Commit Graph

4810 Commits

Author SHA1 Message Date
james
29e46cf347 docs: add link to style guides in readme 2019-05-28 21:33:36 +01:00
Calum Grant
fcfb7b2b8a C#: Fix error caused by Roslyn upgrade. 2019-05-22 16:17:16 +01:00
Calum Grant
e5aa7f3ba7 C#: Upgrade to Roslyn 3.1 2019-05-22 15:54:30 +01:00
Nick Rolfe
94e3c676d5 Merge pull request #1352 from ian-semmle/edg
C++: Follow extractor changes for 0136
2019-05-22 13:11:59 +01:00
semmle-qlci
dc8123db8e Merge pull request #1355 from xiemaisi/js/data-flow-api-fiddling
Approved by asger-semmle
2019-05-22 10:40:32 +01:00
semmle-qlci
c100c70a65 Merge pull request #1348 from xiemaisi/js/add-external-link-cwe
Approved by esben-semmle
2019-05-22 08:12:51 +01:00
semmle-qlci
114ba0e722 Merge pull request #1349 from EdoDodo/js-performance
Approved by xiemaisi
2019-05-21 17:50:01 +01:00
Ian Lynagh
6a77ac8a13 C++: Follow extractor changes for 0136 2019-05-21 17:07:21 +01:00
Edoardo Pirovano
9d2580f778 JS: Fix performance regression of query. 2019-05-21 12:26:11 +01:00
semmle-qlci
8cd3cb501a Merge pull request #1346 from xiemaisi/js/revert-1078
Approved by esben-semmle
2019-05-21 12:19:57 +01:00
Max Schaefer
cf22761ccc JavaScript: Add CWE-1022 to TargetBlank. 2019-05-21 12:16:32 +01:00
semmle-qlci
fe920ecfaa Merge pull request #1331 from asger-semmle/destructuring-assignment-fix
Approved by xiemaisi
2019-05-21 11:32:36 +01:00
semmle-qlci
2b5b8751ea Merge pull request #1316 from asger-semmle/incorrect-suffix-check-fps
Approved by esben-semmle, xiemaisi
2019-05-21 11:30:37 +01:00
Esben Sparre Andreasen
3af3c5413b Merge pull request #1318 from asger-semmle/prototype-pollution-query2
Move prototype pollution query into suite
2019-05-21 12:23:41 +02:00
Max Schaefer
924664afcf JavaScript: Manually revert #1078.
In its present form, `getAnUndefinedReturn` does not handle `finally`
blocks correctly. For example, in this snippet

```
try {
  return 42;
} finally {
  cleanup();
}
```

the call to `cleanup` is erroneously considered an undefined return.

We currently don't use the predicate anywhere, so it seems best to back
it out for the time being.
2019-05-21 08:26:58 +01:00
yh-semmle
29ae7b5c3c Merge pull request #1322 from aschackmull/java/deprecate-remoteuserinput
Java: Deprecate RemoteUserInput
2019-05-20 12:56:51 -04:00
semmle-qlci
56ab013114 Merge pull request #1340 from xiemaisi/js/es2019
Approved by asger-semmle
2019-05-20 16:47:09 +01:00
Asger F
ba69e19e95 JS: Address doc review 2019-05-20 16:46:27 +01:00
Max Schaefer
7b7f92c19e JavaScript: Introduce SSA::definition and SSA::variable. 2019-05-20 16:22:01 +01:00
Max Schaefer
fb744a6c53 JavaScript: Introduce Parameter.getVariable(). 2019-05-20 16:01:12 +01:00
Geoffrey White
67527820a1 Merge pull request #1335 from EdoDodo/optimise-preprocessor
C++: Optimise quadratic code in PreprocessorBranchDirective
2019-05-20 15:58:33 +01:00
Max Schaefer
2cb33f6088 JavaScript: Introduce DataFlow::ExprNode and exprNode for consistency with other languages. 2019-05-20 15:55:03 +01:00
yh-semmle
5466ae619d Merge pull request #1317 from aschackmull/java/domedge
Java: Refactor Guard.controls in terms of dominating edges.
2019-05-20 10:40:10 -04:00
Anders Schack-Mulligen
9ebeac25ad Merge pull request #1329 from hvitved/dataflow/performance
Data flow: performance improvements
2019-05-20 14:27:03 +02:00
Edoardo Pirovano
30198c326d C++: Optimise quadratic code in PreprocessorBranchDirective 2019-05-20 12:57:47 +01:00
Asger F
d4880540e8 JS: Update .expected after rebasing 2019-05-20 11:21:50 +01:00
Tom Hvitved
bc00877ff2 Data flow: Add nomagic to storeCand() 2019-05-20 12:05:20 +02:00
Max Schaefer
b62be049ec JavaScript: Add change note. 2019-05-20 10:56:37 +01:00
Asger F
9989fcee21 JS: Add DataFlow::Configuration test 2019-05-20 09:22:02 +01:00
Asger F
87e0831872 JS: Fix flow for nested destructurings 2019-05-20 09:22:02 +01:00
Tom Hvitved
360c7a1ac5 Address review comments 2019-05-20 09:59:17 +02:00
yh-semmle
6468721f76 Merge pull request #1324 from aschackmull/java/switchexpr-nullness
Java: Add SwitchExpr to Nullness::dereference.
2019-05-19 22:24:27 -04:00
yh-semmle
e5f4d475d0 Merge pull request #1320 from aschackmull/java/guardslogic-perf
Java: Fix join-order for GuardsLogic::conditionalAssign.
2019-05-19 22:23:18 -04:00
Esben Sparre Andreasen
8256f2e736 Merge pull request #1308 from asger-semmle/exceptional-flow
JS: Add flow through exceptions
2019-05-17 08:33:44 +02:00
Robert Marsh
762c977be7 Merge pull request #1326 from jbj/addressConstantVariable-isConstexpr
C++: Use isConstexpr instead of workaround in AddressConstantExpr
2019-05-16 15:18:56 -07:00
Robert Marsh
5f77ac4cf5 Merge pull request #1325 from jbj/reachableRecursive
C++: reachableRecursive refactor for performance
2019-05-16 14:05:57 -07:00
Asger F
9c1208e751 JS: Add change note 2019-05-16 17:50:10 +01:00
Asger F
65cbd47a2d Merge pull request #1314 from xiemaisi/js/fix-hardcoded-pw-fps
JavaScript: Further broaden the whitelist in `PasswordInConfigurationFile`.
2019-05-16 14:42:09 +01:00
Jonas Jensen
947aaa9e4e C++: reachableRecursive refactor for performance
The `reachable` predicate is large and slow to compute. It's part of a
mutual recursion that's non-linear, meaning it has a recursive call on
both sides of an `and`.

This change removes a part of the base case that has no effect on
recursive cases. The removed part is added back after the recursion has
finished.

Before, on Wireshark:

    ControlFlowGraph::Cached::reachable#f .......... 20.8s (executed 9800 times)
    ConstantExprs::successors_adapted#ff ........... 4.2s (executed 615 times)
    ConstantExprs::potentiallyReturningFunction#f .. 3.9s (executed 9799 times)
    ConstantExprs::possiblePredecessor#f ........... 2.9s (executed 788 times)

After, on Wireshark:

    ConstantExprs::reachableRecursive#f ............ 13.2s (executed 9800 times)
    ConstantExprs::successors_adapted#ff ........... 4.2s (executed 615 times)
    ConstantExprs::potentiallyReturningFunction#f .. 4.3s (executed 9799 times)
    ConstantExprs::possiblePredecessor#f ........... 2.6s (executed 788 times)

I've verified that this change doesn't change what's computed by
checking that the output of the following query is unchanged:

    import cpp
    import semmle.code.cpp.controlflow.internal.ConstantExprs

    select
      strictcount(ControlFlowNode n | reachable(n)) as reachable,
      strictcount(ControlFlowNode n1, ControlFlowNode n2 | n2 = n1.getASuccessor()) as edges,
      strictcount(FunctionCall c | aborting(c)) as abortingCall,
      strictcount(Function f | abortingFunction(f)) as abortingFunction
2019-05-16 13:39:23 +02:00
Calum Grant
c1e627d739 Merge pull request #1312 from hvitved/csharp/variable-preds
C#: Refactor predicates in `Variable` class to be defined by dispatch
2019-05-16 12:35:12 +01:00
Jonas Jensen
db6a807ff6 C++: Move same-stage predicates into cached module
This change only moves code around -- there are no changes to predicate
bodies or signatures.

The predicates that go in `ConstantExprs.Cached` after this change were
already cached in the same stage or, in the case of the `aborting*`
predicates, did not need to be cached. This is a fortunate consequence
of how the mutual recursion between the predicates happens to work, and
it's not going to be the case after the next commit.
2019-05-16 13:34:50 +02:00
Mark Shannon
d1a711e459 Merge pull request #1296 from RasmusSemmle/master
Add pythagorean query
2019-05-16 11:02:56 +01:00
Calum Grant
6994ba904b Merge pull request #1309 from hvitved/csharp/get-explicit-arg-nomagic
Add `pragma[nomagic]` to `getExplicitArgument()`
2019-05-16 10:57:00 +01:00
Asger F
b9ade67933 JS: Add change note 2019-05-16 10:56:47 +01:00
Asger F
9293010e4c JS: Fix some FPs in IncorrectSuffixCheck 2019-05-16 10:56:17 +01:00
semmle-qlci
649979de3e Merge pull request #1327 from asger-semmle/express-nomagic
Approved by esben-semmle
2019-05-16 10:43:10 +01:00
Tom Hvitved
02ca09aa43 Data flow: performance improvements 2019-05-16 07:35:10 +02:00
Robert Marsh
14795863e2 Merge pull request #1303 from jbj/hasQualifiedName
C++: Fix `getQualifiedName` performance issues
2019-05-15 12:42:57 -07:00
Asger F
8fe2319a23 JS: Fix lurking cartesian product in Express 2019-05-15 18:07:24 +01:00
Calum Grant
6a198ff7e1 Merge pull request #1306 from hvitved/csharp/dataflow/shared-implementation
C#: Adopt shared data flow implementation
2019-05-15 17:41:46 +01:00