Ahmed Farid
c59a8b0c57
Create PossibleTimingAttackAgainstSensitiveInfo.qhelp
2022-08-04 12:17:43 +01:00
Ahmed Farid
c13477c14f
Update and rename TimingAttack.qhelp to TimingAttackAgainstSensitiveInfo.qhelp
2022-08-04 12:16:06 +01:00
Ahmed Farid
10df8e6c02
Rename TimingAttackAgainstHeader.ql to TimingAttackAgainstHeaderValue.ql
2022-08-04 12:12:44 +01:00
Ahmed Farid
399972071c
Rename TimingAttackAgainstHeaderValue.ql to TimingAttackAgainstHeaderValue.qhelp
2022-08-04 12:11:28 +01:00
Ahmed Farid
89e1ad40f2
Create TimingAttackAgainstHeaderValue.ql
2022-08-04 12:10:06 +01:00
Ahmed Farid
2bb9448c9f
Create PossibleTimingAttackAgainstHash.qhelp
2022-08-04 12:03:48 +01:00
Ahmed Farid
473ff0ef59
Create TimingAttackAgainstHash.qhelp
2022-08-04 12:02:50 +01:00
Ahmed Farid
9b2ff70332
format document
2022-08-04 00:56:30 +01:00
Rasmus Wriedt Larsen
8fb85a98d8
Merge branch 'main' into post-release-prep/codeql-cli-2.10.2
2022-08-03 10:42:02 +02:00
Rasmus Wriedt Larsen
3d0c23e441
Python: Accept .expected for TarSlip
...
Changed after merging https://github.com/github/codeql/pull/9579 ,
which improved our handling of `not` for guards.
2022-08-03 09:52:11 +02:00
Alex Ford
8e3548efb3
Merge branch 'main' into post-release-prep/codeql-cli-2.10.2
2022-08-02 20:29:26 +01:00
Rasmus Wriedt Larsen
1737d08145
Merge pull request #9579 from yoff/python/more-logic-tests
...
Python: Improve `BarrierGuard`
2022-08-01 11:36:11 +02:00
github-actions[bot]
e8747d3176
Post-release preparation for codeql-cli-2.10.2
2022-07-28 20:00:09 +00:00
github-actions[bot]
212786ed91
Release preparation for version 2.10.2
2022-07-28 13:38:35 +00:00
Ahmed Farid
813e2394f7
Merge branch 'main' into timing-attack-py
2022-07-27 14:40:55 +01:00
Ahmed Farid
e3340c9345
Update TimingAttackAgainstSensitiveInfo.py
2022-07-27 00:25:42 +01:00
Ahmed Farid
ca4fa0aaae
Update TimingAttack.qll
2022-07-27 00:06:28 +01:00
Ahmed Farid
ad57ff4def
Rename PossibleTimingAttackAgainstSignature.qlref to PossibleTimingAttackAgainstHash.qlref
2022-07-26 23:56:24 +01:00
Ahmed Farid
d01d7ba766
Create PossibleTimingAttackAgainstSensitiveInfo.ql
2022-07-26 23:53:39 +01:00
Ahmed Farid
0083a7fa6d
Update TimingAttackAgainstSensitiveInfo.ql
2022-07-26 23:53:18 +01:00
Ahmed Farid
f35985097d
Update and rename PossibleTimingAttackAgainstSignature.expected to PossibleTimingAttackAgainstHash.expected
2022-07-26 23:50:44 +01:00
Ahmed Farid
d68f8c5325
Update PossibleTimingAttackAgainstHash.ql
2022-07-26 16:44:33 +01:00
Ahmed Farid
bdf94ceeee
Update TimingAttackAgainstHash.ql
2022-07-26 16:44:08 +01:00
Ahmed Farid
32d380828d
Update TimingAttackAgainstSensitiveInfo.ql
2022-07-26 16:41:23 +01:00
Ahmed Farid
b42293dbbb
Update TimingAttackAgainstSensitiveInfo.ql
2022-07-26 16:40:24 +01:00
Ahmed Farid
735fee53a4
Update TimingAttack.qll
2022-07-26 16:35:26 +01:00
Ahmed Farid
bfb8395dce
Update TimingAttackAgainstSensitiveInfo.ql
2022-07-26 16:05:57 +01:00
Ahmed Farid
9c08f9fbe6
Update TimingAttackAgainstHeader.ql
2022-07-26 15:38:37 +01:00
Ahmed Farid
912f40255d
Update TimingAttackAgainstSensitiveInfo.ql
2022-07-26 15:37:02 +01:00
Ahmed Farid
961cc8778f
Update PossibleTimingAttackAgainstHash.ql
2022-07-26 15:36:07 +01:00
Ahmed Farid
2f3172e74b
Update TimingAttackAgainstHeader.ql
2022-07-26 15:34:40 +01:00
Ahmed Farid
dc89773fe8
Update TimingAttack.qll
2022-07-26 15:30:31 +01:00
Ahmed Farid
c98af44df8
Update Concepts.qll
2022-07-26 15:15:06 +01:00
Ahmed Farid
e6dd21a57d
Update Frameworks.qll
2022-07-26 15:14:02 +01:00
Ahmed Farid
656e8cf44e
Delete CryptographicOperation.qll
2022-07-26 15:13:32 +01:00
Andrew Eisenberg
43ae5d4285
Merge pull request #9838 from github/aeisenberg/python-local-ref-def
...
Move python contextual queries to lib folders
2022-07-25 09:00:32 -07:00
Ahmed Farid
2f72cc5ca8
Update PossibleTimingAttackAgainstHash.ql
2022-07-22 03:28:32 +01:00
Ahmed Farid
fd558604cc
Update TimingAttack.qll
2022-07-21 18:48:07 +01:00
Ahmed Farid
6a782f47a9
Update Frameworks.qll
2022-07-20 13:08:21 +01:00
Ahmed Farid
6871790793
Rename TimingAttackAgainstSignature.ql to TimingAttackAgainstHash.ql
2022-07-20 13:07:14 +01:00
Ahmed Farid
7d0d39e019
Update PossibleTimingAttackAgainstHash.ql
2022-07-20 13:05:49 +01:00
Ahmed Farid
ee743e61e9
Update TimingAttack.qll
2022-07-20 13:03:55 +01:00
Ahmed Farid
238d3250c3
Update Concepts.qll
2022-07-20 13:00:30 +01:00
Ahmed Farid
e7742bd87c
Create CryptographicOperation.qll
...
Provides models for Python's Cryptography-related libraries
2022-07-20 12:58:13 +01:00
Ahmed Farid
4f082e28e5
Update and rename TimingAttackAgainstSignature.py to TimingAttackAgainstHash.py
2022-07-20 12:26:57 +01:00
Ahmed Farid
b3925ae988
Update PossibleTimingAttackAgainstSignature.qlref
2022-07-20 00:57:26 +01:00
Ahmed Farid
3d092f9569
Update TimingAttackAgainstSignature.ql
2022-07-20 00:56:52 +01:00
Ahmed Farid
27d81548a7
Update PossibleTimingAttackAgainstHash.ql
2022-07-20 00:55:22 +01:00
Ahmed Farid
bfce1898b9
Update and rename PossibleTimingAttackAgainstSignature.ql to PossibleTimingAttackAgainstHash.ql
2022-07-20 00:49:09 +01:00
Taus
2436b060f1
Python: Fix another bad "value transfer" join
...
The culprit:
```
Tuple counts for PointsTo::InterProceduralPointsTo::scope_entry_value_transfer_from_earlier#741b54e2#ffff#join_rhs/5@eb1340iv after 12.6s:
72973 ~3% {2} r1 = JOIN PointsToContext::TImportContext#cf3039a0#f WITH Definitions::NonEscapingGlobalVariable#class#486534ab#f CARTESIAN PRODUCT OUTPUT Rhs.0, Lhs.0 'arg1'
537932 ~0% {3} r2 = JOIN r1 WITH Essa::EssaDefinition::getSourceVariable#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1 'arg2', Lhs.1 'arg1', Lhs.0
982333 ~0% {4} r3 = JOIN r2 WITH Essa::EssaVariable::getAUse#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1 'arg1', Lhs.0 'arg2', Rhs.1 'arg0'
37029774 ~0% {4} r4 = JOIN r3 WITH Essa::TEssaNodeDefinition#24e22a14#ffff ON FIRST 1 OUTPUT Rhs.3 'arg3', Lhs.1 'arg1', Lhs.2 'arg2', Lhs.3 'arg0'
35956211 ~0% {5} r5 = JOIN r4 WITH Essa::ScopeEntryDefinition::getScope#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.3 'arg0', Lhs.1 'arg1', Lhs.2 'arg2', Lhs.0 'arg3', Rhs.1 'arg4'
return r5
```
You may notice that this is a predicate that's _materialised_, but it's
never actually used anywhere. It's the old "standard order" bringing
much sadness.
The problem here is that in the standard order (which we never actually
use here), we end up with a join between the bits above, `getRootCall`,
and `appliesToScope`. The `join_rhs` bit is joined twice, once with
`getRootCall#prev` and `appliesToScope#prev_delta` (in that order), and
once with `prev` and `prev_delta` swapped.
So to fix this, I used the unbinding pragma to force `appliesToScope` to
appear first in the join order. This was enough to make the compiler
_not_ push the common context into its own `join_rhs` predicate (and
the join-order is still decent.)
2022-07-19 17:18:07 +00:00
