Commit Graph

3366 Commits

Author SHA1 Message Date
Tom Hvitved
5b5f9adfc6 C#: Add missing CFG edge from generic catch block to finally block 2020-04-23 08:45:11 +02:00
Jonas Jensen
875daae84b Merge pull request #3151 from dbartol/dbartol/floats
C++: Better support for complex numbers in IR and AST
2020-04-20 16:27:20 +02:00
Dave Bartolomeo
de5abdb29a C++/C#: Add missing QLDoc 2020-04-18 09:55:35 -04:00
Robert Marsh
9008084b74 Merge pull request #3272 from dbartol/dbartol/DumpFixes
C++: A couple of fixes for IR dumps
2020-04-17 11:49:52 -07:00
Tom Hvitved
1b6e978a62 Data flow: Sync files 2020-04-17 13:49:06 +02:00
Tom Hvitved
de41e668b0 Data flow: No more flow summaries 2020-04-17 13:48:20 +02:00
Tom Hvitved
1959480b78 C#: Field-flow summaries for library code 2020-04-16 15:20:47 +02:00
Dave Bartolomeo
3dd3b5304e Merge remote-tracking branch 'upstream/master' into dbartol/floats 2020-04-16 08:44:41 -04:00
Tom Hvitved
922e52f061 Merge pull request #3257 from hvitved/csharp/dataflow/tests
C#: Update data flow tests
2020-04-16 11:47:45 +02:00
Dave Bartolomeo
90dc14c56e C++/C#: Fix phantom Chi definitions in PrintSSA
When `PrintSSA.qll` is imported, IR dumps will be annotated with the alias analysis information used during SSA construction. When printing this information, we incorrectly treated instructions at offset -1, which should only be `Phi` instructions, as `Chi` instructions for the instruction at offset 0. This produced phantom annotations, but did not affect the correctness of the actual IR.
2020-04-15 18:24:11 -04:00
Chris Gavin
4e981d8e70 Merge rc/1.24 into master. 2020-04-14 21:30:29 +01:00
Tom Hvitved
a9b88b6eaa C#: Update data flow tests 2020-04-14 09:31:10 +02:00
Dave Bartolomeo
1bde11706e C++: Connect InitializeIndirection to UnmodeledDefinition
The IR generation for `InitializeIndirection` currently connects its load operand to the result of the corresponding `InitializeParameter` instruction. This isn't exactly wrong, but it doesn't fit the IR invariant of "All unmodeled uses consume `UnmodeledDefinition`". Our current code doesn't care, because we just throw away all of the existing def-use information, modeled or otherwise, when we build unaliased SSA. However, some upcoming SSA changes don't work correctly if this invariant is broken.

I've added the trivial IR generation change, along with a new sanity query.
2020-04-13 18:37:47 -04:00
Robert Marsh
a5e7db73b2 Merge branch 'rc/1.24' into rdmarsh/cpp/ir-flow-through-outparams
For submodule consistency
2020-04-13 12:02:59 -07:00
Pavel Avgustinov
6737e99d65 Merge pull request #3209 from hmakholm/baselib-extractor
Add extractor field in base language QL packs
2020-04-09 15:24:49 +01:00
Robert Marsh
7e299e7494 C++/C#: Document ReturnIndirectionInstruction::getParameter 2020-04-08 16:41:07 -07:00
Robert Marsh
c38ccaaab6 Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams 2020-04-08 12:32:35 -07:00
Tom Hvitved
6685a5ed4d Merge pull request #3136 from calumgrant/cs/buildless-extraction
C#: Improvements to buildless extraction
2020-04-07 08:52:00 +02:00
Henning Makholm
bf579dedd4 Add extractor field in base language QL packs 2020-04-06 18:48:01 +02:00
Calum Grant
6cce0de9b2 Merge pull request #3124 from hvitved/csharp/dataflow/sources-and-sinks
C#: Introduce `RemoteFlowSink` class
2020-04-06 12:36:14 +01:00
Jonas Jensen
46fc91315b Java/C++/C#: Revert the join order fix from #2872
This revert brings back the performance problems in
`DataFlowImplLocal.qll` so they can be fixed in a different way. The fix
in #2872 was asymptotically good but had undesired overhead because it
introduced another predicate in the SCC that existed purely for join
ordering.

I did the revert by inlining the helper predicate, eliminating the
`enclosing` variable, and re-ordering the resulting lines to what they
were before #2872.
2020-04-06 10:04:50 +02:00
Robert
1096e5d947 Merge pull request #3163 from robertbrignull/code_scanning_suites
Add code-scanning suites
2020-04-06 08:45:40 +01:00
Tom Hvitved
c8c706a0ba C#: Un-deprecate PublicCallableParameterFlowSource 2020-04-06 09:01:44 +02:00
Tom Hvitved
4e2d6c0250 C#: Add missing QL doc 2020-04-03 12:45:56 +02:00
Mathias Vorreiter Pedersen
0b12c1519b C++/C#: Sync identical files 2020-04-03 10:06:37 +02:00
Robert Marsh
a061811939 Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
Pick up new test for user-defined swap functions
2020-04-01 17:32:55 -07:00
Tom Hvitved
42e180d6c4 Merge pull request #3060 from aschackmull/dataflow/no-param-to-same-param-flow
Dataflow: Exclude param-param flow through with identical params.
2020-04-01 09:42:12 +02:00
Robert Marsh
25f3f67c4a Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
Fixes test conflicts and reveals a bug in parameter handling
2020-03-31 12:54:00 -07:00
Tom Hvitved
9fa9c10361 Merge pull request #2921 from aschackmull/dataflow/consistency-checks
Java: Add data-flow consistency checks.
2020-03-30 12:47:41 +02:00
Anders Schack-Mulligen
caf0d1528f Merge pull request #3155 from max-schaefer/add-module-comment
Data flow: Add module doc comment for `TaintTrackingImpl.qll`
2020-03-30 12:07:08 +02:00
Max Schaefer
e5e94e3357 Data flow: Add module doc comment for TaintTrackingImpl.qll
Modelled after the correponding comment for `DataFlowImpl.qll`.
2020-03-30 10:35:47 +01:00
Dave Bartolomeo
39dd9b7099 C++/C#: Fix formatting 2020-03-27 19:46:53 -04:00
Dave Bartolomeo
c3a6ca0d9a C++: Better support for complex numbers in IR and AST
This PR adds better support for differentiating complex and imaginary floating-point types from real floating-point types, in both the AST and in the IR type system.

*AST Changes*
- Introduces the new class `TypeDomain`, which can be either `RealDomain`, `ImaginaryDomain` or `ComplexDomain`. "type domain" is the term used for this concept in the C standard, and I couldn't think of a better one.
- Introduces `FloatingPointType.getDomain()`, to get the type domain of the type.
- Introduces `FloatingPointType.getBase()`, to get the numeric base of the type (either 2 or 10).
- Introduces three new subtypes of `FloatingPointType`: `RealNumberType`, `ComplexNumberType`, and `ImaginaryNumberType`, which differentiate between the types based on their type domain. Note that the decimal types (e.g., `_Decimal32`) are included in `RealNumberType`.
- Introduces two new subtypes of `FloatingPointType`: `BinaryFloatingPointType` and `DecimalFloatingPointType`, which differentiate between the types based on their numeric base, independent of type domain.

*IR Changes*
- `IRFloatingPointType` now has two additional parameters: the base and the type domain.
- New test that ensures that C++ types get mapped to the correct IR types.
- New IR test that verifies the IR for some basic usage of complex FP types.
2020-03-27 18:08:14 -04:00
Robert Brignull
90fad6f762 add code scanning suites 2020-03-27 17:03:23 +00:00
Mathias Vorreiter Pedersen
7890a322c8 C++/C#/Java: Sync identical files 2020-03-27 11:51:38 +01:00
Calum Grant
b94b4b7c91 C#: Fix tests 2020-03-26 20:40:40 +00:00
Dave Bartolomeo
7879dde8b8 Merge pull request #3097 from jbj/detect-conflated-memory
C++: Implement Instruction.isResultConflated
2020-03-26 14:52:47 -04:00
Tom Hvitved
db8d61c3be C#: Remove compiler warning in Remote.qll 2020-03-26 12:26:17 +01:00
Tom Hvitved
54677189de C#: Introduce RemoteFlowSink class 2020-03-25 20:05:39 +01:00
Tom Hvitved
142737dc61 C#: Move HtmlSinks from XSS.qll into separate file 2020-03-25 20:05:39 +01:00
Tom Hvitved
fddbce0b7b C#: Move all predefined sources and sinks into security/dataflow/flow{sinks,sources} 2020-03-25 20:05:39 +01:00
Dave Bartolomeo
1edd492abf C++: Late fix for PR feedback
I missed this suggestion before I merged the original PR. Fixing it now before I forget.
2020-03-25 10:10:30 -04:00
Dave Bartolomeo
376779421d Merge pull request #2975 from rdmarsh2/printir-generate-all
C++/C#: generate IR for funcs excluded in PrintIR
2020-03-25 09:45:02 -04:00
Jonas Jensen
2b2667aef7 Merge remote-tracking branch 'upstream/master' into detect-conflated-memory
Conflicts:
	cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRSanity.qll
	cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRSanity.qll
	cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRSanity.qll
	cpp/ql/test/library-tests/ir/ir/aliased_ssa_sanity.expected
	cpp/ql/test/library-tests/ir/ir/aliased_ssa_sanity_unsound.expected
	cpp/ql/test/library-tests/ir/ir/raw_sanity.expected
	cpp/ql/test/library-tests/ir/ir/unaliased_ssa_sanity.expected
	cpp/ql/test/library-tests/ir/ir/unaliased_ssa_sanity_unsound.expected
	cpp/ql/test/library-tests/ir/ssa/aliased_ssa_sanity.expected
	cpp/ql/test/library-tests/ir/ssa/aliased_ssa_sanity_unsound.expected
	cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_sanity.expected
	cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_sanity_unsound.expected
	cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
	cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
	cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
	csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRSanity.qll
	csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRSanity.qll
	csharp/ql/test/library-tests/ir/ir/raw_ir_sanity.expected
	csharp/ql/test/library-tests/ir/ir/unaliased_ssa_sanity.expected
2020-03-25 11:55:39 +01:00
Dave Bartolomeo
2b69cc9738 C#: Make IRConfiguration.qll just forward to the implementation
Just like C++ already does.
2020-03-24 13:33:50 -04:00
Jonas Jensen
8f419d1676 C++: Fix conflated-memory sanity query
I had included `InitializeNonLocal` in the recursion because it made
everything look better in the presence of a bug that's since been fixed.
Taking it out means the sanity test is again aligned with the old
`isChiForAllAliasedMemory`.
2020-03-24 16:46:59 +01:00
Jonas Jensen
4e588869d8 C++: Sync identical files 2020-03-24 16:46:42 +01:00
Jonas Jensen
29c4c8c0b2 C#: Fixup to follow C++ changes 2020-03-23 20:39:43 +01:00
Jonas Jensen
999051d20e C++: QLDoc terminology: object -> mem allocation 2020-03-23 20:32:47 +01:00
Dave Bartolomeo
c5ac357bfc C++/C#: Fix bad overlap sanity failures
`Instruction.getDefinitionOverlap()` depends on `SSAConstruction::getMemoryOperandDefinition()`, which in turn depends on `SSAConstruction::hasMemoryOperandDefinition()`. When the definition in question came from a `Chi` instruction, `hasMemoryOperandDefinition()` incorrectly bound `overlap` to the overlap relationship between the original (non-`Chi`) instruction and the use. The fix is to make use of the `actualDefLocation` parameter to `getDefinitionOrChiInstruction()`, which specifies the location for the result of the `Chi` in that case.
2020-03-23 14:57:41 -04:00