hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity
33,347 Commits 1,672 Branches 157 Tags
hmac/command-injection-from-library-inputs
Commit Graph

5325 Commits

Author SHA1 Message Date
Jonas Jensen
0af62b8431 Merge pull request #4515 from geoffw0/modelchanges1 
C++: Changes to models library.
 2020-10-29 11:21:56 +01:00
Mathias Vorreiter Pedersen
43a231f0a5 C++: Store steps now go from operands to instructions, and read steps now go from instructions and operands. There are a couple of read steps that still target instructions because I couldn't decide on an operand to target. 2020-10-29 09:26:51 +01:00
Dave Bartolomeo
7a2c59c194 Merge from main 2020-10-28 15:35:46 -04:00
Geoffrey White
ae84d1383e Merge pull request #4565 from MathiasVP/instruction-tag-for-this-addr-and-load-fix 
C++: Fix spelling in getInstructionTagId
 2020-10-28 16:53:55 +00:00
Mathias Vorreiter Pedersen
614e2ba851 C++: Fix spelling 2020-10-28 13:05:37 +01:00
Cornelius Riemenschneider
f1f64fb7df C++: Make BuiltInVarArgs* classes subclasses of VarArgsExpr. 2020-10-28 10:48:00 +01:00
Geoffrey White
09372f5c81 C++: Remove misleading comment. 2020-10-28 09:04:10 +00:00
Mathias Vorreiter Pedersen
ad9e7b7343 C++: Give getInstructionTagId a result when tag is ThisAddressTag or ThisLoadTag 2020-10-27 22:16:01 +01:00
Robert Marsh
7d7b0eaa7b C++: accept test changes 
The conflation-related changes result from aliased accesses for which a
precise Phi node is generated.
 2020-10-27 09:33:28 -07:00
Geoffrey White
c8783b5ea3 Revert "C++: Create a module for models of things in Std." 
This reverts commit ddc5150080.
 2020-10-27 13:31:16 +00:00
Jonas Jensen
8f6dbe982e Merge pull request #4468 from github/rdmarsh2/cpp/output-iterators-2 
C++: flow through output iterators with user-defined operator= and operator*
 2020-10-27 08:36:14 +01:00
Jonas Jensen
45cd47ea77 Merge pull request #4535 from criemen/jump-to-def 
C++: Extend jump-to-def support to template instantiations.
 2020-10-27 08:16:57 +01:00
Geoffrey White
12233e5874 Merge pull request #4533 from MathiasVP/mathiasvp/fix-broken-qhelp 
C++: Fix broken qhelp links
 2020-10-26 14:40:52 +00:00
Mathias Vorreiter Pedersen
9db66a1b94 Delete the msdn reference in NestedLoopSameVar 
It was a Visual Basic reference anyway, and it doesn't seem to provide more information than the link we have already.
 2020-10-26 15:27:24 +01:00
Cornelius Riemenschneider
1b88ca1e81 C++: Simplify code, add comment explaining the logic. 2020-10-26 14:39:12 +01:00
Cornelius Riemenschneider
447ba205b4 C++: Move Conversions in PrintAST to the side. 2020-10-26 13:49:02 +01:00
Mathias Vorreiter Pedersen
02bcb6d971 Apply suggestions from code review 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2020-10-26 11:39:54 +01:00
Cornelius Riemenschneider
07452c0159 C++: Add comment, explaining where this query is used. 2020-10-26 09:28:24 +01:00
Cornelius Riemenschneider
fca141146b C++: Address review. 2020-10-26 09:27:29 +01:00
Dave Bartolomeo
3fce971f2d Fix taint propagation to qualifier objects and update test expectations 2020-10-23 17:48:37 -04:00
Dave Bartolomeo
4d2f658ece Don't treat allocator argument as a string input 2020-10-23 17:44:07 -04:00
Robert Marsh
aab9797c2f Merge branch 'main' into rdmarsh2/cpp/output-iterators-2 
Resolve merge conflict in tests
 2020-10-23 13:50:15 -07:00
Dave Bartolomeo
35abcae5d3 Fix formatting 2020-10-23 13:43:29 -04:00
Dave Bartolomeo
bace0dca6d Handle more cases that require synthesizing temporary objects 
- Parens around qualifier expressions
- Inheritance conversions involving class prvalues
 2020-10-23 12:04:09 -04:00
Cornelius Riemenschneider
a82cf74161 C++: Improve performance of definitions.qll. 2020-10-23 15:16:53 +02:00
Jonas Jensen
08bf464437 Merge pull request #4540 from criemen/printast-performance 
C++: Improve PrintAST performance if only individual files are printed
 2020-10-23 12:46:34 +02:00
Dave Bartolomeo
99072483b8 Fix PR feedback 2020-10-22 12:55:40 -04:00
Dave Bartolomeo
b62bda6c3a Fix regression due to primary instructions for side effects not being computed correctly in the presence of synthetic temporary objects. 2020-10-22 12:55:30 -04:00
Cornelius Riemenschneider
6b072686ab C++: Improve PrintAST performance. 
This improves the performance of the printAst.ql query by excluding a lot of string concatenations that happen in files unrelated to the one the user is interested in printing.
This is supposed to help the performance of the AST Viewer on bigger databases.
 2020-10-22 16:38:52 +02:00
Mathias Vorreiter Pedersen
90c027f291 Merge pull request #4532 from geoffw0/wrongtypeformaterr 
C++: Harden queries against ErroneousType
 2020-10-22 14:21:14 +02:00
Mathias Vorreiter Pedersen
d0dd71ba10 Apply suggestions from code review 
Co-authored-by: hubwriter <54933897+hubwriter@users.noreply.github.com>
 2020-10-22 12:53:35 +02:00
Dave Bartolomeo
1de1ab65b7 Merge remote-tracking branch 'upstream/main' into work 2020-10-21 18:22:55 -04:00
Cornelius Riemenschneider
9388448053 C++: Extend jump-to-def support to template instantiations. 
This commit extends developers ability to use jump-to-def in C/C++ files opened in the VSCode extension.
Before, jump-to-def starting with code in a template instantiation did not work.

Furthermore, this fixes a bug, as the list of all references of a location did not include template instantiations.
 2020-10-21 21:35:38 +02:00
Robert Marsh
1a365d2098 C++: remove InitializeNonLocalInstruction from IR 
Instead, have AliasedDefinition initialize read-only nonlocal memory
 2020-10-21 12:12:38 -07:00
Dave Bartolomeo
ee18db7b36 Fix IR for member accesses on prvalues 
This fixes the IR generation for member accesses where the qualifier is a prvalue that is _not_ the load of a `TemporaryObjectExpr`. We synthesize a temporary variable during IR generation instead. It fits into the IR construction code at the same spot as `TranslatedLoad`, since it's basically the opposite of `TranslatedLoad` (prvalue->glvalue instead of vice versa). Note that array prvalues require special treatment.

This fixes some consistency errors in the `syntax-zoo`. It introduces three new ones in `dataflow-ir-consistency.expected`, but those are along the same lines as tons of existing failures.
 2020-10-21 13:32:15 -04:00
Mathias Vorreiter Pedersen
056a553976 C++: Fix broken qhelp links 2020-10-21 17:26:46 +02:00
Geoffrey White
d97f03c2be C++: Exclude error types from NonPortablePrintf. 2020-10-21 14:51:52 +01:00
Geoffrey White
ac1e0692bb C++: Exclude error types from WrongTypeFormatArguments. 2020-10-21 13:25:57 +01:00
Geoffrey White
6d91d55669 C++: Use the AllocationExpr model. 2020-10-21 11:00:15 +01:00
Robert Marsh
413c845e97 Merge branch 'main' into rdmarsh2/cpp/output-iterators-2 
Accept test changes for unnamed elements
 2020-10-20 15:22:08 -07:00
Dave Bartolomeo
08af0803ff Add examples to QLDoc comment 2020-10-20 17:34:46 -04:00
Dave Bartolomeo
8c8daa38ec Update stats 2020-10-20 13:41:52 -04:00
Dave Bartolomeo
4ba281731c Fix IR generation for member access with a prvalue on the RHS 
For historical reasons, the extractor marks the temporary object expression used as the qualifier of a member access as a prvalue(load), even though the current C++ standard says that the temporary object materialization results in a glvalue. Added some special handling to ignore the load for both field accesses and member function calls.

This fixes all of the consistency failures in our regular tests, and all of the related failures in `syntax-zoo` other than the ones that deal with pointers-to-member, which aren't really supported yet anyway.
 2020-10-20 12:53:47 -04:00
Geoffrey White
17ff34267a C++: Resolve the overlap. 2020-10-20 17:47:49 +01:00
Geoffrey White
7db2b2ce37 C++: Make the two queries more alike. 2020-10-20 17:46:47 +01:00
Dave Bartolomeo
735c657326 IR consistency checks for FieldAddress and this arguments that are not actually addresses. 
Exposes failures in existing tests. Also added a small test case for `FieldAddress` on a prvalue.
 2020-10-20 10:32:28 -04:00
Dave Bartolomeo
ade6d10e58 Merge remote-tracking branch 'upstream/main' into work 2020-10-20 07:24:42 -04:00
Mathias Vorreiter Pedersen
528afc55ab Merge pull request #3788 from geoffw0/callderef 
C++: Add bcopy to models and use it.
 2020-10-20 12:15:23 +02:00
Geoffrey White
f9987cff64 C++: Update QLDoc comment. 2020-10-20 09:36:33 +01:00
Dave Bartolomeo
2eaa4a4ecf Merge remote-tracking branch 'upstream/main' into work 2020-10-19 15:19:03 -04:00