hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into felicitymay-10250-swift

Browse Source
This commit is contained in:
Felicity Chapman
2023-05-10 19:01:35 +01:00
committed by GitHub
parent 6283ffc1bb 100d960ca9
commit f72fe3ec44
59 changed files with 1356 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cpp/ql/lib/qlpack.yml
View File

@@ -9,3 +9,4 @@ dependencies:
codeql/ssa: ${workspace}
codeql/tutorial: ${workspace}
codeql/util: ${workspace}
warnOnImplicitThis: true

6
cpp/ql/lib/semmle/code/cpp/controlflow/StackVariableReachability.qll
View File

@@ -25,7 +25,7 @@ import cpp
*/
abstract class StackVariableReachability extends string {
bindingset[this]
StackVariableReachability() { length() >= 0 }
StackVariableReachability() { this.length() >= 0 }
/** Holds if `node` is a source for the reachability analysis using variable `v`. */
abstract predicate isSource(ControlFlowNode node, StackVariable v);
@@ -227,7 +227,7 @@ predicate bbSuccessorEntryReachesLoopInvariant(
*/
abstract class StackVariableReachabilityWithReassignment extends StackVariableReachability {
bindingset[this]
StackVariableReachabilityWithReassignment() { length() >= 0 }
StackVariableReachabilityWithReassignment() { this.length() >= 0 }
/** Override this predicate rather than `isSource` (`isSource` is used internally). */
abstract predicate isSourceActual(ControlFlowNode node, StackVariable v);
@@ -330,7 +330,7 @@ abstract class StackVariableReachabilityWithReassignment extends StackVariableRe
*/
abstract class StackVariableReachabilityExt extends string {
bindingset[this]
StackVariableReachabilityExt() { length() >= 0 }
StackVariableReachabilityExt() { this.length() >= 0 }
/** `node` is a source for the reachability analysis using variable `v`. */
abstract predicate isSource(ControlFlowNode node, StackVariable v);

192
cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll
View File

@@ -206,7 +206,34 @@ private predicate deconstructSizeExpr(Expr sizeExpr, Expr lengthExpr, int sizeof
}
/** A `Function` that is a call target of an allocation. */
private signature class CallAllocationExprTarget extends Function;
private signature class CallAllocationExprTarget extends Function {
/**
* Gets the index of the input pointer argument to be reallocated, if
* this is a `realloc` function.
*/
int getReallocPtrArg();
/**
* Gets the index of the argument for the allocation size, if any. The actual
* allocation size is the value of this argument multiplied by the result of
* `getSizeMult()`, in bytes.
*/
int getSizeArg();
/**
* Gets the index of an argument that multiplies the allocation size given
* by `getSizeArg`, if any.
*/
int getSizeMult();
/**
* Holds if this allocation requires a
* corresponding deallocation of some sort (most do, but `alloca` for example
* does not). If it is unclear, we default to no (for example a placement `new`
* allocation may or may not require a corresponding `delete`).
*/
predicate requiresDealloc();
}
/**
* This module abstracts over the type of allocation call-targets and provides a
@@ -220,118 +247,68 @@ private signature class CallAllocationExprTarget extends Function;
* function using various heuristics.
*/
private module CallAllocationExprBase<CallAllocationExprTarget Target> {
/** A module that contains the collection of member-predicates required on `Target`. */
signature module Param {
/**
* Gets the index of the input pointer argument to be reallocated, if
* this is a `realloc` function.
*/
int getReallocPtrArg(Target target);
/**
* Gets the index of the argument for the allocation size, if any. The actual
* allocation size is the value of this argument multiplied by the result of
* `getSizeMult()`, in bytes.
*/
int getSizeArg(Target target);
/**
* Gets the index of an argument that multiplies the allocation size given
* by `getSizeArg`, if any.
*/
int getSizeMult(Target target);
/**
* Holds if this allocation requires a
* corresponding deallocation of some sort (most do, but `alloca` for example
* does not). If it is unclear, we default to no (for example a placement `new`
* allocation may or may not require a corresponding `delete`).
*/
predicate requiresDealloc(Target target);
}
/**
* A module that abstracts over a collection of predicates in
* the `Param` module). This should really be member-predicates
* on `CallAllocationExprTarget`, but we cannot yet write this in QL.
* An allocation expression that is a function call, such as call to `malloc`.
*/
module With<Param P> {
private import P
class CallAllocationExprImpl instanceof FunctionCall {
Target target;
/**
* An allocation expression that is a function call, such as call to `malloc`.
*/
class CallAllocationExprImpl instanceof FunctionCall {
Target target;
CallAllocationExprImpl() {
target = this.getTarget() and
// realloc(ptr, 0) only frees the pointer
not (
exists(getReallocPtrArg(target)) and
this.getArgument(getSizeArg(target)).getValue().toInt() = 0
) and
// these are modeled directly (and more accurately), avoid duplication
not exists(NewOrNewArrayExpr new | new.getAllocatorCall() = this)
}
string toString() { result = super.toString() }
Expr getSizeExprImpl() {
exists(Expr sizeExpr | sizeExpr = super.getArgument(getSizeArg(target)) |
if exists(getSizeMult(target))
then result = sizeExpr
else
exists(Expr lengthExpr |
deconstructSizeExpr(sizeExpr, lengthExpr, _) and
result = lengthExpr
)
)
}
int getSizeMultImpl() {
// malloc with multiplier argument that is a constant
result = super.getArgument(getSizeMult(target)).getValue().toInt()
or
// malloc with no multiplier argument
not exists(getSizeMult(target)) and
deconstructSizeExpr(super.getArgument(getSizeArg(target)), _, result)
}
int getSizeBytesImpl() {
result = this.getSizeExprImpl().getValue().toInt() * this.getSizeMultImpl()
}
Expr getReallocPtrImpl() { result = super.getArgument(getReallocPtrArg(target)) }
Type getAllocatedElementTypeImpl() {
result =
super.getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType() and
not result instanceof VoidType
}
predicate requiresDeallocImpl() { requiresDealloc(target) }
CallAllocationExprImpl() {
target = this.getTarget() and
// realloc(ptr, 0) only frees the pointer
not (
exists(target.getReallocPtrArg()) and
this.getArgument(target.getSizeArg()).getValue().toInt() = 0
) and
// these are modeled directly (and more accurately), avoid duplication
not exists(NewOrNewArrayExpr new | new.getAllocatorCall() = this)
}
string toString() { result = super.toString() }
Expr getSizeExprImpl() {
exists(Expr sizeExpr | sizeExpr = super.getArgument(target.getSizeArg()) |
if exists(target.getSizeMult())
then result = sizeExpr
else
exists(Expr lengthExpr |
deconstructSizeExpr(sizeExpr, lengthExpr, _) and
result = lengthExpr
)
)
}
int getSizeMultImpl() {
// malloc with multiplier argument that is a constant
result = super.getArgument(target.getSizeMult()).getValue().toInt()
or
// malloc with no multiplier argument
not exists(target.getSizeMult()) and
deconstructSizeExpr(super.getArgument(target.getSizeArg()), _, result)
}
int getSizeBytesImpl() {
result = this.getSizeExprImpl().getValue().toInt() * this.getSizeMultImpl()
}
Expr getReallocPtrImpl() { result = super.getArgument(target.getReallocPtrArg()) }
Type getAllocatedElementTypeImpl() {
result =
super.getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType() and
not result instanceof VoidType
}
predicate requiresDeallocImpl() { target.requiresDealloc() }
}
}
private module CallAllocationExpr {
private module Param implements CallAllocationExprBase<AllocationFunction>::Param {
int getReallocPtrArg(AllocationFunction f) { result = f.getReallocPtrArg() }
int getSizeArg(AllocationFunction f) { result = f.getSizeArg() }
int getSizeMult(AllocationFunction f) { result = f.getSizeMult() }
predicate requiresDealloc(AllocationFunction f) { f.requiresDealloc() }
}
/**
* A class that provides the implementation of `AllocationExpr` for an allocation
* that calls an `AllocationFunction`.
*/
private class Base =
CallAllocationExprBase<AllocationFunction>::With<Param>::CallAllocationExprImpl;
private class Base = CallAllocationExprBase<AllocationFunction>::CallAllocationExprImpl;
class CallAllocationExpr extends AllocationExpr, Base {
override Expr getSizeExpr() { result = super.getSizeExprImpl() }
@@ -452,22 +429,11 @@ private module HeuristicAllocation {
override predicate requiresDealloc() { none() }
}
private module Param implements CallAllocationExprBase<HeuristicAllocationFunction>::Param {
int getReallocPtrArg(HeuristicAllocationFunction f) { result = f.getReallocPtrArg() }
int getSizeArg(HeuristicAllocationFunction f) { result = f.getSizeArg() }
int getSizeMult(HeuristicAllocationFunction f) { result = f.getSizeMult() }
predicate requiresDealloc(HeuristicAllocationFunction f) { f.requiresDealloc() }
}
/**
* A class that provides the implementation of `AllocationExpr` for an allocation
* that calls an `HeuristicAllocationFunction`.
*/
private class Base =
CallAllocationExprBase<HeuristicAllocationFunction>::With<Param>::CallAllocationExprImpl;
private class Base = CallAllocationExprBase<HeuristicAllocationFunction>::CallAllocationExprImpl;
private class CallAllocationExpr extends HeuristicAllocationExpr, Base {
override Expr getSizeExpr() { result = super.getSizeExprImpl() }

2
cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisStage.qll
View File

@@ -277,7 +277,7 @@ module RangeStage<
*/
private class SafeCastExpr extends ConvertOrBoxExpr {
SafeCastExpr() {
conversionCannotOverflow(getTrackedType(pragma[only_bind_into](getOperand())),
conversionCannotOverflow(getTrackedType(pragma[only_bind_into](this.getOperand())),
pragma[only_bind_out](getTrackedType(this)))
}
}

2
cpp/ql/lib/upgrades/282c13bfdbcbd57a887972b47a471342a4ad5507/member_function_this_type.ql
View File

@@ -24,7 +24,7 @@ class ClassPointerType extends @derivedtype {
Class getBaseType() { derivedtypes(this, _, _, result) }
string toString() { result = getBaseType().toString() + "*" }
string toString() { result = this.getBaseType().toString() + "*" }
}
class DefinedMemberFunction extends @function {

1
cpp/ql/src/qlpack.yml
View File

@@ -10,3 +10,4 @@ dependencies:
suites: codeql-suites
extractor: cpp
defaultSuiteFile: codeql-suites/cpp-code-scanning.qls
warnOnImplicitThis: true

1
cpp/ql/test/qlpack.yml
View File

@@ -5,3 +5,4 @@ dependencies:
codeql/cpp-queries: ${workspace}
extractor: cpp
tests: .
warnOnImplicitThis: true

291
docs/codeql/codeql-language-guides/analyzing-data-flow-in-swift.rst Normal file
View File

@@ -0,0 +1,291 @@
.. _analyzing-data-flow-in-swift:
Analyzing data flow in Swift
============================
You can use CodeQL to track the flow of data through a Swift program to places where the data is used.
.. include:: ../reusables/swift-beta-note.rst
About this article
------------------
This article describes how data flow analysis is implemented in the CodeQL libraries for Swift and includes examples to help you write your own data flow queries.
The following sections describe how to use the libraries for local data flow, global data flow, and taint tracking.
For a more general introduction to modeling data flow, see ":ref:`About data flow analysis <about-data-flow-analysis>`."
Local data flow
---------------
Local data flow tracks the flow of data within a single function. Local data flow is easier, faster, and more precise than global data flow. Before looking at more complex tracking, you should always consider local tracking because it is sufficient for many queries.
Using local data flow
~~~~~~~~~~~~~~~~~~~~~
You can use the local data flow library by importing the ``DataFlow`` module. The library uses the class ``Node`` to represent any element through which data can flow.
The ``Node`` class has a number of useful subclasses, such as ``ExprNode`` for expressions and ``ParameterNode`` for parameters. You can map between data flow nodes and expressions/control-flow nodes using the member predicates ``asExpr`` and ``getCfgNode``:
.. code-block:: ql
class Node {
/**
* Gets the expression that corresponds to this node, if any.
*/
Expr asExpr() { ... }
/**
* Gets the control flow node that corresponds to this data flow node.
*/
ControlFlowNode getCfgNode() { ... }
...
}
You can use the predicates ``exprNode`` and ``parameterNode`` to map from expressions and parameters to their data-flow node:
.. code-block:: ql
/**
* Gets a node corresponding to expression `e`.
*/
ExprNode exprNode(DataFlowExpr e) { result.asExpr() = e }
/**
* Gets the node corresponding to the value of parameter `p` at function entry.
*/
ParameterNode parameterNode(DataFlowParameter p) { result.getParameter() = p }
There can be multiple data-flow nodes associated with a single expression node in the AST.
The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``.
You can apply the predicate recursively, by using the ``+`` and ``*`` operators, or you can use the predefined recursive predicate ``localFlow``.
For example, you can find flow from an expression ``source`` to an expression ``sink`` in zero or more local steps:
.. code-block:: ql
DataFlow::localFlow(DataFlow::exprNode(source), DataFlow::exprNode(sink))
Using local taint tracking
~~~~~~~~~~~~~~~~~~~~~~~~~~
Local taint tracking extends local data flow to include flow steps where values are not preserved, such as string manipulation.
For example:
.. code-block:: swift
temp = x
y = temp + ", " + temp
If ``x`` is a tainted string then ``y`` is also tainted.
The local taint tracking library is in the module ``TaintTracking``.
Like local data flow, a predicate ``localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo)`` holds if there is an immediate taint propagation edge from the node ``nodeFrom`` to the node ``nodeTo``.
You can apply the predicate recursively, by using the ``+`` and ``*`` operators, or you can use the predefined recursive predicate ``localTaint``.
For example, you can find taint propagation from an expression ``source`` to an expression ``sink`` in zero or more local steps:
.. code-block:: ql
TaintTracking::localTaint(DataFlow::exprNode(source), DataFlow::exprNode(sink))
Examples of local data flow
~~~~~~~~~~~~~~~~~~~~~~~~~~~
This query finds the ``format`` argument passed into each call to ``String.init(format:_:)``:
.. code-block:: ql
import swift
from CallExpr call, Method method
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)")
select call.getArgument(0).getExpr()
Unfortunately this will only give the expression in the argument, not the values which could be passed to it.
So we use local data flow to find all expressions that flow into the argument:
.. code-block:: ql
import swift
import codeql.swift.dataflow.DataFlow
from CallExpr call, Method method, Expr sourceExpr, Expr sinkExpr
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)") and
sinkExpr = call.getArgument(0).getExpr() and
DataFlow::localFlow(DataFlow::exprNode(sourceExpr), DataFlow::exprNode(sinkExpr))
select sourceExpr, sinkExpr
We can vary the source, for example, making the source the parameter of a function rather than an expression. The following query finds where a parameter is used for the format:
.. code-block:: ql
import swift
import codeql.swift.dataflow.DataFlow
from CallExpr call, Method method, ParamDecl sourceParam, Expr sinkExpr
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)") and
sinkExpr = call.getArgument(0).getExpr() and
DataFlow::localFlow(DataFlow::parameterNode(sourceParam), DataFlow::exprNode(sinkExpr))
select sourceParam, sinkExpr
The following example finds calls to ``String.init(format:_:)`` where the format string is not a hard-coded string literal:
.. code-block:: ql
import swift
import codeql.swift.dataflow.DataFlow
from CallExpr call, Method method, DataFlow::Node sinkNode
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)") and
sinkNode.asExpr() = call.getArgument(0).getExpr() and
not exists(StringLiteralExpr sourceLiteral |
DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), sinkNode)
)
select call, "Format argument to " + method.getName() + " isn't hard-coded."
Global data flow
----------------
Global data flow tracks data flow throughout the entire program, and is therefore more powerful than local data flow.
However, global data flow is less precise than local data flow, and the analysis typically requires significantly more time and memory to perform.
.. pull-quote:: Note
.. include:: ../reusables/path-problem.rst
Using global data flow
~~~~~~~~~~~~~~~~~~~~~~
You can use the global data flow library by implementing the module ``DataFlow::ConfigSig``:
.. code-block:: ql
import codeql.swift.dataflow.DataFlow
module MyDataFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
...
}
predicate isSink(DataFlow::Node sink) {
...
}
}
module MyDataFlow = DataFlow::Global<MyDataFlowConfiguration>;
These predicates are defined in the configuration:
- ``isSource`` - defines where data may flow from.
- ``isSink`` - defines where data may flow to.
- ``isBarrier`` - optionally, restricts the data flow.
- ``isAdditionalFlowStep`` - optionally, adds additional flow steps.
The last line (``module MyDataFlow = ...``) instantiates the parameterized module for data flow analysis by passing the configuration to the parameterized module. Data flow analysis can then be performed using ``MyDataFlow::flow(DataFlow::Node source, DataFlow::Node sink)``:
.. code-block:: ql
from DataFlow::Node source, DataFlow::Node sink
where MyDataFlow::flow(source, sink)
select source, "Dataflow to $@.", sink, sink.toString()
Using global taint tracking
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Global taint tracking is to global data flow what local taint tracking is to local data flow.
That is, global taint tracking extends global data flow with additional non-value-preserving steps.
The global taint tracking library uses the same configuration module as the global data flow library. You can perform taint flow analysis using ``TaintTracking::Global``:
.. code-block:: ql
module MyTaintFlow = TaintTracking::Global<MyDataFlowConfiguration>;
from DataFlow::Node source, DataFlow::Node sink
where MyTaintFlow::flow(source, sink)
select source, "Taint flow to $@.", sink, sink.toString()
Predefined sources
~~~~~~~~~~~~~~~~~~
The data flow library module ``codeql.swift.dataflow.FlowSources`` contains a number of predefined sources that you can use to write security queries to track data flow and taint flow.
- The class ``RemoteFlowSource`` represents data flow from remote network inputs and from other applications.
- The class ``LocalFlowSource`` represents data flow from local user input.
- The class ``FlowSource`` includes both of the above.
Examples of global data flow
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following global taint-tracking query finds places where a string literal is used in a function call argument named "password".
- Since this is a taint-tracking query, the ``TaintTracking::Global`` module is used.
- The ``isSource`` predicate defines sources as any ``StringLiteralExpr``.
- The ``isSink`` predicate defines sinks as arguments to a ``CallExpr`` called "password".
- The sources and sinks may need tuning to a particular use, for example, if passwords are represented by a type other than ``String`` or passed in arguments of a different name than "password".
.. code-block:: ql
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
module ConstantPasswordConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof StringLiteralExpr }
predicate isSink(DataFlow::Node node) {
// any argument called `password`
exists(CallExpr call | call.getArgumentWithLabel("password").getExpr() = node.asExpr())
}
module ConstantPasswordFlow = TaintTracking::Global<ConstantPasswordConfig>;
from DataFlow::Node sourceNode, DataFlow::Node sinkNode
where ConstantPasswordFlow::flow(sourceNode, sinkNode)
select sinkNode, "The value $@ is used as a constant password.", sourceNode, sourceNode.toString()
The following global taint-tracking query finds places where a value from a remote or local user input is used as an argument to the SQLite ``Connection.execute(_:)`` function.
- Since this is a taint-tracking query, the ``TaintTracking::Global`` module is used.
- The ``isSource`` predicate defines sources as a ``FlowSource`` (remote or local user input).
- The ``isSink`` predicate defines sinks as the first argument in any call to ``Connection.execute(_:)``.
.. code-block:: ql
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
import codeql.swift.dataflow.FlowSources
module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
predicate isSink(DataFlow::Node node) {
exists(CallExpr call |
call.getStaticTarget().(Method).hasQualifiedName("Connection", "execute(_:)") and
call.getArgument(0).getExpr() = node.asExpr()
)
}
}
module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
from DataFlow::Node sourceNode, DataFlow::Node sinkNode
where SqlInjectionFlow::flow(sourceNode, sinkNode)
select sinkNode, "This query depends on a $@.", sourceNode, "user-provided value"
Further reading
---------------
- ":ref:`Exploring data flow with path queries <exploring-data-flow-with-path-queries>`"
.. include:: ../reusables/swift-further-reading.rst
.. include:: ../reusables/codeql-ref-tools-further-reading.rst

131
docs/codeql/codeql-language-guides/basic-query-for-swift-code.rst Normal file
View File

@@ -0,0 +1,131 @@
.. _basic-query-for-swift-code:
Basic query for Swift code
==========================
Learn to write and run a simple CodeQL query using Visual Studio Code with the CodeQL extension.
.. include:: ../reusables/swift-beta-note.rst
.. include:: ../reusables/vs-code-basic-instructions/setup-to-run-queries.rst
About the query
---------------
The query we're going to run performs a basic search of the code for ``if`` expressions that are redundant, in the sense that they have an empty ``then`` branch. For example, code such as:
.. code-block:: swift
if error {
// we should handle the error
}
.. include:: ../reusables/vs-code-basic-instructions/find-database.rst
Running a quick query
---------------------
.. include:: ../reusables/vs-code-basic-instructions/run-quick-query-1.rst
#. In the quick query tab, delete the content and paste in the following query.
.. code-block:: ql
import swift
from IfStmt ifStmt
where ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0
select ifStmt, "This 'if' statement is redundant."
.. include:: ../reusables/vs-code-basic-instructions/run-quick-query-2.rst
.. image:: ../images/codeql-for-visual-studio-code/basic-swift-query-results-1.png
:align: center
If any matching code is found, click a link in the ``ifStmt`` column to open the file and highlight the matching ``if`` statement.
.. image:: ../images/codeql-for-visual-studio-code/basic-swift-query-results-2.png
:align: center
.. include:: ../reusables/vs-code-basic-instructions/note-store-quick-query.rst
About the query structure
~~~~~~~~~~~~~~~~~~~~~~~~~
After the initial ``import`` statement, this simple query comprises three parts that serve similar purposes to the FROM, WHERE, and SELECT parts of an SQL query.
+------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+
| Query part | Purpose | Details |
+==================================================================+===================================================================================================================+=================================================================================================+
| ``import swift`` | Imports the standard CodeQL AST libraries for Swift. | Every query begins with one or more ``import`` statements. |
+------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+
| ``from IfStmt ifStmt`` | Defines the variables for the query. | We use: an ``IfStmt`` variable for ``if`` statements. |
| | Declarations are of the form: | |
| | ``<type> <variable name>`` | |
+------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+
| ``where ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0`` | Defines a condition on the variables. | ``ifStmt.getThen()``: gets the ``then`` branch of the ``if`` expression. |
| | | ``.(BraceStmt)``: requires that the ``then`` branch is a brace statement (``{ }``). |
| | | ``.getNumberOfElements() = 0``: requires that the brace statement contains no child statements. |
+------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+
| ``select ifStmt, "This 'if' statement is redundant."`` | Defines what to report for each match. | Reports the resulting ``if`` statement with a string that explains the problem. |
| | | |
| | ``select`` statements for queries that are used to find instances of poor coding practice are always in the form: | |
| | ``select <program element>, "<alert message>"`` | |
+------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+
Extend the query
----------------
Query writing is an inherently iterative process. You write a simple query and then, when you run it, you discover examples that you had not previously considered, or opportunities for improvement.
Remove false positive results
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Browsing the results of our basic query shows that it could be improved. Among the results you are likely to find examples of ``if`` statements with an ``else`` branch, where an empty ``then`` branch does serve a purpose. For example:
.. code-block:: swift
if (option == "-verbose") {
// nothing to do - handled earlier
} else {
handleError("unrecognized option")
}
In this case, identifying the ``if`` statement with the empty ``then`` branch as redundant is a false positive. One solution to this is to modify the query to select ``if`` statements where both the ``then`` and ``else`` branches are missing.
To exclude ``if`` statements that have an ``else`` branch:
#. Add the following to the where clause:
.. code-block:: ql
and not exists(ifStmt.getElse())
The ``where`` clause is now:
.. code-block:: ql
where
ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0 and
not exists(ifStmt.getElse())
#. Re-run the query.
There are now fewer results because ``if`` expressions with an ``else`` branch are no longer included.
Further reading
---------------
.. include:: ../reusables/swift-further-reading.rst
.. include:: ../reusables/codeql-ref-tools-further-reading.rst
.. Article-specific substitutions for the reusables used in docs/codeql/reusables/vs-code-basic-instructions
.. |language-text| replace:: Swift
.. |language-code| replace:: ``swift``
.. |example-url| replace:: https://github.com/alamofire/alamofire
.. |image-quick-query| image:: ../images/codeql-for-visual-studio-code/quick-query-tab-swift.png
.. |result-col-1| replace:: The first column corresponds to the expression ``ifStmt`` and is linked to the location in the source code of the project where ``ifStmt`` occurs.

18
docs/codeql/codeql-language-guides/codeql-for-swift.rst Normal file
View File

@@ -0,0 +1,18 @@
.. _codeql-for-swift:
CodeQL for Swift
================
Experiment and learn how to write effective and efficient queries for CodeQL databases generated from Swift codebases.
.. include:: ../reusables/swift-beta-note.rst
.. toctree::
:hidden:
basic-query-for-swift-code
analyzing-data-flow-in-swift
- :doc:`Basic query for Swift code <basic-query-for-swift-code>`: Learn to write and run a simple CodeQL query.
- :doc:`Analyzing data flow in Swift <analyzing-data-flow-in-swift>`: You can use CodeQL to track the flow of data through a Swift program to places where the data is used.

1
docs/codeql/codeql-language-guides/index.rst
View File

@@ -14,3 +14,4 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
codeql-for-javascript
codeql-for-python
codeql-for-ruby
codeql-for-swift

BIN
docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 105 KiB

BIN
docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 132 KiB

BIN
docs/codeql/images/codeql-for-visual-studio-code/quick-query-tab-swift.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 33 KiB

4
docs/codeql/reusables/extractors.rst
View File

@@ -17,4 +17,6 @@
* - Python
- ``python``
* - Ruby
- ``ruby``
- ``ruby``
* - Swift
- ``swift``

31
docs/codeql/reusables/supported-frameworks.rst
View File

@@ -278,3 +278,34 @@ and the CodeQL library pack ``codeql/ruby-all`` (`changelog <https://github.com/
Ruby on Rails, Web framework
rubyzip, Compression library
typhoeus, HTTP client
Swift built-in support
================================
.. include:: ../reusables/swift-beta-note.rst
Provided by the current versions of the
CodeQL query pack ``codeql/swift-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/swift/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/swift/ql/src>`__)
and the CodeQL library pack ``codeql/swift-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/swift/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/swift/ql/lib>`__).
.. csv-table::
:header-rows: 1
:class: fullWidthTable
:widths: auto
Name, Category
`AEXML <https://github.com/tadija/AEXML>`__, XML processing library
`Alamofire <https://github.com/Alamofire/Alamofire>`__, Network communicator
`Core Data <https://developer.apple.com/documentation/coredata/>`__, Database
`CryptoKit <https://developer.apple.com/documentation/cryptokit/>`__, Cryptography library
`CryptoSwift <https://github.com/krzyzanowskim/CryptoSwift>`__, Cryptography library
`Foundation <https://developer.apple.com/documentation/foundation>`__, Utility library
`GRDB <https://github.com/groue/GRDB.swift>`__, Database
`JavaScriptCore <https://developer.apple.com/documentation/javascriptcore>`__, Scripting library
`Libxml2 <https://gitlab.gnome.org/GNOME/libxml2>`__, XML processing library
`Network <https://developer.apple.com/documentation/network>`__, Network communicator
`Realm Swift <https://realm.io/realm-swift/>`__, Database
`RNCryptor <https://github.com/RNCryptor/RNCryptor>`__, Cryptography library
`SQLite3 <https://sqlite.org/index.html>`__, Database
`SQLite.swift <https://github.com/stephencelis/SQLite.swift>`__, Database
`WebKit <https://developer.apple.com/documentation/webkit>`__, User interface library

6
docs/codeql/reusables/supported-versions-compilers.rst
View File

@@ -24,7 +24,8 @@
JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [7]_"
Python [8]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11",Not applicable,``.py``
Ruby [9]_,"up to 3.2",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
TypeScript [10]_,"2.6-5.0",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
Swift [10]_,"Swift 5.4-5.7","Swift compiler","``.swift``"
TypeScript [11]_,"2.6-5.0",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
.. container:: footnote-group
@@ -37,4 +38,5 @@
.. [7] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
.. [8] The extractor requires Python 3 to run. To analyze Python 2.7 you should install both versions of Python.
.. [9] Requires glibc 2.17.
.. [10] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default.
.. [10] Swift support is currently in beta. Support for the analysis of Swift 5.4-5.7 requires macOS. Swift 5.7.3 can also be analyzed using Linux.
.. [11] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default.

4
docs/codeql/reusables/swift-beta-note.rst Normal file
View File

@@ -0,0 +1,4 @@
.. pull-quote:: Note
CodeQL analysis for Swift is currently in beta. During the beta, analysis of Swift code,
and the accompanying documentation, will not be as comprehensive as for other languages.

4
docs/codeql/reusables/swift-further-reading.rst Normal file
View File

@@ -0,0 +1,4 @@
- `CodeQL queries for Swift <https://github.com/github/codeql/tree/main/swift/ql/src/queries>`__
- `Example queries for Swift <https://github.com/github/codeql/tree/main/swift/ql/examples>`__
- `CodeQL library reference for Swift <https://codeql.github.com/codeql-standard-libraries/swift/>`__

4
java/ql/lib/change-notes/2023-05-02-apache-commons-net-models.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added models for the Apache Commons Net library.

30
java/ql/lib/ext/org.apache.commons.net.model.yml Normal file
View File

@@ -0,0 +1,30 @@
extensions:
- addsTo:
pack: codeql/java-all
extensible: sinkModel
data:
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress)", "", "Argument[0]", "open-url", "manual"]
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int)", "", "Argument[0]", "open-url", "manual"]
- ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int,InetAddress,int)", "", "Argument[0]", "open-url", "manual"]
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String)", "", "Argument[0]", "open-url", "manual"]
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int)", "", "Argument[0]", "open-url", "df-manual"]
- ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int,InetAddress,int)", "", "Argument[0]", "open-url", "manual"]
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String)", "", "Argument[0]", "read-file", "df-manual"]
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String,String)", "", "Argument[0]", "read-file", "df-manual"]
- ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(String,File,String,String,String)", "", "Argument[1]", "read-file", "df-manual"]
- addsTo:
pack: codeql/java-all
extensible: sourceModel
data:
- ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "()", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "(String)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "()", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "()", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "(String)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "()", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFile", "(String,OutputStream)", "", "Argument[1]", "remote", "df-manual"]
- ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFileStream", "(String)", "", "ReturnValue", "remote", "df-manual"]

2
swift/README.md
View File

@@ -52,7 +52,7 @@ A log file is produced for each run under `CODEQL_EXTRACTOR_SWIFT_LOG_DIR` (the
You can use the environment variable `CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS` to configure levels for
loggers and outputs. This must have the form of a comma separated `spec:min_level` list, where
`spec` is either a glob pattern (made up of alphanumeric, `/`, `*` and `.` characters) for
matching logger names or one of `out:bin`, `out:text` or `out:console`, and `min_level` is one
matching logger names or one of `out:binary`, `out:text`, `out:console` or `out:diagnostics`, and `min_level` is one
of `trace`, `debug`, `info`, `warning`, `error`, `critical` or `no_logs` to turn logs completely off.
Current output default levels are no binary logs, `info` logs or higher in the text file and `warning` logs or higher on

3
swift/extractor/infra/SwiftDispatcher.h
View File

@@ -5,6 +5,7 @@
#include <swift/AST/SourceFile.h>
#include <swift/Basic/SourceManager.h>
#include <swift/Parse/Token.h>
#include "absl/strings/str_cat.h"
#include "swift/extractor/trap/TrapDomain.h"
#include "swift/extractor/infra/SwiftTagTraits.h"
@@ -83,7 +84,7 @@ class SwiftDispatcher {
valid = false;
}
LOG_ERROR("{} has undefined field {}{}, {}", entry.NAME, field,
index >= 0 ? ('[' + std::to_string(index) + ']') : "", action);
index >= 0 ? absl::StrCat("[", index, "]") : "", action);
}
});
if (valid) {

7
swift/extractor/infra/SwiftMangledName.cpp
View File

@@ -1,4 +1,5 @@
#include "swift/extractor/infra/SwiftMangledName.h"
#include "absl/strings/str_cat.h"
namespace codeql {
@@ -8,13 +9,11 @@ void appendPart(std::string& out, const std::string& prefix) {
}
void appendPart(std::string& out, UntypedTrapLabel label) {
out += '{';
out += label.str();
out += '}';
absl::StrAppend(&out, "{", label.str(), "}");
}
void appendPart(std::string& out, unsigned index) {
out += std::to_string(index);
absl::StrAppend(&out, index);
}
} // namespace

3
swift/extractor/main.cpp
View File

@@ -10,6 +10,7 @@
#include <swift/Basic/InitializeSwiftModules.h>
#include "absl/strings/str_join.h"
#include "absl/strings/str_cat.h"
#include "swift/extractor/SwiftExtractor.h"
#include "swift/extractor/infra/TargetDomains.h"
@@ -166,7 +167,7 @@ static void checkWhetherToRunUnderTool(int argc, char* const* argv) {
// compilations, diagnostics, etc.
codeql::TrapDomain invocationTrapDomain(codeql::SwiftExtractorState& state) {
auto timestamp = std::chrono::system_clock::now().time_since_epoch().count();
auto filename = std::to_string(timestamp) + '-' + std::to_string(getpid());
auto filename = absl::StrCat(timestamp, "-", getpid());
auto target = std::filesystem::path("invocations") / std::filesystem::path(filename);
auto maybeDomain = codeql::createTargetTrapDomain(state, target, codeql::TrapType::invocation);
CODEQL_ASSERT(maybeDomain, "Cannot create invocation trap file for {}", target);

6
swift/extractor/translators/PatternTranslator.cpp
View File

@@ -4,12 +4,6 @@ namespace codeql {
codeql::NamedPattern PatternTranslator::translateNamedPattern(const swift::NamedPattern& pattern) {
auto entry = dispatcher.createEntry(pattern);
// TODO: in some (but not all) cases, this seems to introduce a duplicate entry
// for example the vars listed in a case stmt have a different pointer than then ones in
// patterns.
// assert(pattern.getDecl() && "expect NamedPattern to have Decl");
// dispatcher.emit(NamedPatternsTrap{label, pattern.getNameStr().str(),
// dispatcher.fetchLabel(pattern.getDecl())});
entry.name = pattern.getNameStr().str();
return entry;
}

3
swift/extractor/trap/TrapDomain.h
View File

@@ -2,6 +2,7 @@
#include <memory>
#include <sstream>
#include "absl/strings/str_cat.h"
#include "swift/extractor/trap/TrapLabel.h"
#include "swift/extractor/infra/file/TargetFile.h"
@@ -27,7 +28,7 @@ class TrapDomain {
e.forEachLabel([&e, this](const char* field, int index, auto& label) {
if (!label.valid()) {
LOG_ERROR("{} has undefined field {}{}", e.NAME, field,
index >= 0 ? ('[' + std::to_string(index) + ']') : "");
index >= 0 ? absl::StrCat("[", index, "]") : "");
}
});
}

31
swift/integration-tests/create_database_utils.py
View File

@@ -1,15 +1,34 @@
"""
recreation of internal `create_database_utils.py` to run the tests locally, with minimal
and swift-specialized functionality
Simplified version of internal `create_database_utils.py` used to run the tests locally, with
minimal and swift-specialized functionality
TODO unify integration testing code across the public and private repositories
"""
import subprocess
import pathlib
import sys
import shutil
def run_codeql_database_create(cmds, lang, keep_trap=True):
def runSuccessfully(cmd):
res = subprocess.run(cmd)
if res.returncode:
print("FAILED", file=sys.stderr)
print(" ", *cmd, f"(exit code {res.returncode})", file=sys.stderr)
sys.exit(res.returncode)
def runUnsuccessfully(cmd):
res = subprocess.run(cmd)
if res.returncode == 0:
print("FAILED", file=sys.stderr)
print(" ", *cmd, f"(exit code 0, expected to fail)", file=sys.stderr)
sys.exit(1)
def run_codeql_database_create(cmds, lang, keep_trap=True, db=None, runFunction=runSuccessfully):
""" db parameter is here solely for compatibility with the internal test runner """
assert lang == 'swift'
codeql_root = pathlib.Path(__file__).parents[2]
shutil.rmtree("db", ignore_errors=True)
cmd = [
"codeql", "database", "create",
"-s", ".", "-l", "swift", "--internal-use-lua-tracing", f"--search-path={codeql_root}", "--no-cleanup",
@@ -19,8 +38,4 @@ def run_codeql_database_create(cmds, lang, keep_trap=True):
for c in cmds:
cmd += ["-c", c]
cmd.append("db")
res = subprocess.run(cmd)
if res.returncode:
print("FAILED", file=sys.stderr)
print(" ", *cmd, file=sys.stderr)
sys.exit(res.returncode)
runFunction(cmd)

64
swift/integration-tests/diagnostics_test_utils.py Normal file
View File

@@ -0,0 +1,64 @@
"""
Simplified POSIX only version of internal `diagnostics_test_utils.py` used to run the tests locally
TODO unify integration testing code across the public and private repositories
"""
import json
import pathlib
import subprocess
import os
import difflib
import sys
def _normalize_actual(test_dir, database_dir):
proc = subprocess.run(['codeql', 'database', 'export-diagnostics', '--format', 'raw', '--', database_dir],
stdout=subprocess.PIPE, universal_newlines=True, check=True, text=True)
data = proc.stdout.replace(str(test_dir.absolute()), "<test-root-directory>")
data = json.loads(data)
data[:] = [e for e in data if not e["source"]["id"].startswith("cli/")]
for e in data:
e.pop("timestamp")
return _normalize_json(data)
def _normalize_expected(test_dir):
with open(test_dir / "diagnostics.expected") as expected:
text = expected.read()
return _normalize_json(_load_concatenated_json(text))
def _load_concatenated_json(text):
text = text.lstrip()
entries = []
decoder = json.JSONDecoder()
while text:
obj, index = decoder.raw_decode(text)
entries.append(obj)
text = text[index:].lstrip()
return entries
def _normalize_json(data):
entries = [json.dumps(e, sort_keys=True, indent=2) for e in data]
entries.sort()
entries.append("")
return "\n".join(entries)
def check_diagnostics(test_dir=".", test_db="db"):
test_dir = pathlib.Path(test_dir)
test_db = pathlib.Path(test_db)
actual = _normalize_actual(test_dir, test_db)
if os.environ.get("CODEQL_INTEGRATION_TEST_LEARN") == "true":
with open(test_dir / "diagnostics.expected", "w") as expected:
expected.write(actual)
return
expected = _normalize_expected(test_dir)
if actual != expected:
with open(test_dir / "diagnostics.actual", "w") as actual_out:
actual_out.write(actual)
actual = actual.splitlines(keepends=True)
expected = expected.splitlines(keepends=True)
print("".join(difflib.unified_diff(actual, expected, fromfile="diagnostics.actual", tofile="diagnostics.expected")), file=sys.stderr)
sys.exit(1)

1
swift/integration-tests/osx-only/autobuilder/failure/.gitignore vendored Normal file
View File

@@ -0,0 +1 @@
/build

18
swift/integration-tests/osx-only/autobuilder/failure/diagnostics.expected Normal file
View File

@@ -0,0 +1,18 @@
{
"helpLinks": [
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning",
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language"
],
"plaintextMessage": "The detected build command failed (tried /usr/bin/xcodebuild build -project <test-root-directory>/hello-failure.xcodeproj -target hello-failure CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO).\n\nSet up a manual build command.",
"severity": "error",
"source": {
"extractorName": "swift",
"id": "swift/autobuilder/build-command-failed",
"name": "Detected build command failed"
},
"visibility": {
"cliSummaryTable": true,
"statusPage": true,
"telemetry": true
}
}

364
swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.pbxproj Normal file
View File

@@ -0,0 +1,364 @@
// !$*UTF8*$!
{
archiveVersion = 1;
classes = {
};
objectVersion = 56;
objects = {
/* Begin PBXBuildFile section */
5700ECA72A09043B006BF37C /* hello_failureApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5700ECA62A09043B006BF37C /* hello_failureApp.swift */; };
5700ECA92A09043B006BF37C /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5700ECA82A09043B006BF37C /* ContentView.swift */; };
5700ECAB2A09043C006BF37C /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 5700ECAA2A09043C006BF37C /* Assets.xcassets */; };
5700ECAE2A09043C006BF37C /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */; };
/* End PBXBuildFile section */
/* Begin PBXFileReference section */
5700ECA32A09043B006BF37C /* hello-failure.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "hello-failure.app"; sourceTree = BUILT_PRODUCTS_DIR; };
5700ECA62A09043B006BF37C /* hello_failureApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = hello_failureApp.swift; sourceTree = "<group>"; };
5700ECA82A09043B006BF37C /* ContentView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ContentView.swift; sourceTree = "<group>"; };
5700ECAA2A09043C006BF37C /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
/* End PBXFileReference section */
/* Begin PBXFrameworksBuildPhase section */
5700ECA02A09043B006BF37C /* Frameworks */ = {
isa = PBXFrameworksBuildPhase;
buildActionMask = 2147483647;
files = (
);
runOnlyForDeploymentPostprocessing = 0;
};
/* End PBXFrameworksBuildPhase section */
/* Begin PBXGroup section */
5700EC9A2A09043B006BF37C = {
isa = PBXGroup;
children = (
5700ECA52A09043B006BF37C /* hello-failure */,
5700ECA42A09043B006BF37C /* Products */,
);
sourceTree = "<group>";
};
5700ECA42A09043B006BF37C /* Products */ = {
isa = PBXGroup;
children = (
5700ECA32A09043B006BF37C /* hello-failure.app */,
);
name = Products;
sourceTree = "<group>";
};
5700ECA52A09043B006BF37C /* hello-failure */ = {
isa = PBXGroup;
children = (
5700ECA62A09043B006BF37C /* hello_failureApp.swift */,
5700ECA82A09043B006BF37C /* ContentView.swift */,
5700ECAA2A09043C006BF37C /* Assets.xcassets */,
5700ECAC2A09043C006BF37C /* Preview Content */,
);
path = "hello-failure";
sourceTree = "<group>";
};
5700ECAC2A09043C006BF37C /* Preview Content */ = {
isa = PBXGroup;
children = (
5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */,
);
path = "Preview Content";
sourceTree = "<group>";
};
/* End PBXGroup section */
/* Begin PBXNativeTarget section */
5700ECA22A09043B006BF37C /* hello-failure */ = {
isa = PBXNativeTarget;
buildConfigurationList = 5700ECB12A09043C006BF37C /* Build configuration list for PBXNativeTarget "hello-failure" */;
buildPhases = (
5700ECB42A090460006BF37C /* ShellScript */,
5700EC9F2A09043B006BF37C /* Sources */,
5700ECA02A09043B006BF37C /* Frameworks */,
5700ECA12A09043B006BF37C /* Resources */,
);
buildRules = (
);
dependencies = (
);
name = "hello-failure";
productName = "hello-failure";
productReference = 5700ECA32A09043B006BF37C /* hello-failure.app */;
productType = "com.apple.product-type.application";
};
/* End PBXNativeTarget section */
/* Begin PBXProject section */
5700EC9B2A09043B006BF37C /* Project object */ = {
isa = PBXProject;
attributes = {
BuildIndependentTargetsInParallel = 1;
LastSwiftUpdateCheck = 1430;
LastUpgradeCheck = 1430;
TargetAttributes = {
5700ECA22A09043B006BF37C = {
CreatedOnToolsVersion = 14.3;
};
};
};
buildConfigurationList = 5700EC9E2A09043B006BF37C /* Build configuration list for PBXProject "hello-failure" */;
compatibilityVersion = "Xcode 14.0";
developmentRegion = en;
hasScannedForEncodings = 0;
knownRegions = (
en,
Base,
);
mainGroup = 5700EC9A2A09043B006BF37C;
productRefGroup = 5700ECA42A09043B006BF37C /* Products */;
projectDirPath = "";
projectRoot = "";
targets = (
5700ECA22A09043B006BF37C /* hello-failure */,
);
};
/* End PBXProject section */
/* Begin PBXResourcesBuildPhase section */
5700ECA12A09043B006BF37C /* Resources */ = {
isa = PBXResourcesBuildPhase;
buildActionMask = 2147483647;
files = (
5700ECAE2A09043C006BF37C /* Preview Assets.xcassets in Resources */,
5700ECAB2A09043C006BF37C /* Assets.xcassets in Resources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
/* End PBXResourcesBuildPhase section */
/* Begin PBXShellScriptBuildPhase section */
5700ECB42A090460006BF37C /* ShellScript */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
files = (
);
inputFileListPaths = (
);
inputPaths = (
);
outputFileListPaths = (
);
outputPaths = (
);
runOnlyForDeploymentPostprocessing = 0;
shellPath = /bin/sh;
shellScript = "false\n";
showEnvVarsInLog = 0;
};
/* End PBXShellScriptBuildPhase section */
/* Begin PBXSourcesBuildPhase section */
5700EC9F2A09043B006BF37C /* Sources */ = {
isa = PBXSourcesBuildPhase;
buildActionMask = 2147483647;
files = (
5700ECA92A09043B006BF37C /* ContentView.swift in Sources */,
5700ECA72A09043B006BF37C /* hello_failureApp.swift in Sources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
/* End PBXSourcesBuildPhase section */
/* Begin XCBuildConfiguration section */
5700ECAF2A09043C006BF37C /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
ALWAYS_SEARCH_USER_PATHS = NO;
CLANG_ANALYZER_NONNULL = YES;
CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_ENABLE_OBJC_WEAK = YES;
CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
CLANG_WARN_BOOL_CONVERSION = YES;
CLANG_WARN_COMMA = YES;
CLANG_WARN_CONSTANT_CONVERSION = YES;
CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
CLANG_WARN_EMPTY_BODY = YES;
CLANG_WARN_ENUM_CONVERSION = YES;
CLANG_WARN_INFINITE_RECURSION = YES;
CLANG_WARN_INT_CONVERSION = YES;
CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
CLANG_WARN_STRICT_PROTOTYPES = YES;
CLANG_WARN_SUSPICIOUS_MOVE = YES;
CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
CLANG_WARN_UNREACHABLE_CODE = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
COPY_PHASE_STRIP = NO;
DEBUG_INFORMATION_FORMAT = dwarf;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_TESTABILITY = YES;
GCC_C_LANGUAGE_STANDARD = gnu11;
GCC_DYNAMIC_NO_PIC = NO;
GCC_NO_COMMON_BLOCKS = YES;
GCC_OPTIMIZATION_LEVEL = 0;
GCC_PREPROCESSOR_DEFINITIONS = (
"DEBUG=1",
"$(inherited)",
);
GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
GCC_WARN_UNDECLARED_SELECTOR = YES;
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES;
IPHONEOS_DEPLOYMENT_TARGET = 16.4;
MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
MTL_FAST_MATH = YES;
ONLY_ACTIVE_ARCH = YES;
SDKROOT = iphoneos;
SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
SWIFT_OPTIMIZATION_LEVEL = "-Onone";
};
name = Debug;
};
5700ECB02A09043C006BF37C /* Release */ = {
isa = XCBuildConfiguration;
buildSettings = {
ALWAYS_SEARCH_USER_PATHS = NO;
CLANG_ANALYZER_NONNULL = YES;
CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_ENABLE_OBJC_WEAK = YES;
CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
CLANG_WARN_BOOL_CONVERSION = YES;
CLANG_WARN_COMMA = YES;
CLANG_WARN_CONSTANT_CONVERSION = YES;
CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
CLANG_WARN_EMPTY_BODY = YES;
CLANG_WARN_ENUM_CONVERSION = YES;
CLANG_WARN_INFINITE_RECURSION = YES;
CLANG_WARN_INT_CONVERSION = YES;
CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
CLANG_WARN_STRICT_PROTOTYPES = YES;
CLANG_WARN_SUSPICIOUS_MOVE = YES;
CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
CLANG_WARN_UNREACHABLE_CODE = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
COPY_PHASE_STRIP = NO;
DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
ENABLE_NS_ASSERTIONS = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
GCC_C_LANGUAGE_STANDARD = gnu11;
GCC_NO_COMMON_BLOCKS = YES;
GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
GCC_WARN_UNDECLARED_SELECTOR = YES;
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES;
IPHONEOS_DEPLOYMENT_TARGET = 16.4;
MTL_ENABLE_DEBUG_INFO = NO;
MTL_FAST_MATH = YES;
SDKROOT = iphoneos;
SWIFT_COMPILATION_MODE = wholemodule;
SWIFT_OPTIMIZATION_LEVEL = "-O";
VALIDATE_PRODUCT = YES;
};
name = Release;
};
5700ECB22A09043C006BF37C /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
CODE_SIGN_STYLE = Automatic;
CURRENT_PROJECT_VERSION = 1;
DEVELOPMENT_ASSET_PATHS = "\"hello-failure/Preview Content\"";
ENABLE_PREVIEWS = YES;
GENERATE_INFOPLIST_FILE = YES;
INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
INFOPLIST_KEY_UILaunchScreen_Generation = YES;
INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/Frameworks",
);
MARKETING_VERSION = 1.0;
PRODUCT_BUNDLE_IDENTIFIER = "com.example.hello-failure";
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_EMIT_LOC_STRINGS = YES;
SWIFT_VERSION = 5.0;
TARGETED_DEVICE_FAMILY = "1,2";
};
name = Debug;
};
5700ECB32A09043C006BF37C /* Release */ = {
isa = XCBuildConfiguration;
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
CODE_SIGN_STYLE = Automatic;
CURRENT_PROJECT_VERSION = 1;
DEVELOPMENT_ASSET_PATHS = "\"hello-failure/Preview Content\"";
ENABLE_PREVIEWS = YES;
GENERATE_INFOPLIST_FILE = YES;
INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
INFOPLIST_KEY_UILaunchScreen_Generation = YES;
INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/Frameworks",
);
MARKETING_VERSION = 1.0;
PRODUCT_BUNDLE_IDENTIFIER = "com.example.hello-failure";
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_EMIT_LOC_STRINGS = YES;
SWIFT_VERSION = 5.0;
TARGETED_DEVICE_FAMILY = "1,2";
};
name = Release;
};
/* End XCBuildConfiguration section */
/* Begin XCConfigurationList section */
5700EC9E2A09043B006BF37C /* Build configuration list for PBXProject "hello-failure" */ = {
isa = XCConfigurationList;
buildConfigurations = (
5700ECAF2A09043C006BF37C /* Debug */,
5700ECB02A09043C006BF37C /* Release */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
};
5700ECB12A09043C006BF37C /* Build configuration list for PBXNativeTarget "hello-failure" */ = {
isa = XCConfigurationList;
buildConfigurations = (
5700ECB22A09043C006BF37C /* Debug */,
5700ECB32A09043C006BF37C /* Release */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
};
/* End XCConfigurationList section */
};
rootObject = 5700EC9B2A09043B006BF37C /* Project object */;
}

7
swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/contents.xcworkspacedata generated Normal file
View File

@@ -0,0 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<Workspace
version = "1.0">
<FileRef
location = "self:">
</FileRef>
</Workspace>

8
swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist Normal file
View File

@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>IDEDidComputeMac32BitWarning</key>
<true/>
</dict>
</plist>

5
swift/integration-tests/osx-only/autobuilder/failure/test.py Normal file
View File

@@ -0,0 +1,5 @@
from create_database_utils import *
from diagnostics_test_utils import *
run_codeql_database_create([], lang='swift', keep_trap=True, db=None, runFunction=runUnsuccessfully)
check_diagnostics()

18
swift/integration-tests/osx-only/autobuilder/no-build-system/diagnostics.expected Normal file
View File

@@ -0,0 +1,18 @@
{
"helpLinks": [
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning",
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language"
],
"plaintextMessage": "No Xcode project or workspace was found.\n\nSet up a manual build command.",
"severity": "error",
"source": {
"extractorName": "swift",
"id": "swift/autobuilder/no-project-found",
"name": "No Xcode project or workspace detected"
},
"visibility": {
"cliSummaryTable": true,
"statusPage": true,
"telemetry": true
}
}

5
swift/integration-tests/osx-only/autobuilder/no-build-system/test.py Normal file
View File

@@ -0,0 +1,5 @@
from create_database_utils import *
from diagnostics_test_utils import *
run_codeql_database_create([], lang='swift', keep_trap=True, db=None, runFunction=runUnsuccessfully)
check_diagnostics()

0
swift/integration-tests/osx-only/autobuilder/no-build-system/x.swift Normal file
View File

2
swift/integration-tests/runner.py
View File

@@ -43,6 +43,8 @@ def skipped(test):
def main(opts):
test_dirs = opts.test_dir or [this_dir]
tests = [t for d in test_dirs for t in d.rglob("test.py") if not skipped(t)]
if opts.learn:
os.environ["CODEQL_INTEGRATION_TEST_LEARN"] = "true"
if not tests:
print("No tests found", file=sys.stderr)

2
swift/logging/SwiftDiagnostics.h
View File

@@ -67,6 +67,8 @@ class SwiftDiagnosticsDumper {
return output.good();
}
void flush() { output.flush(); }
// write out binlog entries as corresponding JSON diagnostics entries. Expects all entries to have
// a category equal to an id of a previously created SwiftDiagnosticSource.
void write(const char* buffer, std::size_t bufferSize);

57
swift/logging/SwiftLogging.cpp
View File

@@ -3,6 +3,8 @@
#include <filesystem>
#include <stdlib.h>
#include <optional>
#include <unistd.h>
#include "absl/strings/str_cat.h"
#define LEVEL_REGEX_PATTERN "trace|debug|info|warning|error|critical|no_logs"
@@ -10,6 +12,8 @@ BINLOG_ADAPT_ENUM(codeql::Log::Level, trace, debug, info, warning, error, critic
namespace codeql {
bool Log::initialized{false};
namespace {
using LevelRule = std::pair<std::regex, Log::Level>;
using LevelRules = std::vector<LevelRule>;
@@ -55,8 +59,8 @@ std::vector<std::string> Log::collectLevelRulesAndReturnProblems(const char* env
if (auto levels = getEnvOr(envVar, nullptr)) {
// expect comma-separated <glob pattern>:<log severity>
std::regex comma{","};
std::regex levelAssignment{R"((?:([*./\w]+)|(?:out:(bin|text|console))):()" LEVEL_REGEX_PATTERN
")"};
std::regex levelAssignment{
R"((?:([*./\w]+)|(?:out:(binary|text|console|diagnostics))):()" LEVEL_REGEX_PATTERN ")"};
std::cregex_token_iterator begin{levels, levels + strlen(levels), comma, -1};
std::cregex_token_iterator end{};
for (auto it = begin; it != end; ++it) {
@@ -74,12 +78,14 @@ std::vector<std::string> Log::collectLevelRulesAndReturnProblems(const char* env
sourceRules.emplace_back(pattern, level);
} else {
auto out = matchToView(match[2]);
if (out == "bin") {
if (out == "binary") {
binary.level = level;
} else if (out == "text") {
text.level = level;
} else if (out == "console") {
console.level = level;
} else if (out == "diagnostics") {
diagnostics.level = level;
}
}
} else {
@@ -93,12 +99,13 @@ std::vector<std::string> Log::collectLevelRulesAndReturnProblems(const char* env
void Log::configure() {
// as we are configuring logging right now, we collect problems and log them at the end
auto problems = collectLevelRulesAndReturnProblems("CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS");
auto now = std::to_string(std::chrono::system_clock::now().time_since_epoch().count());
auto timestamp = std::chrono::system_clock::now().time_since_epoch().count();
auto logBaseName = absl::StrCat(timestamp, "-", getpid());
if (text || binary) {
std::filesystem::path logFile = getEnvOr("CODEQL_EXTRACTOR_SWIFT_LOG_DIR", "extractor-out/log");
logFile /= "swift";
logFile /= programName;
logFile /= now;
logFile /= logBaseName;
std::error_code ec;
std::filesystem::create_directories(logFile.parent_path(), ec);
if (!ec) {
@@ -124,31 +131,32 @@ void Log::configure() {
binary.level = Level::no_logs;
text.level = Level::no_logs;
}
if (diagnostics) {
std::filesystem::path diagFile =
getEnvOr("CODEQL_EXTRACTOR_SWIFT_DIAGNOSTIC_DIR", "extractor-out/diagnostics");
diagFile /= programName;
diagFile /= now;
diagFile.replace_extension(".jsonl");
std::error_code ec;
std::filesystem::create_directories(diagFile.parent_path(), ec);
if (!ec) {
if (!diagnostics.output.open(diagFile)) {
problems.emplace_back("Unable to open diagnostics json file " + diagFile.string());
diagnostics.level = Level::no_logs;
}
} else {
problems.emplace_back("Unable to create diagnostics directory " +
diagFile.parent_path().string() + ": " + ec.message());
}
if (diagnostics) {
std::filesystem::path diagFile =
getEnvOr("CODEQL_EXTRACTOR_SWIFT_DIAGNOSTIC_DIR", "extractor-out/diagnostics");
diagFile /= programName;
diagFile /= logBaseName;
diagFile.replace_extension(".jsonl");
std::error_code ec;
std::filesystem::create_directories(diagFile.parent_path(), ec);
if (!ec) {
if (!diagnostics.output.open(diagFile)) {
problems.emplace_back("Unable to open diagnostics json file " + diagFile.string());
diagnostics.level = Level::no_logs;
}
} else {
problems.emplace_back("Unable to create diagnostics directory " +
diagFile.parent_path().string() + ": " + ec.message());
diagnostics.level = Level::no_logs;
}
}
for (const auto& problem : problems) {
LOG_ERROR("{}", problem);
}
LOG_INFO("Logging configured (binary: {}, text: {}, console: {})", binary.level, text.level,
console.level);
LOG_INFO("Logging configured (binary: {}, text: {}, console: {}, diagnostics: {})", binary.level,
text.level, console.level, diagnostics.level);
initialized = true;
flushImpl();
}
@@ -160,6 +168,9 @@ void Log::flushImpl() {
if (binary) {
binary.output.flush();
}
if (diagnostics) {
diagnostics.output.flush();
}
}
Log::LoggerConfiguration Log::getLoggerConfigurationImpl(std::string_view name) {

36
swift/logging/SwiftLogging.h
View File

@@ -32,14 +32,17 @@
// only do the actual logging if the picked up `Logger` instance is configured to handle the
// provided log level. `LEVEL` must be a compile-time constant. `logger()` is evaluated once
#define LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, CATEGORY, ...) \
do { \
constexpr codeql::Log::Level _level = codeql::Log::Level::LEVEL; \
codeql::Logger& _logger = logger(); \
if (_level >= _logger.level()) { \
BINLOG_CREATE_SOURCE_AND_EVENT(_logger.writer(), _level, CATEGORY, binlog::clockNow(), \
__VA_ARGS__); \
} \
#define LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, CATEGORY, ...) \
do { \
constexpr codeql::Log::Level _level = ::codeql::Log::Level::LEVEL; \
::codeql::Logger& _logger = logger(); \
if (_level >= _logger.level()) { \
BINLOG_CREATE_SOURCE_AND_EVENT(_logger.writer(), _level, CATEGORY, ::binlog::clockNow(), \
__VA_ARGS__); \
} \
if (_level >= ::codeql::Log::Level::error) { \
::codeql::Log::flush(); \
} \
} while (false)
#define LOG_WITH_LEVEL(LEVEL, ...) LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, , __VA_ARGS__)
@@ -49,10 +52,10 @@
#define DIAGNOSE_CRITICAL(ID, ...) DIAGNOSE_WITH_LEVEL(critical, ID, __VA_ARGS__)
#define DIAGNOSE_ERROR(ID, ...) DIAGNOSE_WITH_LEVEL(error, ID, __VA_ARGS__)
#define DIAGNOSE_WITH_LEVEL(LEVEL, ID, ...) \
do { \
codeql::SwiftDiagnosticsSource::inscribe<&codeql_diagnostics::ID>(); \
LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, ID, __VA_ARGS__); \
#define DIAGNOSE_WITH_LEVEL(LEVEL, ID, ...) \
do { \
::codeql::SwiftDiagnosticsSource::ensureRegistered<&::codeql_diagnostics::ID>(); \
LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, ID, __VA_ARGS__); \
} while (false)
// avoid calling into binlog's original macros
@@ -96,7 +99,7 @@ extern const std::string_view programName;
// * using environment variable `CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS` to configure levels for
// loggers and outputs. This must have the form of a comma separated `spec:level` list, where
// `spec` is either a glob pattern (made up of alphanumeric, `/`, `*` and `.` characters) for
// matching logger names or one of `out:bin`, `out:text` or `out:console`.
// matching logger names or one of `out:binary`, `out:text`, `out:console` or `out:diagnostics`.
// Output default levels can be seen in the corresponding initializers below. By default, all
// loggers are configured with the lowest output level
class Log {
@@ -111,7 +114,11 @@ class Log {
};
// Flush logs to the designated outputs
static void flush() { instance().flushImpl(); }
static void flush() {
if (initialized) {
instance().flushImpl();
}
}
// create `Logger` configuration, used internally by `Logger`'s constructor
static LoggerConfiguration getLoggerConfiguration(std::string_view name) {
@@ -120,6 +127,7 @@ class Log {
private:
static constexpr const char* format = "%u %S [%n] %m (%G:%L)\n";
static bool initialized;
Log() { configure(); }

4
swift/ql/examples/qlpack.lock.yml Normal file
View File

@@ -0,0 +1,4 @@
---
dependencies: {}
compiled: false
lockVersion: 1.0.0

6
swift/ql/examples/qlpack.yml Normal file
View File

@@ -0,0 +1,6 @@
name: codeql/swift-examples
groups:
- swift
- examples
dependencies:
codeql/swift-all: ${workspace}

15
swift/ql/examples/snippets/empty_if.ql Normal file
View File

@@ -0,0 +1,15 @@
/**
* @name Empty 'if' statement
* @description Finds 'if' statements where the "then" branch is empty and no
* "else" branch exists.
* @id swift/examples/empty-if
* @tags example
*/
import swift
from IfStmt ifStmt
where
ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0 and
not exists(ifStmt.getElse())
select ifStmt, "This 'if' statement is redundant."

26
swift/ql/examples/snippets/simple_constant_password.ql Normal file
View File

@@ -0,0 +1,26 @@
/**
* @name Constant password
* @description Finds places where a string literal is used in a function call
* argument named "password".
* @id swift/examples/simple-constant-password
* @tags example
*/
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
module ConstantPasswordConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof StringLiteralExpr }
predicate isSink(DataFlow::Node node) {
// any argument called `password`
exists(CallExpr call | call.getArgumentWithLabel("password").getExpr() = node.asExpr())
}
}
module ConstantPasswordFlow = TaintTracking::Global<ConstantPasswordConfig>;
from DataFlow::Node sourceNode, DataFlow::Node sinkNode
where ConstantPasswordFlow::flow(sourceNode, sinkNode)
select sinkNode, "The value $@ is used as a constant password.", sourceNode, sourceNode.toString()

30
swift/ql/examples/snippets/simple_sql_injection.ql Normal file
View File

@@ -0,0 +1,30 @@
/**
* @name Database query built from user-controlled sources
* @description Finds places where a value from a remote or local user input
* is used as an argument to the SQLite ``Connection.execute(_:)``
* function.
* @id swift/examples/simple-sql-injection
* @tags example
*/
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
import codeql.swift.dataflow.FlowSources
module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
predicate isSink(DataFlow::Node node) {
exists(CallExpr call |
call.getStaticTarget().(Method).hasQualifiedName("Connection", "execute(_:)") and
call.getArgument(0).getExpr() = node.asExpr()
)
}
}
module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
from DataFlow::Node sourceNode, DataFlow::Node sinkNode
where SqlInjectionFlow::flow(sourceNode, sinkNode)
select sinkNode, "This query depends on a $@.", sourceNode, "user-provided value"

20
swift/ql/examples/snippets/simple_uncontrolled_string_format.ql Normal file
View File

@@ -0,0 +1,20 @@
/**
* @name Uncontrolled format string
* @description Finds calls to ``String.init(format:_:)`` where the format
* string is not a hard-coded string literal.
* @id swift/examples/simple-uncontrolled-format-string
* @tags example
*/
import swift
import codeql.swift.dataflow.DataFlow
from CallExpr call, Method method, DataFlow::Node sinkNode
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)") and
sinkNode.asExpr() = call.getArgument(0).getExpr() and
not exists(StringLiteralExpr sourceLiteral |
DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), sinkNode)
)
select call, "Format argument to " + method.getName() + " isn't hard-coded."

4
swift/ql/lib/codeql/swift/dataflow/Ssa.qll
View File

@@ -184,9 +184,7 @@ module Ssa {
*/
cached
predicate assigns(CfgNode value) {
exists(
AssignExpr a, SsaInput::BasicBlock bb, int i // TODO: use CFG node for assignment expr
|
exists(AssignExpr a, SsaInput::BasicBlock bb, int i |
this.definesAt(_, bb, i) and
a = bb.getNode(i).getNode().asAstNode() and
value.getNode().asAstNode() = a.getSource()

3
swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll
View File

@@ -215,9 +215,6 @@ class PropertyObserverCall extends DataFlowCall, TPropertyObserverCall {
i = -1 and
result = observer.getBase()
or
// TODO: This is correct for `willSet` (which takes a `newValue` parameter),
// but for `didSet` (which takes an `oldValue` parameter) we need an rvalue
// for `getBase()`.
i = 0 and
result = observer.getSource()
}

7
swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
View File

@@ -433,8 +433,6 @@ private module ArgumentNodes {
ObserverArgumentNode() {
observer.getBase() = this.getCfgNode()
or
// TODO: This should be an rvalue representing the `getBase` when
// `observer` a `didSet` observer.
observer.getSource() = this.getCfgNode()
}
@@ -444,7 +442,6 @@ private module ArgumentNodes {
pos = TThisArgument() and
observer.getBase() = this.getCfgNode()
or
// TODO: See the comment above for `didSet` observers.
pos.(PositionalArgumentPosition).getIndex() = 0 and
observer.getSource() = this.getCfgNode()
)
@@ -683,14 +680,14 @@ predicate storeStep(Node node1, ContentSet c, Node node2) {
// i.e. from `f(x)` where `x: T` into `f(.some(x))` where the context `f` expects a `T?`.
exists(InjectIntoOptionalExpr e |
e.convertsFrom(node1.asExpr()) and
node2 = node1 and // HACK: we should ideally have a separate Node case for the (hidden) InjectIntoOptionalExpr
node2 = node1 and // TODO: we should ideally have a separate Node case for the (hidden) InjectIntoOptionalExpr
c instanceof OptionalSomeContentSet
)
or
// creation of an optional by returning from a failable initializer (`init?`)
exists(Initializer init |
node1.asExpr().(CallExpr).getStaticTarget() = init and
node2 = node1 and // HACK: again, we should ideally have a separate Node case here, and not reuse the CallExpr
node2 = node1 and // TODO: again, we should ideally have a separate Node case here, and not reuse the CallExpr
c instanceof OptionalSomeContentSet and
init.isFailable()
)

4
swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll
View File

@@ -129,7 +129,9 @@ class PostUpdateNode extends Node instanceof PostUpdateNodeImpl {
Node getPreUpdateNode() { result = super.getPreUpdateNode() }
}
/** Gets a node corresponding to expression `e`. */
/**
* Gets a node corresponding to expression `e`.
*/
ExprNode exprNode(DataFlowExpr e) { result.asExpr() = e }
/**

12
swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll
View File

@@ -31,25 +31,19 @@ DataFlowType getContentType(ContentSet c) { any() }
/** Gets the return type of kind `rk` for callable `c`. */
bindingset[c]
DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
any() // TODO once we have type pruning
}
DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) { any() }
/**
* Gets the type of the parameter matching arguments at position `pos` in a
* synthesized call that targets a callback of type `t`.
*/
DataFlowType getCallbackParameterType(DataFlowType t, ArgumentPosition pos) {
any() // TODO once we have type pruning
}
DataFlowType getCallbackParameterType(DataFlowType t, ArgumentPosition pos) { any() }
/**
* Gets the return type of kind `rk` in a synthesized call that targets a
* callback of type `t`.
*/
DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) {
any() // TODO once we have type pruning
}
DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { any() }
/** Gets the type of synthetic global `sg`. */
DataFlowType getSyntheticGlobalType(SummaryComponent::SyntheticGlobal sg) { any() }

5
swift/ql/lib/codeql/swift/frameworks/StandardLibrary/CustomUrlSchemes.qll
View File

@@ -19,10 +19,6 @@ private class CustomUrlRemoteFlowSource extends SourceModelCsv {
";UIApplicationDelegate;true;application(_:open:options:);;;Parameter[1];remote",
";UIApplicationDelegate;true;application(_:handleOpen:);;;Parameter[1];remote",
";UIApplicationDelegate;true;application(_:open:sourceApplication:annotation:);;;Parameter[1];remote",
// TODO 1: The actual source is the value of `UIApplication.LaunchOptionsKey.url` in the launchOptions dictionary.
// Use dictionary value contents when available.
// ";UIApplicationDelegate;true;application(_:didFinishLaunchingWithOptions:);;;Parameter[1].MapValue;remote",
// ";UIApplicationDelegate;true;application(_:willFinishLaunchingWithOptions:);;;Parameter[1].MapValue;remote"
";UISceneDelegate;true;scene(_:continue:);;;Parameter[1];remote",
";UISceneDelegate;true;scene(_:didUpdate:);;;Parameter[1];remote",
";UISceneDelegate;true;scene(_:openURLContexts:);;;Parameter[1];remote",
@@ -36,7 +32,6 @@ private class CustomUrlRemoteFlowSource extends SourceModelCsv {
* `UIApplicationDelegate.application(_:didFinishLaunchingWithOptions:)` or
* `UIApplicationDelegate.application(_:willFinishLaunchingWithOptions:)`.
*/
// This is a temporary workaround until the TODO 1 above is addressed.
private class UrlLaunchOptionsRemoteFlowSource extends RemoteFlowSource {
UrlLaunchOptionsRemoteFlowSource() {
exists(ApplicationWithLaunchOptionsFunc f, SubscriptExpr e |

4
swift/xcode-autobuilder/BUILD.bazel
View File

@@ -13,6 +13,10 @@ swift_cc_binary(
"-framework CoreFoundation",
],
target_compatible_with = ["@platforms//os:macos"],
deps = [
"@absl//absl/strings",
"//swift/logging",
],
)
generate_cmake(

12
swift/xcode-autobuilder/CustomizingBuildDiagnostics.h Normal file
View File

@@ -0,0 +1,12 @@
#include <string_view>
namespace codeql_diagnostics {
constexpr std::string_view customizingBuildAction = "Set up a manual build command";
constexpr std::string_view customizingBuildHelpLinks =
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/"
"automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning "
"https://docs.github.com/en/enterprise-server/code-security/code-scanning/"
"automatically-scanning-your-code-for-vulnerabilities-and-errors/"
"configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-"
"language";
} // namespace codeql_diagnostics

24
swift/xcode-autobuilder/XcodeBuildRunner.cpp
View File

@@ -3,6 +3,21 @@
#include <vector>
#include <iostream>
#include <spawn.h>
#include "absl/strings/str_join.h"
#include "swift/logging/SwiftLogging.h"
#include "swift/xcode-autobuilder/CustomizingBuildDiagnostics.h"
namespace codeql_diagnostics {
constexpr codeql::SwiftDiagnosticsSource build_command_failed{
"build_command_failed", "Detected build command failed", customizingBuildAction,
customizingBuildHelpLinks};
}
static codeql::Logger& logger() {
static codeql::Logger ret{"build"};
return ret;
}
static int waitpid_status(pid_t child) {
int status;
@@ -52,13 +67,12 @@ void buildTarget(Target& target, bool dryRun) {
argv.push_back("CODE_SIGNING_ALLOWED=NO");
if (dryRun) {
for (auto& arg : argv) {
std::cout << arg + " ";
}
std::cout << "\n";
std::cout << absl::StrJoin(argv, " ") << "\n";
} else {
if (!exec(argv)) {
std::cerr << "Build failed\n";
DIAGNOSE_ERROR(build_command_failed, "The detected build command failed (tried {})",
absl::StrJoin(argv, " "));
codeql::Log::flush();
exit(1);
}
}

20
swift/xcode-autobuilder/XcodeProjectParser.cpp
View File

@@ -1,6 +1,4 @@
#include "swift/xcode-autobuilder/XcodeProjectParser.h"
#include "swift/xcode-autobuilder/XcodeWorkspaceParser.h"
#include "swift/xcode-autobuilder/CFHelpers.h"
#include <iostream>
#include <filesystem>
@@ -9,8 +7,24 @@
#include <fstream>
#include <CoreFoundation/CoreFoundation.h>
#include "swift/xcode-autobuilder/XcodeWorkspaceParser.h"
#include "swift/xcode-autobuilder/CFHelpers.h"
#include "swift/logging/SwiftLogging.h"
#include "swift/xcode-autobuilder/CustomizingBuildDiagnostics.h"
namespace codeql_diagnostics {
constexpr codeql::SwiftDiagnosticsSource no_project_found{
"no_project_found", "No Xcode project or workspace detected", customizingBuildAction,
customizingBuildHelpLinks};
} // namespace codeql_diagnostics
namespace fs = std::filesystem;
static codeql::Logger& logger() {
static codeql::Logger ret{"project"};
return ret;
}
struct TargetData {
std::string workspace;
std::string project;
@@ -253,7 +267,7 @@ std::vector<Target> collectTargets(const std::string& workingDir) {
// Getting a list of workspaces and the project that belong to them
auto workspaces = collectWorkspaces(workingDir);
if (workspaces.empty()) {
std::cerr << "[xcode autobuilder] Xcode project or workspace not found\n";
DIAGNOSE_ERROR(no_project_found, "No Xcode project or workspace was found");
exit(1);
}

3
swift/xcode-autobuilder/xcode-autobuilder.cpp
View File

@@ -4,10 +4,13 @@
#include "swift/xcode-autobuilder/XcodeTarget.h"
#include "swift/xcode-autobuilder/XcodeBuildRunner.h"
#include "swift/xcode-autobuilder/XcodeProjectParser.h"
#include "swift/logging/SwiftLogging.h"
static const char* Application = "com.apple.product-type.application";
static const char* Framework = "com.apple.product-type.framework";
const std::string_view codeql::programName = "autobuilder";
struct CLIArgs {
std::string workingDir;
bool dryRun;