosingCallable()
)
@@ -450,7 +452,8 @@ module Ssa {
* code location. This is used as the representative location.
*/
private FieldOrPropAccess getFirstAccess() {
result = min(this.getAnAccess() as a
result =
min(this.getAnAccess() as a
order by
a.getLocation().getStartLine(), a.getLocation().getStartColumn()
)
@@ -1064,12 +1067,14 @@ module Ssa {
private predicate delegateCreation(
Expr e, Callable c, SystemLinqExpressions::DelegateExtType dt
) {
e = any(AnonymousFunctionExpr afe |
e =
any(AnonymousFunctionExpr afe |
dt = afe.getType() and
c = afe
)
or
e = any(CallableAccess ca |
e =
any(CallableAccess ca |
c = ca.getTarget().getSourceDeclaration() and
dt = ca.getType()
)
@@ -2560,7 +2565,8 @@ module Ssa {
*/
class UncertainDefinition extends Definition {
UncertainDefinition() {
this = any(ExplicitDefinition def |
this =
any(ExplicitDefinition def |
forex(AssignableDefinition ad | ad = def.getADefinition() | not ad.isCertain())
)
or

6
csharp/ql/src/semmle/code/csharp/dataflow/flowsources/Remote.qll
View File

@@ -77,10 +77,8 @@ class AspNetUnvalidatedQueryStringRemoteFlowSource extends AspNetRemoteFlowSourc
DataFlow::ExprNode {
AspNetUnvalidatedQueryStringRemoteFlowSource() {
this.getExpr() = any(SystemWebUnvalidatedRequestValues c).getAProperty().getGetter().getACall() or
this.getExpr() = any(SystemWebUnvalidatedRequestValuesBase c)
.getAProperty()
.getGetter()
.getACall()
this.getExpr() =
any(SystemWebUnvalidatedRequestValuesBase c).getAProperty().getGetter().getACall()
}
override string getSourceType() { result = "ASP.NET unvalidated request data" }

31
csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
View File

@@ -96,7 +96,8 @@ module LocalFlow {
scope = e2 and
isSuccessor = true
or
e2 = any(ConditionalExpr ce |
e2 =
any(ConditionalExpr ce |
e1 = ce.getThen() or
e1 = ce.getElse()
) and
@@ -112,7 +113,8 @@ module LocalFlow {
isSuccessor = true
or
// An `=` expression, where the result of the expression is used
e2 = any(AssignExpr ae |
e2 =
any(AssignExpr ae |
ae.getParent() = any(ControlFlowElement cfe | not cfe instanceof ExprStmt) and
e1 = ae.getRValue()
) and
@@ -167,7 +169,8 @@ module LocalFlow {
UncertainExplicitSsaDefinition() {
this instanceof Ssa::ExplicitDefinition
or
this = any(Ssa::ImplicitQualifierDefinition qdef |
this =
any(Ssa::ImplicitQualifierDefinition qdef |
qdef.getQualifierDefinition() instanceof UncertainExplicitSsaDefinition
)
}
@@ -279,7 +282,8 @@ private class Argument extends Expr {
private int arg;
Argument() {
call = any(DispatchCall dc |
call =
any(DispatchCall dc |
this = dc.getArgument(arg)
or
this = dc.getQualifier() and arg = -1 and not dc.getAStaticTarget().(Modifiable).isStatic()
@@ -468,11 +472,8 @@ private module Cached {
predicate readStepImpl(Node node1, Content c, Node node2) {
exists(ReadStepConfiguration x |
x.hasNodePath(node1, node2) and
c.(FieldLikeContent).getField() = node2
.asExpr()
.(FieldLikeRead)
.getTarget()
.getSourceDeclaration()
c.(FieldLikeContent).getField() =
node2.asExpr().(FieldLikeRead).getTarget().getSourceDeclaration()
)
}
@@ -671,7 +672,8 @@ private module ParameterNodes {
// the order is irrelevant
int getParameterPosition(SsaCapturedEntryDefinition def) {
exists(Callable c | c = def.getCallable() |
def = rank[-result - 1](SsaCapturedEntryDefinition def0 |
def =
rank[-result - 1](SsaCapturedEntryDefinition def0 |
def0.getCallable() = c
|
def0 order by getId(def0.getSourceVariable().getAssignable())
@@ -1115,10 +1117,8 @@ private module OutNodes {
override DataFlowCall getCall(ReturnKind kind) {
result = call and
kind.(ImplicitCapturedReturnKind).getVariable() = this
.getDefinition()
.getSourceVariable()
.getAssignable()
kind.(ImplicitCapturedReturnKind).getVariable() =
this.getDefinition().getSourceVariable().getAssignable()
}
}
@@ -1253,7 +1253,8 @@ predicate flowOutOfDelegateLibraryCall(
private class FieldLike extends Assignable, Modifiable {
FieldLike() {
this instanceof Field or
this = any(Property p |
this =
any(Property p |
not p.isOverridableOrImplementable() and
(
p.isAutoImplemented()

3
csharp/ql/src/semmle/code/csharp/dataflow/internal/DelegateDataFlow.qll
View File

@@ -18,7 +18,8 @@ private class DelegateFlowSource extends DataFlow::ExprNode {
Callable c;
DelegateFlowSource() {
this.getExpr() = any(Expr e |
this.getExpr() =
any(Expr e |
c = e.(AnonymousFunctionExpr) or
c = e.(CallableAccess).getTarget().getSourceDeclaration()
)

13
csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
View File

@@ -99,7 +99,8 @@ private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityCon
isSuccessor = false
or
// Taint from tuple argument
e2 = any(TupleExpr te |
e2 =
any(TupleExpr te |
e1 = te.getAnArgument() and
te.isReadAccess() and
scope = e2 and
@@ -111,14 +112,16 @@ private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityCon
isSuccessor = true
or
// Taint from tuple expression
e2 = any(MemberAccess ma |
e2 =
any(MemberAccess ma |
ma.getQualifier().getType() instanceof TupleType and
e1 = ma.getQualifier() and
scope = e2 and
isSuccessor = true
)
or
e2 = any(OperatorCall oc |
e2 =
any(OperatorCall oc |
oc.getTarget().(ConversionOperator).fromLibrary() and
e1 = oc.getAnArgument() and
scope = e2 and
@@ -134,8 +137,8 @@ private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityCon
// Taint from `foreach` expression
exists(ForeachStmt fs |
e = fs.getIterableExpr() and
defTo.(AssignableDefinitions::LocalVariableDefinition).getDeclaration() = fs
.getVariableDeclExpr() and
defTo.(AssignableDefinitions::LocalVariableDefinition).getDeclaration() =
fs.getVariableDeclExpr() and
isSuccessor = true
|
scope = fs and

10
csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
View File

@@ -381,7 +381,8 @@ private module Internal {
or
this = any(DispatchReflectionOrDynamicCall c).getArgument(_)
or
this = any(MethodCall mc | mc.getTarget() = any(SystemObjectClass c).getGetTypeMethod())
this =
any(MethodCall mc | mc.getTarget() = any(SystemObjectClass c).getGetTypeMethod())
.getQualifier()
or
this = any(DispatchCallImpl c).getQualifier()
@@ -738,7 +739,8 @@ private module Internal {
override Callable getAStaticTarget() {
result = getACallableWithMatchingName() and
exists(int minArgs |
minArgs = count(Parameter p |
minArgs =
count(Parameter p |
p = result.getAParameter() and
not p.hasDefaultValue() and
not p.isParams()
@@ -1090,8 +1092,8 @@ private module Internal {
override string getName() { this = TDispatchDynamicEventAccess(_, _, result) }
override Expr getQualifier() {
result = any(DynamicMemberAccess dma | this = TDispatchDynamicEventAccess(_, dma, _))
.getQualifier()
result =
any(DynamicMemberAccess dma | this = TDispatchDynamicEventAccess(_, dma, _)).getQualifier()
}
override Expr getArgument(int i) { i = 0 and result = getCall().getRValue() }

7
csharp/ql/src/semmle/code/csharp/exprs/Creation.qll
View File

@@ -380,11 +380,8 @@ class AnonymousFunctionExpr extends Expr, Callable, @anonymous_function_expr {
override string getName() { result = "<anonymous>" }
override Type getReturnType() {
result = this
.getType()
.(SystemLinqExpressions::DelegateExtType)
.getDelegateType()
.getReturnType()
result =
this.getType().(SystemLinqExpressions::DelegateExtType).getDelegateType().getReturnType()
}
override AnonymousFunctionExpr getSourceDeclaration() { result = this }

3
csharp/ql/src/semmle/code/csharp/frameworks/JsonNET.qll
View File

@@ -210,7 +210,8 @@ module JsonNET {
preservesValue = false
or
// operator string
c = any(Operator op |
c =
any(Operator op |
op.getDeclaringType() = this.getABaseType*() and op.getReturnType() instanceof StringType
) and
source = any(CallableFlowSourceArg arg | arg.getArgumentIndex() = 0) and

16
csharp/ql/src/semmle/code/csharp/frameworks/system/Xml.qll
View File

@@ -118,16 +118,16 @@ class SystemXmlXmlNamedNodeMapClass extends Class {
/** An enum constant in `System.Xml.ValidationType`. */
class SystemXmlValidationType extends EnumConstant {
SystemXmlValidationType() {
this.getDeclaringEnum() = any(Enum e |
e = any(SystemXmlNamespace n).getAnEnum() and e.hasName("ValidationType")
)
this.getDeclaringEnum() =
any(Enum e | e = any(SystemXmlNamespace n).getAnEnum() and e.hasName("ValidationType"))
}
}
/** An enum constant in `System.Xml.Schema.XmlSchemaValidationFlags`. */
class SystemXmlSchemaXmlSchemaValidationFlags extends EnumConstant {
SystemXmlSchemaXmlSchemaValidationFlags() {
this.getDeclaringEnum() = any(Enum e |
this.getDeclaringEnum() =
any(Enum e |
e = any(SystemXmlSchemaNamespace s).getAnEnum() and e.hasName("XmlSchemaValidationFlags")
)
}
@@ -141,14 +141,14 @@ class XmlReaderSettingsCreation extends ObjectCreation {
/** Gets a value set on the `ValidationType` property, if any. */
SystemXmlValidationType getValidationType() {
result.getAnAccess() = this
.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationTypeProperty())
result.getAnAccess() =
this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationTypeProperty())
}
/** Gets a flag set on the `ValidationFlags` property, if any. */
SystemXmlSchemaXmlSchemaValidationFlags getAValidationFlag() {
result.getAnAccess() = this
.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationFlagsProperty())
result.getAnAccess() =
this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationFlagsProperty())
}
/** Gets a value set for the given property in this local context. */

3
csharp/ql/src/semmle/code/csharp/frameworks/system/linq/Expressions.qll
View File

@@ -35,7 +35,8 @@ module SystemLinqExpressions {
DelegateExtType() {
this = dt
or
this = any(csharp::ConstructedClass cc |
this =
any(csharp::ConstructedClass cc |
cc.getUnboundGeneric() instanceof ExpressionDelegate and
dt = cc.getTypeArgument(0)
)

6
csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
View File

@@ -252,7 +252,8 @@ module IRTypeSanity {
query predicate multipleCanonicalLanguageTypes(IRType type, string message) {
strictcount(type.getCanonicalLanguageType()) > 1 and
message = "Type has multiple canonical `LanguageType`s: " +
message =
"Type has multiple canonical `LanguageType`s: " +
concat(type.getCanonicalLanguageType().toString(), ", ")
}
@@ -263,7 +264,8 @@ module IRTypeSanity {
query predicate multipleIRTypes(Language::LanguageType type, string message) {
strictcount(type.getIRType()) > 1 and
message = "`LanguageType` " + type.getAQlClass() + " has multiple `IRType`s: " +
message =
"`LanguageType` " + type.getAQlClass() + " has multiple `IRType`s: " +
concat(type.getIRType().toString(), ", ")
}

3
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRBlock.qll
View File

@@ -27,7 +27,8 @@ class IRBlockBase extends TIRBlock {
* by debugging and printing code only.
*/
int getDisplayIndex() {
this = rank[result + 1](IRBlock funcBlock |
this =
rank[result + 1](IRBlock funcBlock |
funcBlock.getEnclosingFunction() = getEnclosingFunction()
|
funcBlock order by funcBlock.getUniqueId()

3
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll
View File

@@ -161,7 +161,8 @@ class IRGeneratedVariable extends IRVariable {
override string getUniqueId() { none() }
final string getLocationString() {
result = ast.getLocation().getStartLine().toString() + ":" +
result =
ast.getLocation().getStartLine().toString() + ":" +
ast.getLocation().getStartColumn().toString()
}

38
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
View File

@@ -21,7 +21,8 @@ module InstructionSanity {
operand = instr.getAnOperand() and
operand.getOperandTag() = tag
) and
message = "Instruction '" + instr.getOpcode().toString() +
message =
"Instruction '" + instr.getOpcode().toString() +
"' is missing an expected operand with tag '" + tag.toString() + "' in function '$@'." and
func = instr.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -51,13 +52,15 @@ module InstructionSanity {
Instruction instr, string message, IRFunction func, string funcText
) {
exists(OperandTag tag, int operandCount |
operandCount = strictcount(NonPhiOperand operand |
operandCount =
strictcount(NonPhiOperand operand |
operand = instr.getAnOperand() and
operand.getOperandTag() = tag
) and
operandCount > 1 and
not tag instanceof UnmodeledUseOperandTag and
message = "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
message =
"Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
" in function '$@'." and
func = instr.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -81,8 +84,9 @@ module InstructionSanity {
not exists(operand.getType()) and
use = operand.getUse() and
func = use.getEnclosingFunction() and
message = "Operand '" + operand.toString() + "' of instruction '" + use.getOpcode().toString()
+ "' missing type in function '" + Language::getIdentityString(func) + "'."
message =
"Operand '" + operand.toString() + "' of instruction '" + use.getOpcode().toString() +
"' missing type in function '" + Language::getIdentityString(func) + "'."
)
}
@@ -90,7 +94,8 @@ module InstructionSanity {
ChiInstruction chi, string message, IRFunction func, string funcText
) {
chi.getTotal() = chi.getPartial() and
message = "Chi instruction for " + chi.getPartial().toString() +
message =
"Chi instruction for " + chi.getPartial().toString() +
" has duplicate operands in function $@" and
func = chi.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -204,10 +209,12 @@ module InstructionSanity {
* and the `IRBlock` graph.
*/
query predicate backEdgeCountMismatch(Language::Function f, int fromInstr, int fromBlock) {
fromInstr = count(Instruction i1, Instruction i2 |
fromInstr =
count(Instruction i1, Instruction i2 |
i1.getEnclosingFunction() = f and i1.getBackEdgeSuccessor(_) = i2
) and
fromBlock = count(IRBlock b1, IRBlock b2 |
fromBlock =
count(IRBlock b1, IRBlock b2 |
b1.getEnclosingFunction() = f and b1.getBackEdgeSuccessor(_) = b2
) and
fromInstr != fromBlock
@@ -252,7 +259,8 @@ module InstructionSanity {
defBlock = useBlock and
defIndex < useIndex
) and
message = "Operand '" + useOperand.toString() +
message =
"Operand '" + useOperand.toString() +
"' is not dominated by its definition in function '$@'." and
func = useOperand.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -327,7 +335,8 @@ class Instruction extends Construction::TInstruction {
exists(IRBlock block |
this = block.getInstruction(result)
or
this = rank[-result - 1](PhiInstruction phiInstr |
this =
rank[-result - 1](PhiInstruction phiInstr |
phiInstr = block.getAPhiInstruction()
|
phiInstr order by phiInstr.getUniqueId()
@@ -336,8 +345,10 @@ class Instruction extends Construction::TInstruction {
}
private int getLineRank() {
this = rank[result](Instruction instr |
instr = getAnInstructionAtLine(getEnclosingIRFunction(), getLocation().getFile(),
this =
rank[result](Instruction instr |
instr =
getAnInstructionAtLine(getEnclosingIRFunction(), getLocation().getFile(),
getLocation().getStartLine())
|
instr order by instr.getBlock().getDisplayIndex(), instr.getDisplayIndexInBlock()
@@ -373,7 +384,8 @@ class Instruction extends Construction::TInstruction {
* Example: `func:r3_4, this:r3_5`
*/
string getOperandsString() {
result = concat(Operand operand |
result =
concat(Operand operand |
operand = getAnOperand()
|
operand.getDumpString(), ", " order by operand.getDumpSortOrder()

19
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/PrintIR.qll
View File

@@ -110,7 +110,8 @@ class PrintableIRFunction extends PrintableIRNode, TPrintableIRFunction {
override string getLabel() { result = Language::getIdentityString(irFunc.getFunction()) }
override int getOrder() {
this = rank[result + 1](PrintableIRFunction orderedFunc, Language::Location location |
this =
rank[result + 1](PrintableIRFunction orderedFunc, Language::Location location |
location = orderedFunc.getIRFunction().getLocation()
|
orderedFunc
@@ -180,7 +181,8 @@ class PrintableInstruction extends PrintableIRNode, TPrintableInstruction {
operationString = instr.getOperationString() and
operandsString = instr.getOperandsString() and
columnWidths(block, resultWidth, operationWidth) and
result = resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
result =
resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
operationString + getPaddingString(operationWidth - operationString.length()) + " : " +
operandsString
)
@@ -201,15 +203,13 @@ class PrintableInstruction extends PrintableIRNode, TPrintableInstruction {
private predicate columnWidths(IRBlock block, int resultWidth, int operationWidth) {
resultWidth = max(Instruction instr | instr.getBlock() = block | instr.getResultString().length()) and
operationWidth = max(Instruction instr |
instr.getBlock() = block
|
instr.getOperationString().length()
)
operationWidth =
max(Instruction instr | instr.getBlock() = block | instr.getOperationString().length())
}
private int maxColumnWidth() {
result = max(Instruction instr, int width |
result =
max(Instruction instr, int width |
width = instr.getResultString().length() or
width = instr.getOperationString().length() or
width = instr.getOperandsString().length()
@@ -229,7 +229,8 @@ query predicate nodes(PrintableIRNode node, string key, string value) {
}
private int getSuccessorIndex(IRBlock pred, IRBlock succ) {
succ = rank[result + 1](IRBlock aSucc, EdgeKind kind |
succ =
rank[result + 1](IRBlock aSucc, EdgeKind kind |
aSucc = pred.getSuccessor(kind)
|
aSucc order by kind.toString()

7
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/ValueNumbering.qll
View File

@@ -73,7 +73,8 @@ class ValueNumber extends TValueNumber {
* deterministic but arbitrary. Intended for use only in debugging.
*/
final Instruction getExampleInstruction() {
result = min(Instruction instr |
result =
min(Instruction instr |
instr = getAnInstruction()
|
instr order by instr.getBlock().getDisplayIndex(), instr.getDisplayIndexInBlock()
@@ -308,8 +309,8 @@ private ValueNumber nonUniqueValueNumber(Instruction instr) {
|
pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
rightOperand) and
result = TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand,
rightOperand)
result =
TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
)
or
// The value number of a copy is just the value number of its source value.

27
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRConstruction.qll
View File

@@ -82,7 +82,8 @@ private module Cached {
cached
Instruction getRegisterOperandDefinition(Instruction instruction, RegisterOperandTag tag) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionOperand(getInstructionTag(instruction), tag)
}
@@ -91,7 +92,8 @@ private module Cached {
Instruction instruction, MemoryOperandTag tag, Overlap overlap
) {
overlap instanceof MustTotallyOverlap and
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionOperand(getInstructionTag(instruction), tag)
}
@@ -125,7 +127,8 @@ private module Cached {
if instruction instanceof LoadInstruction
then result = instruction.(LoadInstruction).getResultLanguageType()
else
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionOperandType(getInstructionTag(instruction), tag)
}
@@ -141,7 +144,8 @@ private module Cached {
cached
Instruction getInstructionSuccessor(Instruction instruction, EdgeKind kind) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionSuccessor(getInstructionTag(instruction), kind)
}
@@ -284,7 +288,8 @@ private module Cached {
cached
ArrayAccess getInstructionArrayAccess(Instruction instruction) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionArrayAccess(getInstructionTag(instruction))
}
@@ -293,19 +298,22 @@ private module Cached {
cached
Callable getInstructionFunction(Instruction instruction) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionFunction(getInstructionTag(instruction))
}
cached
string getInstructionConstantValue(Instruction instruction) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionConstantValue(getInstructionTag(instruction))
}
cached
CSharpType getInstructionExceptionType(Instruction instruction) {
result = getInstructionTranslatedElement(instruction)
result =
getInstructionTranslatedElement(instruction)
.getInstructionExceptionType(getInstructionTag(instruction))
}
@@ -365,7 +373,8 @@ private module CachedForDebugging {
cached
string getInstructionUniqueId(Instruction instruction) {
result = getInstructionTranslatedElement(instruction).getId() + ":" +
result =
getInstructionTranslatedElement(instruction).getId() + ":" +
getInstructionTagId(getInstructionTag(instruction))
}
}

10
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/TranslatedElement.qll
View File

@@ -226,7 +226,8 @@ private predicate ignoreLoad(Expr expr) {
// ignore the load since the address of a variable that is a value type is
// given by a single `VariableAddress` instruction.
expr = any(FieldAccess fa).getQualifier() and
expr = any(VariableAccess va |
expr =
any(VariableAccess va |
va.getType().isValueType() and
not va.getTarget() = any(Parameter p | p.isOutOrRef() or p.isIn())
)
@@ -378,7 +379,8 @@ abstract class TranslatedElement extends TTranslatedElement {
final string getId() { result = this.getUniqueId().toString() }
private TranslatedElement getChildByRank(int rankIndex) {
result = rank[rankIndex + 1](TranslatedElement child, int id |
result =
rank[rankIndex + 1](TranslatedElement child, int id |
child = this.getChild(id)
|
child order by id
@@ -387,8 +389,8 @@ abstract class TranslatedElement extends TTranslatedElement {
language[monotonicAggregates]
private int getDescendantCount() {
result = 1 +
sum(TranslatedElement child | child = this.getChildByRank(_) | child.getDescendantCount())
result =
1 + sum(TranslatedElement child | child = this.getChildByRank(_) | child.getDescendantCount())
}
private int getUniqueId() {

3
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/TranslatedInitialization.qll
View File

@@ -108,7 +108,8 @@ class TranslatedArrayListInitialization extends TranslatedListInitialization {
override TranslatedElement getChild(int id) {
// The children are in initialization order
result = rank[id + 1](TranslatedElementInitialization init |
result =
rank[id + 1](TranslatedElementInitialization init |
init.getInitList() = expr
|
init order by init.getElementIndex()

4
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/TranslatedStmt.qll
View File

@@ -458,8 +458,8 @@ class TranslatedThrowExceptionStmt extends TranslatedStmt, InitializationContext
result = this.getInstruction(InitializerVariableAddressTag())
or
operandTag instanceof LoadOperandTag and
result = getTranslatedFunction(stmt.getEnclosingCallable())
.getUnmodeledDefinitionInstruction()
result =
getTranslatedFunction(stmt.getEnclosingCallable()).getUnmodeledDefinitionInstruction()
)
}

3
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/desugar/Foreach.qll
View File

@@ -211,7 +211,8 @@ private class TranslatedForeachGetEnumerator extends TranslatedCompilerGenerated
result = generatedBy.getIterableExpr().getType().(ValueOrRefType).getAMember("GetEnumerator")
else
exists(Interface inter |
inter = generatedBy
inter =
generatedBy
.getIterableExpr()
.getType()
.(ValueOrRefType)

3
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/reachability/PrintDominance.qll
View File

@@ -12,7 +12,8 @@ private class DominancePropertyProvider extends IRPropertyProvider {
)
or
key = "DominanceFrontier" and
result = strictconcat(IRBlock frontierBlock |
result =
strictconcat(IRBlock frontierBlock |
frontierBlock = getDominanceFrontier(block)
|
frontierBlock.getDisplayIndex().toString(), ", " order by frontierBlock.getDisplayIndex()

3
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRBlock.qll
View File

@@ -27,7 +27,8 @@ class IRBlockBase extends TIRBlock {
* by debugging and printing code only.
*/
int getDisplayIndex() {
this = rank[result + 1](IRBlock funcBlock |
this =
rank[result + 1](IRBlock funcBlock |
funcBlock.getEnclosingFunction() = getEnclosingFunction()
|
funcBlock order by funcBlock.getUniqueId()

3
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll
View File

@@ -161,7 +161,8 @@ class IRGeneratedVariable extends IRVariable {
override string getUniqueId() { none() }
final string getLocationString() {
result = ast.getLocation().getStartLine().toString() + ":" +
result =
ast.getLocation().getStartLine().toString() + ":" +
ast.getLocation().getStartColumn().toString()
}

38
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
View File

@@ -21,7 +21,8 @@ module InstructionSanity {
operand = instr.getAnOperand() and
operand.getOperandTag() = tag
) and
message = "Instruction '" + instr.getOpcode().toString() +
message =
"Instruction '" + instr.getOpcode().toString() +
"' is missing an expected operand with tag '" + tag.toString() + "' in function '$@'." and
func = instr.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -51,13 +52,15 @@ module InstructionSanity {
Instruction instr, string message, IRFunction func, string funcText
) {
exists(OperandTag tag, int operandCount |
operandCount = strictcount(NonPhiOperand operand |
operandCount =
strictcount(NonPhiOperand operand |
operand = instr.getAnOperand() and
operand.getOperandTag() = tag
) and
operandCount > 1 and
not tag instanceof UnmodeledUseOperandTag and
message = "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
message =
"Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
" in function '$@'." and
func = instr.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -81,8 +84,9 @@ module InstructionSanity {
not exists(operand.getType()) and
use = operand.getUse() and
func = use.getEnclosingFunction() and
message = "Operand '" + operand.toString() + "' of instruction '" + use.getOpcode().toString()
+ "' missing type in function '" + Language::getIdentityString(func) + "'."
message =
"Operand '" + operand.toString() + "' of instruction '" + use.getOpcode().toString() +
"' missing type in function '" + Language::getIdentityString(func) + "'."
)
}
@@ -90,7 +94,8 @@ module InstructionSanity {
ChiInstruction chi, string message, IRFunction func, string funcText
) {
chi.getTotal() = chi.getPartial() and
message = "Chi instruction for " + chi.getPartial().toString() +
message =
"Chi instruction for " + chi.getPartial().toString() +
" has duplicate operands in function $@" and
func = chi.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -204,10 +209,12 @@ module InstructionSanity {
* and the `IRBlock` graph.
*/
query predicate backEdgeCountMismatch(Language::Function f, int fromInstr, int fromBlock) {
fromInstr = count(Instruction i1, Instruction i2 |
fromInstr =
count(Instruction i1, Instruction i2 |
i1.getEnclosingFunction() = f and i1.getBackEdgeSuccessor(_) = i2
) and
fromBlock = count(IRBlock b1, IRBlock b2 |
fromBlock =
count(IRBlock b1, IRBlock b2 |
b1.getEnclosingFunction() = f and b1.getBackEdgeSuccessor(_) = b2
) and
fromInstr != fromBlock
@@ -252,7 +259,8 @@ module InstructionSanity {
defBlock = useBlock and
defIndex < useIndex
) and
message = "Operand '" + useOperand.toString() +
message =
"Operand '" + useOperand.toString() +
"' is not dominated by its definition in function '$@'." and
func = useOperand.getEnclosingIRFunction() and
funcText = Language::getIdentityString(func.getFunction())
@@ -327,7 +335,8 @@ class Instruction extends Construction::TInstruction {
exists(IRBlock block |
this = block.getInstruction(result)
or
this = rank[-result - 1](PhiInstruction phiInstr |
this =
rank[-result - 1](PhiInstruction phiInstr |
phiInstr = block.getAPhiInstruction()
|
phiInstr order by phiInstr.getUniqueId()
@@ -336,8 +345,10 @@ class Instruction extends Construction::TInstruction {
}
private int getLineRank() {
this = rank[result](Instruction instr |
instr = getAnInstructionAtLine(getEnclosingIRFunction(), getLocation().getFile(),
this =
rank[result](Instruction instr |
instr =
getAnInstructionAtLine(getEnclosingIRFunction(), getLocation().getFile(),
getLocation().getStartLine())
|
instr order by instr.getBlock().getDisplayIndex(), instr.getDisplayIndexInBlock()
@@ -373,7 +384,8 @@ class Instruction extends Construction::TInstruction {
* Example: `func:r3_4, this:r3_5`
*/
string getOperandsString() {
result = concat(Operand operand |
result =
concat(Operand operand |
operand = getAnOperand()
|
operand.getDumpString(), ", " order by operand.getDumpSortOrder()

19
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/PrintIR.qll
View File

@@ -110,7 +110,8 @@ class PrintableIRFunction extends PrintableIRNode, TPrintableIRFunction {
override string getLabel() { result = Language::getIdentityString(irFunc.getFunction()) }
override int getOrder() {
this = rank[result + 1](PrintableIRFunction orderedFunc, Language::Location location |
this =
rank[result + 1](PrintableIRFunction orderedFunc, Language::Location location |
location = orderedFunc.getIRFunction().getLocation()
|
orderedFunc
@@ -180,7 +181,8 @@ class PrintableInstruction extends PrintableIRNode, TPrintableInstruction {
operationString = instr.getOperationString() and
operandsString = instr.getOperandsString() and
columnWidths(block, resultWidth, operationWidth) and
result = resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
result =
resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
operationString + getPaddingString(operationWidth - operationString.length()) + " : " +
operandsString
)
@@ -201,15 +203,13 @@ class PrintableInstruction extends PrintableIRNode, TPrintableInstruction {
private predicate columnWidths(IRBlock block, int resultWidth, int operationWidth) {
resultWidth = max(Instruction instr | instr.getBlock() = block | instr.getResultString().length()) and
operationWidth = max(Instruction instr |
instr.getBlock() = block
|
instr.getOperationString().length()
)
operationWidth =
max(Instruction instr | instr.getBlock() = block | instr.getOperationString().length())
}
private int maxColumnWidth() {
result = max(Instruction instr, int width |
result =
max(Instruction instr, int width |
width = instr.getResultString().length() or
width = instr.getOperationString().length() or
width = instr.getOperandsString().length()
@@ -229,7 +229,8 @@ query predicate nodes(PrintableIRNode node, string key, string value) {
}
private int getSuccessorIndex(IRBlock pred, IRBlock succ) {
succ = rank[result + 1](IRBlock aSucc, EdgeKind kind |
succ =
rank[result + 1](IRBlock aSucc, EdgeKind kind |
aSucc = pred.getSuccessor(kind)
|
aSucc order by kind.toString()

7
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll
View File

@@ -73,7 +73,8 @@ class ValueNumber extends TValueNumber {
* deterministic but arbitrary. Intended for use only in debugging.
*/
final Instruction getExampleInstruction() {
result = min(Instruction instr |
result =
min(Instruction instr |
instr = getAnInstruction()
|
instr order by instr.getBlock().getDisplayIndex(), instr.getDisplayIndexInBlock()
@@ -308,8 +309,8 @@ private ValueNumber nonUniqueValueNumber(Instruction instr) {
|
pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
rightOperand) and
result = TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand,
rightOperand)
result =
TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
)
or
// The value number of a copy is just the value number of its source value.

4
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
View File

@@ -228,8 +228,8 @@ private predicate isArgumentForParameter(CallInstruction ci, Operand operand, In
ci = operand.getUse() and
c = ci.getStaticCallTarget() and
(
init.(InitializeParameterInstruction).getParameter() = c
.getParameter(operand.(PositionalArgumentOperand).getIndex())
init.(InitializeParameterInstruction).getParameter() =
c.getParameter(operand.(PositionalArgumentOperand).getIndex())
or
init instanceof InitializeThisInstruction and
init.getEnclosingFunction() = c and

43
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll
View File

@@ -19,28 +19,32 @@ private int getIndexForOffset(int offset) { result = offset / 2 }
class PropertyProvider extends IRPropertyProvider {
override string getInstructionProperty(Instruction instruction, string key) {
key = "ResultMemoryLocation" and
result = strictconcat(MemoryLocation loc |
result =
strictconcat(MemoryLocation loc |
loc = getResultMemoryLocation(instruction)
|
loc.toString(), ","
)
or
key = "ResultVirtualVariable" and
result = strictconcat(MemoryLocation loc |
result =
strictconcat(MemoryLocation loc |
loc = getResultMemoryLocation(instruction)
|
loc.getVirtualVariable().toString(), ","
)
or
key = "OperandMemoryLocation" and
result = strictconcat(MemoryLocation loc |
result =
strictconcat(MemoryLocation loc |
loc = getOperandMemoryLocation(instruction.getAnOperand())
|
loc.toString(), ","
)
or
key = "OperandVirtualVariable" and
result = strictconcat(MemoryLocation loc |
result =
strictconcat(MemoryLocation loc |
loc = getOperandMemoryLocation(instruction.getAnOperand())
|
loc.getVirtualVariable().toString(), ","
@@ -62,9 +66,11 @@ class PropertyProvider extends IRPropertyProvider {
exists(MemoryLocation useLocation, IRBlock defBlock, int defRank, int defOffset |
hasDefinitionAtRank(useLocation, _, defBlock, defRank, defOffset) and
defBlock.getInstruction(getIndexForOffset(defOffset)) = instruction and
key = "DefinitionReachesUse" + getKeySuffixForOffset(defOffset) + "[" + useLocation.toString()
+ "]" and
result = strictconcat(IRBlock useBlock, int useRank, int useIndex |
key =
"DefinitionReachesUse" + getKeySuffixForOffset(defOffset) + "[" + useLocation.toString() +
"]" and
result =
strictconcat(IRBlock useBlock, int useRank, int useIndex |
exists(Instruction useInstruction |
hasUseAtRank(useLocation, useBlock, useRank, useInstruction) and
useBlock.getInstruction(useIndex) = useInstruction and
@@ -90,7 +96,8 @@ class PropertyProvider extends IRPropertyProvider {
hasDefinitionAtRank(useLocation, defLocation, block, defRank, defIndex) and
defIndex = -1 and
key = "DefinitionReachesUse(Phi)[" + useLocation.toString() + "]" and
result = strictconcat(IRBlock useBlock, int useRank, int useIndex |
result =
strictconcat(IRBlock useBlock, int useRank, int useIndex |
exists(Instruction useInstruction |
hasUseAtRank(useLocation, useBlock, useRank, useInstruction) and
useBlock.getInstruction(useIndex) = useInstruction and
@@ -108,35 +115,39 @@ class PropertyProvider extends IRPropertyProvider {
MemoryLocation useLocation, IRBlock predBlock, IRBlock defBlock, int defIndex, Overlap overlap
|
hasPhiOperandDefinition(_, useLocation, block, predBlock, defBlock, defIndex) and
key = "PhiUse[" + useLocation.toString() + " from " + predBlock.getDisplayIndex().toString() +
"]" and
result = defBlock.getDisplayIndex().toString() + "_" + defIndex + " (" + overlap.toString() +
")"
key =
"PhiUse[" + useLocation.toString() + " from " + predBlock.getDisplayIndex().toString() + "]" and
result =
defBlock.getDisplayIndex().toString() + "_" + defIndex + " (" + overlap.toString() + ")"
)
or
key = "LiveOnEntry" and
result = strictconcat(MemoryLocation useLocation |
result =
strictconcat(MemoryLocation useLocation |
locationLiveOnEntryToBlock(useLocation, block)
|
useLocation.toString(), ", " order by useLocation.toString()
)
or
key = "LiveOnExit" and
result = strictconcat(MemoryLocation useLocation |
result =
strictconcat(MemoryLocation useLocation |
locationLiveOnExitFromBlock(useLocation, block)
|
useLocation.toString(), ", " order by useLocation.toString()
)
or
key = "DefsLiveOnEntry" and
result = strictconcat(MemoryLocation defLocation |
result =
strictconcat(MemoryLocation defLocation |
definitionLiveOnEntryToBlock(defLocation, block)
|
defLocation.toString(), ", " order by defLocation.toString()
)
or
key = "DefsLiveOnExit" and
result = strictconcat(MemoryLocation defLocation |
result =
strictconcat(MemoryLocation defLocation |
definitionLiveOnExitFromBlock(defLocation, block)
|
defLocation.toString(), ", " order by defLocation.toString()

23
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
View File

@@ -334,9 +334,8 @@ private module Cached {
cached
IRVariable getInstructionVariable(Instruction instruction) {
result = getNewIRVariable(getOldInstruction(instruction)
.(OldIR::VariableInstruction)
.getIRVariable())
result =
getNewIRVariable(getOldInstruction(instruction).(OldIR::VariableInstruction).getIRVariable())
}
cached
@@ -361,9 +360,8 @@ private module Cached {
cached
Language::BuiltInOperation getInstructionBuiltInOperation(Instruction instruction) {
result = getOldInstruction(instruction)
.(OldIR::BuiltInOperationInstruction)
.getBuiltInOperation()
result =
getOldInstruction(instruction).(OldIR::BuiltInOperationInstruction).getBuiltInOperation()
}
cached
@@ -527,7 +525,8 @@ private module PhiInsertion {
predicate definitionLiveOnEntryToBlock(Alias::MemoryLocation defLocation, OldBlock block) {
exists(int firstAccess |
definitionHasUse(defLocation, block, firstAccess) and
firstAccess = min(int index |
firstAccess =
min(int index |
definitionHasUse(defLocation, block, index)
or
definitionHasRedefinition(defLocation, block, index)
@@ -709,7 +708,8 @@ module DefUse {
or
exists(int firstAccess |
hasUse(useLocation, block, firstAccess, _) and
firstAccess = min(int offset |
firstAccess =
min(int offset |
hasUse(useLocation, block, offset, _)
or
hasNonPhiDefinition(useLocation, _, block, offset)
@@ -817,7 +817,8 @@ module DefUse {
private predicate defUseRank(
Alias::MemoryLocation useLocation, OldBlock block, int rankIndex, int offset
) {
offset = rank[rankIndex](int j |
offset =
rank[rankIndex](int j |
hasDefinition(useLocation, _, block, j) or hasUse(useLocation, block, j, _)
)
}
@@ -868,8 +869,8 @@ private module CachedForDebugging {
or
exists(Alias::MemoryLocation location, OldBlock phiBlock, string specificity |
instr = Phi(phiBlock, location) and
result = "Phi Block(" + phiBlock.getUniqueId() + ")[" + specificity + "]: " +
location.getUniqueId() and
result =
"Phi Block(" + phiBlock.getUniqueId() + ")[" + specificity + "]: " + location.getUniqueId() and
if location instanceof Alias::VirtualVariable
then
// Sort Phi nodes for virtual variables before Phi nodes for member locations.

3
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll
View File

@@ -12,7 +12,8 @@ private class DominancePropertyProvider extends IRPropertyProvider {
)
or
key = "DominanceFrontier" and
result = strictconcat(IRBlock frontierBlock |
result =
strictconcat(IRBlock frontierBlock |
frontierBlock = getDominanceFrontier(block)
|
frontierBlock.getDisplayIndex().toString(), ", " order by frontierBlock.getDisplayIndex()

Some files were not shown because too many files have changed in this diff Show More