diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index 2c84e013333..3f6482c1ebe 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -9,3 +9,4 @@ dependencies: codeql/ssa: ${workspace} codeql/tutorial: ${workspace} codeql/util: ${workspace} +warnOnImplicitThis: true diff --git a/cpp/ql/lib/semmle/code/cpp/controlflow/StackVariableReachability.qll b/cpp/ql/lib/semmle/code/cpp/controlflow/StackVariableReachability.qll index 3af5f2dbf0c..9fa5c57ef12 100644 --- a/cpp/ql/lib/semmle/code/cpp/controlflow/StackVariableReachability.qll +++ b/cpp/ql/lib/semmle/code/cpp/controlflow/StackVariableReachability.qll @@ -25,7 +25,7 @@ import cpp */ abstract class StackVariableReachability extends string { bindingset[this] - StackVariableReachability() { length() >= 0 } + StackVariableReachability() { this.length() >= 0 } /** Holds if `node` is a source for the reachability analysis using variable `v`. */ abstract predicate isSource(ControlFlowNode node, StackVariable v); @@ -227,7 +227,7 @@ predicate bbSuccessorEntryReachesLoopInvariant( */ abstract class StackVariableReachabilityWithReassignment extends StackVariableReachability { bindingset[this] - StackVariableReachabilityWithReassignment() { length() >= 0 } + StackVariableReachabilityWithReassignment() { this.length() >= 0 } /** Override this predicate rather than `isSource` (`isSource` is used internally). */ abstract predicate isSourceActual(ControlFlowNode node, StackVariable v); @@ -330,7 +330,7 @@ abstract class StackVariableReachabilityWithReassignment extends StackVariableRe */ abstract class StackVariableReachabilityExt extends string { bindingset[this] - StackVariableReachabilityExt() { length() >= 0 } + StackVariableReachabilityExt() { this.length() >= 0 } /** `node` is a source for the reachability analysis using variable `v`. */ abstract predicate isSource(ControlFlowNode node, StackVariable v); diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll index a1fa08daa7d..00b241bc4fa 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll @@ -206,7 +206,34 @@ private predicate deconstructSizeExpr(Expr sizeExpr, Expr lengthExpr, int sizeof } /** A `Function` that is a call target of an allocation. */ -private signature class CallAllocationExprTarget extends Function; +private signature class CallAllocationExprTarget extends Function { + /** + * Gets the index of the input pointer argument to be reallocated, if + * this is a `realloc` function. + */ + int getReallocPtrArg(); + + /** + * Gets the index of the argument for the allocation size, if any. The actual + * allocation size is the value of this argument multiplied by the result of + * `getSizeMult()`, in bytes. + */ + int getSizeArg(); + + /** + * Gets the index of an argument that multiplies the allocation size given + * by `getSizeArg`, if any. + */ + int getSizeMult(); + + /** + * Holds if this allocation requires a + * corresponding deallocation of some sort (most do, but `alloca` for example + * does not). If it is unclear, we default to no (for example a placement `new` + * allocation may or may not require a corresponding `delete`). + */ + predicate requiresDealloc(); +} /** * This module abstracts over the type of allocation call-targets and provides a @@ -220,118 +247,68 @@ private signature class CallAllocationExprTarget extends Function; * function using various heuristics. */ private module CallAllocationExprBase { - /** A module that contains the collection of member-predicates required on `Target`. */ - signature module Param { - /** - * Gets the index of the input pointer argument to be reallocated, if - * this is a `realloc` function. - */ - int getReallocPtrArg(Target target); - - /** - * Gets the index of the argument for the allocation size, if any. The actual - * allocation size is the value of this argument multiplied by the result of - * `getSizeMult()`, in bytes. - */ - int getSizeArg(Target target); - - /** - * Gets the index of an argument that multiplies the allocation size given - * by `getSizeArg`, if any. - */ - int getSizeMult(Target target); - - /** - * Holds if this allocation requires a - * corresponding deallocation of some sort (most do, but `alloca` for example - * does not). If it is unclear, we default to no (for example a placement `new` - * allocation may or may not require a corresponding `delete`). - */ - predicate requiresDealloc(Target target); - } - /** - * A module that abstracts over a collection of predicates in - * the `Param` module). This should really be member-predicates - * on `CallAllocationExprTarget`, but we cannot yet write this in QL. + * An allocation expression that is a function call, such as call to `malloc`. */ - module With { - private import P + class CallAllocationExprImpl instanceof FunctionCall { + Target target; - /** - * An allocation expression that is a function call, such as call to `malloc`. - */ - class CallAllocationExprImpl instanceof FunctionCall { - Target target; - - CallAllocationExprImpl() { - target = this.getTarget() and - // realloc(ptr, 0) only frees the pointer - not ( - exists(getReallocPtrArg(target)) and - this.getArgument(getSizeArg(target)).getValue().toInt() = 0 - ) and - // these are modeled directly (and more accurately), avoid duplication - not exists(NewOrNewArrayExpr new | new.getAllocatorCall() = this) - } - - string toString() { result = super.toString() } - - Expr getSizeExprImpl() { - exists(Expr sizeExpr | sizeExpr = super.getArgument(getSizeArg(target)) | - if exists(getSizeMult(target)) - then result = sizeExpr - else - exists(Expr lengthExpr | - deconstructSizeExpr(sizeExpr, lengthExpr, _) and - result = lengthExpr - ) - ) - } - - int getSizeMultImpl() { - // malloc with multiplier argument that is a constant - result = super.getArgument(getSizeMult(target)).getValue().toInt() - or - // malloc with no multiplier argument - not exists(getSizeMult(target)) and - deconstructSizeExpr(super.getArgument(getSizeArg(target)), _, result) - } - - int getSizeBytesImpl() { - result = this.getSizeExprImpl().getValue().toInt() * this.getSizeMultImpl() - } - - Expr getReallocPtrImpl() { result = super.getArgument(getReallocPtrArg(target)) } - - Type getAllocatedElementTypeImpl() { - result = - super.getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType() and - not result instanceof VoidType - } - - predicate requiresDeallocImpl() { requiresDealloc(target) } + CallAllocationExprImpl() { + target = this.getTarget() and + // realloc(ptr, 0) only frees the pointer + not ( + exists(target.getReallocPtrArg()) and + this.getArgument(target.getSizeArg()).getValue().toInt() = 0 + ) and + // these are modeled directly (and more accurately), avoid duplication + not exists(NewOrNewArrayExpr new | new.getAllocatorCall() = this) } + + string toString() { result = super.toString() } + + Expr getSizeExprImpl() { + exists(Expr sizeExpr | sizeExpr = super.getArgument(target.getSizeArg()) | + if exists(target.getSizeMult()) + then result = sizeExpr + else + exists(Expr lengthExpr | + deconstructSizeExpr(sizeExpr, lengthExpr, _) and + result = lengthExpr + ) + ) + } + + int getSizeMultImpl() { + // malloc with multiplier argument that is a constant + result = super.getArgument(target.getSizeMult()).getValue().toInt() + or + // malloc with no multiplier argument + not exists(target.getSizeMult()) and + deconstructSizeExpr(super.getArgument(target.getSizeArg()), _, result) + } + + int getSizeBytesImpl() { + result = this.getSizeExprImpl().getValue().toInt() * this.getSizeMultImpl() + } + + Expr getReallocPtrImpl() { result = super.getArgument(target.getReallocPtrArg()) } + + Type getAllocatedElementTypeImpl() { + result = + super.getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType() and + not result instanceof VoidType + } + + predicate requiresDeallocImpl() { target.requiresDealloc() } } } private module CallAllocationExpr { - private module Param implements CallAllocationExprBase::Param { - int getReallocPtrArg(AllocationFunction f) { result = f.getReallocPtrArg() } - - int getSizeArg(AllocationFunction f) { result = f.getSizeArg() } - - int getSizeMult(AllocationFunction f) { result = f.getSizeMult() } - - predicate requiresDealloc(AllocationFunction f) { f.requiresDealloc() } - } - /** * A class that provides the implementation of `AllocationExpr` for an allocation * that calls an `AllocationFunction`. */ - private class Base = - CallAllocationExprBase::With::CallAllocationExprImpl; + private class Base = CallAllocationExprBase::CallAllocationExprImpl; class CallAllocationExpr extends AllocationExpr, Base { override Expr getSizeExpr() { result = super.getSizeExprImpl() } @@ -452,22 +429,11 @@ private module HeuristicAllocation { override predicate requiresDealloc() { none() } } - private module Param implements CallAllocationExprBase::Param { - int getReallocPtrArg(HeuristicAllocationFunction f) { result = f.getReallocPtrArg() } - - int getSizeArg(HeuristicAllocationFunction f) { result = f.getSizeArg() } - - int getSizeMult(HeuristicAllocationFunction f) { result = f.getSizeMult() } - - predicate requiresDealloc(HeuristicAllocationFunction f) { f.requiresDealloc() } - } - /** * A class that provides the implementation of `AllocationExpr` for an allocation * that calls an `HeuristicAllocationFunction`. */ - private class Base = - CallAllocationExprBase::With::CallAllocationExprImpl; + private class Base = CallAllocationExprBase::CallAllocationExprImpl; private class CallAllocationExpr extends HeuristicAllocationExpr, Base { override Expr getSizeExpr() { result = super.getSizeExprImpl() } diff --git a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisStage.qll b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisStage.qll index cbccb4a6ca8..58c6e62fe2e 100644 --- a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisStage.qll +++ b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisStage.qll @@ -277,7 +277,7 @@ module RangeStage< */ private class SafeCastExpr extends ConvertOrBoxExpr { SafeCastExpr() { - conversionCannotOverflow(getTrackedType(pragma[only_bind_into](getOperand())), + conversionCannotOverflow(getTrackedType(pragma[only_bind_into](this.getOperand())), pragma[only_bind_out](getTrackedType(this))) } } diff --git a/cpp/ql/lib/upgrades/282c13bfdbcbd57a887972b47a471342a4ad5507/member_function_this_type.ql b/cpp/ql/lib/upgrades/282c13bfdbcbd57a887972b47a471342a4ad5507/member_function_this_type.ql index 2e99f1ed5f0..4b10d3627c1 100644 --- a/cpp/ql/lib/upgrades/282c13bfdbcbd57a887972b47a471342a4ad5507/member_function_this_type.ql +++ b/cpp/ql/lib/upgrades/282c13bfdbcbd57a887972b47a471342a4ad5507/member_function_this_type.ql @@ -24,7 +24,7 @@ class ClassPointerType extends @derivedtype { Class getBaseType() { derivedtypes(this, _, _, result) } - string toString() { result = getBaseType().toString() + "*" } + string toString() { result = this.getBaseType().toString() + "*" } } class DefinedMemberFunction extends @function { diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index 3718b83cb14..4df58a2da69 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -10,3 +10,4 @@ dependencies: suites: codeql-suites extractor: cpp defaultSuiteFile: codeql-suites/cpp-code-scanning.qls +warnOnImplicitThis: true diff --git a/cpp/ql/test/qlpack.yml b/cpp/ql/test/qlpack.yml index 34c48f7029b..6ee37c09b64 100644 --- a/cpp/ql/test/qlpack.yml +++ b/cpp/ql/test/qlpack.yml @@ -5,3 +5,4 @@ dependencies: codeql/cpp-queries: ${workspace} extractor: cpp tests: . +warnOnImplicitThis: true diff --git a/docs/codeql/codeql-language-guides/analyzing-data-flow-in-swift.rst b/docs/codeql/codeql-language-guides/analyzing-data-flow-in-swift.rst new file mode 100644 index 00000000000..9de7d620abf --- /dev/null +++ b/docs/codeql/codeql-language-guides/analyzing-data-flow-in-swift.rst @@ -0,0 +1,291 @@ +.. _analyzing-data-flow-in-swift: + +Analyzing data flow in Swift +============================ + +You can use CodeQL to track the flow of data through a Swift program to places where the data is used. + +.. include:: ../reusables/swift-beta-note.rst + +About this article +------------------ + +This article describes how data flow analysis is implemented in the CodeQL libraries for Swift and includes examples to help you write your own data flow queries. +The following sections describe how to use the libraries for local data flow, global data flow, and taint tracking. +For a more general introduction to modeling data flow, see ":ref:`About data flow analysis `." + +Local data flow +--------------- + +Local data flow tracks the flow of data within a single function. Local data flow is easier, faster, and more precise than global data flow. Before looking at more complex tracking, you should always consider local tracking because it is sufficient for many queries. + +Using local data flow +~~~~~~~~~~~~~~~~~~~~~ + +You can use the local data flow library by importing the ``DataFlow`` module. The library uses the class ``Node`` to represent any element through which data can flow. +The ``Node`` class has a number of useful subclasses, such as ``ExprNode`` for expressions and ``ParameterNode`` for parameters. You can map between data flow nodes and expressions/control-flow nodes using the member predicates ``asExpr`` and ``getCfgNode``: + +.. code-block:: ql + + class Node { + /** + * Gets the expression that corresponds to this node, if any. + */ + Expr asExpr() { ... } + + /** + * Gets the control flow node that corresponds to this data flow node. + */ + ControlFlowNode getCfgNode() { ... } + + ... + } + +You can use the predicates ``exprNode`` and ``parameterNode`` to map from expressions and parameters to their data-flow node: + +.. code-block:: ql + + /** + * Gets a node corresponding to expression `e`. + */ + ExprNode exprNode(DataFlowExpr e) { result.asExpr() = e } + + /** + * Gets the node corresponding to the value of parameter `p` at function entry. + */ + ParameterNode parameterNode(DataFlowParameter p) { result.getParameter() = p } + +There can be multiple data-flow nodes associated with a single expression node in the AST. + +The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``. +You can apply the predicate recursively, by using the ``+`` and ``*`` operators, or you can use the predefined recursive predicate ``localFlow``. + +For example, you can find flow from an expression ``source`` to an expression ``sink`` in zero or more local steps: + +.. code-block:: ql + + DataFlow::localFlow(DataFlow::exprNode(source), DataFlow::exprNode(sink)) + +Using local taint tracking +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Local taint tracking extends local data flow to include flow steps where values are not preserved, such as string manipulation. +For example: + +.. code-block:: swift + + temp = x + y = temp + ", " + temp + +If ``x`` is a tainted string then ``y`` is also tainted. + +The local taint tracking library is in the module ``TaintTracking``. +Like local data flow, a predicate ``localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo)`` holds if there is an immediate taint propagation edge from the node ``nodeFrom`` to the node ``nodeTo``. +You can apply the predicate recursively, by using the ``+`` and ``*`` operators, or you can use the predefined recursive predicate ``localTaint``. + +For example, you can find taint propagation from an expression ``source`` to an expression ``sink`` in zero or more local steps: + +.. code-block:: ql + + TaintTracking::localTaint(DataFlow::exprNode(source), DataFlow::exprNode(sink)) + +Examples of local data flow +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This query finds the ``format`` argument passed into each call to ``String.init(format:_:)``: + +.. code-block:: ql + + import swift + + from CallExpr call, Method method + where + call.getStaticTarget() = method and + method.hasQualifiedName("String", "init(format:_:)") + select call.getArgument(0).getExpr() + +Unfortunately this will only give the expression in the argument, not the values which could be passed to it. +So we use local data flow to find all expressions that flow into the argument: + +.. code-block:: ql + + import swift + import codeql.swift.dataflow.DataFlow + + from CallExpr call, Method method, Expr sourceExpr, Expr sinkExpr + where + call.getStaticTarget() = method and + method.hasQualifiedName("String", "init(format:_:)") and + sinkExpr = call.getArgument(0).getExpr() and + DataFlow::localFlow(DataFlow::exprNode(sourceExpr), DataFlow::exprNode(sinkExpr)) + select sourceExpr, sinkExpr + +We can vary the source, for example, making the source the parameter of a function rather than an expression. The following query finds where a parameter is used for the format: + +.. code-block:: ql + + import swift + import codeql.swift.dataflow.DataFlow + + from CallExpr call, Method method, ParamDecl sourceParam, Expr sinkExpr + where + call.getStaticTarget() = method and + method.hasQualifiedName("String", "init(format:_:)") and + sinkExpr = call.getArgument(0).getExpr() and + DataFlow::localFlow(DataFlow::parameterNode(sourceParam), DataFlow::exprNode(sinkExpr)) + select sourceParam, sinkExpr + +The following example finds calls to ``String.init(format:_:)`` where the format string is not a hard-coded string literal: + +.. code-block:: ql + + import swift + import codeql.swift.dataflow.DataFlow + + from CallExpr call, Method method, DataFlow::Node sinkNode + where + call.getStaticTarget() = method and + method.hasQualifiedName("String", "init(format:_:)") and + sinkNode.asExpr() = call.getArgument(0).getExpr() and + not exists(StringLiteralExpr sourceLiteral | + DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), sinkNode) + ) + select call, "Format argument to " + method.getName() + " isn't hard-coded." + +Global data flow +---------------- + +Global data flow tracks data flow throughout the entire program, and is therefore more powerful than local data flow. +However, global data flow is less precise than local data flow, and the analysis typically requires significantly more time and memory to perform. + +.. pull-quote:: Note + + .. include:: ../reusables/path-problem.rst + +Using global data flow +~~~~~~~~~~~~~~~~~~~~~~ + +You can use the global data flow library by implementing the module ``DataFlow::ConfigSig``: + +.. code-block:: ql + + import codeql.swift.dataflow.DataFlow + + module MyDataFlowConfiguration implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { + ... + } + + predicate isSink(DataFlow::Node sink) { + ... + } + } + + module MyDataFlow = DataFlow::Global; + +These predicates are defined in the configuration: + +- ``isSource`` - defines where data may flow from. +- ``isSink`` - defines where data may flow to. +- ``isBarrier`` - optionally, restricts the data flow. +- ``isAdditionalFlowStep`` - optionally, adds additional flow steps. + +The last line (``module MyDataFlow = ...``) instantiates the parameterized module for data flow analysis by passing the configuration to the parameterized module. Data flow analysis can then be performed using ``MyDataFlow::flow(DataFlow::Node source, DataFlow::Node sink)``: + +.. code-block:: ql + + from DataFlow::Node source, DataFlow::Node sink + where MyDataFlow::flow(source, sink) + select source, "Dataflow to $@.", sink, sink.toString() + +Using global taint tracking +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Global taint tracking is to global data flow what local taint tracking is to local data flow. +That is, global taint tracking extends global data flow with additional non-value-preserving steps. +The global taint tracking library uses the same configuration module as the global data flow library. You can perform taint flow analysis using ``TaintTracking::Global``: + +.. code-block:: ql + + module MyTaintFlow = TaintTracking::Global; + + from DataFlow::Node source, DataFlow::Node sink + where MyTaintFlow::flow(source, sink) + select source, "Taint flow to $@.", sink, sink.toString() + +Predefined sources +~~~~~~~~~~~~~~~~~~ + +The data flow library module ``codeql.swift.dataflow.FlowSources`` contains a number of predefined sources that you can use to write security queries to track data flow and taint flow. + +- The class ``RemoteFlowSource`` represents data flow from remote network inputs and from other applications. +- The class ``LocalFlowSource`` represents data flow from local user input. +- The class ``FlowSource`` includes both of the above. + +Examples of global data flow +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The following global taint-tracking query finds places where a string literal is used in a function call argument named "password". + - Since this is a taint-tracking query, the ``TaintTracking::Global`` module is used. + - The ``isSource`` predicate defines sources as any ``StringLiteralExpr``. + - The ``isSink`` predicate defines sinks as arguments to a ``CallExpr`` called "password". + - The sources and sinks may need tuning to a particular use, for example, if passwords are represented by a type other than ``String`` or passed in arguments of a different name than "password". + +.. code-block:: ql + + import swift + import codeql.swift.dataflow.DataFlow + import codeql.swift.dataflow.TaintTracking + + module ConstantPasswordConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node node) { node.asExpr() instanceof StringLiteralExpr } + + predicate isSink(DataFlow::Node node) { + // any argument called `password` + exists(CallExpr call | call.getArgumentWithLabel("password").getExpr() = node.asExpr()) + } + + module ConstantPasswordFlow = TaintTracking::Global; + + from DataFlow::Node sourceNode, DataFlow::Node sinkNode + where ConstantPasswordFlow::flow(sourceNode, sinkNode) + select sinkNode, "The value $@ is used as a constant password.", sourceNode, sourceNode.toString() + + +The following global taint-tracking query finds places where a value from a remote or local user input is used as an argument to the SQLite ``Connection.execute(_:)`` function. + - Since this is a taint-tracking query, the ``TaintTracking::Global`` module is used. + - The ``isSource`` predicate defines sources as a ``FlowSource`` (remote or local user input). + - The ``isSink`` predicate defines sinks as the first argument in any call to ``Connection.execute(_:)``. + +.. code-block:: ql + + import swift + import codeql.swift.dataflow.DataFlow + import codeql.swift.dataflow.TaintTracking + import codeql.swift.dataflow.FlowSources + + module SqlInjectionConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node node) { node instanceof FlowSource } + + predicate isSink(DataFlow::Node node) { + exists(CallExpr call | + call.getStaticTarget().(Method).hasQualifiedName("Connection", "execute(_:)") and + call.getArgument(0).getExpr() = node.asExpr() + ) + } + } + + module SqlInjectionFlow = TaintTracking::Global; + + from DataFlow::Node sourceNode, DataFlow::Node sinkNode + where SqlInjectionFlow::flow(sourceNode, sinkNode) + select sinkNode, "This query depends on a $@.", sourceNode, "user-provided value" + +Further reading +--------------- + +- ":ref:`Exploring data flow with path queries `" + + +.. include:: ../reusables/swift-further-reading.rst +.. include:: ../reusables/codeql-ref-tools-further-reading.rst diff --git a/docs/codeql/codeql-language-guides/basic-query-for-swift-code.rst b/docs/codeql/codeql-language-guides/basic-query-for-swift-code.rst new file mode 100644 index 00000000000..fdaa1ec6290 --- /dev/null +++ b/docs/codeql/codeql-language-guides/basic-query-for-swift-code.rst @@ -0,0 +1,131 @@ +.. _basic-query-for-swift-code: + +Basic query for Swift code +========================== + +Learn to write and run a simple CodeQL query using Visual Studio Code with the CodeQL extension. + +.. include:: ../reusables/swift-beta-note.rst +.. include:: ../reusables/vs-code-basic-instructions/setup-to-run-queries.rst + +About the query +--------------- + +The query we're going to run performs a basic search of the code for ``if`` expressions that are redundant, in the sense that they have an empty ``then`` branch. For example, code such as: + +.. code-block:: swift + + if error { + // we should handle the error + } + +.. include:: ../reusables/vs-code-basic-instructions/find-database.rst + +Running a quick query +--------------------- + +.. include:: ../reusables/vs-code-basic-instructions/run-quick-query-1.rst + +#. In the quick query tab, delete the content and paste in the following query. + + .. code-block:: ql + + import swift + + from IfStmt ifStmt + where ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0 + select ifStmt, "This 'if' statement is redundant." + +.. include:: ../reusables/vs-code-basic-instructions/run-quick-query-2.rst + +.. image:: ../images/codeql-for-visual-studio-code/basic-swift-query-results-1.png + :align: center + +If any matching code is found, click a link in the ``ifStmt`` column to open the file and highlight the matching ``if`` statement. + +.. image:: ../images/codeql-for-visual-studio-code/basic-swift-query-results-2.png + :align: center + +.. include:: ../reusables/vs-code-basic-instructions/note-store-quick-query.rst + +About the query structure +~~~~~~~~~~~~~~~~~~~~~~~~~ + +After the initial ``import`` statement, this simple query comprises three parts that serve similar purposes to the FROM, WHERE, and SELECT parts of an SQL query. + ++------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+ +| Query part | Purpose | Details | ++==================================================================+===================================================================================================================+=================================================================================================+ +| ``import swift`` | Imports the standard CodeQL AST libraries for Swift. | Every query begins with one or more ``import`` statements. | ++------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+ +| ``from IfStmt ifStmt`` | Defines the variables for the query. | We use: an ``IfStmt`` variable for ``if`` statements. | +| | Declarations are of the form: | | +| | `` `` | | ++------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+ +| ``where ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0`` | Defines a condition on the variables. | ``ifStmt.getThen()``: gets the ``then`` branch of the ``if`` expression. | +| | | ``.(BraceStmt)``: requires that the ``then`` branch is a brace statement (``{ }``). | +| | | ``.getNumberOfElements() = 0``: requires that the brace statement contains no child statements. | ++------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+ +| ``select ifStmt, "This 'if' statement is redundant."`` | Defines what to report for each match. | Reports the resulting ``if`` statement with a string that explains the problem. | +| | | | +| | ``select`` statements for queries that are used to find instances of poor coding practice are always in the form: | | +| | ``select , ""`` | | ++------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------+ + +Extend the query +---------------- + +Query writing is an inherently iterative process. You write a simple query and then, when you run it, you discover examples that you had not previously considered, or opportunities for improvement. + +Remove false positive results +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Browsing the results of our basic query shows that it could be improved. Among the results you are likely to find examples of ``if`` statements with an ``else`` branch, where an empty ``then`` branch does serve a purpose. For example: + +.. code-block:: swift + + if (option == "-verbose") { + // nothing to do - handled earlier + } else { + handleError("unrecognized option") + } + +In this case, identifying the ``if`` statement with the empty ``then`` branch as redundant is a false positive. One solution to this is to modify the query to select ``if`` statements where both the ``then`` and ``else`` branches are missing. + +To exclude ``if`` statements that have an ``else`` branch: + +#. Add the following to the where clause: + + .. code-block:: ql + + and not exists(ifStmt.getElse()) + + The ``where`` clause is now: + + .. code-block:: ql + + where + ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0 and + not exists(ifStmt.getElse()) + +#. Re-run the query. + + There are now fewer results because ``if`` expressions with an ``else`` branch are no longer included. + +Further reading +--------------- + +.. include:: ../reusables/swift-further-reading.rst +.. include:: ../reusables/codeql-ref-tools-further-reading.rst + +.. Article-specific substitutions for the reusables used in docs/codeql/reusables/vs-code-basic-instructions + +.. |language-text| replace:: Swift + +.. |language-code| replace:: ``swift`` + +.. |example-url| replace:: https://github.com/alamofire/alamofire + +.. |image-quick-query| image:: ../images/codeql-for-visual-studio-code/quick-query-tab-swift.png + +.. |result-col-1| replace:: The first column corresponds to the expression ``ifStmt`` and is linked to the location in the source code of the project where ``ifStmt`` occurs. diff --git a/docs/codeql/codeql-language-guides/codeql-for-swift.rst b/docs/codeql/codeql-language-guides/codeql-for-swift.rst new file mode 100644 index 00000000000..132ab004d6f --- /dev/null +++ b/docs/codeql/codeql-language-guides/codeql-for-swift.rst @@ -0,0 +1,18 @@ +.. _codeql-for-swift: + +CodeQL for Swift +================ + +Experiment and learn how to write effective and efficient queries for CodeQL databases generated from Swift codebases. + +.. include:: ../reusables/swift-beta-note.rst + +.. toctree:: + :hidden: + + basic-query-for-swift-code + analyzing-data-flow-in-swift + +- :doc:`Basic query for Swift code `: Learn to write and run a simple CodeQL query. + +- :doc:`Analyzing data flow in Swift `: You can use CodeQL to track the flow of data through a Swift program to places where the data is used. diff --git a/docs/codeql/codeql-language-guides/index.rst b/docs/codeql/codeql-language-guides/index.rst index 79f3f79ac54..2b4fabc01a7 100644 --- a/docs/codeql/codeql-language-guides/index.rst +++ b/docs/codeql/codeql-language-guides/index.rst @@ -14,3 +14,4 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat codeql-for-javascript codeql-for-python codeql-for-ruby + codeql-for-swift diff --git a/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-1.png b/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-1.png new file mode 100644 index 00000000000..3ab9607442d Binary files /dev/null and b/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-1.png differ diff --git a/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-2.png b/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-2.png new file mode 100644 index 00000000000..b3e42e7a954 Binary files /dev/null and b/docs/codeql/images/codeql-for-visual-studio-code/basic-swift-query-results-2.png differ diff --git a/docs/codeql/images/codeql-for-visual-studio-code/quick-query-tab-swift.png b/docs/codeql/images/codeql-for-visual-studio-code/quick-query-tab-swift.png new file mode 100644 index 00000000000..e7caf3dd438 Binary files /dev/null and b/docs/codeql/images/codeql-for-visual-studio-code/quick-query-tab-swift.png differ diff --git a/docs/codeql/reusables/extractors.rst b/docs/codeql/reusables/extractors.rst index 606c57d0208..bfcd7571cb7 100644 --- a/docs/codeql/reusables/extractors.rst +++ b/docs/codeql/reusables/extractors.rst @@ -17,4 +17,6 @@ * - Python - ``python`` * - Ruby - - ``ruby`` \ No newline at end of file + - ``ruby`` + * - Swift + - ``swift`` \ No newline at end of file diff --git a/docs/codeql/reusables/supported-frameworks.rst b/docs/codeql/reusables/supported-frameworks.rst index cd1112a6e0c..520969d51c8 100644 --- a/docs/codeql/reusables/supported-frameworks.rst +++ b/docs/codeql/reusables/supported-frameworks.rst @@ -278,3 +278,34 @@ and the CodeQL library pack ``codeql/ruby-all`` (`changelog `__, `source `__) +and the CodeQL library pack ``codeql/swift-all`` (`changelog `__, `source `__). + +.. csv-table:: + :header-rows: 1 + :class: fullWidthTable + :widths: auto + + Name, Category + `AEXML `__, XML processing library + `Alamofire `__, Network communicator + `Core Data `__, Database + `CryptoKit `__, Cryptography library + `CryptoSwift `__, Cryptography library + `Foundation `__, Utility library + `GRDB `__, Database + `JavaScriptCore `__, Scripting library + `Libxml2 `__, XML processing library + `Network `__, Network communicator + `Realm Swift `__, Database + `RNCryptor `__, Cryptography library + `SQLite3 `__, Database + `SQLite.swift `__, Database + `WebKit `__, User interface library diff --git a/docs/codeql/reusables/supported-versions-compilers.rst b/docs/codeql/reusables/supported-versions-compilers.rst index 04bc890c707..4e43433ced7 100644 --- a/docs/codeql/reusables/supported-versions-compilers.rst +++ b/docs/codeql/reusables/supported-versions-compilers.rst @@ -24,7 +24,8 @@ JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [7]_" Python [8]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11",Not applicable,``.py`` Ruby [9]_,"up to 3.2",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``" - TypeScript [10]_,"2.6-5.0",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``" + Swift [10]_,"Swift 5.4-5.7","Swift compiler","``.swift``" + TypeScript [11]_,"2.6-5.0",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``" .. container:: footnote-group @@ -37,4 +38,5 @@ .. [7] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files. .. [8] The extractor requires Python 3 to run. To analyze Python 2.7 you should install both versions of Python. .. [9] Requires glibc 2.17. - .. [10] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default. + .. [10] Swift support is currently in beta. Support for the analysis of Swift 5.4-5.7 requires macOS. Swift 5.7.3 can also be analyzed using Linux. + .. [11] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default. diff --git a/docs/codeql/reusables/swift-beta-note.rst b/docs/codeql/reusables/swift-beta-note.rst new file mode 100644 index 00000000000..27336683340 --- /dev/null +++ b/docs/codeql/reusables/swift-beta-note.rst @@ -0,0 +1,4 @@ + .. pull-quote:: Note + + CodeQL analysis for Swift is currently in beta. During the beta, analysis of Swift code, + and the accompanying documentation, will not be as comprehensive as for other languages. \ No newline at end of file diff --git a/docs/codeql/reusables/swift-further-reading.rst b/docs/codeql/reusables/swift-further-reading.rst new file mode 100644 index 00000000000..306bc0fa0c0 --- /dev/null +++ b/docs/codeql/reusables/swift-further-reading.rst @@ -0,0 +1,4 @@ +- `CodeQL queries for Swift `__ +- `Example queries for Swift `__ +- `CodeQL library reference for Swift `__ + diff --git a/java/ql/lib/change-notes/2023-05-02-apache-commons-net-models.md b/java/ql/lib/change-notes/2023-05-02-apache-commons-net-models.md new file mode 100644 index 00000000000..a669c74d3e8 --- /dev/null +++ b/java/ql/lib/change-notes/2023-05-02-apache-commons-net-models.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Added models for the Apache Commons Net library. diff --git a/java/ql/lib/ext/org.apache.commons.net.model.yml b/java/ql/lib/ext/org.apache.commons.net.model.yml new file mode 100644 index 00000000000..1ea8876a4e1 --- /dev/null +++ b/java/ql/lib/ext/org.apache.commons.net.model.yml @@ -0,0 +1,30 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress)", "", "Argument[0]", "open-url", "manual"] + - ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int)", "", "Argument[0]", "open-url", "manual"] + - ["org.apache.commons.net", "SocketClient", true, "connect", "(InetAddress,int,InetAddress,int)", "", "Argument[0]", "open-url", "manual"] + - ["org.apache.commons.net", "SocketClient", true, "connect", "(String)", "", "Argument[0]", "open-url", "manual"] + - ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int)", "", "Argument[0]", "open-url", "df-manual"] + - ["org.apache.commons.net", "SocketClient", true, "connect", "(String,int,InetAddress,int)", "", "Argument[0]", "open-url", "manual"] + - ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String)", "", "Argument[0]", "read-file", "df-manual"] + - ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(File,String,String)", "", "Argument[0]", "read-file", "df-manual"] + - ["org.apache.commons.net.util", "KeyManagerUtils", false, "createClientKeyManager", "(String,File,String,String,String)", "", "Argument[1]", "read-file", "df-manual"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "()", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listDirectories", "(String)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "()", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listFiles", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "()", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "listNames", "(String)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "()", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "mlistDir", "(String,FTPFileFilter)", "", "ReturnValue", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFile", "(String,OutputStream)", "", "Argument[1]", "remote", "df-manual"] + - ["org.apache.commons.net.ftp", "FTPClient", true, "retrieveFileStream", "(String)", "", "ReturnValue", "remote", "df-manual"] diff --git a/swift/README.md b/swift/README.md index bbf0ef30dc6..b16d5efe360 100644 --- a/swift/README.md +++ b/swift/README.md @@ -52,7 +52,7 @@ A log file is produced for each run under `CODEQL_EXTRACTOR_SWIFT_LOG_DIR` (the You can use the environment variable `CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS` to configure levels for loggers and outputs. This must have the form of a comma separated `spec:min_level` list, where `spec` is either a glob pattern (made up of alphanumeric, `/`, `*` and `.` characters) for -matching logger names or one of `out:bin`, `out:text` or `out:console`, and `min_level` is one +matching logger names or one of `out:binary`, `out:text`, `out:console` or `out:diagnostics`, and `min_level` is one of `trace`, `debug`, `info`, `warning`, `error`, `critical` or `no_logs` to turn logs completely off. Current output default levels are no binary logs, `info` logs or higher in the text file and `warning` logs or higher on diff --git a/swift/extractor/infra/SwiftDispatcher.h b/swift/extractor/infra/SwiftDispatcher.h index 33b0614e435..7a1548c4f53 100644 --- a/swift/extractor/infra/SwiftDispatcher.h +++ b/swift/extractor/infra/SwiftDispatcher.h @@ -5,6 +5,7 @@ #include #include #include +#include "absl/strings/str_cat.h" #include "swift/extractor/trap/TrapDomain.h" #include "swift/extractor/infra/SwiftTagTraits.h" @@ -83,7 +84,7 @@ class SwiftDispatcher { valid = false; } LOG_ERROR("{} has undefined field {}{}, {}", entry.NAME, field, - index >= 0 ? ('[' + std::to_string(index) + ']') : "", action); + index >= 0 ? absl::StrCat("[", index, "]") : "", action); } }); if (valid) { diff --git a/swift/extractor/infra/SwiftMangledName.cpp b/swift/extractor/infra/SwiftMangledName.cpp index 83bf2ff5708..d4c88c3d314 100644 --- a/swift/extractor/infra/SwiftMangledName.cpp +++ b/swift/extractor/infra/SwiftMangledName.cpp @@ -1,4 +1,5 @@ #include "swift/extractor/infra/SwiftMangledName.h" +#include "absl/strings/str_cat.h" namespace codeql { @@ -8,13 +9,11 @@ void appendPart(std::string& out, const std::string& prefix) { } void appendPart(std::string& out, UntypedTrapLabel label) { - out += '{'; - out += label.str(); - out += '}'; + absl::StrAppend(&out, "{", label.str(), "}"); } void appendPart(std::string& out, unsigned index) { - out += std::to_string(index); + absl::StrAppend(&out, index); } } // namespace diff --git a/swift/extractor/main.cpp b/swift/extractor/main.cpp index f195193e5d7..de8a0d3f5e5 100644 --- a/swift/extractor/main.cpp +++ b/swift/extractor/main.cpp @@ -10,6 +10,7 @@ #include #include "absl/strings/str_join.h" +#include "absl/strings/str_cat.h" #include "swift/extractor/SwiftExtractor.h" #include "swift/extractor/infra/TargetDomains.h" @@ -166,7 +167,7 @@ static void checkWhetherToRunUnderTool(int argc, char* const* argv) { // compilations, diagnostics, etc. codeql::TrapDomain invocationTrapDomain(codeql::SwiftExtractorState& state) { auto timestamp = std::chrono::system_clock::now().time_since_epoch().count(); - auto filename = std::to_string(timestamp) + '-' + std::to_string(getpid()); + auto filename = absl::StrCat(timestamp, "-", getpid()); auto target = std::filesystem::path("invocations") / std::filesystem::path(filename); auto maybeDomain = codeql::createTargetTrapDomain(state, target, codeql::TrapType::invocation); CODEQL_ASSERT(maybeDomain, "Cannot create invocation trap file for {}", target); diff --git a/swift/extractor/translators/PatternTranslator.cpp b/swift/extractor/translators/PatternTranslator.cpp index 85b5bc73ffe..ee119af1c30 100644 --- a/swift/extractor/translators/PatternTranslator.cpp +++ b/swift/extractor/translators/PatternTranslator.cpp @@ -4,12 +4,6 @@ namespace codeql { codeql::NamedPattern PatternTranslator::translateNamedPattern(const swift::NamedPattern& pattern) { auto entry = dispatcher.createEntry(pattern); - // TODO: in some (but not all) cases, this seems to introduce a duplicate entry - // for example the vars listed in a case stmt have a different pointer than then ones in - // patterns. - // assert(pattern.getDecl() && "expect NamedPattern to have Decl"); - // dispatcher.emit(NamedPatternsTrap{label, pattern.getNameStr().str(), - // dispatcher.fetchLabel(pattern.getDecl())}); entry.name = pattern.getNameStr().str(); return entry; } diff --git a/swift/extractor/trap/TrapDomain.h b/swift/extractor/trap/TrapDomain.h index 2ca5efa113d..5741597d756 100644 --- a/swift/extractor/trap/TrapDomain.h +++ b/swift/extractor/trap/TrapDomain.h @@ -2,6 +2,7 @@ #include #include +#include "absl/strings/str_cat.h" #include "swift/extractor/trap/TrapLabel.h" #include "swift/extractor/infra/file/TargetFile.h" @@ -27,7 +28,7 @@ class TrapDomain { e.forEachLabel([&e, this](const char* field, int index, auto& label) { if (!label.valid()) { LOG_ERROR("{} has undefined field {}{}", e.NAME, field, - index >= 0 ? ('[' + std::to_string(index) + ']') : ""); + index >= 0 ? absl::StrCat("[", index, "]") : ""); } }); } diff --git a/swift/integration-tests/create_database_utils.py b/swift/integration-tests/create_database_utils.py index 38822fd70b4..8627f97a686 100644 --- a/swift/integration-tests/create_database_utils.py +++ b/swift/integration-tests/create_database_utils.py @@ -1,15 +1,34 @@ """ -recreation of internal `create_database_utils.py` to run the tests locally, with minimal -and swift-specialized functionality +Simplified version of internal `create_database_utils.py` used to run the tests locally, with +minimal and swift-specialized functionality +TODO unify integration testing code across the public and private repositories """ import subprocess import pathlib import sys +import shutil -def run_codeql_database_create(cmds, lang, keep_trap=True): +def runSuccessfully(cmd): + res = subprocess.run(cmd) + if res.returncode: + print("FAILED", file=sys.stderr) + print(" ", *cmd, f"(exit code {res.returncode})", file=sys.stderr) + sys.exit(res.returncode) + +def runUnsuccessfully(cmd): + res = subprocess.run(cmd) + if res.returncode == 0: + print("FAILED", file=sys.stderr) + print(" ", *cmd, f"(exit code 0, expected to fail)", file=sys.stderr) + sys.exit(1) + + +def run_codeql_database_create(cmds, lang, keep_trap=True, db=None, runFunction=runSuccessfully): + """ db parameter is here solely for compatibility with the internal test runner """ assert lang == 'swift' codeql_root = pathlib.Path(__file__).parents[2] + shutil.rmtree("db", ignore_errors=True) cmd = [ "codeql", "database", "create", "-s", ".", "-l", "swift", "--internal-use-lua-tracing", f"--search-path={codeql_root}", "--no-cleanup", @@ -19,8 +38,4 @@ def run_codeql_database_create(cmds, lang, keep_trap=True): for c in cmds: cmd += ["-c", c] cmd.append("db") - res = subprocess.run(cmd) - if res.returncode: - print("FAILED", file=sys.stderr) - print(" ", *cmd, file=sys.stderr) - sys.exit(res.returncode) + runFunction(cmd) diff --git a/swift/integration-tests/diagnostics_test_utils.py b/swift/integration-tests/diagnostics_test_utils.py new file mode 100644 index 00000000000..aa6f8df7488 --- /dev/null +++ b/swift/integration-tests/diagnostics_test_utils.py @@ -0,0 +1,64 @@ +""" +Simplified POSIX only version of internal `diagnostics_test_utils.py` used to run the tests locally +TODO unify integration testing code across the public and private repositories +""" + +import json +import pathlib +import subprocess +import os +import difflib +import sys + + +def _normalize_actual(test_dir, database_dir): + proc = subprocess.run(['codeql', 'database', 'export-diagnostics', '--format', 'raw', '--', database_dir], + stdout=subprocess.PIPE, universal_newlines=True, check=True, text=True) + data = proc.stdout.replace(str(test_dir.absolute()), "") + data = json.loads(data) + data[:] = [e for e in data if not e["source"]["id"].startswith("cli/")] + for e in data: + e.pop("timestamp") + return _normalize_json(data) + + +def _normalize_expected(test_dir): + with open(test_dir / "diagnostics.expected") as expected: + text = expected.read() + return _normalize_json(_load_concatenated_json(text)) + + +def _load_concatenated_json(text): + text = text.lstrip() + entries = [] + decoder = json.JSONDecoder() + while text: + obj, index = decoder.raw_decode(text) + entries.append(obj) + text = text[index:].lstrip() + return entries + + +def _normalize_json(data): + entries = [json.dumps(e, sort_keys=True, indent=2) for e in data] + entries.sort() + entries.append("") + return "\n".join(entries) + + +def check_diagnostics(test_dir=".", test_db="db"): + test_dir = pathlib.Path(test_dir) + test_db = pathlib.Path(test_db) + actual = _normalize_actual(test_dir, test_db) + if os.environ.get("CODEQL_INTEGRATION_TEST_LEARN") == "true": + with open(test_dir / "diagnostics.expected", "w") as expected: + expected.write(actual) + return + expected = _normalize_expected(test_dir) + if actual != expected: + with open(test_dir / "diagnostics.actual", "w") as actual_out: + actual_out.write(actual) + actual = actual.splitlines(keepends=True) + expected = expected.splitlines(keepends=True) + print("".join(difflib.unified_diff(actual, expected, fromfile="diagnostics.actual", tofile="diagnostics.expected")), file=sys.stderr) + sys.exit(1) diff --git a/swift/integration-tests/osx-only/autobuilder/failure/.gitignore b/swift/integration-tests/osx-only/autobuilder/failure/.gitignore new file mode 100644 index 00000000000..796b96d1c40 --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/.gitignore @@ -0,0 +1 @@ +/build diff --git a/swift/integration-tests/osx-only/autobuilder/failure/diagnostics.expected b/swift/integration-tests/osx-only/autobuilder/failure/diagnostics.expected new file mode 100644 index 00000000000..fdb36dc401b --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/diagnostics.expected @@ -0,0 +1,18 @@ +{ + "helpLinks": [ + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning", + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language" + ], + "plaintextMessage": "The detected build command failed (tried /usr/bin/xcodebuild build -project /hello-failure.xcodeproj -target hello-failure CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO).\n\nSet up a manual build command.", + "severity": "error", + "source": { + "extractorName": "swift", + "id": "swift/autobuilder/build-command-failed", + "name": "Detected build command failed" + }, + "visibility": { + "cliSummaryTable": true, + "statusPage": true, + "telemetry": true + } +} diff --git a/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.pbxproj b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.pbxproj new file mode 100644 index 00000000000..a7b0ee2cf7c --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.pbxproj @@ -0,0 +1,364 @@ +// !$*UTF8*$! +{ + archiveVersion = 1; + classes = { + }; + objectVersion = 56; + objects = { + +/* Begin PBXBuildFile section */ + 5700ECA72A09043B006BF37C /* hello_failureApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5700ECA62A09043B006BF37C /* hello_failureApp.swift */; }; + 5700ECA92A09043B006BF37C /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5700ECA82A09043B006BF37C /* ContentView.swift */; }; + 5700ECAB2A09043C006BF37C /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 5700ECAA2A09043C006BF37C /* Assets.xcassets */; }; + 5700ECAE2A09043C006BF37C /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */; }; +/* End PBXBuildFile section */ + +/* Begin PBXFileReference section */ + 5700ECA32A09043B006BF37C /* hello-failure.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "hello-failure.app"; sourceTree = BUILT_PRODUCTS_DIR; }; + 5700ECA62A09043B006BF37C /* hello_failureApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = hello_failureApp.swift; sourceTree = ""; }; + 5700ECA82A09043B006BF37C /* ContentView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ContentView.swift; sourceTree = ""; }; + 5700ECAA2A09043C006BF37C /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = ""; }; + 5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = ""; }; +/* End PBXFileReference section */ + +/* Begin PBXFrameworksBuildPhase section */ + 5700ECA02A09043B006BF37C /* Frameworks */ = { + isa = PBXFrameworksBuildPhase; + buildActionMask = 2147483647; + files = ( + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXFrameworksBuildPhase section */ + +/* Begin PBXGroup section */ + 5700EC9A2A09043B006BF37C = { + isa = PBXGroup; + children = ( + 5700ECA52A09043B006BF37C /* hello-failure */, + 5700ECA42A09043B006BF37C /* Products */, + ); + sourceTree = ""; + }; + 5700ECA42A09043B006BF37C /* Products */ = { + isa = PBXGroup; + children = ( + 5700ECA32A09043B006BF37C /* hello-failure.app */, + ); + name = Products; + sourceTree = ""; + }; + 5700ECA52A09043B006BF37C /* hello-failure */ = { + isa = PBXGroup; + children = ( + 5700ECA62A09043B006BF37C /* hello_failureApp.swift */, + 5700ECA82A09043B006BF37C /* ContentView.swift */, + 5700ECAA2A09043C006BF37C /* Assets.xcassets */, + 5700ECAC2A09043C006BF37C /* Preview Content */, + ); + path = "hello-failure"; + sourceTree = ""; + }; + 5700ECAC2A09043C006BF37C /* Preview Content */ = { + isa = PBXGroup; + children = ( + 5700ECAD2A09043C006BF37C /* Preview Assets.xcassets */, + ); + path = "Preview Content"; + sourceTree = ""; + }; +/* End PBXGroup section */ + +/* Begin PBXNativeTarget section */ + 5700ECA22A09043B006BF37C /* hello-failure */ = { + isa = PBXNativeTarget; + buildConfigurationList = 5700ECB12A09043C006BF37C /* Build configuration list for PBXNativeTarget "hello-failure" */; + buildPhases = ( + 5700ECB42A090460006BF37C /* ShellScript */, + 5700EC9F2A09043B006BF37C /* Sources */, + 5700ECA02A09043B006BF37C /* Frameworks */, + 5700ECA12A09043B006BF37C /* Resources */, + ); + buildRules = ( + ); + dependencies = ( + ); + name = "hello-failure"; + productName = "hello-failure"; + productReference = 5700ECA32A09043B006BF37C /* hello-failure.app */; + productType = "com.apple.product-type.application"; + }; +/* End PBXNativeTarget section */ + +/* Begin PBXProject section */ + 5700EC9B2A09043B006BF37C /* Project object */ = { + isa = PBXProject; + attributes = { + BuildIndependentTargetsInParallel = 1; + LastSwiftUpdateCheck = 1430; + LastUpgradeCheck = 1430; + TargetAttributes = { + 5700ECA22A09043B006BF37C = { + CreatedOnToolsVersion = 14.3; + }; + }; + }; + buildConfigurationList = 5700EC9E2A09043B006BF37C /* Build configuration list for PBXProject "hello-failure" */; + compatibilityVersion = "Xcode 14.0"; + developmentRegion = en; + hasScannedForEncodings = 0; + knownRegions = ( + en, + Base, + ); + mainGroup = 5700EC9A2A09043B006BF37C; + productRefGroup = 5700ECA42A09043B006BF37C /* Products */; + projectDirPath = ""; + projectRoot = ""; + targets = ( + 5700ECA22A09043B006BF37C /* hello-failure */, + ); + }; +/* End PBXProject section */ + +/* Begin PBXResourcesBuildPhase section */ + 5700ECA12A09043B006BF37C /* Resources */ = { + isa = PBXResourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 5700ECAE2A09043C006BF37C /* Preview Assets.xcassets in Resources */, + 5700ECAB2A09043C006BF37C /* Assets.xcassets in Resources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXResourcesBuildPhase section */ + +/* Begin PBXShellScriptBuildPhase section */ + 5700ECB42A090460006BF37C /* ShellScript */ = { + isa = PBXShellScriptBuildPhase; + buildActionMask = 2147483647; + files = ( + ); + inputFileListPaths = ( + ); + inputPaths = ( + ); + outputFileListPaths = ( + ); + outputPaths = ( + ); + runOnlyForDeploymentPostprocessing = 0; + shellPath = /bin/sh; + shellScript = "false\n"; + showEnvVarsInLog = 0; + }; +/* End PBXShellScriptBuildPhase section */ + +/* Begin PBXSourcesBuildPhase section */ + 5700EC9F2A09043B006BF37C /* Sources */ = { + isa = PBXSourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 5700ECA92A09043B006BF37C /* ContentView.swift in Sources */, + 5700ECA72A09043B006BF37C /* hello_failureApp.swift in Sources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXSourcesBuildPhase section */ + +/* Begin XCBuildConfiguration section */ + 5700ECAF2A09043C006BF37C /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + ALWAYS_SEARCH_USER_PATHS = NO; + CLANG_ANALYZER_NONNULL = YES; + CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE; + CLANG_CXX_LANGUAGE_STANDARD = "gnu++20"; + CLANG_ENABLE_MODULES = YES; + CLANG_ENABLE_OBJC_ARC = YES; + CLANG_ENABLE_OBJC_WEAK = YES; + CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_COMMA = YES; + CLANG_WARN_CONSTANT_CONVERSION = YES; + CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_DOCUMENTATION_COMMENTS = YES; + CLANG_WARN_EMPTY_BODY = YES; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_INFINITE_RECURSION = YES; + CLANG_WARN_INT_CONVERSION = YES; + CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES; + CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES; + CLANG_WARN_OBJC_LITERAL_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES; + CLANG_WARN_RANGE_LOOP_ANALYSIS = YES; + CLANG_WARN_STRICT_PROTOTYPES = YES; + CLANG_WARN_SUSPICIOUS_MOVE = YES; + CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE; + CLANG_WARN_UNREACHABLE_CODE = YES; + CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + COPY_PHASE_STRIP = NO; + DEBUG_INFORMATION_FORMAT = dwarf; + ENABLE_STRICT_OBJC_MSGSEND = YES; + ENABLE_TESTABILITY = YES; + GCC_C_LANGUAGE_STANDARD = gnu11; + GCC_DYNAMIC_NO_PIC = NO; + GCC_NO_COMMON_BLOCKS = YES; + GCC_OPTIMIZATION_LEVEL = 0; + GCC_PREPROCESSOR_DEFINITIONS = ( + "DEBUG=1", + "$(inherited)", + ); + GCC_WARN_64_TO_32_BIT_CONVERSION = YES; + GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; + GCC_WARN_UNDECLARED_SELECTOR = YES; + GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; + GCC_WARN_UNUSED_FUNCTION = YES; + GCC_WARN_UNUSED_VARIABLE = YES; + IPHONEOS_DEPLOYMENT_TARGET = 16.4; + MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; + MTL_FAST_MATH = YES; + ONLY_ACTIVE_ARCH = YES; + SDKROOT = iphoneos; + SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; + SWIFT_OPTIMIZATION_LEVEL = "-Onone"; + }; + name = Debug; + }; + 5700ECB02A09043C006BF37C /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + ALWAYS_SEARCH_USER_PATHS = NO; + CLANG_ANALYZER_NONNULL = YES; + CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE; + CLANG_CXX_LANGUAGE_STANDARD = "gnu++20"; + CLANG_ENABLE_MODULES = YES; + CLANG_ENABLE_OBJC_ARC = YES; + CLANG_ENABLE_OBJC_WEAK = YES; + CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_COMMA = YES; + CLANG_WARN_CONSTANT_CONVERSION = YES; + CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_DOCUMENTATION_COMMENTS = YES; + CLANG_WARN_EMPTY_BODY = YES; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_INFINITE_RECURSION = YES; + CLANG_WARN_INT_CONVERSION = YES; + CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES; + CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES; + CLANG_WARN_OBJC_LITERAL_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES; + CLANG_WARN_RANGE_LOOP_ANALYSIS = YES; + CLANG_WARN_STRICT_PROTOTYPES = YES; + CLANG_WARN_SUSPICIOUS_MOVE = YES; + CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE; + CLANG_WARN_UNREACHABLE_CODE = YES; + CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + COPY_PHASE_STRIP = NO; + DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; + ENABLE_NS_ASSERTIONS = NO; + ENABLE_STRICT_OBJC_MSGSEND = YES; + GCC_C_LANGUAGE_STANDARD = gnu11; + GCC_NO_COMMON_BLOCKS = YES; + GCC_WARN_64_TO_32_BIT_CONVERSION = YES; + GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; + GCC_WARN_UNDECLARED_SELECTOR = YES; + GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; + GCC_WARN_UNUSED_FUNCTION = YES; + GCC_WARN_UNUSED_VARIABLE = YES; + IPHONEOS_DEPLOYMENT_TARGET = 16.4; + MTL_ENABLE_DEBUG_INFO = NO; + MTL_FAST_MATH = YES; + SDKROOT = iphoneos; + SWIFT_COMPILATION_MODE = wholemodule; + SWIFT_OPTIMIZATION_LEVEL = "-O"; + VALIDATE_PRODUCT = YES; + }; + name = Release; + }; + 5700ECB22A09043C006BF37C /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; + ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor; + CODE_SIGN_STYLE = Automatic; + CURRENT_PROJECT_VERSION = 1; + DEVELOPMENT_ASSET_PATHS = "\"hello-failure/Preview Content\""; + ENABLE_PREVIEWS = YES; + GENERATE_INFOPLIST_FILE = YES; + INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES; + INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES; + INFOPLIST_KEY_UILaunchScreen_Generation = YES; + INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; + INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; + LD_RUNPATH_SEARCH_PATHS = ( + "$(inherited)", + "@executable_path/Frameworks", + ); + MARKETING_VERSION = 1.0; + PRODUCT_BUNDLE_IDENTIFIER = "com.example.hello-failure"; + PRODUCT_NAME = "$(TARGET_NAME)"; + SWIFT_EMIT_LOC_STRINGS = YES; + SWIFT_VERSION = 5.0; + TARGETED_DEVICE_FAMILY = "1,2"; + }; + name = Debug; + }; + 5700ECB32A09043C006BF37C /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; + ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor; + CODE_SIGN_STYLE = Automatic; + CURRENT_PROJECT_VERSION = 1; + DEVELOPMENT_ASSET_PATHS = "\"hello-failure/Preview Content\""; + ENABLE_PREVIEWS = YES; + GENERATE_INFOPLIST_FILE = YES; + INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES; + INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES; + INFOPLIST_KEY_UILaunchScreen_Generation = YES; + INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; + INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; + LD_RUNPATH_SEARCH_PATHS = ( + "$(inherited)", + "@executable_path/Frameworks", + ); + MARKETING_VERSION = 1.0; + PRODUCT_BUNDLE_IDENTIFIER = "com.example.hello-failure"; + PRODUCT_NAME = "$(TARGET_NAME)"; + SWIFT_EMIT_LOC_STRINGS = YES; + SWIFT_VERSION = 5.0; + TARGETED_DEVICE_FAMILY = "1,2"; + }; + name = Release; + }; +/* End XCBuildConfiguration section */ + +/* Begin XCConfigurationList section */ + 5700EC9E2A09043B006BF37C /* Build configuration list for PBXProject "hello-failure" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 5700ECAF2A09043C006BF37C /* Debug */, + 5700ECB02A09043C006BF37C /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; + 5700ECB12A09043C006BF37C /* Build configuration list for PBXNativeTarget "hello-failure" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 5700ECB22A09043C006BF37C /* Debug */, + 5700ECB32A09043C006BF37C /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; +/* End XCConfigurationList section */ + }; + rootObject = 5700EC9B2A09043B006BF37C /* Project object */; +} diff --git a/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/contents.xcworkspacedata b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/contents.xcworkspacedata new file mode 100644 index 00000000000..919434a6254 --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/contents.xcworkspacedata @@ -0,0 +1,7 @@ + + + + + diff --git a/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist new file mode 100644 index 00000000000..18d981003d6 --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/hello-failure.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist @@ -0,0 +1,8 @@ + + + + + IDEDidComputeMac32BitWarning + + + diff --git a/swift/integration-tests/osx-only/autobuilder/failure/test.py b/swift/integration-tests/osx-only/autobuilder/failure/test.py new file mode 100644 index 00000000000..37aaa3ce344 --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/failure/test.py @@ -0,0 +1,5 @@ +from create_database_utils import * +from diagnostics_test_utils import * + +run_codeql_database_create([], lang='swift', keep_trap=True, db=None, runFunction=runUnsuccessfully) +check_diagnostics() diff --git a/swift/integration-tests/osx-only/autobuilder/no-build-system/diagnostics.expected b/swift/integration-tests/osx-only/autobuilder/no-build-system/diagnostics.expected new file mode 100644 index 00000000000..1e988936c9a --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/no-build-system/diagnostics.expected @@ -0,0 +1,18 @@ +{ + "helpLinks": [ + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning", + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language" + ], + "plaintextMessage": "No Xcode project or workspace was found.\n\nSet up a manual build command.", + "severity": "error", + "source": { + "extractorName": "swift", + "id": "swift/autobuilder/no-project-found", + "name": "No Xcode project or workspace detected" + }, + "visibility": { + "cliSummaryTable": true, + "statusPage": true, + "telemetry": true + } +} diff --git a/swift/integration-tests/osx-only/autobuilder/no-build-system/test.py b/swift/integration-tests/osx-only/autobuilder/no-build-system/test.py new file mode 100644 index 00000000000..37aaa3ce344 --- /dev/null +++ b/swift/integration-tests/osx-only/autobuilder/no-build-system/test.py @@ -0,0 +1,5 @@ +from create_database_utils import * +from diagnostics_test_utils import * + +run_codeql_database_create([], lang='swift', keep_trap=True, db=None, runFunction=runUnsuccessfully) +check_diagnostics() diff --git a/swift/integration-tests/osx-only/autobuilder/no-build-system/x.swift b/swift/integration-tests/osx-only/autobuilder/no-build-system/x.swift new file mode 100644 index 00000000000..e69de29bb2d diff --git a/swift/integration-tests/runner.py b/swift/integration-tests/runner.py index 6abeaa050a5..bf65781cdb2 100755 --- a/swift/integration-tests/runner.py +++ b/swift/integration-tests/runner.py @@ -43,6 +43,8 @@ def skipped(test): def main(opts): test_dirs = opts.test_dir or [this_dir] tests = [t for d in test_dirs for t in d.rglob("test.py") if not skipped(t)] + if opts.learn: + os.environ["CODEQL_INTEGRATION_TEST_LEARN"] = "true" if not tests: print("No tests found", file=sys.stderr) diff --git a/swift/logging/SwiftDiagnostics.h b/swift/logging/SwiftDiagnostics.h index 95c6cb85e5a..81d7f170ff3 100644 --- a/swift/logging/SwiftDiagnostics.h +++ b/swift/logging/SwiftDiagnostics.h @@ -67,6 +67,8 @@ class SwiftDiagnosticsDumper { return output.good(); } + void flush() { output.flush(); } + // write out binlog entries as corresponding JSON diagnostics entries. Expects all entries to have // a category equal to an id of a previously created SwiftDiagnosticSource. void write(const char* buffer, std::size_t bufferSize); diff --git a/swift/logging/SwiftLogging.cpp b/swift/logging/SwiftLogging.cpp index 4f3e3607f2b..2cea555e0c8 100644 --- a/swift/logging/SwiftLogging.cpp +++ b/swift/logging/SwiftLogging.cpp @@ -3,6 +3,8 @@ #include #include #include +#include +#include "absl/strings/str_cat.h" #define LEVEL_REGEX_PATTERN "trace|debug|info|warning|error|critical|no_logs" @@ -10,6 +12,8 @@ BINLOG_ADAPT_ENUM(codeql::Log::Level, trace, debug, info, warning, error, critic namespace codeql { +bool Log::initialized{false}; + namespace { using LevelRule = std::pair; using LevelRules = std::vector; @@ -55,8 +59,8 @@ std::vector Log::collectLevelRulesAndReturnProblems(const char* env if (auto levels = getEnvOr(envVar, nullptr)) { // expect comma-separated : std::regex comma{","}; - std::regex levelAssignment{R"((?:([*./\w]+)|(?:out:(bin|text|console))):()" LEVEL_REGEX_PATTERN - ")"}; + std::regex levelAssignment{ + R"((?:([*./\w]+)|(?:out:(binary|text|console|diagnostics))):()" LEVEL_REGEX_PATTERN ")"}; std::cregex_token_iterator begin{levels, levels + strlen(levels), comma, -1}; std::cregex_token_iterator end{}; for (auto it = begin; it != end; ++it) { @@ -74,12 +78,14 @@ std::vector Log::collectLevelRulesAndReturnProblems(const char* env sourceRules.emplace_back(pattern, level); } else { auto out = matchToView(match[2]); - if (out == "bin") { + if (out == "binary") { binary.level = level; } else if (out == "text") { text.level = level; } else if (out == "console") { console.level = level; + } else if (out == "diagnostics") { + diagnostics.level = level; } } } else { @@ -93,12 +99,13 @@ std::vector Log::collectLevelRulesAndReturnProblems(const char* env void Log::configure() { // as we are configuring logging right now, we collect problems and log them at the end auto problems = collectLevelRulesAndReturnProblems("CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS"); - auto now = std::to_string(std::chrono::system_clock::now().time_since_epoch().count()); + auto timestamp = std::chrono::system_clock::now().time_since_epoch().count(); + auto logBaseName = absl::StrCat(timestamp, "-", getpid()); if (text || binary) { std::filesystem::path logFile = getEnvOr("CODEQL_EXTRACTOR_SWIFT_LOG_DIR", "extractor-out/log"); logFile /= "swift"; logFile /= programName; - logFile /= now; + logFile /= logBaseName; std::error_code ec; std::filesystem::create_directories(logFile.parent_path(), ec); if (!ec) { @@ -124,31 +131,32 @@ void Log::configure() { binary.level = Level::no_logs; text.level = Level::no_logs; } - if (diagnostics) { - std::filesystem::path diagFile = - getEnvOr("CODEQL_EXTRACTOR_SWIFT_DIAGNOSTIC_DIR", "extractor-out/diagnostics"); - diagFile /= programName; - diagFile /= now; - diagFile.replace_extension(".jsonl"); - std::error_code ec; - std::filesystem::create_directories(diagFile.parent_path(), ec); - if (!ec) { - if (!diagnostics.output.open(diagFile)) { - problems.emplace_back("Unable to open diagnostics json file " + diagFile.string()); - diagnostics.level = Level::no_logs; - } - } else { - problems.emplace_back("Unable to create diagnostics directory " + - diagFile.parent_path().string() + ": " + ec.message()); + } + if (diagnostics) { + std::filesystem::path diagFile = + getEnvOr("CODEQL_EXTRACTOR_SWIFT_DIAGNOSTIC_DIR", "extractor-out/diagnostics"); + diagFile /= programName; + diagFile /= logBaseName; + diagFile.replace_extension(".jsonl"); + std::error_code ec; + std::filesystem::create_directories(diagFile.parent_path(), ec); + if (!ec) { + if (!diagnostics.output.open(diagFile)) { + problems.emplace_back("Unable to open diagnostics json file " + diagFile.string()); diagnostics.level = Level::no_logs; } + } else { + problems.emplace_back("Unable to create diagnostics directory " + + diagFile.parent_path().string() + ": " + ec.message()); + diagnostics.level = Level::no_logs; } } for (const auto& problem : problems) { LOG_ERROR("{}", problem); } - LOG_INFO("Logging configured (binary: {}, text: {}, console: {})", binary.level, text.level, - console.level); + LOG_INFO("Logging configured (binary: {}, text: {}, console: {}, diagnostics: {})", binary.level, + text.level, console.level, diagnostics.level); + initialized = true; flushImpl(); } @@ -160,6 +168,9 @@ void Log::flushImpl() { if (binary) { binary.output.flush(); } + if (diagnostics) { + diagnostics.output.flush(); + } } Log::LoggerConfiguration Log::getLoggerConfigurationImpl(std::string_view name) { diff --git a/swift/logging/SwiftLogging.h b/swift/logging/SwiftLogging.h index cf756c9e5a0..e07b46e245d 100644 --- a/swift/logging/SwiftLogging.h +++ b/swift/logging/SwiftLogging.h @@ -32,14 +32,17 @@ // only do the actual logging if the picked up `Logger` instance is configured to handle the // provided log level. `LEVEL` must be a compile-time constant. `logger()` is evaluated once -#define LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, CATEGORY, ...) \ - do { \ - constexpr codeql::Log::Level _level = codeql::Log::Level::LEVEL; \ - codeql::Logger& _logger = logger(); \ - if (_level >= _logger.level()) { \ - BINLOG_CREATE_SOURCE_AND_EVENT(_logger.writer(), _level, CATEGORY, binlog::clockNow(), \ - __VA_ARGS__); \ - } \ +#define LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, CATEGORY, ...) \ + do { \ + constexpr codeql::Log::Level _level = ::codeql::Log::Level::LEVEL; \ + ::codeql::Logger& _logger = logger(); \ + if (_level >= _logger.level()) { \ + BINLOG_CREATE_SOURCE_AND_EVENT(_logger.writer(), _level, CATEGORY, ::binlog::clockNow(), \ + __VA_ARGS__); \ + } \ + if (_level >= ::codeql::Log::Level::error) { \ + ::codeql::Log::flush(); \ + } \ } while (false) #define LOG_WITH_LEVEL(LEVEL, ...) LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, , __VA_ARGS__) @@ -49,10 +52,10 @@ #define DIAGNOSE_CRITICAL(ID, ...) DIAGNOSE_WITH_LEVEL(critical, ID, __VA_ARGS__) #define DIAGNOSE_ERROR(ID, ...) DIAGNOSE_WITH_LEVEL(error, ID, __VA_ARGS__) -#define DIAGNOSE_WITH_LEVEL(LEVEL, ID, ...) \ - do { \ - codeql::SwiftDiagnosticsSource::inscribe<&codeql_diagnostics::ID>(); \ - LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, ID, __VA_ARGS__); \ +#define DIAGNOSE_WITH_LEVEL(LEVEL, ID, ...) \ + do { \ + ::codeql::SwiftDiagnosticsSource::ensureRegistered<&::codeql_diagnostics::ID>(); \ + LOG_WITH_LEVEL_AND_CATEGORY(LEVEL, ID, __VA_ARGS__); \ } while (false) // avoid calling into binlog's original macros @@ -96,7 +99,7 @@ extern const std::string_view programName; // * using environment variable `CODEQL_EXTRACTOR_SWIFT_LOG_LEVELS` to configure levels for // loggers and outputs. This must have the form of a comma separated `spec:level` list, where // `spec` is either a glob pattern (made up of alphanumeric, `/`, `*` and `.` characters) for -// matching logger names or one of `out:bin`, `out:text` or `out:console`. +// matching logger names or one of `out:binary`, `out:text`, `out:console` or `out:diagnostics`. // Output default levels can be seen in the corresponding initializers below. By default, all // loggers are configured with the lowest output level class Log { @@ -111,7 +114,11 @@ class Log { }; // Flush logs to the designated outputs - static void flush() { instance().flushImpl(); } + static void flush() { + if (initialized) { + instance().flushImpl(); + } + } // create `Logger` configuration, used internally by `Logger`'s constructor static LoggerConfiguration getLoggerConfiguration(std::string_view name) { @@ -120,6 +127,7 @@ class Log { private: static constexpr const char* format = "%u %S [%n] %m (%G:%L)\n"; + static bool initialized; Log() { configure(); } diff --git a/swift/ql/examples/qlpack.lock.yml b/swift/ql/examples/qlpack.lock.yml new file mode 100644 index 00000000000..06dd07fc7dc --- /dev/null +++ b/swift/ql/examples/qlpack.lock.yml @@ -0,0 +1,4 @@ +--- +dependencies: {} +compiled: false +lockVersion: 1.0.0 diff --git a/swift/ql/examples/qlpack.yml b/swift/ql/examples/qlpack.yml new file mode 100644 index 00000000000..ed3c6f12bac --- /dev/null +++ b/swift/ql/examples/qlpack.yml @@ -0,0 +1,6 @@ +name: codeql/swift-examples +groups: + - swift + - examples +dependencies: + codeql/swift-all: ${workspace} diff --git a/swift/ql/examples/snippets/empty_if.ql b/swift/ql/examples/snippets/empty_if.ql new file mode 100644 index 00000000000..6dd1c2ee1f0 --- /dev/null +++ b/swift/ql/examples/snippets/empty_if.ql @@ -0,0 +1,15 @@ +/** + * @name Empty 'if' statement + * @description Finds 'if' statements where the "then" branch is empty and no + * "else" branch exists. + * @id swift/examples/empty-if + * @tags example + */ + +import swift + +from IfStmt ifStmt +where + ifStmt.getThen().(BraceStmt).getNumberOfElements() = 0 and + not exists(ifStmt.getElse()) +select ifStmt, "This 'if' statement is redundant." diff --git a/swift/ql/examples/snippets/simple_constant_password.ql b/swift/ql/examples/snippets/simple_constant_password.ql new file mode 100644 index 00000000000..1307ea2d968 --- /dev/null +++ b/swift/ql/examples/snippets/simple_constant_password.ql @@ -0,0 +1,26 @@ +/** + * @name Constant password + * @description Finds places where a string literal is used in a function call + * argument named "password". + * @id swift/examples/simple-constant-password + * @tags example + */ + +import swift +import codeql.swift.dataflow.DataFlow +import codeql.swift.dataflow.TaintTracking + +module ConstantPasswordConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node node) { node.asExpr() instanceof StringLiteralExpr } + + predicate isSink(DataFlow::Node node) { + // any argument called `password` + exists(CallExpr call | call.getArgumentWithLabel("password").getExpr() = node.asExpr()) + } +} + +module ConstantPasswordFlow = TaintTracking::Global; + +from DataFlow::Node sourceNode, DataFlow::Node sinkNode +where ConstantPasswordFlow::flow(sourceNode, sinkNode) +select sinkNode, "The value $@ is used as a constant password.", sourceNode, sourceNode.toString() diff --git a/swift/ql/examples/snippets/simple_sql_injection.ql b/swift/ql/examples/snippets/simple_sql_injection.ql new file mode 100644 index 00000000000..46e7fb6ae31 --- /dev/null +++ b/swift/ql/examples/snippets/simple_sql_injection.ql @@ -0,0 +1,30 @@ +/** + * @name Database query built from user-controlled sources + * @description Finds places where a value from a remote or local user input + * is used as an argument to the SQLite ``Connection.execute(_:)`` + * function. + * @id swift/examples/simple-sql-injection + * @tags example + */ + +import swift +import codeql.swift.dataflow.DataFlow +import codeql.swift.dataflow.TaintTracking +import codeql.swift.dataflow.FlowSources + +module SqlInjectionConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node node) { node instanceof FlowSource } + + predicate isSink(DataFlow::Node node) { + exists(CallExpr call | + call.getStaticTarget().(Method).hasQualifiedName("Connection", "execute(_:)") and + call.getArgument(0).getExpr() = node.asExpr() + ) + } +} + +module SqlInjectionFlow = TaintTracking::Global; + +from DataFlow::Node sourceNode, DataFlow::Node sinkNode +where SqlInjectionFlow::flow(sourceNode, sinkNode) +select sinkNode, "This query depends on a $@.", sourceNode, "user-provided value" diff --git a/swift/ql/examples/snippets/simple_uncontrolled_string_format.ql b/swift/ql/examples/snippets/simple_uncontrolled_string_format.ql new file mode 100644 index 00000000000..1e4ab990277 --- /dev/null +++ b/swift/ql/examples/snippets/simple_uncontrolled_string_format.ql @@ -0,0 +1,20 @@ +/** + * @name Uncontrolled format string + * @description Finds calls to ``String.init(format:_:)`` where the format + * string is not a hard-coded string literal. + * @id swift/examples/simple-uncontrolled-format-string + * @tags example + */ + +import swift +import codeql.swift.dataflow.DataFlow + +from CallExpr call, Method method, DataFlow::Node sinkNode +where + call.getStaticTarget() = method and + method.hasQualifiedName("String", "init(format:_:)") and + sinkNode.asExpr() = call.getArgument(0).getExpr() and + not exists(StringLiteralExpr sourceLiteral | + DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), sinkNode) + ) +select call, "Format argument to " + method.getName() + " isn't hard-coded." diff --git a/swift/ql/lib/codeql/swift/dataflow/Ssa.qll b/swift/ql/lib/codeql/swift/dataflow/Ssa.qll index 055deaa7009..ffe86b34cbe 100644 --- a/swift/ql/lib/codeql/swift/dataflow/Ssa.qll +++ b/swift/ql/lib/codeql/swift/dataflow/Ssa.qll @@ -184,9 +184,7 @@ module Ssa { */ cached predicate assigns(CfgNode value) { - exists( - AssignExpr a, SsaInput::BasicBlock bb, int i // TODO: use CFG node for assignment expr - | + exists(AssignExpr a, SsaInput::BasicBlock bb, int i | this.definesAt(_, bb, i) and a = bb.getNode(i).getNode().asAstNode() and value.getNode().asAstNode() = a.getSource() diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll index 5263ec99be2..4fc1b70b9a0 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowDispatch.qll @@ -215,9 +215,6 @@ class PropertyObserverCall extends DataFlowCall, TPropertyObserverCall { i = -1 and result = observer.getBase() or - // TODO: This is correct for `willSet` (which takes a `newValue` parameter), - // but for `didSet` (which takes an `oldValue` parameter) we need an rvalue - // for `getBase()`. i = 0 and result = observer.getSource() } diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll index 3259bc3099e..7b2bc359c9a 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll @@ -433,8 +433,6 @@ private module ArgumentNodes { ObserverArgumentNode() { observer.getBase() = this.getCfgNode() or - // TODO: This should be an rvalue representing the `getBase` when - // `observer` a `didSet` observer. observer.getSource() = this.getCfgNode() } @@ -444,7 +442,6 @@ private module ArgumentNodes { pos = TThisArgument() and observer.getBase() = this.getCfgNode() or - // TODO: See the comment above for `didSet` observers. pos.(PositionalArgumentPosition).getIndex() = 0 and observer.getSource() = this.getCfgNode() ) @@ -683,14 +680,14 @@ predicate storeStep(Node node1, ContentSet c, Node node2) { // i.e. from `f(x)` where `x: T` into `f(.some(x))` where the context `f` expects a `T?`. exists(InjectIntoOptionalExpr e | e.convertsFrom(node1.asExpr()) and - node2 = node1 and // HACK: we should ideally have a separate Node case for the (hidden) InjectIntoOptionalExpr + node2 = node1 and // TODO: we should ideally have a separate Node case for the (hidden) InjectIntoOptionalExpr c instanceof OptionalSomeContentSet ) or // creation of an optional by returning from a failable initializer (`init?`) exists(Initializer init | node1.asExpr().(CallExpr).getStaticTarget() = init and - node2 = node1 and // HACK: again, we should ideally have a separate Node case here, and not reuse the CallExpr + node2 = node1 and // TODO: again, we should ideally have a separate Node case here, and not reuse the CallExpr c instanceof OptionalSomeContentSet and init.isFailable() ) diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll index 6d3db9c04fa..74779ea3b37 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll @@ -129,7 +129,9 @@ class PostUpdateNode extends Node instanceof PostUpdateNodeImpl { Node getPreUpdateNode() { result = super.getPreUpdateNode() } } -/** Gets a node corresponding to expression `e`. */ +/** + * Gets a node corresponding to expression `e`. + */ ExprNode exprNode(DataFlowExpr e) { result.asExpr() = e } /** diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll index 1c584b24071..e13636a911e 100644 --- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll +++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll @@ -31,25 +31,19 @@ DataFlowType getContentType(ContentSet c) { any() } /** Gets the return type of kind `rk` for callable `c`. */ bindingset[c] -DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) { - any() // TODO once we have type pruning -} +DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) { any() } /** * Gets the type of the parameter matching arguments at position `pos` in a * synthesized call that targets a callback of type `t`. */ -DataFlowType getCallbackParameterType(DataFlowType t, ArgumentPosition pos) { - any() // TODO once we have type pruning -} +DataFlowType getCallbackParameterType(DataFlowType t, ArgumentPosition pos) { any() } /** * Gets the return type of kind `rk` in a synthesized call that targets a * callback of type `t`. */ -DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { - any() // TODO once we have type pruning -} +DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { any() } /** Gets the type of synthetic global `sg`. */ DataFlowType getSyntheticGlobalType(SummaryComponent::SyntheticGlobal sg) { any() } diff --git a/swift/ql/lib/codeql/swift/frameworks/StandardLibrary/CustomUrlSchemes.qll b/swift/ql/lib/codeql/swift/frameworks/StandardLibrary/CustomUrlSchemes.qll index 10460686b4a..dafcba01c37 100644 --- a/swift/ql/lib/codeql/swift/frameworks/StandardLibrary/CustomUrlSchemes.qll +++ b/swift/ql/lib/codeql/swift/frameworks/StandardLibrary/CustomUrlSchemes.qll @@ -19,10 +19,6 @@ private class CustomUrlRemoteFlowSource extends SourceModelCsv { ";UIApplicationDelegate;true;application(_:open:options:);;;Parameter[1];remote", ";UIApplicationDelegate;true;application(_:handleOpen:);;;Parameter[1];remote", ";UIApplicationDelegate;true;application(_:open:sourceApplication:annotation:);;;Parameter[1];remote", - // TODO 1: The actual source is the value of `UIApplication.LaunchOptionsKey.url` in the launchOptions dictionary. - // Use dictionary value contents when available. - // ";UIApplicationDelegate;true;application(_:didFinishLaunchingWithOptions:);;;Parameter[1].MapValue;remote", - // ";UIApplicationDelegate;true;application(_:willFinishLaunchingWithOptions:);;;Parameter[1].MapValue;remote" ";UISceneDelegate;true;scene(_:continue:);;;Parameter[1];remote", ";UISceneDelegate;true;scene(_:didUpdate:);;;Parameter[1];remote", ";UISceneDelegate;true;scene(_:openURLContexts:);;;Parameter[1];remote", @@ -36,7 +32,6 @@ private class CustomUrlRemoteFlowSource extends SourceModelCsv { * `UIApplicationDelegate.application(_:didFinishLaunchingWithOptions:)` or * `UIApplicationDelegate.application(_:willFinishLaunchingWithOptions:)`. */ -// This is a temporary workaround until the TODO 1 above is addressed. private class UrlLaunchOptionsRemoteFlowSource extends RemoteFlowSource { UrlLaunchOptionsRemoteFlowSource() { exists(ApplicationWithLaunchOptionsFunc f, SubscriptExpr e | diff --git a/swift/xcode-autobuilder/BUILD.bazel b/swift/xcode-autobuilder/BUILD.bazel index 116d11cbfab..d497666f3e2 100644 --- a/swift/xcode-autobuilder/BUILD.bazel +++ b/swift/xcode-autobuilder/BUILD.bazel @@ -13,6 +13,10 @@ swift_cc_binary( "-framework CoreFoundation", ], target_compatible_with = ["@platforms//os:macos"], + deps = [ + "@absl//absl/strings", + "//swift/logging", + ], ) generate_cmake( diff --git a/swift/xcode-autobuilder/CustomizingBuildDiagnostics.h b/swift/xcode-autobuilder/CustomizingBuildDiagnostics.h new file mode 100644 index 00000000000..7920e4a62ca --- /dev/null +++ b/swift/xcode-autobuilder/CustomizingBuildDiagnostics.h @@ -0,0 +1,12 @@ +#include + +namespace codeql_diagnostics { +constexpr std::string_view customizingBuildAction = "Set up a manual build command"; +constexpr std::string_view customizingBuildHelpLinks = + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/" + "automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning " + "https://docs.github.com/en/enterprise-server/code-security/code-scanning/" + "automatically-scanning-your-code-for-vulnerabilities-and-errors/" + "configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-" + "language"; +} // namespace codeql_diagnostics diff --git a/swift/xcode-autobuilder/XcodeBuildRunner.cpp b/swift/xcode-autobuilder/XcodeBuildRunner.cpp index cbc99592d24..d6e14155052 100644 --- a/swift/xcode-autobuilder/XcodeBuildRunner.cpp +++ b/swift/xcode-autobuilder/XcodeBuildRunner.cpp @@ -3,6 +3,21 @@ #include #include #include +#include "absl/strings/str_join.h" + +#include "swift/logging/SwiftLogging.h" +#include "swift/xcode-autobuilder/CustomizingBuildDiagnostics.h" + +namespace codeql_diagnostics { +constexpr codeql::SwiftDiagnosticsSource build_command_failed{ + "build_command_failed", "Detected build command failed", customizingBuildAction, + customizingBuildHelpLinks}; +} + +static codeql::Logger& logger() { + static codeql::Logger ret{"build"}; + return ret; +} static int waitpid_status(pid_t child) { int status; @@ -52,13 +67,12 @@ void buildTarget(Target& target, bool dryRun) { argv.push_back("CODE_SIGNING_ALLOWED=NO"); if (dryRun) { - for (auto& arg : argv) { - std::cout << arg + " "; - } - std::cout << "\n"; + std::cout << absl::StrJoin(argv, " ") << "\n"; } else { if (!exec(argv)) { - std::cerr << "Build failed\n"; + DIAGNOSE_ERROR(build_command_failed, "The detected build command failed (tried {})", + absl::StrJoin(argv, " ")); + codeql::Log::flush(); exit(1); } } diff --git a/swift/xcode-autobuilder/XcodeProjectParser.cpp b/swift/xcode-autobuilder/XcodeProjectParser.cpp index 5fb20ad625a..9ace4b43696 100644 --- a/swift/xcode-autobuilder/XcodeProjectParser.cpp +++ b/swift/xcode-autobuilder/XcodeProjectParser.cpp @@ -1,6 +1,4 @@ #include "swift/xcode-autobuilder/XcodeProjectParser.h" -#include "swift/xcode-autobuilder/XcodeWorkspaceParser.h" -#include "swift/xcode-autobuilder/CFHelpers.h" #include #include @@ -9,8 +7,24 @@ #include #include +#include "swift/xcode-autobuilder/XcodeWorkspaceParser.h" +#include "swift/xcode-autobuilder/CFHelpers.h" +#include "swift/logging/SwiftLogging.h" +#include "swift/xcode-autobuilder/CustomizingBuildDiagnostics.h" + +namespace codeql_diagnostics { +constexpr codeql::SwiftDiagnosticsSource no_project_found{ + "no_project_found", "No Xcode project or workspace detected", customizingBuildAction, + customizingBuildHelpLinks}; +} // namespace codeql_diagnostics + namespace fs = std::filesystem; +static codeql::Logger& logger() { + static codeql::Logger ret{"project"}; + return ret; +} + struct TargetData { std::string workspace; std::string project; @@ -253,7 +267,7 @@ std::vector collectTargets(const std::string& workingDir) { // Getting a list of workspaces and the project that belong to them auto workspaces = collectWorkspaces(workingDir); if (workspaces.empty()) { - std::cerr << "[xcode autobuilder] Xcode project or workspace not found\n"; + DIAGNOSE_ERROR(no_project_found, "No Xcode project or workspace was found"); exit(1); } diff --git a/swift/xcode-autobuilder/xcode-autobuilder.cpp b/swift/xcode-autobuilder/xcode-autobuilder.cpp index 8c6650094ba..ca6dbe5dcac 100644 --- a/swift/xcode-autobuilder/xcode-autobuilder.cpp +++ b/swift/xcode-autobuilder/xcode-autobuilder.cpp @@ -4,10 +4,13 @@ #include "swift/xcode-autobuilder/XcodeTarget.h" #include "swift/xcode-autobuilder/XcodeBuildRunner.h" #include "swift/xcode-autobuilder/XcodeProjectParser.h" +#include "swift/logging/SwiftLogging.h" static const char* Application = "com.apple.product-type.application"; static const char* Framework = "com.apple.product-type.framework"; +const std::string_view codeql::programName = "autobuilder"; + struct CLIArgs { std::string workingDir; bool dryRun;