Commit Graph

2812 Commits

Author SHA1 Message Date
Calum Grant
61630118fe C#: Fix ql tests. 2019-11-12 13:40:58 +00:00
Calum Grant
58e14af9cd C#: Address review comments. Create a TNullability type annotation and restructure TAnnotation. 2019-11-12 13:40:58 +00:00
Calum Grant
f00276a82c C#: Remove non-essential changes 2019-11-12 13:40:58 +00:00
Calum Grant
a0fa7dad79 C#: Autoformat 2019-11-12 13:40:58 +00:00
Calum Grant
163b931d49 C#: Update db stats 2019-11-12 13:40:58 +00:00
Calum Grant
9fd4a9ceb6 C#: Implement NullabilityEntity to model structured nullability on the side 2019-11-12 13:40:57 +00:00
Calum Grant
61ab9431ab C#: Fix DB inconsistencies, and rework id generation. 2019-11-12 13:40:57 +00:00
Tom Hvitved
28141c9d4d C#: Teach unification library about tuple types 2019-11-12 12:09:58 +01:00
Tom Hvitved
ee2496ab7c C#: Add unification tests for tuple types 2019-11-12 12:08:03 +01:00
Dave Bartolomeo
303bab61b5 Merge pull request #2289 from jbj/ConvertToNonVirtualBaseInstruction
C++ IR: clearly distinguish between virtual and non-virtual base conversions
2019-11-11 13:37:07 -07:00
Felicity Chapman
c4f958d396 Merge pull request #2263 from sauyon/master
Update links to OWASP cheat sheet
2019-11-11 08:51:52 +00:00
Jonas Jensen
7758b43e34 C++: Add ConvertToBase{Opcode,Instruction} classes
These should make it easy to match base-class conversions when it's not
important whether the base class is virtual.
2019-11-10 11:09:54 +01:00
Jonas Jensen
279fc16b60 C++: ConvertToBase -> ConvertToNonVirtualBase
This rename was done with

    perl -p -i -e's/ConvertToBase/ConvertToNonVirtualBase/g' **/*.ql* **/*.expected

followed by re-running the affected tests.
2019-11-10 10:35:53 +01:00
Robert Marsh
64b34ad975 Merge branch 'master' of github.com:Semmle/ql into rdmarsh/cpp/ir-constructor-side-effects 2019-11-08 14:06:36 -08:00
Calum Grant
9715d8849a C#: Disable a CIL consistency check that seems to be invalid. 2019-11-08 16:50:51 +00:00
Calum Grant
4e2e64e949 C#: Fix up CallableReturns tests. 2019-11-08 16:42:22 +00:00
Calum Grant
e12a33d4e0 C#: Disposal tests do not depend on external DLLs. 2019-11-08 16:22:47 +00:00
Calum Grant
d64c244257 C#: Fix test for AspLine. 2019-11-08 15:48:56 +00:00
Tom Hvitved
af5c60c341 C#: Use type unification library in virtual dispatch library 2019-11-08 12:06:05 +01:00
Tom Hvitved
f4b92137d9 C#: Add more virtual dispatch tests 2019-11-08 12:06:05 +01:00
Tom Hvitved
ae54852fa4 C#: Add type unification library 2019-11-08 12:06:05 +01:00
Robert Marsh
2582b69e17 Merge branch 'master' of github.com:Semmle/ql into rdmarsh/cpp/ir-constructor-side-effects 2019-11-07 15:46:08 -08:00
Robert Marsh
e93dcdb16c Merge branch 'master' into rdmarsh/cpp/ir-constructor-side-effects 2019-11-07 15:19:46 -08:00
Dave Bartolomeo
6c1d219c86 Merge from master 2019-11-07 14:50:04 -07:00
Dave Bartolomeo
df1d64fbeb Merge pull request #2244 from jbj/IRType-cached
C++: Minimal caching of the IR type system
2019-11-07 12:44:16 -07:00
Dave Bartolomeo
2c88848d2f Merge pull request #2272 from jbj/getIRTypeForPRValue-join-order
C++/C#: Fix getIRTypeForPRValue join order
2019-11-07 12:22:39 -07:00
semmle-qlci
2b120def01 Merge pull request #2211 from hvitved/csharp/unsafe-deserialization
Approved by jf205
2019-11-07 14:16:13 +00:00
Jonas Jensen
6385528d5f C++/C#: Fix getIRTypeForPRValue join order
This predicate was taking 39s on a snapshot of Facebook Fizz because it
had disjuncts like this:

    43685     ~0%     {1} r34 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685     ~1%     {2} r35 = JOIN r34 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r34.<0>
    170371500 ~2%     {2} r36 = JOIN r35 WITH IRType::IRSizedType#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r35.<1>
    43685     ~6%     {2} r37 = JOIN r36 WITH IRType::IRFunctionAddressType#class#ff AS R ON FIRST 1 OUTPUT r36.<1>, r36.<0>

Instead of fixing the joins in `getIRTypeForPRValue` itself, I've
changed the `IRType::getByteSize` predicate such that the optimiser
knows how to join with it efficiently.

The disjunct shown above now looks like this instead:

    43685  ~0%     {1} r26 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685  ~1%     {2} r27 = JOIN r26 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r26.<0>
    43685  ~6%     {2} r28 = JOIN r27 WITH IRType::IRFunctionAddressType::getByteSize#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r27.<1>, R.<1>
2019-11-07 11:48:16 +01:00
Sauyon Lee
0040c9fb4c Update links to OWASP cheat sheet 2019-11-06 20:21:47 -08:00
Dave Bartolomeo
a9e3bfbd11 C++/C#: Treat string literals like read-only global variables for alias purposes.
Previously, we didn't track string literals as known memory locations at all, so they all just got marked as `UnknownMemoryLocation`, just like an aribtrary read from a random pointer. This led to some confusing def-use chains, where it would look like the contents of a string literal were being written to by the side effect of an earlier function call, which of course is impossible.

To fix this, I've made two changes. First, each string literal is now given a corresponding `IRVariable` (specifically `IRStringLiteral`), since a string literal behaves more or less as a read-only global variable. Second, the `IRVariable` for each string literal is now marked `isReadOnly()`, which the alias analysis uses to determine that an arbitrary write to aliased memory will not overwrite the contents of a string literal.

I originally planned to treat all string literals with the same value as being the same memory location, since this is the usual behavior of modern compilers. However, this made implementing `IRVariable.getAST()` tricky for string literals, so I left them unpooled.
2019-11-06 13:08:28 -07:00
Jonas Jensen
fca7d9a391 C#: Cache IRType like for C++ 2019-11-06 07:42:34 +01:00
Geoffrey White
8c16b36c7f Merge pull request #2231 from semmledocs-ac/newqueries-docscheck
CPP & C#: Review of qhelp (SD-4028)
2019-11-05 11:11:34 +00:00
Tom Hvitved
508b09f565 C#: Address review comments 2019-11-04 13:43:39 +01:00
Tom Hvitved
fd63246f44 Merge remote-tracking branch 'upstream/master' into csharp/unsafe-deserialization 2019-11-04 13:42:35 +01:00
semmle-qlci
fa5388b5f3 Merge pull request #2209 from hvitved/csharp/deserialized-delegate
Approved by calumgrant, jf205
2019-11-04 12:32:04 +00:00
Tom Hvitved
cc7c30def8 Merge pull request #2179 from calumgrant/cs/local-disposal
C#: Fix a FP in cs/local-not-disposed
2019-11-04 11:23:50 +01:00
Robert Marsh
86b5e97f76 Merge branch 'master' of github.com:Semmle/ql into rdmarsh/cpp/ir-constructor-side-effects 2019-10-31 11:34:22 -07:00
alistair
27d0b51c6b CPP & C#: Review of qhelp
PR #2151 got merged without a review of the qhelp
by a technical writer.
The current PR makes changes I would have suggested on that PR.
2019-10-30 16:10:03 +00:00
alexet
924d23f657 Cache the computation of core toString predicates. 2019-10-29 14:48:27 +00:00
Robert Marsh
8076156cb1 Merge branch 'master' into rdmarsh/cpp/ir-callee-side-effects 2019-10-28 16:50:34 -07:00
Robert Marsh
120fa6c330 C++: alias fixes for ReturnIndirection 2019-10-28 15:09:35 -07:00
Anders Schack-Mulligen
d0842fc35d Java/C++/C#: Minor refactor following review comment. 2019-10-28 16:31:22 +01:00
Tom Hvitved
eb990525d7 C#: Add precision tags to UnsafeDeserialization[UntrustedInput].ql 2019-10-28 14:19:40 +01:00
Tom Hvitved
b0cf7cb39a C#: Move UnsafeDeserialization.qll 2019-10-28 13:38:53 +01:00
Tom Hvitved
1fc786bea7 C#: Add precision tag to cs/deserialized-delegate 2019-10-28 13:11:10 +01:00
Anders Schack-Mulligen
379ef1d2f9 Java: Fix bad magic and join-order. 2019-10-28 10:40:06 +01:00
Dave Bartolomeo
cc5a689293 C++/C#: Fix up after merge from master 2019-10-25 14:11:34 -07:00
Dave Bartolomeo
f5e320e988 Merge from master 2019-10-25 13:24:19 -07:00
Dave Bartolomeo
56cbd0c152 C++/C#: Make AliasedUse access only non-local memory
The `AliasedUse` instruction is supposed to represent future uses of aliased memory after the function returns. Since local variables from that function are no longer allocated after the function returns, the `AliasedUse` instruction should access only the set of aliased locations that does not include locals from the current stack frame.
2019-10-25 13:10:39 -07:00
Jonas Jensen
22de0efc58 Merge pull request #2008 from dave-bartolomeo/dave/IRType2
C++: Implement language-neutral IR type system
2019-10-25 09:42:23 +02:00