Robert Marsh
37570c7750
Merge pull request #2676 from jbj/dataflow-partial-chi
...
C++: data flow through partial chi operands where type is known
2020-01-29 13:44:06 -05:00
Jonas Jensen
52d2bebd1c
C++: Taint through most partial chi operands
...
This changes the flow to be taint rather than data flow, and it extends
it to include chi instructions with unknown type as long as they're not
for the `AliasedVirtualVariable`.
We're losing three good test results because these tests are not
affected by `DefaultTaintTracking.qll`. The taint step added here can
later be ported to `TaintTrackingUtil.qll` to recover these results, but
we probably want a better API than transitive-closure search through
instructions before doing that.
2020-01-29 18:02:03 +01:00
Jonas Jensen
0436caecdc
C++: Always use the old library for the diff test
...
This change ensures that the diff test will show the difference between
the old and the new library even after we switch the default
implementation of `security.TaintTracking` to be the new one.
2020-01-29 16:03:35 +01:00
Jonas Jensen
4a77f2b53c
Merge remote-tracking branch 'upstream/master' into ir-crement-load
...
Update test output to fix semantic merge conflict.
2020-01-29 15:56:05 +01:00
Anders Schack-Mulligen
96e4a57edd
C++: Autoformat.
2020-01-29 13:11:50 +01:00
Jonas Jensen
02cb8e9cc7
Merge remote-tracking branch 'upstream/master' into dataflow-partial-chi
...
Conflicts:
cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected
2020-01-29 13:03:40 +01:00
Jonas Jensen
27b5902258
Merge pull request #2707 from geoffw0/taint-format
...
C++: Add TaintFunction model to FormattingFunction
2020-01-29 08:20:34 +01:00
Dave Bartolomeo
60a0eff4d7
Merge remote-tracking branch 'upstream/master' into dbartol/Indirections
2020-01-28 12:06:43 -07:00
Dave Bartolomeo
542579de7f
C++: Accept dataflow test changes due to new alias analysis
2020-01-28 10:58:27 -07:00
Mathias Vorreiter Pedersen
c1091a03d0
C++: Accept output
2020-01-28 17:38:35 +01:00
Mathias Vorreiter Pedersen
928b0c50d2
C++: Add test demonstrating false negative when using dynamic_cast
2020-01-28 17:31:53 +01:00
Geoffrey White
f02ffcbbd2
C++: Modify ParameterIndex to account for varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
d66f608d41
C++: Taint from FormattingFunction varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
8b215c155e
C++: Correct a few test comments.
2020-01-28 14:51:46 +00:00
Mathias Vorreiter Pedersen
287af2bdec
C++: Fix annotations in testcase file
2020-01-28 13:51:36 +01:00
Mathias Vorreiter Pedersen
611d9553dd
C++: Fix formatting
2020-01-28 10:22:33 +01:00
Mathias Vorreiter Pedersen
130911ad44
C++: Accept new output in already existing test
2020-01-28 10:00:52 +01:00
Mathias Vorreiter Pedersen
fd79e7991d
C++: Add tests demonstrating differences between AST virtual dispatch analysis and IR virtual dispatch analysis
2020-01-28 10:00:21 +01:00
Geoffrey White
30580e97dc
C++: Add a TaintFunction model to FormattingFunction.
2020-01-28 08:46:46 +00:00
Geoffrey White
06f5720cd5
C++: Add taint tests of formatting functions.
2020-01-28 08:46:46 +00:00
Robert Marsh
fd807d46d6
C++: IR dataflow through modeled functions
2020-01-27 16:38:07 -08:00
Robert Marsh
a9bcc1dcc6
Merge pull request #2667 from dbartol/dbartol/NoEscape
...
C++/C#: Make escape analysis unsound by default
2020-01-27 19:17:33 -05:00
Robert Marsh
c7975e83a7
Merge pull request #2657 from jbj/DefaultTaintTracking-models
...
C++: wire up models library to DefaultTaintTracking
2020-01-27 17:41:54 -05:00
Dave Bartolomeo
3b3502060b
Merge remote-tracking branch 'upstream/master' into dbartol/NoEscape
2020-01-27 13:29:18 -07:00
Robert Marsh
79a72a3496
Merge pull request #2680 from geoffw0/modelstrndup
...
CPP: Model strndup.
2020-01-27 15:19:52 -05:00
Dave Bartolomeo
40952f85a9
C++: Accept test diffs
2020-01-27 10:31:18 -07:00
Geoffrey White
4778914154
CPP: Repair flow.
2020-01-27 14:08:03 +00:00
Geoffrey White
d9f6895602
CPP: 'sometimes copying' is considered data flow.
2020-01-27 14:07:39 +00:00
Jonas Jensen
0e3ed2dfa6
C++: Remove test for unrelated issue
...
The issue for that test is being tested and fixed on PR #2686 . Adding a
test here will cause a semantic merge conflict.
2020-01-27 14:25:28 +01:00
Dave Bartolomeo
6988241b09
Merge from master
2020-01-26 16:38:48 -07:00
Robert Marsh
959ce3b355
C++: add diff tests for DefaultTaintTracking
2020-01-24 13:46:11 -08:00
Mathias Vorreiter Pedersen
d26cf12c3a
Merge pull request #2688 from geoffw0/move-taint-test
...
C++: Add the security taint test (previously internal).
2020-01-24 15:58:20 +01:00
Geoffrey White
af903fc30c
C++: Add the security taint test (previously internal).
2020-01-24 11:28:51 +00:00
Jonas Jensen
9a45c5570d
C++: Move Load from AssignmentOperation to its LHS
...
This is analogous to what was done for `CrementOperation`.
2020-01-24 09:09:31 +01:00
Jonas Jensen
c5950d2c9d
C++: IR: Result of x in x++ is now the Load
...
Previously, the `Load` would be associated with the `CrementOperation`
rather than its operand, which gave surprising results when mapping
taint sinks back to `Expr`.
The changes in `raw_ir.expected` are to add `Copy` operations on the
`x++` in code like `y = x++`. This is now needed because the result that
`x++` would otherwise have (the Load) no longer belongs to the `++`
expression. Copies are inserted to ensure that all expressions are
associated with an `Instruction` result.
The changes in `*aliased_ssa_ir.expected` appear to be just wobble.
2020-01-24 09:02:50 +01:00
Jonas Jensen
ed3ed5f1b6
C++: Test to show lack of flow to crement operands
2020-01-23 17:42:51 +01:00
Jonas Jensen
33070cc16d
Merge pull request #2678 from MathiasVP/union-access-global-virtual-dispatch
...
C++: IR virtual dispatch through union field access
2020-01-23 15:32:31 +01:00
Geoffrey White
edf2b54813
CPP: Model strndup.
2020-01-23 13:46:57 +00:00
Mathias Vorreiter Pedersen
77531294bf
C++: Accepted output on tests
2020-01-23 10:20:10 +01:00
Mathias Vorreiter Pedersen
256ae2fda6
C++: Add test demonstrating a flow not detected
2020-01-23 10:16:24 +01:00
Geoffrey White
1867d58034
CPP: Allow flow to return value.
2020-01-22 16:25:40 +00:00
Geoffrey White
704bfe7184
CPP: Support taint flow from qualifiers.
2020-01-22 16:22:29 +00:00
Geoffrey White
e6daf3b7ee
CPP: Support taint flow to qualifiers.
2020-01-22 16:16:31 +00:00
Jonas Jensen
7376daf16e
C++: Some data flow through partial chi operands
2020-01-22 17:14:32 +01:00
Geoffrey White
1a6f7febe7
CPP: Add tests of taint through qualifiers.
2020-01-22 16:11:13 +00:00
Jonas Jensen
3827411095
Merge branch 'dbartol/NoEscape' into HEAD
2020-01-22 16:21:24 +01:00
Jonas Jensen
66914e52c6
C++: accept test changes
2020-01-22 14:08:05 +01:00
Jonas Jensen
6cdca29aa6
C++: Flow through read side effects
...
Until we have better tracking of indirections, these flow rules conflate
pointers and their contents.
2020-01-22 13:27:10 +01:00
Jonas Jensen
2aaf41a0d8
C++: Test lack of flow through read side effect
2020-01-22 13:27:10 +01:00
Jonas Jensen
6d46e4d946
C++: Wire up models to DefaultTaintTracking
...
This adds support for arg-to-arg and arg-to-return taint.
2020-01-21 12:04:45 +01:00
