Commit Graph

4392 Commits

Author SHA1 Message Date
Chris Smowton
ee63e60bb7 qlpacks: libraryPathDependencies -> dependencies 2022-10-28 16:07:36 +01:00
Geoffrey White
648c2d09f9 Swift: Simplify InsecureTLS.ql. 2022-10-28 15:56:03 +01:00
Tony Torralba
baf7986cfa Rework types exported through JSContext
Better model the JSExport protocol logic
2022-10-28 15:56:05 +02:00
Geoffrey White
cf9c3afc86 Swift: Add and use AbstractFunctionDecl.hasGlobalName predicate. 2022-10-28 13:57:24 +01:00
Paolo Tranquilli
3dcdc739de Swift: add possibility to run the extractor under an env-specified tool
if `CODEQL_EXTRACTOR_SWIFT_RUN_UNDER` env variable is set, and either
* `CODEQL_EXTRACTOR_SWIFT_RUN_UNDER_FILTER` is not set, or
* it is set to a regexp matching any substring of the extractor call
then the extractor process is substituted with the command (and possibly
options) stated in `CODEQL_EXTRACTOR_SWIFT_RUN_UNDER`, followed by the
system arguments of the extractor itself (which should include the
extractor program itself at the start).

Before calling `exec`, `CODEQL_EXTRACTOR_SWIFT_RUN_UNDER` is unset to
avoid unpleasant loops.

An example usage is to run the extractor under `gdbserver :1234` when
the arguments match a given source file.
2022-10-28 14:12:27 +02:00
Mathias Vorreiter Pedersen
0a3d0c4f56 Merge pull request #11031 from geoffw0/simplify
Swift: Simplify queries using MethodDecl.hasQualifiedName
2022-10-28 13:58:08 +02:00
Tony Torralba
48b0cc0229 Add models for JSContext and JSValue 2022-10-28 13:01:25 +02:00
Tony Torralba
81701547b2 Add taint sources for WKScriptMessage
This is what contains externally-provided data in Webview JS-native bridges
2022-10-28 12:58:27 +02:00
Mathias Vorreiter Pedersen
142e50008e Merge pull request #10967 from MathiasVP/fix-swift-summary
Swift: Fix flow out of summarized callables
2022-10-28 12:57:52 +02:00
Geoffrey White
368f37a27e Swift: And another. 2022-10-28 11:46:27 +01:00
Geoffrey White
1f3ed1cec7 Merge remote-tracking branch 'upstream/main' into simplify 2022-10-28 11:42:05 +01:00
Geoffrey White
6fca350714 Use MethodDecl.hasQualifiedName. 2022-10-28 11:41:42 +01:00
Mathias Vorreiter Pedersen
062a0abceb Swift: Fix flow out of summarized callables. 2022-10-28 12:09:05 +02:00
Paolo Tranquilli
a87495226a Swift: fix remapping
With the change to `std::filesystem` some path concatenations were
translated to appending, which is not the same. In case rhs is absolute
`lhs / rhs == rhs`, while concatenating treats `rhs` as if it was
relative. The same behaviour can be obtained in `std::filesystem` by
using `lhs / rhs.relative_path()`.
2022-10-28 11:16:49 +02:00
Rasmus Wriedt Larsen
8628ff5e52 Merge pull request #10999 from RasmusWL/inline-fail-tag
InlineExpectationsTest: Fail if missing `getARelevantTag`
2022-10-28 10:35:49 +02:00
Geoffrey White
ca279f4073 Merge pull request #10996 from geoffw0/methods
Swift: Add MethodDecl.hasQualifiedName
2022-10-27 19:18:48 +01:00
Geoffrey White
3507ea3f2a Swift: Autoformat. 2022-10-27 17:37:21 +01:00
Geoffrey White
d0f45180ab Swift: cache some predicated. 2022-10-27 14:17:51 +01:00
Paolo Tranquilli
507e3b35ad Merge pull request #10987 from github/redsun82/swift-filesystem
Swift: use `std::filesystem` and `picoSHA2`
2022-10-27 14:14:37 +02:00
Rasmus Wriedt Larsen
adf109b624 Merge branch 'main' into inline-fail-tag 2022-10-27 13:42:32 +02:00
Paolo Tranquilli
09a51ecdd5 Swift: fix cmake generator on Linux 2022-10-27 09:32:05 +02:00
Paolo Tranquilli
3fca25310f Swift: fix copy option 2022-10-27 09:29:05 +02:00
Paolo Tranquilli
22db4932ee Swift: add overwrite_existing to source archiving 2022-10-27 09:26:57 +02:00
Rasmus Wriedt Larsen
fc7eb5b4fc InlineExpectationsTest: sync 2022-10-27 09:02:28 +02:00
Dave Bartolomeo
23b572e9b7 Use ${workspace} for intra-workspace dependencies
Now that the released CLI supports replacement variables in dependency version ranges, we can now mark our published library packs as depending on whatever version of their dependency is in our workspace, without having to manually bump the dependency version every release.

Note that when the packs are published, the dependencies in the published pack file are rewritten to have the correct specific version.
2022-10-26 16:40:01 -04:00
Rasmus Wriedt Larsen
5e9897d150 InlineExpectationsTest: sync 2022-10-26 18:21:13 +02:00
Geoffrey White
a32b08f56a Swift: remove redundant line. 2022-10-26 16:39:33 +01:00
Geoffrey White
e981a28b0f Swift: autoformat test. 2022-10-26 16:32:52 +01:00
Geoffrey White
0b3408b1f6 Swift: Fix typo. 2022-10-26 16:24:25 +01:00
Geoffrey White
5d21c51deb Swift: use hasQualifiedName in UnsafeWebViewFetch.ql. 2022-10-26 16:12:29 +01:00
Geoffrey White
0d41d4e90c Swift: for consistancy, lets have a simple hasName function as well. 2022-10-26 16:11:01 +01:00
Geoffrey White
b24a27d4ae Swift: Add hasQualifiedName methods and tests. 2022-10-26 16:03:49 +01:00
Karim Ali
420c35d4a2 add a query that detects the use of constant salts 2022-10-26 15:32:59 +02:00
Paolo Tranquilli
521e6235b5 Swift: use std::filesystem and picoSHA2
This replaces usages of `llvm::fs` and string manipulation with
`std::filesystem`, also replacing `std::string` with
`std::filesystem::path` where it made sense.

Moreover MD5 hashing used in macOS file remapping was replaced by
SHA256 hashing using a small header-only SHA256 C++ library with an
MIT license, https://github.com/okdshin/PicoSHA2.

File contents hashing was relocated to the newly created `file` library
for later planned reuse.
2022-10-26 13:23:44 +02:00
Paolo Tranquilli
e422a4eef9 Swift: move TargetFile to a separate lib 2022-10-26 10:54:51 +02:00
Paolo Tranquilli
c8788bb5cd Swift: move libraries from tools to third_party 2022-10-26 07:05:56 +02:00
Geoffrey White
53fa91f8ba Swift: Add comment. 2022-10-25 16:51:57 +01:00
Geoffrey White
a67bd4d903 Swift: Fix name clash. 2022-10-25 16:40:27 +01:00
Geoffrey White
3d025ea77e Merge pull request #10903 from geoffw0/review
Swift: Add some summary queries.
2022-10-25 14:47:09 +01:00
Geoffrey White
b59f01f968 Swift: Use UnknownFile. 2022-10-25 13:44:13 +01:00
Karim Ali
18dd0f650c update iterations threshold to most recent OWASP recommendation
which is at least 120,000 iterations for secure password hashing
2022-10-25 14:01:40 +02:00
Karim Ali
408c7bebe5 fix .expected file 2022-10-25 13:24:37 +02:00
Karim Ali
e8f55b9f0d update output message 2022-10-25 13:24:37 +02:00
Karim Ali
c0ac29db16 clarify qhelp + add references to it 2022-10-25 13:24:37 +02:00
Karim Ali
4b7cb706f6 fix error in checking # of iterations
plus also simplify the pattern matching of the sink classes
2022-10-25 13:24:37 +02:00
Karim Ali
0d2e7d43b9 add expected output 2022-10-25 13:24:37 +02:00
Karim Ali
5179a99abb fix test cases to use the correct class name 2022-10-25 13:24:37 +02:00
Karim Ali
c4b2519e6c initial draft of the Swift query for CWE-916 2022-10-25 13:24:37 +02:00
Paolo Tranquilli
d419749eb2 Swift: fix missing extraction of function bodies in SPM builds
For some reason `-experimental-skip-non-inlinable-function-bodies-without-types`
is passed to the frontend, which will skip extraction of most bodies.

By suppressing that option the problem goes away.
2022-10-24 17:11:13 +02:00
Paolo Tranquilli
6651c9447e Swift: failing test for extracting function bodies 2022-10-24 17:10:38 +02:00