diff --git a/powershell/ql/lib/semmle/code/powershell/ExpandableStringExpression.qll b/powershell/ql/lib/semmle/code/powershell/ExpandableStringExpression.qll index c35e406b7c4..fa3a8a77ba2 100644 --- a/powershell/ql/lib/semmle/code/powershell/ExpandableStringExpression.qll +++ b/powershell/ql/lib/semmle/code/powershell/ExpandableStringExpression.qll @@ -7,8 +7,6 @@ class ExpandableStringExpr extends @expandable_string_expression, Expr { StringLiteral getUnexpandedValue() { expandable_string_expression(this, result, _, _) } - private int getKind() { expandable_string_expression(this, _, result, _) } - int getNumExprs() { result = count(this.getAnExpr()) } Expr getExpr(int i) { expandable_string_expression_nested_expression(this, i, result) } diff --git a/powershell/ql/lib/semmle/code/powershell/controlflow/internal/Completion.qll b/powershell/ql/lib/semmle/code/powershell/controlflow/internal/Completion.qll index d37d566ea0d..9fe03123793 100644 --- a/powershell/ql/lib/semmle/code/powershell/controlflow/internal/Completion.qll +++ b/powershell/ql/lib/semmle/code/powershell/controlflow/internal/Completion.qll @@ -96,12 +96,16 @@ abstract class Completion extends TCompletion { /** Holds if node `n` has the Boolean constant value `value`. */ private predicate isBooleanConstant(Ast n, boolean value) { mustHaveBooleanCompletion(n) and - none() // TODO + // TODO + exists(value) and + none() } private predicate isMatchingConstant(Ast n, boolean value) { inMatchingContext(n) and - none() // TODO + // TODO + exists(value) and + none() } /** diff --git a/powershell/ql/src/experimental/CommandInjection.ql b/powershell/ql/src/experimental/CommandInjection.ql index e32f5aedd71..c7bc85dbcce 100644 --- a/powershell/ql/src/experimental/CommandInjection.ql +++ b/powershell/ql/src/experimental/CommandInjection.ql @@ -24,7 +24,7 @@ predicate constantBinaryExpression(BinaryExpr binary) { } predicate onlyConstantExpressions(Expr expr){ - expr instanceof StringConstExpression or constantBinaryExpression(expr) or constantTernaryExpression(expr) + expr instanceof StringConstExpr or constantBinaryExpression(expr) or constantTernaryExpression(expr) } VarAccess getNonConstantVariableAssignment(VarAccess varexpr) { @@ -39,7 +39,7 @@ VarAccess getNonConstantVariableAssignment(VarAccess varexpr) { VarAccess getParameterWithVariableScope(VarAccess varexpr) { exists(Parameter parameter | - result = parameter.getName() and + result = parameter.getAnAccess() and containsScope(result, varexpr) ) } @@ -48,16 +48,16 @@ Expr getAllSubExpressions(Expr expr) { result = expr or result = getAllSubExpressions(expr.(ArrayLiteral).getAnElement()) or - result = getAllSubExpressions(expr.(ArrayExpr).getStatementBlock().getAStatement().(Pipeline).getAComponent().(CmdExpr).getExpr()) + result = getAllSubExpressions(expr.(ArrayExpr).getStmtBlock().getAStmt().(Pipeline).getAComponent().(CmdExpr).getExpr()) } Expr dangerousCommandElement(Cmd command) { ( command.getKind() = 28 or - command.getName() = "Invoke-Expression" + command.getCommandName() = "Invoke-Expression" ) and - result = getAllSubExpressions(command.getAnElement()) + result = getAllSubExpressions(command.getAnArgument()) } from Expr commandarg, VarAccess unknownDeclaration