Commit Graph

1043 Commits

Author SHA1 Message Date
Calum Grant
7c21ebb526 C#: Change dbscheme from nullability_member to nullability_parent 2019-11-12 13:40:58 +00:00
Calum Grant
41b441614b C#: Address review comments part 1. 2019-11-12 13:40:58 +00:00
Calum Grant
fe83bac0fb C#: Fix up test output
C#: Fix a qltest whereby a tuple type having multiple underlying types was causing an issue with the IR sanity checks.
C#: Revert more changes.
C#: Fix tests and remove dead code.
2019-11-12 13:40:58 +00:00
Calum Grant
ce188c0c22 C#: Autoformat 2019-11-12 13:40:58 +00:00
Calum Grant
657c839e2b C#: Change varchar to string in the dbscheme. 2019-11-12 13:40:58 +00:00
Calum Grant
61630118fe C#: Fix ql tests. 2019-11-12 13:40:58 +00:00
Calum Grant
58e14af9cd C#: Address review comments. Create a TNullability type annotation and restructure TAnnotation. 2019-11-12 13:40:58 +00:00
Calum Grant
f00276a82c C#: Remove non-essential changes 2019-11-12 13:40:58 +00:00
Calum Grant
a0fa7dad79 C#: Autoformat 2019-11-12 13:40:58 +00:00
Calum Grant
163b931d49 C#: Update db stats 2019-11-12 13:40:58 +00:00
Calum Grant
9fd4a9ceb6 C#: Implement NullabilityEntity to model structured nullability on the side 2019-11-12 13:40:57 +00:00
Calum Grant
61ab9431ab C#: Fix DB inconsistencies, and rework id generation. 2019-11-12 13:40:57 +00:00
Dave Bartolomeo
303bab61b5 Merge pull request #2289 from jbj/ConvertToNonVirtualBaseInstruction
C++ IR: clearly distinguish between virtual and non-virtual base conversions
2019-11-11 13:37:07 -07:00
Felicity Chapman
c4f958d396 Merge pull request #2263 from sauyon/master
Update links to OWASP cheat sheet
2019-11-11 08:51:52 +00:00
Jonas Jensen
7758b43e34 C++: Add ConvertToBase{Opcode,Instruction} classes
These should make it easy to match base-class conversions when it's not
important whether the base class is virtual.
2019-11-10 11:09:54 +01:00
Jonas Jensen
279fc16b60 C++: ConvertToBase -> ConvertToNonVirtualBase
This rename was done with

    perl -p -i -e's/ConvertToBase/ConvertToNonVirtualBase/g' **/*.ql* **/*.expected

followed by re-running the affected tests.
2019-11-10 10:35:53 +01:00
Dave Bartolomeo
6c1d219c86 Merge from master 2019-11-07 14:50:04 -07:00
Dave Bartolomeo
df1d64fbeb Merge pull request #2244 from jbj/IRType-cached
C++: Minimal caching of the IR type system
2019-11-07 12:44:16 -07:00
Dave Bartolomeo
2c88848d2f Merge pull request #2272 from jbj/getIRTypeForPRValue-join-order
C++/C#: Fix getIRTypeForPRValue join order
2019-11-07 12:22:39 -07:00
semmle-qlci
2b120def01 Merge pull request #2211 from hvitved/csharp/unsafe-deserialization
Approved by jf205
2019-11-07 14:16:13 +00:00
Jonas Jensen
6385528d5f C++/C#: Fix getIRTypeForPRValue join order
This predicate was taking 39s on a snapshot of Facebook Fizz because it
had disjuncts like this:

    43685     ~0%     {1} r34 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685     ~1%     {2} r35 = JOIN r34 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r34.<0>
    170371500 ~2%     {2} r36 = JOIN r35 WITH IRType::IRSizedType#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r35.<1>
    43685     ~6%     {2} r37 = JOIN r36 WITH IRType::IRFunctionAddressType#class#ff AS R ON FIRST 1 OUTPUT r36.<1>, r36.<0>

Instead of fixing the joins in `getIRTypeForPRValue` itself, I've
changed the `IRType::getByteSize` predicate such that the optimiser
knows how to join with it efficiently.

The disjunct shown above now looks like this instead:

    43685  ~0%     {1} r26 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685  ~1%     {2} r27 = JOIN r26 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r26.<0>
    43685  ~6%     {2} r28 = JOIN r27 WITH IRType::IRFunctionAddressType::getByteSize#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r27.<1>, R.<1>
2019-11-07 11:48:16 +01:00
Sauyon Lee
0040c9fb4c Update links to OWASP cheat sheet 2019-11-06 20:21:47 -08:00
Dave Bartolomeo
a9e3bfbd11 C++/C#: Treat string literals like read-only global variables for alias purposes.
Previously, we didn't track string literals as known memory locations at all, so they all just got marked as `UnknownMemoryLocation`, just like an aribtrary read from a random pointer. This led to some confusing def-use chains, where it would look like the contents of a string literal were being written to by the side effect of an earlier function call, which of course is impossible.

To fix this, I've made two changes. First, each string literal is now given a corresponding `IRVariable` (specifically `IRStringLiteral`), since a string literal behaves more or less as a read-only global variable. Second, the `IRVariable` for each string literal is now marked `isReadOnly()`, which the alias analysis uses to determine that an arbitrary write to aliased memory will not overwrite the contents of a string literal.

I originally planned to treat all string literals with the same value as being the same memory location, since this is the usual behavior of modern compilers. However, this made implementing `IRVariable.getAST()` tricky for string literals, so I left them unpooled.
2019-11-06 13:08:28 -07:00
Jonas Jensen
fca7d9a391 C#: Cache IRType like for C++ 2019-11-06 07:42:34 +01:00
Geoffrey White
8c16b36c7f Merge pull request #2231 from semmledocs-ac/newqueries-docscheck
CPP & C#: Review of qhelp (SD-4028)
2019-11-05 11:11:34 +00:00
Tom Hvitved
508b09f565 C#: Address review comments 2019-11-04 13:43:39 +01:00
Tom Hvitved
fd63246f44 Merge remote-tracking branch 'upstream/master' into csharp/unsafe-deserialization 2019-11-04 13:42:35 +01:00
semmle-qlci
fa5388b5f3 Merge pull request #2209 from hvitved/csharp/deserialized-delegate
Approved by calumgrant, jf205
2019-11-04 12:32:04 +00:00
Tom Hvitved
cc7c30def8 Merge pull request #2179 from calumgrant/cs/local-disposal
C#: Fix a FP in cs/local-not-disposed
2019-11-04 11:23:50 +01:00
alistair
27d0b51c6b CPP & C#: Review of qhelp
PR #2151 got merged without a review of the qhelp
by a technical writer.
The current PR makes changes I would have suggested on that PR.
2019-10-30 16:10:03 +00:00
Tom Hvitved
eb990525d7 C#: Add precision tags to UnsafeDeserialization[UntrustedInput].ql 2019-10-28 14:19:40 +01:00
Tom Hvitved
b0cf7cb39a C#: Move UnsafeDeserialization.qll 2019-10-28 13:38:53 +01:00
Tom Hvitved
1fc786bea7 C#: Add precision tag to cs/deserialized-delegate 2019-10-28 13:11:10 +01:00
Dave Bartolomeo
cc5a689293 C++/C#: Fix up after merge from master 2019-10-25 14:11:34 -07:00
Dave Bartolomeo
f5e320e988 Merge from master 2019-10-25 13:24:19 -07:00
Dave Bartolomeo
56cbd0c152 C++/C#: Make AliasedUse access only non-local memory
The `AliasedUse` instruction is supposed to represent future uses of aliased memory after the function returns. Since local variables from that function are no longer allocated after the function returns, the `AliasedUse` instruction should access only the set of aliased locations that does not include locals from the current stack frame.
2019-10-25 13:10:39 -07:00
Jonas Jensen
22de0efc58 Merge pull request #2008 from dave-bartolomeo/dave/IRType2
C++: Implement language-neutral IR type system
2019-10-25 09:42:23 +02:00
Dave Bartolomeo
956c18f976 C++/C#: Fix formatting 2019-10-24 13:54:09 -07:00
Tom Hvitved
6d22e351f1 Merge pull request #2151 from raulgarciamsft/users/raul/oss
Users/raul/oss
2019-10-24 19:35:40 +02:00
Tom Hvitved
4ac32c4b12 C#: Fix more tests 2019-10-24 13:00:14 +02:00
Calum Grant
b9ba534bcb C#: Update qltest output. 2019-10-24 11:06:34 +01:00
Calum Grant
df1e215d98 C#: Add ?? as a local dataflow step. 2019-10-23 21:47:03 +01:00
Dave Bartolomeo
d03a4f86e5 C++/C#: Add AliasedUse instruction to all functions
This new instruction is the dual of the existing `AliasedDefinition` instruction. Whereas that instruction defines the contents of aliased memory before the function was called, `AliasedUse` represents the potential use of all aliased memory after the function returns. This ensures that writes to aliased memory do not appear "dead", even if there are no further reads from aliased memory within the function itself.
2019-10-23 11:59:05 -07:00
Geoffrey White
0427b1eb3f C#: Fix more tests. 2019-10-23 18:20:44 +01:00
Calum Grant
48c0d9ecca C#: Add qltests for ?? dataflow. 2019-10-23 15:17:26 +01:00
Calum Grant
6b15bf62fd C#: Rewrite null-coalsecing logic 2019-10-23 13:49:22 +01:00
Calum Grant
01ad93d199 C#: Fix for false positive. 2019-10-23 12:26:01 +01:00
Calum Grant
ee7cf17b15 C#: Add test case for local disposal. 2019-10-23 11:22:52 +01:00
Geoffrey White
e331a24dbb C#: Fix autoformat. 2019-10-23 08:48:07 +01:00
Geoffrey White
9949d8a000 C#: Fix warnings. 2019-10-22 17:10:11 +01:00