Robert Marsh
4617940eee
Merge branch 'master' into connect-ir-dataflow-models
2020-01-30 08:49:42 -08:00
Jonas Jensen
148e87c61d
C++: Put AliasedSSA.qll in new qlformat style
2020-01-30 11:38:16 +01:00
Jonas Jensen
f0f752844e
Merge remote-tracking branch 'upstream/master' into dbartol/Indirections
...
Conflicts:
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
2020-01-30 10:26:44 +01:00
Jonas Jensen
c4d2163321
Merge pull request #2673 from aschackmull/ql/autoformat-comparisonterm
...
Java/C++/C#: Autoformat comparison terms
2020-01-30 08:47:50 +01:00
Dave Bartolomeo
6249446ba0
Merge remote-tracking branch 'upstream/master' into dbartol/Indirections
2020-01-29 17:29:44 -07:00
Robert Marsh
37570c7750
Merge pull request #2676 from jbj/dataflow-partial-chi
...
C++: data flow through partial chi operands where type is known
2020-01-29 13:44:06 -05:00
Jonas Jensen
52d2bebd1c
C++: Taint through most partial chi operands
...
This changes the flow to be taint rather than data flow, and it extends
it to include chi instructions with unknown type as long as they're not
for the `AliasedVirtualVariable`.
We're losing three good test results because these tests are not
affected by `DefaultTaintTracking.qll`. The taint step added here can
later be ported to `TaintTrackingUtil.qll` to recover these results, but
we probably want a better API than transitive-closure search through
instructions before doing that.
2020-01-29 18:02:03 +01:00
Jonas Jensen
7bed6ad63b
C++: Add taint from gets through memcpy
2020-01-29 15:42:43 +01:00
Jonas Jensen
d7e8ea7cc5
Merge pull request #2641 from marcrepo/master
...
Documentation update for Issue #2623
2020-01-29 13:37:00 +01:00
Jonas Jensen
386e8e87d1
Merge pull request #2645 from geoffw0/typo
...
CPP: Fix typo.
2020-01-29 13:35:55 +01:00
Anders Schack-Mulligen
0d4b2e4bf7
C#/C++: Autoformat post rebase.
2020-01-29 13:16:46 +01:00
Anders Schack-Mulligen
96e4a57edd
C++: Autoformat.
2020-01-29 13:11:50 +01:00
Jonas Jensen
02cb8e9cc7
Merge remote-tracking branch 'upstream/master' into dataflow-partial-chi
...
Conflicts:
cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected
2020-01-29 13:03:40 +01:00
Jonas Jensen
27b5902258
Merge pull request #2707 from geoffw0/taint-format
...
C++: Add TaintFunction model to FormattingFunction
2020-01-29 08:20:34 +01:00
Dave Bartolomeo
976b564b68
C++: Update AliasedSSA to use Allocation instead of IRVariable
...
This introduces a new type of `MemoryLocation`: `EntireAllocationMemoryLocation`, representing an entire contiguous allocation whose size is not known. This is used to model the memory accesses on `InitializeIndirection` and `ReturnIndirection`.
2020-01-28 10:55:24 -07:00
Dave Bartolomeo
165a45d9b5
C++/C#: Update SimpleSSA to use Allocation instead of IRVariable
2020-01-28 10:53:18 -07:00
Dave Bartolomeo
1bbc875442
C++/C#: Parameterize alias analysis based on AliasConfiguration
...
Instead of tracking `IRVariable`s directly, alias analysis now tracks instances of the `Allocation` type provided by its `Configuration` parameter. For unaliased SSA, an `Allocation` is just an `IRAutomaticVariable`. For aliased SSA, an `Allocation` is either an `IRVariable` or the memory pointed to by an indirect parameter.
2020-01-28 10:51:21 -07:00
Dave Bartolomeo
b15dd82732
C++/C#: Share alias analysis between C++ and C#
2020-01-28 10:47:37 -07:00
Dave Bartolomeo
1b1fded535
C++/C#: Add new MemoryAccessKind to represent entire allocation
2020-01-28 10:41:53 -07:00
Mathias Vorreiter Pedersen
46ce228bce
C++: Add instruction for CheckedConvertOrNull and handle it in alias analysis and data flow
2020-01-28 17:36:17 +01:00
Geoffrey White
f02ffcbbd2
C++: Modify ParameterIndex to account for varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
d66f608d41
C++: Taint from FormattingFunction varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
b1f66ae825
C++: Fix warnings.
2020-01-28 14:51:46 +00:00
Geoffrey White
01dc3661b7
C++: Autoformat.
2020-01-28 12:17:56 +00:00
Geoffrey White
30580e97dc
C++: Add a TaintFunction model to FormattingFunction.
2020-01-28 08:46:46 +00:00
Geoffrey White
1d46971bb7
C++: Add an ArrayFunction model to FormattingFunction.
2020-01-28 08:46:46 +00:00
Robert Marsh
1b9e375341
C++: Move getACallArgumentOrIndirection
2020-01-27 16:44:41 -08:00
Robert Marsh
fd807d46d6
C++: IR dataflow through modeled functions
2020-01-27 16:38:07 -08:00
Robert Marsh
a9bcc1dcc6
Merge pull request #2667 from dbartol/dbartol/NoEscape
...
C++/C#: Make escape analysis unsound by default
2020-01-27 19:17:33 -05:00
Robert Marsh
c7975e83a7
Merge pull request #2657 from jbj/DefaultTaintTracking-models
...
C++: wire up models library to DefaultTaintTracking
2020-01-27 17:41:54 -05:00
Dave Bartolomeo
3b3502060b
Merge remote-tracking branch 'upstream/master' into dbartol/NoEscape
2020-01-27 13:29:18 -07:00
Robert Marsh
79a72a3496
Merge pull request #2680 from geoffw0/modelstrndup
...
CPP: Model strndup.
2020-01-27 15:19:52 -05:00
Robert Marsh
4d743d2bce
Merge pull request #2692 from jbj/pure-string-read
...
C++: Model that string functions read their buffer
2020-01-27 11:40:03 -05:00
Geoffrey White
4778914154
CPP: Repair flow.
2020-01-27 14:08:03 +00:00
Geoffrey White
d9f6895602
CPP: 'sometimes copying' is considered data flow.
2020-01-27 14:07:39 +00:00
Geoffrey White
2c7e2c4506
CPP: Not in std namespace.
2020-01-27 10:20:56 +00:00
Dave Bartolomeo
6988241b09
Merge from master
2020-01-26 16:38:48 -07:00
Robert Marsh
0180672dc0
Merge pull request #2687 from jbj/DefaultTaintTracking-asExpr
...
C++: Use asExpr, not getConvertedResultExpression
2020-01-24 15:42:58 -05:00
Jonas Jensen
b290c7b47a
C++: Model that string functions read their buffer
2020-01-24 15:53:38 +01:00
Jonas Jensen
6606b2e18a
C++: autoformat fixup
2020-01-24 10:48:03 +01:00
Jonas Jensen
5eeb5c6e67
C++: Use asExpr, not getConvertedResultExpression
...
We designed the IR's `DataFlow::Node.asExpr` very carefully so that it's
suitable for taint tracking, but then we didn't use it in
`DefaultTaintTracking.qll`. This meant that the sources in
`ArithmeticWithExtremeValues.ql` didn't get associated with any
`Instruction` and thus didn't propagate anywhere.
With this commit, the mapping of `Expr`-based sources to IR data-flow
nodes uses `asExpr`.
2020-01-24 09:42:26 +01:00
yo-h
eb6f8da080
Merge pull request #2679 from aschackmull/java/remove-depr-flow-fwd-back
...
Java/C++/C#: Remove the deprecated hasFlowForward/hasFlowBackward.
2020-01-23 14:10:28 -05:00
Geoffrey White
f16870f8c6
CPP: Autoformat.
2020-01-23 16:20:18 +00:00
Jonas Jensen
33070cc16d
Merge pull request #2678 from MathiasVP/union-access-global-virtual-dispatch
...
C++: IR virtual dispatch through union field access
2020-01-23 15:32:31 +01:00
Geoffrey White
edf2b54813
CPP: Model strndup.
2020-01-23 13:46:57 +00:00
Anders Schack-Mulligen
e7f7c7370a
Java/C++/C#: Remove the deprecated hasFlowForward/hasFlowBackward.
2020-01-23 14:05:18 +01:00
Mathias Vorreiter Pedersen
5fd1c6fedb
C++: Remove parameter from predicate for some tiny performance benefits
2020-01-23 13:29:48 +01:00
Jonas Jensen
8a0089a875
Merge pull request #2672 from geoffw0/qualifierflow
...
CPP: Support taint flow in and out of qualifiers
2020-01-23 13:17:17 +01:00
Geoffrey White
ccf268d048
CPP: Autoformat.
2020-01-23 10:07:21 +00:00
Mathias Vorreiter Pedersen
9412ec7f4f
C++: Added union field flow for globals
2020-01-23 10:17:36 +01:00
