hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,822 Commits 1,684 Branches 159 Tags
280ffdf060855824085b4ec5dd48b4e92076aa1d
Commit Graph

1822 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Slavomir
280ffdf060 Fix test 2021-04-08 14:24:35 +01:00
Slavomir
5351a8eeb7 Use TaintTracking an TaintTracking2 2021-04-08 14:24:35 +01:00
Slavomir
b42d21f740 Improve comments and naming. 2021-04-08 14:24:35 +01:00
Slavomir
d5355eb6b4 Cleanup 2021-04-08 14:24:35 +01:00
Slavomir
cc31cd2fe2 Fix test 2021-04-08 14:24:35 +01:00
Slavomir
0bb5ef6af2 Fix test 2021-04-08 14:24:35 +01:00
Slavomir
7b4a748793 Remove DummySource 2021-04-08 14:24:35 +01:00
Slavomir
7e9f23ab8e Refactor flow logic to ensure untrusted flows to conversion, and conversion flows to template-exec. 2021-04-08 14:24:35 +01:00
Slavomir
963631dedf Improve naming. 2021-04-08 14:24:35 +01:00
Slavomir
687e556df6 Fixes from code review 2021-04-08 14:24:35 +01:00
Slavomir
ad91e4abcb Remove DummySource 2021-04-08 14:24:35 +01:00
Slavomir
63d51205c9 Apply suggestions from code review 
Co-authored-by: Sauyon Lee <sauyon@github.com>
 2021-04-08 14:24:35 +01:00
Slavomir
49894341a8 Add CWE-79: HTML template escaping passthrough 2021-04-08 14:24:35 +01:00
Sauyon Lee
29bf388b83 Merge pull request #519 from sauyon/fix-consistency 
Extract files for error locations
 2021-04-02 01:37:11 -07:00
Chris Smowton
c742a131de Remove filename containing hiragana 
Good test, but unfortunately it turns out our ODASA build under Windows can't cope -- we get `make: *** No rule to make target 'language-packs/go/ql/test/library-tests/semmle/go/Files/�.go', needed by 'target/general/go-tools/output/tools/tokenizer.jar'.  Stop.`

Evidently our windows Actions build *does* work, so this is possible in principle, but let's not delay this PR finding out the exact reasons why right now.
 2021-04-01 08:57:15 +01:00
Sauyon Lee
4451920ada fixup windows 2021-03-31 08:56:34 -07:00
Sauyon Lee
9b60aff45e Sort extractor smoke test output 2021-03-31 08:12:19 -07:00
Sauyon Lee
44cb8f4f0f Check database consistency in smoke tests 2021-03-31 03:37:55 -07:00
Sauyon Lee
cd6fb7d699 Extract files for error locations 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-03-31 03:37:55 -07:00
Sauyon Lee
7e3e2f9adf Add file tests 2021-03-31 02:01:26 -07:00
Owen Mansel-Chan
2ef85291fd Merge pull request #492 from owen-mc/promoted-field-data-flow-non-pointer-type 
Add control flow nodes for implicit fields reads when reading a promoted field
 2021-03-30 11:15:55 +01:00
Owen Mansel-Chan
2fce333a0b Fix bad join order in getBaseInstruction 
It was joining on the index first, rather than the selector expression
 2021-03-30 10:13:31 +01:00
Owen Mansel-Chan
3e57ea0e75 Fix Revel template test 
We want the controller, which is the type which embeds *Revel.Controller.
We have to skip the implicit field reads to get to the base of the selector
expression.
 2021-03-30 10:13:30 +01:00
Owen Mansel-Chan
b507c0d584 Add implicit field reads for promoted method calls 2021-03-30 10:13:30 +01:00
Owen Mansel-Chan
a89a42df6f Expand PromotedField to PromotedValueEntity 
This includes promoted methods as well
 2021-03-30 10:13:29 +01:00
Owen Mansel-Chan
770c770a8f Add tests for promoted methods 
We need implicit field reads for calls to promoted methods.
False negative flags have been added to make this pass on main.
 2021-03-30 10:13:29 +01:00
Owen Mansel-Chan
42300819a5 Remove incorrect assumption 
Now that we have implicit field reads, it is no longer the case
that the base of a field read instruction will be an eval
instruction.
 2021-03-30 10:13:28 +01:00
Owen Mansel-Chan
44b4e211c1 Make ImplicitFieldReadInstruction extend ImplicitFieldReadInstruction 
This avoids some code duplication.
 2021-03-30 10:13:28 +01:00
Owen Mansel-Chan
00aac808d2 Address review comments 2021-03-30 10:13:27 +01:00
Owen Mansel-Chan
a5293fa835 Use index to determine selector base 2021-03-30 10:13:27 +01:00
Owen Mansel-Chan
015c0537c2 Add index to FieldReadInstruction 2021-03-30 10:13:27 +01:00
Owen Mansel-Chan
0d071b2119 Use depth for implicit field selection 2021-03-30 10:13:26 +01:00
Chris Smowton
204e313c3b Improve documentation 2021-03-30 10:13:26 +01:00
Chris Smowton
6645613eb8 Deduplicate and document helper types 2021-03-30 10:13:25 +01:00
Chris Smowton
9a427931b7 Explicitly walk pointer types 
In a previous draft these could use getBaseType*
 2021-03-30 10:13:25 +01:00
Chris Smowton
660ba4e31c Optimise selectorBase, similar to existing work on implicitFieldRead 2021-03-30 10:13:25 +01:00
Chris Smowton
8cde56dfc2 Neaten and fix documentation of selectorBase 2021-03-30 10:13:24 +01:00
Chris Smowton
9444774895 Add further hints that the range of possible addressed fields, and therefore the interesting selector expressions, are small 2021-03-30 10:13:24 +01:00
Chris Smowton
22a3fccf79 Use type to hint that constraining to embedded fields is a good first step 
This improves the join order for `implicitFieldSelection`
 2021-03-30 10:13:23 +01:00
Sauyon Lee
e1b4867a19 Refactor embedded field calculation to expose access chain 
This allows us to reuse the embedded field calculation in the
logic for generating implicit field selection nodes.
 2021-03-30 10:13:23 +01:00
Owen Mansel-Chan
c192a255c5 Add change note 2021-03-30 10:13:22 +01:00
Owen Mansel-Chan
f1b6139ace Update expected results for ZipSlip to include implicit field reads 2021-03-30 10:13:22 +01:00
Owen Mansel-Chan
13cd19ee40 Make ImplicitFieldReadInstruction include implicit deref when needed 
When an ImplicitFieldReadInstruction reads an embedded field which has
a pointer type, it now includes the implicit dereference.

It might be better to extend MkImplicitDeref to cover this case, so we have
an explicit instruction for this. Then it would be easier to see when
dereferences are happening, and hence when they might cause a nil pointer
dereference.
 2021-03-30 10:13:22 +01:00
Owen Mansel-Chan
2d3caf48c1 Add implicit field reads for promoted fields 
This may not work when the embedded fields are pointer types, as
we don't have anything corresponding to MkImplicitDeref
 2021-03-30 10:13:21 +01:00
Owen Mansel-Chan
7ded91e81d Make depth of promoted fields accessible 2021-03-30 10:13:21 +01:00
Owen Mansel-Chan
b6dddd36e1 Update FieldTarget.getBaseType() 
It wasn't defined when `getBase()` was an EvalImplicitDerefInstruction.
Rewriting it like this means it should work no matter what type of
instruction `getBase()` is.
 2021-03-30 10:13:20 +01:00
Owen Mansel-Chan
b32b3157d4 (Minor) Add missing this. to method call 2021-03-30 10:13:19 +01:00
Sauyon Lee
3045eec63d Merge pull request #518 from smowton/smowton/fix/restore-extraction-under-codeql 
Tolerate empty-string CODEQL_PLATFORM, and add smoke tests
 2021-03-29 13:55:27 -07:00
Chris Smowton
87d8bc8d6f Add basic extractor smoke test 
This exercises the extractor via 'codeql', with and without tracing.
 2021-03-29 14:53:44 +01:00
Chris Smowton
23b8af3a56 Tolerate empty-string CODEQL_PLATFORM 
This is normal when invoked with tracing disabled, so we also don't log when this happens.
 2021-03-29 11:34:50 +01:00