Commit Graph

725 Commits

Author SHA1 Message Date
Aditya Sharad
0882eb7bb3 Merge rc/1.18 into master. 2018-10-01 12:08:16 +01:00
Nick Rolfe
828d3cb138 Merge pull request #250 from adityasharad/version/1.18.1-dev
Version: Bump to 1.18.1 dev.
2018-10-01 10:59:52 +01:00
Jonas Jensen
9ffdf3b69e Merge pull request #254 from dave-bartolomeo/dave/InstructionToString
C++: Make `Instruction.toString()` less expensive
2018-10-01 08:57:24 +02:00
Dave Bartolomeo
37091953dc C++: Fix test expectations after rebase 2018-09-30 08:25:42 -07:00
Dave Bartolomeo
eb987d5da9 C++: Make Instruction.toString() less expensive
Previously, `Instruction.toString()` returned the same string that is used in IR dumps, which requires numbering all instructions and generating a unique string for each instruction. This is too expensive on large snapshots. I've moved the original code into the new `Instruction.getDumpString()`, and made `Instruction.toString()` just return the opcode plus `getAST().toString()`.
2018-09-30 08:22:15 -07:00
semmle-qlci
89183bd61b Merge pull request #244 from aschackmull/java/typeflow-perf
Approved by yh-semmle
2018-09-29 01:08:15 +01:00
Jonas Jensen
16004facd9 Merge pull request #197 from rdmarsh2/rdmarsh/cpp/ir-guards
IR-based guards library
2018-09-28 21:14:08 +02:00
Aditya Sharad
1c71a856e1 Version: Bump to 1.18.1 dev. 2018-09-28 16:39:44 +01:00
Max Schaefer
b8b41a42fa Merge pull request #248 from adityasharad/fix/eclipse-versions-1.18
Version: Fix C# and JavaScript Eclipse plugins for 1.18.
v1.18.0
2018-09-28 14:17:40 +01:00
Aditya Sharad
f5bd737ada Version: Fix C# and JavaScript Eclipse plugins for 1.18. 2018-09-28 14:10:06 +01:00
Robert Marsh
93732d8b5a C++: Combine IR guard tests into one ql file
This is motivated by test performance; IR compilation happens separately
for each test and takes a bit over a minute, so combining these 8 tests
saves about 10 minutes of test running.
2018-09-27 13:53:02 -07:00
Robert Marsh
b6cc6a3b23 C++: Fix BinaryLogicalOperators always being guards 2018-09-27 13:09:15 -07:00
Robert Marsh
f323fa1df8 C++: test changes from previous commit
The IR for the conversion to bool results in a comparison where the left
hand side is not the result of any expression in the AST, so they can't
be usefully converted back to the AST
2018-09-27 13:06:57 -07:00
Aditya Sharad
87271fb391 Merge pull request #234 from jbj/gitignore-vs
.gitignore everything under .vs in repo root dir
2018-09-27 17:54:56 +01:00
ian-semmle
077ce6a4be Merge pull request #242 from jbj/unresolveCheckResult
C++: Make unresolve dispatch on `result`
2018-09-27 14:59:34 +01:00
Aditya Sharad
1f9da28647 Merge pull request #243 from jbj/CommentedOutCode-join-fix
C++: Fix join order in CommentedOutCode
2018-09-27 14:59:13 +01:00
Anders Schack-Mulligen
b3dbb44e3a Java: Improve performance of TypeFlow. 2018-09-27 15:39:26 +02:00
Jonas Jensen
19435e07a1 C++: Fix join order in CommentedOutCode
After the recent inlining of `unresolveElement`, the join order in
`CommentedOutCode` became a problem. The join orderer was tempted to
join the two `hasLocationInfo` calls first because they had one column
in common. With this commit, they have no columns in common. It follows
from the other predicates in the same file that this column would be the
same, so there is no need to assert it in this predicate and risk that
the join orderer uses that information.

On Wireshark, the `CommentBlock::hasLocationInfo` predicate goes from
taking 2m2s to taking 180ms. The query produces the same 7,448 alerts.
2018-09-27 14:07:13 +02:00
Jonas Jensen
0da452d59a C++: Revert object-orientation of unresolveElement
The change to make `unresolveElement` a member predicate was helpful for
the optimiser when it dispatched on `this`, but now that it "dispatches"
on `result` it's just an unnecessary pollution of the `ElementBase`
namespace.
2018-09-27 13:25:30 +02:00
Jonas Jensen
c61b311682 C++: Make unresolve dispatch on result, not this
This change means that there are no results for `unresolveElement(t)`
where `t` is a "junk type" -- a class definition that is not in the
image of `resolveClass`. These "junk types" still exist as `Element`s,
but they will never be returned by any predicate that goes through
`unresolveElement` to query the db.

We get a small reduction in DIL size and a significant speed
improvement. The DIL for `NewArrayDeleteMismatch.ql` is reduced from
27,630 lines to 27,507 lines, and the total analysis time for the LGTM
suite on jdk8u is reduced from 1158s to 984s.
2018-09-27 13:23:11 +02:00
semmle-qlci
df4bd36b0f Merge pull request #236 from aschackmull/xml-qll/use-concat
Approved by hvitved, xiemaisi, yh-semmle
2018-09-27 11:58:58 +01:00
Aditya Sharad
4767d85a96 Merge pull request #239 from ian-semmle/type_mention
C++: Update test output
2018-09-27 11:02:46 +01:00
Pavel Avgustinov
1248088519 Merge pull request #237 from adityasharad/version/1.18.0-release
Version: Bump to 1.18.0 release.
2018-09-27 11:01:06 +01:00
Ian Lynagh
fd91374b2f C++: Update test output 2018-09-26 18:22:20 +01:00
Aditya Sharad
51697f077c Version: Bump to 1.18.0 release. 2018-09-26 18:18:20 +01:00
Aditya Sharad
40c29263c4 Merge pull request #232 from jbj/resolveElement-member
C++: make `unresolve` a member of ElementBase
2018-09-26 18:09:48 +01:00
semmle-qlci
c36e7f07be Merge pull request #231 from asger-semmle/express-headers
Approved by xiemaisi
2018-09-26 15:40:58 +01:00
Jonas Jensen
c5d08ffcd4 Don't .gitignore .vs/VSWorkspaceSettings.json 2018-09-26 15:52:44 +02:00
Anders Schack-Mulligen
9198f5b9bd CPP/CSharp/Java/Javascript: Use concat in XMLParent.allCharactersString(). 2018-09-26 15:47:21 +02:00
Anders Schack-Mulligen
26c1397216 CPP/CSharp/Javascript: Clean up QLDoc and bring the different XML.qll files closer. 2018-09-26 15:36:20 +02:00
semmle-qlci
a93939b827 Merge pull request #230 from esben-semmle/js/ad-hoc-whitelisting
Approved by xiemaisi
2018-09-26 14:14:25 +01:00
Jonas Jensen
e2ccd57bdd .gitignore everything under .vs in repo root dir
We have external users editing queries with Visual Studio, and it seems
to automatically add very specific files to `.gitignore`. These changes
cause conflicts between unrelated PRs.

This commit adds all of `/.vs` to `.gitignore`, which should hopfully
make Visual Studio stop adding more entries.
2018-09-26 15:12:32 +02:00
Jonas Jensen
3b2512fa0d C++: pragma[nomagic] in Overflow.qll
These two predicates were supposed to be fast but became slow after the
recent inlining of `unresolve`.
2018-09-26 14:39:44 +02:00
Jonas Jensen
6ccd208d4e C++: Prevent incomplete classes from being Types
Raw classes from the database that are incomplete and should be
represented by their complete twin are now allowed to be `Element`s for
performance reasons, but this commit prevents them from being `Type`s.
It was causing confusion in test results and might also cause confusion
in queries.
2018-09-26 14:02:15 +02:00
Nick Rolfe
57f3ac8a79 Merge pull request #226 from adityasharad/merge/1.18-master-250918
Merge rc/1.18 into master.
2018-09-26 10:47:03 +01:00
Jonas Jensen
0e0ab1ea97 C++: make unresolve a member of ElementBase
Also remove the charpred of ElementBase. This gets rid of many redundant
charpred checks. It means that incomplete classes from the db are now
`Element`s, which is maybe noisy but should not be harmful.

Together, these changes give a great reduction in DIL and should help
the optimiser. It brings the DIL of `UncontrolledFormatString.ql` down
from 43,908 lines to 35,400 lines.
2018-09-26 11:12:40 +02:00
Asger F
057c3a92b4 JS: update other Express test outputs 2018-09-26 08:36:52 +01:00
Jonas Jensen
397c8b5750 Merge pull request #212 from raulgarciamsft/master
Setting a SECURITY_DESCRIPTOR’s DACL to NULL
2018-09-26 09:32:29 +02:00
Esben Sparre Andreasen
7c006d4530 Merge pull request #222 from xiemaisi/js/identity-replacement
JavaScript: Add new query flagging identity replacements.
2018-09-26 09:25:19 +02:00
Asger F
a47b1dc774 JS: recognize Express header access with dynamic name 2018-09-26 08:22:21 +01:00
Esben Sparre Andreasen
097a2811e1 JS: change notes for AdHocWhitelistCheckSanitizer 2018-09-26 09:20:40 +02:00
Esben Sparre Andreasen
52061b35d8 JS: address review comments: improve regex, limit sanitizer usage 2018-09-26 09:20:07 +02:00
Asger F
e78a4e9f10 JS: update output from other Express tests 2018-09-26 07:58:44 +01:00
Asger F
ce11b5330d JS: recognize Express headers as RequestInputAccess 2018-09-26 07:58:44 +01:00
Geoffrey White
9c219b958c Merge pull request #225 from sauyon/sizeofcheck
Allow void* pointer arithmetic with sizeof
2018-09-25 22:53:07 +01:00
Raul Garcia
54493eb990 Merge branch 'master' into master 2018-09-25 10:58:51 -07:00
Raul Garcia
d6d27df27b Removing all usage of single quotes 2018-09-25 10:50:34 -07:00
Aditya Sharad
28329562a7 Merge rc/1.18 into master. 2018-09-25 14:31:45 +01:00
Max Schaefer
0e63ea1b51 JavaScript: Update tests. 2018-09-25 11:27:12 +01:00
Max Schaefer
659c67c715 JavaScript: Produce friendlier message for empty-string replacements. 2018-09-25 11:27:12 +01:00