Commit Graph

8549 Commits

Author SHA1 Message Date
Andrei Diaconu
dae37e5472 Fixed bugs, updated tests
Fixed a bug in TranslatedExpr: decl + init where the rhs is a reference now work as expected
Uncommented the code for the switch statement
2019-08-28 12:25:13 +01:00
Andrei Diaconu
be01b031b0 Fixed and refactored code for arrays
Introduced 2 new tags to support multidimensional arrays
Multidimensional arrays produce correct code
All types of initializations for arrays work correctly
2019-08-28 12:25:13 +01:00
Andrei Diaconu
35b028e626 Initial work for objects and statements
Objects now work, although I will refactor the code quite a bit for clarity
If and while statements now produce good code
Began work on try statements
2019-08-28 12:25:13 +01:00
Andrei Diaconu
4462babc0b Added support for switch stmt (CS 6.0 style) 2019-08-28 12:25:13 +01:00
AndreiDiaconu1
49777636aa Applied the review comments 2019-08-28 12:25:13 +01:00
AndreiDiaconu1
ffb22bfff8 Locatable -> Language::AST 2019-08-28 12:25:13 +01:00
Andrei Diaconu
9105641741 Update csharp/ql/src/semmle/code/csharp/ir/IRSanity.ql
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-08-28 12:25:13 +01:00
Andrei Diaconu
81d8905a0f Update csharp/ql/src/semmle/code/csharp/ir/PrintIR.ql
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-08-28 12:25:13 +01:00
Andrei Diaconu
ce06bd8af3 Update csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRSanity.ql
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-08-28 12:25:13 +01:00
Andrei Diaconu
d8f8b47605 Update csharp/ql/src/semmle/code/csharp/ir/implementation/raw/PrintIR.ql
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-08-28 12:25:13 +01:00
Dave Bartolomeo
073812b6f1 Rename Cpp -> CSharp 2019-08-28 12:25:13 +01:00
Dave Bartolomeo
609ca034c0 C#/C++: Share IR implementation 2019-08-28 12:25:13 +01:00
Andrei Diaconu
50ba4d1fda Deleted folder 2019-08-28 12:25:13 +01:00
Andrei Diaconu
45455a12d6 Fixed function calls
Function calls now produce correct code.
Added 2 test cases to showcase this.
2019-08-28 12:25:13 +01:00
Andrei Diaconu
26bf7e116d Arrays fixed, simple variable initialization fixed.
Correct code is now generated for array initialization and element access.
Created a new binary Opcode, `IndexedElementAddress`, used to get the address of an array element, similar to how CIL does it.
Fixed simple variable initialization.
2019-08-28 12:25:13 +01:00
Andrei Diaconu
2a41e7b5c0 Fixed issues mentioned in the PR comments
Modified _.getCallable() to _.getFunction()
Deleted both *ssa folders from ir/implementation
Deleted the ValueCategory.qll file
2019-08-28 12:25:13 +01:00
Andrei Diaconu
aea0356994 Fixed var addressing and other changes
Now variables addressing correctly gets translated
Added a new test case to showcase this
Changed VoidType to ObjectType for the type of the 2 instructions
generated by as the prelude of a translated function
(UnmodeledDefinition and AliasedDefinition)
2019-08-28 12:25:13 +01:00
Andrei Diaconu
7ef9bf6eea Fixed whitespace errors in PR 2019-08-28 12:25:13 +01:00
Andrei Diaconu
025d68f07a General tidy up and refactor
Refactored the C++ specific names
Tidied the code
Updated TODOs
2019-08-28 12:25:13 +01:00
Andrei Diaconu
c733bc0ae9 Functional basic porting
Ported basic functionalities from the C++ IR
Added a simple test that passes the IR sanity check and produces
sensible IR (together with the .expected files) to the C# test folder
2019-08-28 12:25:13 +01:00
Andrei Diaconu
fc69c1201d Initial copy of C++ IR with some modifications 2019-08-28 12:25:13 +01:00
Tom Hvitved
16f40fd45a C#: Consolidate CFG tests 2019-08-23 15:25:01 +02:00
Anders Schack-Mulligen
2bea0a459a Java/C++/C#: Sync. 2019-08-23 11:34:17 +02:00
Tom Hvitved
c5d9d74c0a C#: Nested field flow 2019-08-23 09:25:05 +02:00
Calum Grant
ff20a2ceb9 Merge pull request #1761 from hvitved/csharp/dataflow/fields
C#: Data flow through fields
2019-08-22 20:46:00 +01:00
Tom Hvitved
0801e51175 Merge pull request #1790 from jbj/tainttracking-cross-language
C++/C#/Java: Shared TaintTrackingImpl.qll
2019-08-22 14:17:23 +02:00
Jonas Jensen
ad9ee54b65 C++/C#/Java: defaultAdditionalTaintStep 2019-08-22 11:14:06 +02:00
Tom Hvitved
d2f8b0bc20 C#: Handle constructors with member initializers and base() calls in CFG 2019-08-22 10:34:23 +02:00
Tom Hvitved
e6ba282e05 C#: Revert a few changes 2019-08-22 09:26:13 +02:00
Tom Hvitved
5d140930d0 C#: Add field initializers to CFG for constructors
This commit adds field initializers to the CFG for non-static constructors. For
example, in

```
class C
{
    int Field1 = 0;
    int Field2 = Field1 + 1;
    int Field3;

    public C()
    {
        Field3 = 2;
    }

    public C(int i)
    {
        Field3 = 3;
    }
}
```

the initializer expressions `Field1 = 0` and `Field2 = Field1 + 1` are added
to the two constructors, mimicking

```
public C()
{
    Field1 = 0;
    Field2 = Field1 + 1;
    Field3 = 2;
}
```

and

```
public C()
{
    Field1 = 0;
    Field2 = Field1 + 1;
    Field3 = 3;
}
```

respectively. This means that we no longer have to synthesize calls, callables,
parameters, and arguments in the data flow library, so much of the work from
d1755500e4 can be simplified.
2019-08-21 16:21:38 +02:00
Tom Hvitved
a2ffddec5f Merge pull request #1785 from jbj/dataflow-recursion-prevention-shared
C++/C#/Java: Pyrameterize ConfigurationRecursionPrevention
2019-08-21 15:56:50 +02:00
Jonas Jensen
25701f203d C++/C#/Java: Shared TaintTrackingImpl.qll
This file is now identical in all languages. Unifying this file led to
the following changes:
- The documentation spelling fixes and example from the C++ version
  were copied to the other versions and updated.
- The steps through `NonLocalJumpNode` from C# were abstracted into a
  `globalAdditionalTaintStep` predicate that's empty for C++ and Java.
- The `defaultTaintBarrier` predicate from Java is now present but empty
  on C++ and C#.
- The C++ `isAdditionalFlowStep` predicate on
  `TaintTracking::Configuration` no longer includes `localFlowStep`.
  That should avoid some unnecessary tuple copying.
2019-08-21 14:55:54 +02:00
Jonas Jensen
863bf523d6 C++/C#/Java: Autoformat 2019-08-21 13:24:01 +02:00
Jonas Jensen
fdd3b901f7 C/C#/Java: Share ConfigurationRecursionPrevention
This class was copy-pasted in all `DataFlowN.qll` files without using
the identical-files system to keep the copies in sync. The class is now
moved to the `DataFlowImplN.qll` files.

This also has the effect of preventing recursion through first data flow
library copy for C/C++. Such recursion has been deprecated for over a
year, and some forms of recursions are already ruled out by the library
implementation.
2019-08-21 13:04:10 +02:00
Jonas Jensen
6fc3a62edb C++/C#/Java: Change another caller of localFlow
There was also a use of `localFlowStep` in `DataFlowImplCommon` that
should now be `simpleLocalFlowStep`.
2019-08-21 10:20:15 +02:00
Jonas Jensen
ec2cc5a80e C#: Refactor how simpleLocalFlowStep is called
`localFlowStep` is no longer an alias because it should not have the
same QLDoc as `simpleLocalFlowStep`.
2019-08-21 10:05:54 +02:00
Tom Hvitved
eb97d7beaa Revert "C#: Generalize CFG entry/exit nodes to include field/property initializers"
This reverts commit b7e732fddb.
2019-08-21 09:55:24 +02:00
Jonas Jensen
c9ea5ad9a3 C#/Java: Remove cached from wrapper predicate 2019-08-21 09:43:13 +02:00
Jonas Jensen
4b7813b98e C++/C#/Java: Split localFlowStep predicate in two
There's now a `localFlowStep` predicate for use directly in queries and
other libraries and a `simpleLocalFlowStep` for use only by the global
data flow library. The former predicate is intended to include field
flow, but the latter may not.

This will let Java and C# (and possibly C++ IR) avoid getting two kinds
of field flow at the same time, both from SSA and from the global data
flow library. It should let C++ AST add some form of field flow to
`localFlowStep` without making it an input to the global data flow
library.
2019-08-21 09:27:01 +02:00
Anders Schack-Mulligen
9150682ada Merge pull request #1757 from jbj/pyrameterized-taint
C++: Use pyrameterized modules for TaintTracking
2019-08-20 16:33:22 +02:00
Calum Grant
35017786cf Merge pull request #1739 from hvitved/csharp/ssa/delegate-call-source
C#: Search from delegate creation in `delegateCallSource()`
2019-08-20 15:16:20 +01:00
Tom Hvitved
7ab9c8b90d Java/C++/C#: flowCandFwdRead() refactor 2019-08-20 14:44:04 +02:00
Tom Hvitved
80e91cceb1 C#: Disable field flow for cs/inappropriate-encoding 2019-08-20 13:59:46 +02:00
Tom Hvitved
14378ee41a Java/C++/C#: Remove some unbind() calls from shared data flow implementation 2019-08-20 13:59:01 +02:00
Jonas Jensen
7c4938c035 C#: Get rid of TaintTrackingUtil.qll 2019-08-20 13:56:13 +02:00
Jonas Jensen
11583b69e0 C#: Use pyrameterized modules for TaintTracking
To keep the code changes minimal, and to keep the implementation similar
to C++ and Java, the `TaintTracking{Public,Private}` files are now
imported together through `TaintTrackingUtil`. This has the side effect
of exposing `localAdditionalTaintStep`. The corresponding predicate for
Java was already exposed.
2019-08-20 13:45:38 +02:00
Tom Hvitved
a0c834c83d Java/C++/C#: Improve data flow join orders for field flow 2019-08-20 10:14:08 +02:00
Tom Hvitved
1e46509a2a C#: Use TaintTracking2 in cs/inappropriate-encoding 2019-08-19 17:18:49 +02:00
Tom Hvitved
2a2e07d2fc C#: Avoid recomputation in last data flow stage
Avoid recomputing the `ControlFlowReachabilityConfiguration` predicates, as well
as `DispatchCall::getStaticTarget()`.
2019-08-19 17:17:47 +02:00
Anders Schack-Mulligen
6ff4fe38ec Java/C++/C#: Add field flow support for stores in nested fields. 2019-08-19 14:41:06 +02:00