Taus
5c3ff8aadd
Merge pull request #604 from markshannon/python-faster-essa-computation
...
Python : Speed up ESSA computation
2018-12-04 16:20:49 +01:00
semmle-qlci
732874b236
Merge pull request #610 from Semmle/xiemaisi-patch-1
...
Approved by esben-semmle
2018-12-04 14:44:49 +00:00
Max Schaefer
2e45c50067
JavaScript: Correct change note for new query.
...
"Hard-coded data interpreted as code" is run, but not shown by default.
2018-12-04 14:40:03 +00:00
Geoffrey White
a7f45bb59d
Merge pull request #608 from jbj/assignment-this-templates
...
C++: Fix "Overloaded assignment does not return 'this'" for templates
2018-12-04 14:12:56 +00:00
Jonas Jensen
6239455a91
C++: Remove extra type check in AV Rule 82
...
These type checks were overlapping with `assignOperatorWithWrongType` is
are no longer needed now that `assignOperatorWithWrongType` is improved.
They were causing FPs and misleading error messages on uninstantiated
templates.
2018-12-04 12:59:21 +01:00
Jonas Jensen
8ac427c387
C++: Add missing getUnspecifiedType in AV Rule 82
...
Adding this call to `getUnspecifiedType` makes the error message better
in the presence of typedefs and qualifiers on an assignment operator
return type. It's also needed to avoid losing valid results in the
commit that comes after this.
2018-12-04 11:13:11 +01:00
Taus
a23f7a6b0e
Merge pull request #592 from markshannon/python-windows-import-root
...
Python: Fix up computation of import root path
2018-12-04 11:11:59 +01:00
Jonas Jensen
a78ded7551
C++: Demonstrate FP in AV Rule 82
...
The added test is a reduced version of a FP observed in the wild.
2018-12-04 11:09:35 +01:00
Mark Shannon
8cd497890a
Merge pull request #546 from adityasharad/python/vs-workspace-settings
...
Python: Add QL for VS workspace settings file.
2018-12-04 10:00:09 +00:00
semmle-qlci
3d058a2895
Merge pull request #603 from xiemaisi/js/fix-inconsistent-new
...
Approved by asger-semmle, esben-semmle
2018-12-03 16:48:55 +00:00
Geoffrey White
436ee553a6
Merge pull request #589 from jbj/1.19-change-notes
...
C++: add missing 1.19 change notes
2018-12-03 15:56:18 +00:00
Mark Shannon
68440f7f77
Python ESSA: Speed up ESSA computation by refactoring ADT to match class hierarchy making it more transparent to the optimizer.
2018-12-03 15:08:56 +00:00
Taus
76b1bbc56a
Merge pull request #565 from markshannon/python-analysis-queries-qhelp
...
Python: Delete some misleading qhelp and rename a couple of queries.
2018-12-03 14:42:03 +01:00
Max Schaefer
8627ddbe4b
JavaScript: Adjust alert message.
2018-12-03 12:38:00 +00:00
Jonas Jensen
8f60c09804
C++: Clarify cpp/virtual-destructor changelog
2018-12-03 13:04:24 +01:00
Mark Shannon
d32e6b8501
Python tests: Make sure stdlib can be found.
2018-12-03 11:55:57 +00:00
Geoffrey White
a3a5829fd0
Merge pull request #598 from jbj/AlwaysTrueUponEntryLoop-perf
...
C++: data flow AlwaysTrueUponEntryLoop perf fix
2018-12-03 10:59:50 +00:00
Max Schaefer
1a3e3baf80
JavaScript: Add change note.
2018-12-03 09:06:48 +00:00
Mark Shannon
8e6c16d59f
Python: Fix import root computation for windows and 3.7
2018-12-01 16:53:41 +00:00
Jonas Jensen
d14cf34cc6
C++: data flow AlwaysTrueUponEntryLoop perf fix
...
The predicate `AlwaysTrueUponEntryLoop.getARelevantVariable` was very
sensitive to join ordering, and with the 1.19 QL engine it got an
unfortunate join order that made it explode on certain snapshots. With
this change, it goes from taking minutes to taking less than a second on
a libretro-uae snapshot.
2018-12-01 10:07:08 +01:00
Max Schaefer
3351650895
JavaScript: Make InconsistentNew give fewer results.
2018-11-30 16:13:46 +00:00
Max Schaefer
b17518a5eb
JavaScript: Refactor InconsistentNew to improve performance.
...
All the filtering is now done in `getALikelyCallee`, to which I have also added an additional parameter that improves the join in the `select` clause.
I've also simplified the alert message to no longer use `toString`, which isn't meant for alert messages anyway. (This is an old query.)
2018-11-30 15:40:45 +00:00
Jonas Jensen
148c79a0e6
C++: Deprecate RecursionPrevention
2018-11-30 15:41:43 +01:00
Jonas Jensen
9532ee5177
C++: Add more detail to change notes for libraries
2018-11-30 14:29:08 +01:00
Jonas Jensen
b793807af5
C++: Complete change notes for Dave's PRs
2018-11-30 13:44:40 +01:00
Mark Shannon
d933152a54
Merge pull request #573 from felicity-semmle/1.19/python-change-notes
...
Python: finalize change notes for 1.19
2018-11-30 12:30:57 +00:00
Jonas Jensen
9daefa3613
C++: Complete change notes for my own PRs
2018-11-30 13:09:27 +01:00
semmle-qlci
608d84cfa3
Merge pull request #561 from asger-semmle/useless-conditional-change-note
...
Approved by esben-semmle
2018-11-30 11:37:51 +00:00
Geoffrey White
453529e3bf
Merge pull request #575 from jbj/UnsafeCreateProcessCall-nullValue
...
C++: Avoid using nullValue predicate (rc/1.19)
2018-11-30 09:54:17 +00:00
Jonas Jensen
dd3791490a
Merge pull request #580 from geoffw0/av-79-perf
...
CPP: Fix performance issue with AV Rule 79.ql.
2018-11-30 08:39:38 +01:00
Felicity Chapman
586eaef270
Update for feedback
2018-11-29 18:20:34 +00:00
Mark Shannon
9aa59fd419
Fix spelling.
2018-11-29 18:11:57 +00:00
Jonas Jensen
b98452ddb1
Merge pull request #474 from rdmarsh2/rdmarsh/cpp/call-side-effect
...
C++: Initital aliased SSA with Chi nodes and function side effects
2018-11-29 18:31:29 +01:00
Geoffrey White
4744cece7b
Merge pull request #576 from jbj/bbEntryReachesLocally-perf
...
C++: Fix performance of bbEntryReachesLocally (1.19)
2018-11-29 17:12:47 +00:00
Asger F
f85e30aa6c
Merge pull request #571 from xiemaisi/js/numeric-constant-interpreted-as-code
...
JavaScript: Add new query `HardcodedDataInterpretedAsCode`.
2018-11-29 17:07:48 +00:00
Taus
1956cd802f
Merge pull request #577 from markshannon/python-fix-performance-regression-dependencies
...
Python: Fix performance regression in dependency analysis
2018-11-29 16:41:58 +01:00
Geoffrey White
e09ce77678
CPP: Fix performance issue with AV Rule 79.ql.
2018-11-29 15:16:01 +00:00
Mark Shannon
8414d46a87
Python: Fix accidentally introduced cartesian product.
2018-11-29 14:19:47 +00:00
Jonas Jensen
62d478eab3
C++: Fix performance of bbEntryReachesLocally
...
This predicate was fast with the queries and engine from 1.18. With the
queries from `master` it got a bad join order in the
`UninitializedLocal.ql` query, which made it take 2m34s on Wireshark.
This commit decomposes `bbEntryReachesLocally` into two predicates that
together take only 4s.
2018-11-29 15:11:32 +01:00
Jonas Jensen
8654ebcbbd
C++: Avoid using nullValue predicate
...
The `nullValue` predicate performs a slow custom data-flow analysis to
find possible null values. It's so slow that it timed out after 1200s on
Wireshark.
In `UnsafeCreateProcessCall.ql`, the values found with `nullValue` were
used as sources in another data-flow analysis. By using the `NullValue`
class as sink instead of `nullValue`, we avoid the slow-down of doing
data flow twice. The `NullValue` class is essentially the base case of
`nullValue`. Confusing names, yes.
2018-11-29 13:33:45 +01:00
Max Schaefer
73ce0f17d6
JavaScript: Americanise change note spelling.
2018-11-29 11:23:47 +00:00
Max Schaefer
8637eaf100
JavaScript: Address review comments.
2018-11-29 10:48:44 +00:00
Felicity Chapman
f6fe8d5a28
Text updates for consistency and clarity
2018-11-29 10:20:13 +00:00
mc
83d4fb6711
Merge pull request #559 from xiemaisi/js/invalid-dynamic-method-call
...
JavaScript: Documentation review for new query `UnvalidatedDynamicMethodCall`.
2018-11-29 09:59:53 +00:00
Max Schaefer
5f16406ad7
JavaScript: Add new query HardcodedDataInterpretedAsCode.
2018-11-29 09:52:31 +00:00
Max Schaefer
94a5722c2a
JavaScript: Model taint propagation through new Buffer and Buffer.from.
2018-11-29 09:52:31 +00:00
Max Schaefer
4091cf410d
JavaScript: Improve detection of require calls.
2018-11-29 09:52:31 +00:00
Max Schaefer
506236994f
JavaScript: Address doc review comments.
2018-11-29 09:49:13 +00:00
Dave Bartolomeo
40864f9ebb
C++: Fix GVN test expectation
2018-11-28 14:07:23 -08:00
Dave Bartolomeo
d7938362dd
C++: Rename Chi IPA types to match classes
2018-11-28 10:33:04 -08:00
