hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
82,275 Commits 1,671 Branches 157 Tags
tausbn/python-refine-location-of-flask-request-sources
Commit Graph

13682 Commits

Author SHA1 Message Date
Ziemowit Laski
03aa86ed4d Merge branch 'master' into cpp340a 
So as to get to change-notes/1.21/analysis-cpp.md
 2019-04-01 18:51:03 -07:00
Ziemowit Laski
bd139829ea [CPP-340] Delete old 'UnspecifiedFunctions' folders 2019-04-01 18:44:49 -07:00
Ziemowit Laski
3ec988c39b [CPP-340] Rename 'UnspecifiedFunctions' to 'Unspecified Functions' 
Make MistypedFunctionArguments.ql more restrictive (allowing
          type matching only in the presence of no-op conversions).
 2019-04-01 18:39:46 -07:00
Arthur Baars
5eb58f3ba2 C++: fix HubClasses.ql by changing its kind to 'table' 2019-04-01 16:17:23 +02:00
Jonas Jensen
71659594c8 C++: Let data flow past definition by reference 
This commit changes how data flow works in the following code.

    MyType x = source();
    defineByReference(&x);
    sink(x);

The question here is whether there should be flow from `source` to
`sink`. Such flow is desirable if `defineByReference` doesn't write to
all of `x`, but it's undesirable if `defineByReference` is a typical
init function in `C` that writes to every field or if
`defineByReference` is `memcpy` or `memset` on the full range.

Before 1.20.0, there would be flow from `source` to `sink` in case `x`
happened to be modeled with `BlockVar` but not in case `x` happened to
be modelled with SSA. The choice of modelling depends on an analysis of
how `x` is used elsewhere in the function, and it's supposed to be an
internal implementation detail that there are two ways to model
variables. In 1.20.0, I changed the `BlockVar` behavior so it worked the
same as SSA, never allowing that flow. It turns out that this change
broke a customer's query.

This commit reverts `BlockVar` to its old behavior of letting flow
propagate past the `defineByReference` call and then regains consistency
by changing all variables that are ever defined by reference to be
modelled with `BlockVar` instead of SSA. This means we now get too much
flow in certain cases, but that appears to be better overall than
getting too little flow. See also the discussion in CPP-336.
 2019-04-01 14:13:47 +02:00
Arthur Baars
4b95fbbb39 C++ Fix select statements of AV 3 and 81 2019-04-01 11:20:12 +02:00
Arthur Baars
ba7fdddafb Change @kind to 'table' for test and sanity checks queries that don't select problems 2019-04-01 11:20:12 +02:00
Jonas Jensen
04a48e9034 Merge remote-tracking branch 'upstream/master' into SimpleRangeAnalysis-use-after-cast 2019-04-01 09:10:57 +02:00
Ziemowit Laski
8a653b9adc [CPP-340] Fix TooFewArguments.c to actually provide a ()-prototype. 2019-03-29 20:34:49 -07:00
Ziemowit Laski
59a54df149 [CPP-340] cpp/too-many-arguments should remain as cpp/futile-params. 2019-03-29 20:30:40 -07:00
Ziemowit Laski
2ea9f81c7f [CPP-340] Refer to C coding standard, not C++. 2019-03-29 20:27:25 -07:00
Ziemowit Laski
cb5bbd2197 [CPP-340] When warning about mismatched parameters, follow what C 
compilers do.  Various integral and floating-point types
          are treated as mutually implicitly convertible.  Remaining
          warnings deal with misuse of pointer and array types.
 2019-03-29 20:19:45 -07:00
Geoffrey White
a6e0296c0c CPP: Be slash/case insensitive. 2019-03-29 11:19:20 +00:00
Geoffrey White
c8caca3305 CPP: Add test cases for %ls, %hs. 2019-03-29 11:19:20 +00:00
Geoffrey White
f5a7d7a035 CPP: Correct a few comments. 2019-03-29 11:19:19 +00:00
Geoffrey White
66e87fc34c CPP: Detect Microsoft compilations even more reliably. 2019-03-29 11:18:32 +00:00
Geoffrey White
5911699c55 CPP: Clean up some remaining old 'isWideCharDefault' logic that has caused confusion. 2019-03-29 11:18:31 +00:00
Geoffrey White
eef050dd47 CPP: Improve deduction of %S types in FormattingFunction.qll. 2019-03-29 11:18:31 +00:00
Geoffrey White
4a25c37ecc CPP: Detect Microsoft compilations somewhat more reliably. 2019-03-29 11:18:31 +00:00
Geoffrey White
975a0bbf0d CPP: Handle %s/%c/%S/%C correctly on non-MS platforms. 2019-03-29 11:18:31 +00:00
Geoffrey White
648cdbab6c CPP: Add FormattingFunction.getFormatCharType() and test. 2019-03-29 11:18:31 +00:00
Geoffrey White
162c9981bd CPP: Add some test cases. 2019-03-29 11:18:31 +00:00
Jonas Jensen
68a19d7d3e Merge branch 'master' into taintedmalloc 2019-03-29 09:12:38 +01:00
Jason Reed
d03b5bca31 C++: Fix non-private imports. 2019-03-28 20:39:29 -04:00
Jason Reed
9c0be34fd4 C++: Remove accidental redundancy. 2019-03-28 20:39:29 -04:00
Jason Reed
23ee7ee928 C++: Teach range analysis to pay attention to NaNs. 2019-03-28 20:39:29 -04:00
Geoffrey White
f358e61719 CPP: Add a reference about include optimization to the qhelp for AV Rule 35. 2019-03-28 16:37:50 +00:00
Geoffrey White
faa23a53be CPP: Update expected for changes elsewhere. 2019-03-28 15:49:36 +00:00
Geoffrey White
e7c02027f5 CPP: Fix 'BAD'. 2019-03-28 15:49:36 +00:00
Geoffrey White
743b17af50 CPP: Autoformat. 2019-03-28 15:49:36 +00:00
Geoffrey White
0b85966b31 CPP: Fix dubious [old] taint library results involving strlen. 2019-03-28 15:49:36 +00:00
Geoffrey White
8c75e730e4 CPP: Widen TaintedAllocationSize.ql. 2019-03-28 15:49:36 +00:00
Geoffrey White
dab1bba25c CPP: Add a test of TaintedAllocationSize. 2019-03-28 15:49:36 +00:00
Jonas Jensen
debc441d03 Merge pull request #1158 from geoffw0/moremsalloc 
CPP: Add more allocation functions to Alloc.qll
 2019-03-27 13:51:39 +01:00
Geoffrey White
885df8754e Merge pull request #1165 from dave-bartolomeo/dave/CompareFP 
C++: Fix FP in PointlessComparison due to preprocessor
 2019-03-27 10:54:26 +00:00
Jonas Jensen
36ba56c690 C++: Tests for PointlessComparison shortcomings 2019-03-27 10:48:35 +01:00
Jonas Jensen
1ffeebcfea C++: Range analysis: support casts from/to typedef 2019-03-27 10:48:35 +01:00
Jonas Jensen
1c71c74ce5 C++: Tests showing problems with casts of typedefs 2019-03-27 10:48:35 +01:00
Jonas Jensen
10585e719d C++: Support widening casts in range analysis 
This makes sure we can conclude from `(int)myShort == 0` that `myShort`
is 0 even though we can no longer conclude from `(short)myInt == 0` that
`myInt` is 0. Without this, we lost a good result in the test for
`InfiniteLoopWithUnsatisfiableExitCondition.ql`.
 2019-03-27 10:48:34 +01:00
Jonas Jensen
640f900efd C++: Add missing getFullyConverted for unary +/- 2019-03-27 10:48:34 +01:00
Jonas Jensen
50559d5e63 C++: Accept test output change 
The new output looks correct, although I'm not sure if it's correct for
the right reasons.
 2019-03-27 10:48:34 +01:00
Jonas Jensen
b827e7a1ea C++: Fix use-after-cast bug in SimpleRangeAnalysis 
Like everywhere else in the range analysis, operands to comparison
operators must be considered in their fully-converted form.
 2019-03-27 10:48:34 +01:00
Jonas Jensen
ad61b4f55e C++: Add test to demonstrate use-after-cast bugs 2019-03-27 10:48:34 +01:00
semmledocs-ac
fa260872b5 Merge pull request #1081 from rdmarsh2/rdmarsh/cpp/alloca-in-loop 
C++: docs for AllocaInLoop
 2019-03-27 09:10:24 +00:00
Jonas Jensen
581e765f97 Merge pull request #1168 from geoffw0/format-amp 
CPP: %@ in format strings
 2019-03-27 09:08:39 +01:00
Robert Marsh
578ed146ed Merge pull request #1115 from dave-bartolomeo/dave/Lambdas 
C++: IR construction for lambda expressions
 2019-03-26 15:08:34 -07:00
Robert Marsh
30f744a824 C++/Docs: fix whitespace in AllocaInLoop.qhelp 2019-03-26 15:07:28 -07:00
Dave Bartolomeo
127b759bad C++: Move a couple predicates into Exclusions.qll 2019-03-26 14:51:28 -07:00
Dave Bartolomeo
f13fc42a85 C++: Make recursive predicates recursive and non-recursive predicates non-recursive 2019-03-26 14:36:35 -07:00
Geoffrey White
1d0c74daa7 CPP: Fix typo. 2019-03-26 14:34:55 +00:00